1 Introduction

In July, 2021, the head of India’s competition authority outlined the challenges facing the Competition Commission of India (CCI) in regulating digital markets.Footnote 1Data was at the heart of these challenges–from the need to develop data-centric theories of harm to the dynamics of data-fuelled digital platforms’ market power. Until recently, at least some of this, such as his bracing admission of a possible role for ex-ante regulation, would have been deemed dangerously heterodox. Now, when regulators and legislators globally are grappling with the distinct ways in which digital markets operate differently from their analogue counterparts, it is timely.

The digitalisation of the global economy has undergone a rapid transformation over the past quarter-century. Schumpeterian creative destruction dominated the first part of the evolution. Business models and market dominance were ephemeral. Today’s digital economy market leaders are the successors of companies whose continued reign seemed inevitable until the moment it wasn’t. The digital antitrust paradigm that evolved amidst such volatility reflected it. Digital markets were deemed largely self-regulating when it came to competition dynamics. There was thus no need to stray from the certainties of the Chicago school of antitrustFootnote 2 that dominated competition regulation across major jurisdictions, including the US, European Union (EU)Footnote 3 and India. The headline casesFootnote 4 that saw competition authorities step in were the exception. The hangover of this conventional, light-touch approach has persisted until recently.

The leading tech firms today–Alphabet, Apple, Amazon, Facebook, Microsoft–have market capitalisations of over $1 trillion each. They rule over a different landscape. Between their acquisition strategies and the decline of start-up activity in the sectors they occupy,Footnote 5their dominance is entrenched and sustainable. Their rise underscores that competition frameworks created for analogue economies are no longer fit for purpose when it comes to digital markets.Footnote 6These markets are often built around intermediary platforms fuelled by consumer and business user data. This enables network effects and ‘data monopolies’; digital markets are thus prone to tipping [1]. There are other complications as well. Dominant digital companies are able to leverage the data they have harvested to foreclose competition in adjacent sectors. And when they anchor digital ecosystems – in e-commerce or mobile operating systems, for instance–their role as intermediaries complicates the idea of market dominance [2]. Traditional competition regulation lacks the tools to tackle these challenges [3].

Scrutiny of these business models and markets in another regulatory realm–data protection–has evolved in parallel with the antitrust response. Its concerns are different, centering on a rights-based approach to privacy that is largely agnostic to the market structure and competitive process factors that preoccupy antitrust regulation. Yet, as the EU’s General Data Protection Regulation (GDPR), the tip of the spear when it comes to data protection frameworks, has shown, data protection has significant economic effects. This is inevitable when access to personal data and the insights derived from it are the most effective economic moat in digital markets. Kira, Sinha and Srinivasan [4] have mapped the intersections of competition regulation and data protection to show the extensive interplay between the two regulatory realms. The lack of a systematic regulatory approach to these intersections means that the outcomes frequently diverge. For instance, strict data protection regulation may improve digital privacy, but damage the competitive process, advantaging incumbents at the expense of rivals who lack the capital or the scale to gather data in compliance. Equally, fierce competition in a digital market may be good for consumers in the short run, but also lead to a digital privacy race to the bottom as firms seek a competitive edge by harvesting more granular consumer data. The danger of such divergent outcomes is particularly pronounced in zero-price markets where conventional antitrust approaches, focused on monetary price as a metric of consumer welfare, observe only consumer surplus.

The relatively new neo-Brandesian approach has attempted to address these gaps by proposing a return to the pre-Bork status quo where competition regulation addressed wider structural concerns, not merely consumer welfare [5, 6]. While this is an important debate, it is beyond the scope of this essay. Instead, we focus on the possibilities of what Lianos [7] has called polycentric competition regulation–a systemic regulatory approach to the intersections of competition regulation and data protection–in India. The positive synergies of such an approach have been analysed in the literature [8] and are starting to be seen in practice.Footnote 7The Competition Act, 2002, provides for this approach as well, if with regards to another regulatory area; Sect. 3(5) lays out the manner in which India’s competition framework interacts with intellectual property rights. In the data protection realm, India currently lacks a comprehensive regime. The IT Act, 2000 is entirely unsuited to data protection concerns today, and its successor, the draft Personal Data Protection (PDP) Bill, 2019 is yet to be enacted into law. However, for the purposes of this paper, we have used the PDP Bill as the basis of a hypothetical data protection framework.

