“Privacy and Antitrust”

1. “Privacy and Antitrust” Professor Peter Swire Ohio State University Center for American Progress IAPP Spring Conference March 2008

2. The Basic Idea • Basic idea: • Price competition is part of antitrust • Non-price competition is part of antitrust • Privacy can be a form of non-price competition • All 5 FTC Commissioners recognized this idea in the Google/DoubleClick opinion • So, privacy considerations will be part of antitrust analysis going forward

3. Overview • My background • Other arguments for how privacy matters to antitrust • Sen. Kohl: privacy and be skeptical of bigness • Rotenberg: privacy as fundamental right • Microsoft last fall: beware of exclusionary conduct • My approach: privacy as non-price competition • What that means for privacy professionals

4. My Background • Privacy background • Chief Counselor for Privacy at OMB, 1999-2001 • “Privacy Year in Review” to all IAPP members • Lead author of official book for Certified Information Privacy Professionals exam • Antitrust background • Practiced in antitrust before entering law teaching • Teach antitrust law • Submitted testimony on privacy & antitrust to FTC this October: http://www.americanprogress.org/issues/2007/10/privacy.html

5. History of Privacy & Antitrust • Traditionally, mergers were for products • Exxon/Mobil • Beer manufacturers • Etc. • Information about individuals was not a major factor in the mergers • Practices about personally identifiable information were not a major factor in the businesses

6. Sen. Kohl – Bigness is Bad • The populist strain of antitrust law • Bigness is itself a cause for worry • Fear of the big “trusts” at time of Sherman (1890) and Clayton (1914) Acts • 1950 amendment to Section 7 of the Clayton Act continued the populist tradition – block mergers that “may substantially affect competition” • 1960s cases stopped mergers to <10% of the market, to prevent gradual mergers into bigness

7. Big is Bad • Sen. Kohl is Chairman of the antitrust subcommittee in Senate Judiciary • In hearing this fall on Google/DoubleClick and privacy: • “The antitrust laws were written more than a century ago out of a concern with the effects of undue concentrations of economic power for our society as a whole, and not just merely their effects on consumers’ pocketbooks. No one concerned with antitrust policy should stand idly by if industry consolidation jeopardizes the vital privacy interests of our citizens so essential to our democracy."

8. Legal Status of Big is Bad • Sen. Kohl very important as chair of the committee • But “big is bad” or “undue concentration of economic power” has faded from antitrust jurisprudence • Recent focus instead on whether merger will harm competition: will the result be reduced price or non-price competition?

9. Rotenberg: Privacy as Fundamental Right • EPIC complaint to the FTC: “The right of privacy is a personal and fundamental right in the United States.” • Therefore, “unless the Commission establishes substantial privacy safeguards by means of a consent decree, Google’s proposed acquisition of DoubleClick should be blocked.” • On this view, as for traditional antitrust concerns, a merger can increase the risk of harm to consumers, so mergers are an important opportunity to protect privacy rights

10. Fundamental Rights • U.S. example of a fundamental right is 1st Amendment: • Intermediate or strict scrutiny of limits on free speech • Do Not Call rule has exception, for instance, for political speech • For fundamental rights, government actors must take them into account in official actions • In Europe, privacy clearly a fundamental right • That strengthens the case for privacy concerns to be explicitly considered in E.U. competition review • In U.S., much weaker legal basis for privacy as that sort of right • Would quite likely require statutory change to have privacy (as privacy) become a factor in merger review

11. Exclusionary Arguments • A standard antitrust issue is whether a merger “excludes” effective competition • Microsoft GC Brad Smith critiqued Google/DClick: • “These privacy issues have antitrust consequences. Given the nature and economics of online advertising, this concentration of user information means that no other company will be able to target ads as profitably. It will substantially reduce the ability of others to compete.” • Standard antitrust issue if can identify an exclusionary effect

12. My Approach:Privacy as Non-Price Competition • NY Times May 2007: “Strictly speaking, privacy is not an antitrust issue” • Swire testimony for Town Hall in October, 2007 • The basic idea: • Privacy can be an important aspect of competition • Where it is, then a merger or other practice can reduce competition, triggering antitrust scrutiny

