Infolist ÚOHS a ÚOOÚ: Ochrana osobních údajů a soutěž na digitálních trzích

The infolist was created to inform the public and the professional community about how personal data protection and competition intersect in the digital market environment. The document responds to the dynamic development of technologies that bring new legal and institutional challenges and provides a framework for understanding legislative changes, synergistic effects, and risk areas.

The material summarizes legislative developments and current European regulations that connect competition regulation with data protection. It thoroughly analyzes the Digital Markets Act (DMA), the Digital Services Act (DSA), the Data Act, and the Artificial Intelligence Act (AI Act), including their impacts on the market environment and privacy protection. These rules establish obligations for large platforms, promote interoperability, data portability, and the security of the online environment.

The document also addresses the practical intersection of both areas. It emphasizes that data protection is becoming a parameter influencing competition and recalls the European Commission's decisions in the Microsoft/LinkedIn and Facebook/WhatsApp cases. A key point is the ruling of the Court of Justice of the EU in the case of Meta Platforms vs. Bundeskartellamt, which confirmed the possibility of considering GDPR violations when assessing abuse of dominance, thereby offering a broader evaluation of the interrelationship between competition and personal data protection.

Violations of data protection rules can thus have significant impacts in the area of competition, as unauthorized data processing provides companies with an illegitimate competitive advantage and disrupts equal market conditions.

The infolist analyzes the synergistic aspects of cooperation between regulatory authorities, the principle of loyal cooperation, and provides examples of coordination, such as the Google Privacy Sandbox project evaluated by the UK Competition Authority and the Data Protection Authority, or the consultations of the French Competition Authority with the Data Protection Authority during the investigation of Apple's measures.

It also includes an analysis of conflicting situations between the goals of privacy protection and competition. The conflicting scenarios described in the document primarily include access to personal data versus its protection, data-driven dominance versus privacy protection, and innovations in favor of privacy versus potential restrictions on competition. These situations demonstrate that finding a balance between both areas is essential and requires an individual assessment of each case.

The concluding section provides an overview of key cases from the last decade that illustrate the gradual convergence of both areas and confirm that privacy protection is becoming a significant factor in competitive assessment.

The document concludes with recommendations for businesses: compliance with GDPR is part of competition compliance. Ignoring the rules poses risks not only of fines from supervisory authorities but also interventions from competition authorities if it disrupts competition. Conversely, quality data protection can be a competitive advantage and a means of gaining customer trust. The digital economy requires an integrated approach that ensures fair markets, innovation, and respect for fundamental privacy rights.

Authors:

Vladimír Petráček

Johanna Roháčková