In Sect. 2, we examine the role that data plays in competition regulation for digital markets, charting the evolution of the CCI’s approach by mapping its cases and investigations. We lay out how each step of competition enforcement in digital platforms needs to account for data-related considerations. Section 3 suggests how the CCI can integrate data protection concerns into its analysis, and the conclusion summarises our arguments.

2 CCI’s approach to digital markets

Digital platforms have distinct characteristics that incline digital markets towards monopoly structures [9]: supply side economies of scale with high fixed investment but low marginal costs and network effects that lead to users converging on the same platform [10]. Access to personal data underlies these dynamics and fuels the revenue models of digital platforms, particularly those that are ‘zero-price’. A platform such as Google Search or Facebook, while offering a service for 'free', collects user data to sell personalised, targeted ads. When data is not the main source of revenue generation, it may still be used in subtle ways to gain an advantage such as when Amazon collects the data of buyers and sellers on its platform- to better tailor its own private brands [5].

The data-fuelled competitive advantage such platforms enjoy poses many challenges for competition regulation, complicating market power and abuse of dominance assessment. Compared to a traditional firm, digital platforms, through the sheer volume, velocity and variety of data they collect, enable ‘data network effects’, similar to general network effects. Data collected from users enables these platforms to offer personalised products and services, leading to more users joining the platform and offering up more of their data. This also erects market barriers given that new entrants need to provide a better product or service to break into the market, but lack access to the vast amount of data needed to do so [11]. Platforms can also merge datasets they collect from various sources to help them generate detailed profiles of users. This enables them to leverage their market power not just in adjacent complementary markets but across the whole ecosystem [12].

From a consumer perspective, digital platforms—and more specifically, zero-price platforms—generate substantial consumer surplus given that the services they offer are ‘free’ from a monetary price perspective [13]. Given that antitrust law has traditionally focused on protecting consumer welfare across major jurisdictions for the past several decades [14], this has led to regulators allowing digital platforms significant leeway. However, an increasing body of literature is now examining data-fuelled anti-competitive behaviour that harms consumer welfare but is not easily captured by current antitrust tools that focus on price. On zero price platforms, data collection and extraction from users in lieu of money can be far more pervasive than what users consent to—akin to charging excessive prices [15].

However, without an objective measure for quantifying the extent of data collection by these platforms, users have little control over the actual value of the data they part with. This also brings out some of the tension between data protection and antitrust: the lower the level of data protection and privacy offered to users, the greater the potential competitive advantage for companies with enhanced access to data [16].

The Competition Commission of India (CCI) has largely taken a conventional consumer welfare approach thus far with the Competition Act of 2002 governing three main areas. The law prohibits anti-competitive horizontal and vertical agreements that will have an 'appreciable adverse effect on competition'. Second, it outlaws abuse of dominance by a market player that enables it to ‘operate independently of competitive forces prevailing in the relevant market, or affect its competitors or consumers or the relevant market in its favour.’Footnote 8 Finally, it assesses mergers and acquisitions above a certain threshold for anti-competitive effects. In all these areas, except for certain horizontal mergers, the CCI has largely adopted an éffects-based approach [17]).

