Data Protection and Competition Law: Developments and the Way Forward

The article provides a brief overview of the existing legal framework on data privacy in India, analyses the CCI's decisional practice in this regard, and suggests an appropriate way forward for the CCI on this matter.

In the last decade, the digital sector has witnessed tremendous growth in India and worldwide. While this growth has given rise to new business models, opened up new markets, and unlocked significant efficiencies, it has also raised concerns that tech giants may use the excessive amounts of user data they hold, to influence digital markets to their advantage.

In this background, the Competition Commission of India (the "CCI") has initiated investigations into several players such as WhatsApp, Facebook and Google. However, there are also apprehensions regarding the use of competition law (instead of privacy and consumer legislations) to address such concerns.

This note provides a brief overview of the existing legal framework on data privacy in India, analyses the CCI's decisional practice in this regard, and suggests an appropriate way forward for the CCI on this matter.

A. WHAT DOES THE LAW ON DATA PRIVACY IN INDIA CURRENTLY LOOK LIKE?

In 2017, the Supreme Court of India ("Supreme Court") recognized the right to privacy as a fundamental right.¹ Currently, the Information Technology Act (2000) ("IT Act") includes two provisions² to regulate improper disclosure of personal information: (i) Section 43A of the IT Act requires the maintenance of 'reasonable security practices and procedures' in relation to any 'sensitive personal data or information' handled by a body corporate, and provides for compensation to the user for misuse of their personal data;³ and (ii) Section 72A of the IT Act imposes a penalty on any person (including an intermediary) who intentionally discloses personal information without the consent of the user.

However, the Government of India has recognised that specialised legislation regulating privacy rights is required⁴ and to this end, it has formulated the Personal Data Protection Bill, 2019 ("PDP Bill"). The PDP Bill is currently under consideration by the Parliament, and is expected to be presented in the first week of the Winter Session⁵, which usually commences around the last week of November. The PDP Bill, once in force, will repeal Section 43A of the IT Act.

The PDP Bill defines personal data as data "relating to a natural person who is directly or indirectly identifiable, having regard to any characteristic, trait, attribute or any other feature of the identity of such natural person, whether online or offline […] and shall include any inference drawn from such data for the purpose of profiling"⁶. It increases compliance related requirements, gives individuals more control over their information, sets up a regulator to monitor data protection issues (the Data Protection Authority of India ("DPA")), and sets out directions for data storage and localization. Further, the PDP Bill gives the DPA extraterritorial powers and allows for monetary penalties for non-compliance. Notably, the PDP Bill also allows the Government to exempt its agencies from some or all provisions that protect users' data privacy.

Separately, the MEITY has also issued a report on the framework for governance in respect of non-personal data (the "NPD Report") in July 2020.⁷ Non-personal data is data that cannot identify an individual, and includes aggregated data.⁸ However, contrary to the principles under the Competition Act, 2002 (the "Competition Act"), the NPD Report appears to characterize a dominant position as a per se violation of competition law, and suggests that the Competition Act may be a tool to protect competitors (instead of competition). It states that "companies with the largest data pools have outsized, unbeatable techno-economic advantages" and that this "has left many new entrants and start-ups being squeezed"⁹, indicating that this advantage is problematic at the outset.

Accordingly, while it is a positive development that the Government is cognizant of the need for explicit privacy rights, the framework for such regulation, including in respect of the interplay of various regulators, must be established after a thorough study and consultation.

B. WHAT IS THE RELATION BETWEEN DATA PRIVACY AND COMPETITION LAW?

The CCI, by way of the Competition Act, is charged with the responsibility to "prevent practices having an adverse effect on competition and sustain competition in the market". Under the Competition Act, the CCI can look into the three aspects of competition law:

• Anti-competitive agreements between enterprises under Section 3 of the Competition Act,

• Abuse of dominant position by an enterprise under Section 4 of the Competition Act, and

• Regulation of mergers and acquisitions under Sections 5 and 6 of the Competition Act.

The application of the Competition Act could become complicated in digital markets which are often 'zero-price markets', a concept that is at odds with the traditional legal and economic theories relating to competitive harm. In addition, such markets have other unique characteristics including complexity in determining market power or market shares; low entry barriers for players- juxtaposed against network effects which may not allow new entrants to expand or achieve economies of scale; and the ability of customers to multi-home yet at the same time be locked-in due to the lack of inter-operability (thereby complicating the analysis in respect of switching costs).

