Messenger and video services: Bundeskartellamt on data protection, transparency and interoperability

Today the Bundeskartellamt has published the final report on its sector inquiry into messenger and video services.

Andreas Mundt, President of the Bundeskartellamt: “Messenger and video services have become an everyday means of communication for most of us. Users are often not aware that not all services equally ensure the protection of their personal data. The legal regulations for and the technical basis of data security are complex, intricate and difficult to understand. Clear provisions, information and more transparency could lead to the issue of data protection becoming more important to users when deciding for or against the use of one messenger service or another. As a result, providers would in turn have a greater incentive to ensure a high level of data protection.”

The Bundeskartellamt’s inquiry takes an in-depth look at the technical and legal framework conditions of messenger and video services. It especially focuses on the issues of data protection and data security.

The Bundeskartellamt has found that some services are likely to violate consumer law provisions regarding functions which are particularly important to users:

- If the contact list is synchronised, the data of those contacts that have so far not registered with the relevant service are also collected. In the Bundeskartellamt’s view, this practice may violate the GDPR if it is employed on a permanent basis. This also applies if the telephone numbers are shown in encrypted form.

- Some messenger and video services are also not in compliance with the law when transferring and storing data. Personal data of German and European consumers may only be transferred to and stored in countries where the level of data protection is similar to that ensured by the European GDPR. Based on the current legal situation, the transfer of data to and their storage in the USA in particular is not permissible.

- According to the German Act against Unfair Competition (UWG), consumers also have to be given truthful information on how the security of their communication is ensured, e.g. through data encryption. In the Bundeskartellamt's assessment, the current practice of many services should be improved.

Checklist

Encryption is only one of several criteria which together determine a service’s level of data security. The authority’s investigations have shown that there is still a great deal to be done also in the area of data security. In consultation with the Federal Office for Information Security (BSI), the Bundeskartellamt has compiled a checklist outlining the essential criteria (available in German only) which ensure data security and compliance with the law.

Interoperability

In the interim report (in German only) on the sector inquiry into messenger and video services of 4 November 2021 the Bundeskartellamt has already examined the complexity of interoperability in great detail. Based on the European Digital Markets Act, which has since then entered into force, namely in November 2022, certain large online platforms (referred to as designated gatekeepers) will be obliged to ensure interoperability with other messenger services.  

This is linked, among other things, to the expectation that interoperability will make it easier to switch between different providers and result in better chances for newcomers who rely on access to the established systems. The Bundeskartellamt’s inquiry makes it clear that this process also has to take into account that standardisation, which will be necessary to make interoperability possible, can also have negative effects on the willingness to innovate and thus on competition between the various providers. In addition, depending on how widely the regulation will be used, new risks will arise due to technical challenges in implementing data security, especially with regard to encryption as well as the monitoring and controlling of data. As a result, the level of data security provided by the different services could become even less transparent to consumers.

Background

The Bundeskartellamt launched the sector inquiry into messenger and video services in November 2020. The final report is based in particular on the results of a detailed survey of more than 40 services available in Germany, numerous expert discussions and the evaluation of various studies. The full report is available (in German) here.

The Bundeskartellamt can carry out investigations in the area of consumer protection and identify shortcomings. However, unlike in the area of competition law, the Bundeskartellamt does not have the possibility to terminate or penalise any violations of law in the area of consumer protection.

The sector inquiry into messenger and video services is already the fifth inquiry conducted by the Bundeskartellamt in the area of consumer protection, for which the authority has been responsible since 2017. The other inquiries, which have already been concluded, dealt with comparison websites (2019), user reviews (2020), smart TVs (2020) and mobile apps (2021). Another inquiry into scoring in the online retail sector is currently still ongoing.

For more information on the existing cooperation with the BSI, please refer to the press release of 22 January 2021 [link].

In addition to the (German-language) final report on the sector inquiry into messenger and video services, a summary (in English) is available here.