Since its establishment in 2009, the CCI has looked at a number of cases involving antitrust issues related to digital platforms but intervened in only a few. In general, the Commission has been circumspect about intervening in these digital markets due to the fear of chilling innovation. The Commission was of the opinion that these were still nascent, developing markets and a heavy-handed approach could prove to be counterproductive to growth and innovation [17, 18]. However, the e-commerce market study report in 2019Footnote 9 was an inflection point; the Commission has been significantly more proactive since then. We limit our focus to cases that involve the intersection of data and competition regulation.

2.1 Assessing market power

Prior to the report, two major cases involving digital platforms were closed at the threshold level: Vinod Kumar Gupta vs WhatsAppFootnote 10 and AIOVA vs. Flipkart.Footnote 11 In the WhatsApp case, the CCI found the platform to be prima facie dominant. However, it dropped the case at the threshold level, dismissing the possibility of abusive conduct, stating that the platform offered a free product and the costs of switching were minimal. It failed to consider the network effects that a dominant entity such as WhatsApp enjoys, making it difficult for users to switch to another platform that is likely to have a lower base of users. Network effects also raise the barriers to entry, with rivals needing to provide a product that would entice a critical mass of users to switch from the incumbent. These issues are compounded by the fact that rivals would be likely to find it hard to produce a better product given their lack of access to data from users [11].

In the AIOVA vs. Flipkart case, the CCI contended again that Flipkart could not have indulged in abuse of dominance (of deep discounting and of leveraging its dominant position to enter a complementary market) because of the presence of a competitor—Amazon. Here again, the Commission failed to consider the ways in which a digital platform (which is dominant within its own ecosystem) with greater access to data than a seller could leverage that to promote its own products and private brands.

2.2 Assessing abuse of dominance

Competition law considers non-price metrics such as a reduction in product quality for assessing abuse of dominance. Price, however, remains a signifier in traditional markets under the assumption that users have considered all non-price parameters of a product while purchasing it. In digital markets, consumers may be harmed in terms of product quality in a way that price cannot capture. On zero price platforms in particular, the scope of data collection can serve as a measure of product quality [19]. The greater the collection of personal data, the lower the level of privacy – a proxy for product quality. The CCI has recently acknowledged privacy as a non-price metric of competition in a market study report on the telecom sector.Footnote 12Regulators in other jurisdictions have done so as well over the past few years. In Microsoft's acquisition of Linkedin in 2016, the European Commission stressed that privacy was an important parameter and assessed if a high degree of data concentration in a single firm post the acquisition could harm competition on privacy in the market [20]. The European Data Protection Supervisor (EDPS) held that privacy is encapsulated in product quality, which is a relevant metric of competition.Footnote 13 In 2017, the Japan Fair Trade Commission (the competition regulator of Japan) too acknowledged privacy as a dimension of product quality.Footnote 14

In the Vinod Kumar vs WhatsApp case, the CCI looked at the anti-competitive conduct in question–WhatsApp sharing user account information with Facebook. It concluded that there was no abuse of dominance for a number of reasons. In addition to the reasoning laid out in Sect.  2.1, the Commission held that users were given an opt-out option within 30 days of the new privacy policy update and the data would be used by WhatsApp to improve service delivery. However, privacy policies are often opaque and vague and users are generally unaware of the extent of data they are parting with on such platforms [15]. Platforms also have an incentive to collect excessive data given that it helps them gain an advantage over competitors. This excessive data collection due to the new privacy policy update was the equivalent of a reduction in product quality or excessive pricing in a traditional market.

The Commission has also been slow to intervene with respect to digital platforms that fashion and dominate ecosystems. Many zero price platforms (Google Search or Facebook) use their access to data to further entrench their market power across the whole supply chain and in complementary markets (eg. Google through its Android operating system uses its dominance in the app store market to dictate terms to app developers as well as handset and mobile device manufacturers). The dominant player within an ecosystem is able to leverage its central position by not only limiting intra-ecosystem competition to favour its own products but also by locking in users and raising the costs of switching to an alternative ecosystem [2]. For example, Google leverages the dominance of its operating system by ensuring that Android phone manufacturers pre-install Google applications (for instance, Chrome is the pre-installed browser) as the default option. Regulators from the European Union to India have now condemned this practice as anti-competitive.Footnote 15