13. Price and Non-Price • Traditional focus on price competition • Would G/DC merger affect prices of online advertising? • Longstanding antitrust attention to non-price competition • Imagine an agreement not to compete on warranties • Or, a merger where competition on warranties would be greatly reduced • On those facts, there would be an antitrust injury to consumers

14. Non-Price and Quality • DOJ 2001 speech where price is “synecdoche” • Price stands for the full range of issues that can affect competition in a market • Quality of a product one example, such as if quality of shirts would decline due to merger • Privacy as quality of a product or service • One quality of a service, such as surfing the net, is whether it is high-surveillance or low-surveillance • Consumers who care about privacy are harmed if there is less competition on privacy, and privacy protections decline

15. 2 Key Questions • Is privacy a non-price factor (a quality of a product or service) that is important to consumers? • Will the merger or other action reduce competition in privacy, creating antitrust injury to consumers?

16. Does Privacy Matter? • Quite possibly yes • Personal information practices – privacy & security – clearly more important in the information economy • Westin surveys consistently show: • “High privacy concern” group at 25-40 % • Large “medium privacy concern” group as well • For these diverse consumer preferences, there is competitive advantage to having a good privacy reputation

17. Competition in Privacy? • Again, often yes • Search privacy 2007-08: • Google announcement on deleting logs • Microsoft announcement on logs & other issues • Ask announcement of AskEraser • This is evidence of competition on privacy, by major players, in a major market

18. What Implications for Antitrust? • Have just said: • Privacy as potentially important non-price factor • Evidence of competition on privacy • Clayton Act § 7, for mergers: “may substantially affect competition” • This is the logic of how a merger could reduce competition in privacy, affecting competition in a significant non-price way • Could be reason to block a merger • Or, place “conditions” on a merger, to assure no harm to privacy

19. Current Mergers • I have specifically not taken a position on the facts for Google/DoubleClick or Microsoft/Yahoo • I have done work for companies potentially affected by these theories – the views here are mine, as an academic • My point – is part of the job for antitrust agencies to look at privacy as a non-price aspect of competition • The agencies receive confidential information & presentations • Those on the outside thus don’t see critical information on market definition and market effects

20. FTC Decision on Google/DoubleClick • Majority upheld Google/DoubleClick merger (4 votes) • It specifically referenced the approach here: “We investigated the possibility that this transaction could adversely affect non-price attributes of competition, such as consumer privacy.” • Accepted the analysis, but held the facts not there • Commissioner Harbour dissented • She cited my testimony, saying antitrust law should ensure competition “based on privacy protections or related non-price dimensions.”

21. Second Requests • Another important way that privacy may well become part of antitrust cases • Commr. Harbour: companies seeking a merger in data-rich industries should receive detailed questions about privacy in “second requests” • Companies can thus expect to provide detailed answers and data about their privacy practices, and how the merger will affect those practices • A new role for the CPO in mergers & other transactions

22. To Recap • Significant, but limited, effects of privacy issues on mergers & other antitrust analysis • The significant effects: • Unanimous FTC support for the idea that antitrust law should examine whether any loss of competition in privacy due to the merger • Increased questions likely as part of mergers about privacy practices, and thus a role for CPOs as part of the antitrust due diligence

23. Limits of This Antitrust Approach • This approach fits within existing U.S. law, with focus on competition & antitrust injury to consumers • Not treating privacy as a fundamental right • Not a free-floating investigation into privacy practices • Section 7 looks to the effect of the merger • If privacy practices are lousy, but unchanged by the merger, then antitrust authorities don’t intervene

24. More to Explore • Issues for possible discussion: • How should we assess the likelihood that a merger will reduce competition for privacy? • How should we weigh possible harm to privacy felt by some consumers with possible benefits to consumers from more intensive personalization? • How well will antitrust agencies deal with these privacy-based problems? Would the FTC do better at this than DOJ? • Let the debates begin