“Privacy and Antitrust” Professor Peter Swire Ohio State University Center for American Progress IAPP Spring Conference March 2008

The Basic Idea Basic idea: Price competition is part of antitrust Non-price competition is part of antitrust Privacy can be a form of non-price competition All 5 FTC Commissioners recognized this idea in the Google/DoubleClick opinion So, privacy considerations will be part of antitrust analysis going forward

Overview My background Other arguments for how privacy matters to antitrust Sen. Kohl: privacy and be skeptical of bigness Rotenberg: privacy as fundamental right Microsoft last fall: beware of exclusionary conduct My approach: privacy as non-price competition What that means for privacy professionals

My Background Privacy background Chief Counselor for Privacy at OMB, 1999-2001 “Privacy Year in Review” to all IAPP members Lead author of official book for Certified Information Privacy Professionals exam Antitrust background Practiced in antitrust before entering law teaching Teach antitrust law Submitted testimony on privacy & antitrust to FTC this October: http://www.americanprogress.org/issues/2007/10/privacy.html

History of Privacy & Antitrust Traditionally, mergers were for products Exxon/Mobil Beer manufacturers Etc. Information about individuals was not a major factor in the mergers Practices about personally identifiable information were not a major factor in the businesses

Sen. Kohl – Bigness is Bad The populist strain of antitrust law Bigness is itself a cause for worry Fear of the big “trusts” at time of Sherman (1890) and Clayton (1914) Acts 1950 amendment to Section 7 of the Clayton Act continued the populist tradition – block mergers that “may substantially affect competition” 1960s cases stopped mergers to <10% of the market, to prevent gradual mergers into bigness

Big is Bad Sen. Kohl is Chairman of the antitrust subcommittee in Senate Judiciary In hearing this fall on Google/DoubleClick and privacy: “The antitrust laws were written more than a century ago out of a concern with the effects of undue concentrations of economic power for our society as a whole, and not just merely their effects on consumers’ pocketbooks. No one concerned with antitrust policy should stand idly by if industry consolidation jeopardizes the vital privacy interests of our citizens so essential to our democracy."

Legal Status of Big is Bad Sen. Kohl very important as chair of the committee But “big is bad” or “undue concentration of economic power” has faded from antitrust jurisprudence Recent focus instead on whether merger will harm competition: will the result be reduced price or non-price competition?

Rotenberg: Privacy as Fundamental Right EPIC complaint to the FTC: “The right of privacy is a personal and fundamental right in the United States.” Therefore, “unless the Commission establishes substantial privacy safeguards by means of a consent decree, Google’s proposed acquisition of DoubleClick should be blocked.” On this view, as for traditional antitrust concerns, a merger can increase the risk of harm to consumers, so mergers are an important opportunity to protect privacy rights

Fundamental Rights U.S. example of a fundamental right is 1st Amendment: Intermediate or strict scrutiny of limits on free speech Do Not Call rule has exception, for instance, for political speech For fundamental rights, government actors must take them into account in official actions In Europe, privacy clearly a fundamental right That strengthens the case for privacy concerns to be explicitly considered in E.U. competition review In U.S., much weaker legal basis for privacy as that sort of right Would quite likely require statutory change to have privacy (as privacy) become a factor in merger review

Exclusionary Arguments A standard antitrust issue is whether a merger “excludes” effective competition Microsoft GC Brad Smith critiqued Google/DClick: “These privacy issues have antitrust consequences. Given the nature and economics of online advertising, this concentration of user information means that no other company will be able to target ads as profitably. It will substantially reduce the ability of others to compete.” Standard antitrust issue if can identify an exclusionary effect

My Approach: Privacy as Non-Price Competition NY Times May 2007: “Strictly speaking, privacy is not an antitrust issue” Swire testimony for Town Hall in October, 2007 The basic idea: Privacy can be an important aspect of competition Where it is, then a merger or other practice can reduce competition, triggering antitrust scrutiny

Price and Non-Price Traditional focus on price competition Would G/DC merger affect prices of online advertising? Longstanding antitrust attention to non-price competition Imagine an agreement not to compete on warranties Or, a merger where competition on warranties would be greatly reduced On those facts, there would be an antitrust injury to consumers

Non-Price and Quality DOJ 2001 speech where price is “synecdoche” Price stands for the full range of issues that can affect competition in a market Quality of a product one example, such as if quality of shirts would decline due to merger Privacy as quality of a product or service One quality of a service, such as surfing the net, is whether it is high-surveillance or low-surveillance Consumers who care about privacy are harmed if there is less competition on privacy, and privacy protections decline

2 Key Questions Is privacy a non-price factor (a quality of a product or service) that is important to consumers? Will the merger or other action reduce competition in privacy, creating antitrust injury to consumers?

Does Privacy Matter? Quite possibly yes Personal information practices – privacy & security – clearly more important in the information economy Westin surveys consistently show: “High privacy concern” group at 25-40 % Large “medium privacy concern” group as well For these diverse consumer preferences, there is competitive advantage to having a good privacy reputation

Competition in Privacy? Again, often yes Search privacy 2007-08: Google announcement on deleting logs Microsoft announcement on logs & other issues Ask announcement of AskEraser This is evidence of competition on privacy, by major players, in a major market

What Implications for Antitrust? Have just said: Privacy as potentially important non-price factor Evidence of competition on privacy Clayton Act § 7, for mergers: “may substantially affect competition” This is the logic of how a merger could reduce competition in privacy, affecting competition in a significant non-price way Could be reason to block a merger Or, place “conditions” on a merger, to assure no harm to privacy

Current Mergers I have specifically not taken a position on the facts for Google/DoubleClick or Microsoft/Yahoo I have done work for companies potentially affected by these theories – the views here are mine, as an academic My point – is part of the job for antitrust agencies to look at privacy as a non-price aspect of competition The agencies receive confidential information & presentations Those on the outside thus don’t see critical information on market definition and market effects

FTC Decision on Google/DoubleClick Majority upheld Google/DoubleClick merger (4 votes) It specifically referenced the approach here: “We investigated the possibility that this transaction could adversely affect non-price attributes of competition, such as consumer privacy.” Accepted the analysis, but held the facts not there Commissioner Harbour dissented She cited my testimony, saying antitrust law should ensure competition “based on privacy protections or related non-price dimensions.”

Second Requests Another important way that privacy may well become part of antitrust cases Commr. Harbour: companies seeking a merger in data-rich industries should receive detailed questions about privacy in “second requests” Companies can thus expect to provide detailed answers and data about their privacy practices, and how the merger will affect those practices A new role for the CPO in mergers & other transactions

To Recap Significant, but limited, effects of privacy issues on mergers & other antitrust analysis The significant effects: Unanimous FTC support for the idea that antitrust law should examine whether any loss of competition in privacy due to the merger Increased questions likely as part of mergers about privacy practices, and thus a role for CPOs as part of the antitrust due diligence

Limits of This Antitrust Approach This approach fits within existing U.S. law, with focus on competition & antitrust injury to consumers Not treating privacy as a fundamental right Not a free-floating investigation into privacy practices Section 7 looks to the effect of the merger If privacy practices are lousy, but unchanged by the merger, then antitrust authorities don’t intervene

More to Explore Issues for possible discussion: How should we assess the likelihood that a merger will reduce competition for privacy? How should we weigh possible harm to privacy felt by some consumers with possible benefits to consumers from more intensive personalization? How well will antitrust agencies deal with these privacy-based problems? Would the FTC do better at this than DOJ? Let the debates begin