In the AIOVA vs. Flipkart case,Footnote 16the Commission was dismissive of the conduct of Flipkart which had leveraged its position within its ecosystem to compete with business users through private labels only because it did not deem Flipkart to be a dominant entity in the presence of Amazon. However, the Commission failed to investigate further on two accounts a) a platform can be dominant within an ecosystem it has created even if not in the broader market and use that power to its advantage b) the platform in question could have unfair access to a large amount of data regarding buyers and sellers on its platform that it could use to enter a complementary market.

2.3 Mergers and acquisitions

The data implications of mergers and acquisitions, especially by dominant platforms, are three-fold: firstly, the access to broader and complementary datasets arising from a merger could lead to more profound profiling of users and enable differential price targeting; secondly, the buying of competitors with more stringent privacy policies could potentially lead to less competition amongst firms on issues of data protection in the long run [21]. And finally, the market power acquired by a dominant firm with access to broader datasets after the merger could erect entry barriers for rivals without access to such data.

The CCI so far has not intervened in a significant way to stall any merger or acquisition when it comes to digital platforms. But it is becoming increasingly cognisant of these issues: the Competition Law Review Committee has called for increased scrutiny of mergers and of review of existing thresholds so that acquisitions such as WhatsApp by Facebook can be covered [22].

2.4 CCI's evolving approach

In 2019, the CCI launched a market study in the e-commerce sector to better understand competition issues arising from the emergence of digital platforms. Since the studyFootnote 17 as well as the Competition Law Review Committee’s report, the CCI has been more cognisant of the role data plays on these platforms for anti-competitive practices: from platforms using seller data to introduce private labels and skewing search results to favour their own verticals to imposing unfair data collection and sharing policies that hurt users and erects entry barriers.

Prior to the report, the Matrimony.com vs Google caseFootnote 18 marked the first time the CCI made a substantial intervention in the market by fining Google for abusing its dominant position in the online search market. The Commission found that Google's display of universal search results in fixed positions in the search engine's results page was not according to relevance, although it was understood to be so.Footnote 19 And secondly, Google was also found to be manipulating its search algorithm to favour its own services such as Google Flights, displaying them prominently in the search results.

After the study, the Commission has been quite zealous in launching investigations. In 2020, the Commission opened a suo moto investigation against WhatsApp regarding its privacy policy update allowing data sharing with Facebook. Unlike in 2016, the Commission prima facie has noted that WhatsApp's 'take it or leave it' policy may not amount to voluntary consent as the terms imposed were vague and lock-in effects could be high. Second, while acknowledging privacy as a non-price metric of competition, it noted that data sharing between these companies could amount to degradation of quality. Finally, cross-linking of data across platforms gives an advantage that could amount to leveraging of dominance across markets. [22]. In a recent market study report on the telecom sector, the Committee explicitly argued that privacy could be a non-price metric of competition.Footnote 20

3 A polycentric approach to digital antitrust in India

From a normative perspective, India’s current competition framework is traditional in its focus on protecting consumer welfare and the competitive process rather than competitors. Case law under the Competition Act, 2002–in contrast to the prior regime established under the Monopolies and Restrictive Trade Practices Act, 1969–shows that the CCI has eschewed broader ‘public interest’ arguments [17]. The CCI’s growing appreciation of the role data plays in competition dynamics in digital markets has not changed this. Its thinking on multiple fronts, from assessing the practices of intermediary platforms vis-a-vis complementors to network effects, has stayed within the established guardrails) [23, 24]. The Competition Law Review Committee’s recommendations for changes to the Competition Act that would make it more suited to the changing nature of markets today [25],Footnote 21implemented in the draft Competition (Amendment) Bill, 2020, have done likewise.