While the CCI has had several opportunities to examine the digital sector since its inception in 2010, only recently has it analysed data as an asset. In January 2021, the CCI issued a report¹⁰ on the telecom sector in India (the "CCI Telecom Report"), noting the intersection of data privacy and competition law. It identifies the use of data as non-price competition, indicating that data collected from users by an enterprise may be used to the competitive advantage of the enterprise over its competitors. In another report of 2020¹¹, the CCI has also noted that network effects resulting from large amounts of data collected allow companies to compete on a level that does not relate to pricing and creates a system of 'winner takes all'.

Accordingly, data could be used as a proxy for assessing market power, and once such a determination is made, the misuse of data could be considered to cause an appreciable adverse effect on competition.

i. Data as an Indicator of Market Power

The CCI has issued an order initiating an investigation against WhatsApp and Facebook under Section 26(1) of the Competition Act ("WhatsApp Suo Moto Order") which considers data as a non-price competitive parameter.¹²

In its order, the CCI considered its decisional history regarding WhatsApp¹³ to establish its market power and stated that "given its popularity and wide usage, for one-to-one as well as group communications and its distinct and unique features, WhatsApp seems to be dominant". This finding is important, since it relies on the number of users on the platform creating a network effect.

In relation to data usage, the CCI has previously held that companies such as Facebook have the "potential to collect and process significant amounts of customer data"¹⁴. In the WhatsApp Suo Moto Order, the CCI takes this theory forward to state that "in a data driven ecosystem, the competition law needs to examine whether the excessive data collection and the extent to which such collected data is subsequently put to use or otherwise shared, have anti-competitive implications, which require anti-trust scrutiny".¹⁵

The CCI has also taken a similar approach in its assessment of combinations, where it has noted that in "new age dynamic markets" traditional market share analysis may only provide a starting point for inquiry, but is not the sole guiding parameter for assessment of market power. Recent decisions in such markets have also factored in net neutrality and potential data exchange issues.

ii. Abuse of Dominant Position by Manipulation of Data

The CCI Telecom Report provides the following illustrations of abusive conduct: (a) a low privacy standard implying lack of consumer welfare; (b) lower data protection, which could also indicate exclusionary behaviour; and (c) leveraging a data advantage across various services.

In the WhatsApp Suo Moto Order, the CCI appears to endorse this theory of harm, and opines that data-sharing by WhatsApp with Facebook amounts to degradation of non-price parameters of competition, and that this conduct prima facie amounts to imposition of unfair terms and conditions upon the users of WhatsApp (Facebook is also included in the investigation as a direct beneficiary of this privacy policy).

C. IS THIS THE RIGHT TIME FOR REGULATORY INTERVENTION BY THE CCI?

While the CCI Telecom Report identifies data as a metric for non-price competition, it also acknowledges that privacy could, fundamentally, be a consumer protection issue; as opposed to competition law which is aimed at preserving and fostering competition, and not protecting individual market players (i.e., competitors or consumers).

The CCI should act in conjunction with other agencies (in this case, the proposed DPA) that have been specifically empowered to set standards for data protection. While the CCI could take cognizance over an anti-competitive digression from such standards, its venturing to assess what constitutes an 'excessive amount of data' could create conflicting positions with other regulators who may be in a better position to make such assessments in any event.¹⁶

Further, the CCI is clearly still developing its position on misuse of data. The CCI has correctly in the past closed matters which were based on 'bald assertions' and 'assertions which are neither corroborated nor otherwise substantiated in any manner'¹⁷ and has also refused to hold 'potential future exclusion'¹⁸ as a theory of harm. Yet, the investigations initiated by the CCI in the MMT Interim Order and the WhatsApp Suo Moto Order appear to be based on uncorroborated statements.

Given that the requisite boundaries or standards for data protection and usage are yet to be settled and are in appeal before higher courts, the CCI's investigation of these issues may be premature. An approach which may be helpful is for the CCI to be more liberal with preliminary hearings; this would serve to clarify the underlying technology and business models to the CCI and also optimize the use of CCI's investigative resources.

The need of the hour remains that a clear and comprehensive data protection legislation be implemented at the earliest. If such legislation specifies a threshold for data collection, the CCI could then assess market power in digital markets accordingly. Interestingly, the MEITY has already issued a notification that defines a 'significant social media intermediary' as a social media intermediary with 5 million or more registered users in India.¹⁹ Therefore, it would be sensible for the CCI to refrain from creation of thresholds or standards in the realm of data, and instead fortify its understanding of the underlying concerns via market studies and preliminary conferences and focus on effects based approaches.

In the meantime, enterprises in digital markets are advised to review their privacy policies, and adhere to best practices for user data collection such as transparency in end use and advertising.