These efforts, however, have failed to acknowledge the need to systematically integrate data protection considerations into the consumer welfare standard for digital markets. By definition, competition regulation has a differentiated approach; it concerns itself with companies that wield market power over a certain threshold. Data protection frameworks are more horizontal, focusing on individuals’ digital privacy [26]. Where they converge is their emphasis on consumer preference. Traditional competition regulation sees monetary price as a mechanism for consumers to reveal their preferences, acting upon consumer surplus and nudging the market towards Pareto optimality [4]. Data functions in much the same way in zero-price digital markets, as we have detailed in Sect. 2. By setting standards for consent and user control over personal data, data protection aims to allow individuals to reveal their preferences regarding privacy in a meaningful way and compel companies to act upon them. These standards can thus provide normative guidance to competition regulators in operationalising data-related theories of consumer harm and exploitative conduct.

3.1 Assessing market power

Competition regulation is predicated upon the existence of market power. If a company does not occupy a dominant position in the relevant market, its consumer-facing actions fall outside the CCI’s ambit. Article 4(a)(i) of the Competition Act defines a dominant position as a company’s ability to “operate independently of competitive forces prevailing in the relevant market”24. In conventional markets, this is measured via price, product quality and choice. For instance, if a company is able to profitably increase price or reduce product quality–with the marginal cost serving as the competitive price–it exhibits market power [27].

The hypothetical nature of the marginal cost construct complicates such assessment. In data-driven zero-price markets, it becomes impossible. Market share is a reasonable proxy in both conventional and digital markets; it indicates the competitive constraints a company faces [21]. The PDP Bill could provide useful guidance for the latter. Section 3(13) defines data fiduciaries as any of a number of entities, including companies, that determine “the purpose and means of processing personal data.” Sect. 26(1) qualifies this by listing parameters for a subset of significant data fiduciaries. These include, among other metrics, “volume of personal data processed”. The Data Protection Authority’s Codes of Practice, once implemented, will lay out precise guidelines for the cutoff that will qualify a data fiduciary for the “significant” category, and how to measure it. Contingent on where these lines are drawn, they could inform the CCI’s assessment of the market share of digital businesses.

However, there are two complications. First, market share does not always give a complete picture of a company’s ability or lack thereof to act independently of market forces. For instance, the CCI explicitly rejected a static market share approach in Fast Track v Ola (2017).Footnote 22Second, the rise of digital ecosystems and intra-ecosystem competition makes market share assessment suspect as an indicator of market power. While the digital platform anchoring an ecosystem may have a relatively small market share – relevant for inter-ecosystem competition – switching costs and the friction in multi-homing for its complementors could allow it to impose exploitative terms on them [2]. The debate around Apple’s App Store policies despite iOS having approximately 27% of the mobile operating system market globally reflects this [28].

The growing consensus around the fact that privacy protection could be a parameter of competition on product quality, particularly in zero-price markets, points to an alternative [21]. Kesler et al. [29] provide empirical evidence for this, assessing two million apps in the Google Play Store to find a positive correlation between app market share and more data collection. The corollary is that the quality of data protection and privacy will be better in competitive markets. However, assessing the quality of a product’s digital privacy protections is both a subjective exercise and a highly specialised one. This is where data protection regulation comes in. The privacy mechanisms outlined in the PDP Bill, to be given substance in future Codes of Practice, provide objective standards for assessing product quality on this parameter. Drawing upon the data protection framework to assess both market share and dominance via a company’s level of data protection for consumers and business users would enable the CCI to make more informed decisions in zero-price markets that are currently a blind spot.

3.2 Abuse of dominance

The data-centric theories of harm discussed in Sect. 2 are, almost by definition, subjective. In conventional markets, monetary price functions as an objective metric of consumer preference, incorporating quality and choice considerations, among others. Consumer preferences and welfare on digital platforms–particularly in zero-price markets–are complex, multi-dimensional and lacking in a measure that can capture them adequately. Data costs for the same product can be different across consumers, as can the advertisements they are targeted with. Those advertisements, in turn, may add to product quality for some consumers and degrade it for others [4].

Information asymmetry further complicates the picture. While this is at play in analogue markets as well, its effects are particularly pronounced in digital markets. Consumers may incur excessive data costs due to ‘concealed data practices’, surrendering data they have not agreed to based on deceptive consent notices [15]. Alternatively, if the data they surrender is in keeping with their consent, they may incur unknown data costs due to a lack of knowledge regarding the inferences platforms and third parties draw from the data.

The CLRC touched upon these issues tangentially in debating whether Sect. 2(o) of the Competition Act should be amended to include data in the definition of price. It decided against it given that the existing definition, which covers ‘every valuable consideration, whether direct or indirect’, is broad enough to include data. The acknowledgement of data as non-monetary price here and privacy as a non-price metric of competition in the suo moto WhatsApp investigation launched in 2020 open the door for synergising with data protection regulation. In the latter instance, the CCI’s logic echoes that of the BundeskartellamtFootnote 23 which held that Facebook’s consent practices which gave consumers a choice between not using the service or agreeing to extensive data collection, particularly from third-party sites, amounted to exploitative conduct. However, the German competition authority adopted an explicitly polycentric approach, using Facebook’s violation of GDPR as a metric for establishing exploitative conduct.

While the CCI’s WhatsApp investigation establishes a useful precedent, by failing to adopt a polycentric view de jure while doing so de facto–the investigation focuses, essentially, on WhatsApp’s failure to unbundle consent, a privacy protection measure found in the PDP Bill–it leaves a regulatory gap. To operationalise the concepts of data overcharges or exploitative conduct via degrading product privacy, the CCI would have to create or adopt reliable metrics. As discussed in Sect. 3.1, the PDP Bill contains such guidelines. Section 5(b), for instance, mandates purpose limitation while Sect. 6 focuses on data minimisation and Sects. 7(1) and 7(2) on consent mechanisms. There are a host of other provisions with implications for competition regulation.Footnote 24By using these to inform assessment of overcharging or exploitative conduct and abuse of dominance, the CCI would ensure regulatory clarity and avoid both institutional clashes and divergent data protection and competition outcomes.

3.3 Mergers and acquisitions

Section 5 of the Competition Act, 2002, delineates thresholds, based on companies’ monetary assets and turnover, for determining whether a “combination” should be investigated or not. There are two problems with this. First, digital companies, particularly start-ups, are often asset-light given the nature of their business models and products [25]. In addition, the logic of digital markets, where network effects and user data make growing the consumer base the highest priority, often drives platforms to de-prioritise turnover. Second, these thresholds fail to account for the data-related market power and adverse effects on competition described in Sect. 2.3.

The draft Competition (Amendment) Bill, 2020 attempts to address these and other gaps in Sect. 6, adding the proviso that the Central Government may, in consultation with the CCI, prescribe any other criteria it thinks appropriate to the criteria defined in Sect. 5 of the Competition Act.Footnote 25 The proviso is broad enough to be used for incorporating data concerns into merger assessment. Kira, Sinha and Srinivasan [4] argue that “Drawing on data protection frameworks to develop methodologies for assessing mergers from the perspective of data concentration and privacy would give competition regulators clearer parameters.” The consent and privacy guardrails established by the PDP Bill can thus feed into CCI’s analysis of long-term adverse effects on competition on privacy and data protection arising from combinations. The draft Bill also incorporates the concept of settlements and commitments that investigated parties can apply for; the CCI can close an investigation if it is satisfied by the remedial measures the company commits to. In fast-moving digital markets where the extended timelines of ex post regulation mean that the harm to competition and consumers has often been done by the time an investigation has been completed, this is a welcome measure for streamlining the process. The CCI can, again, look to the data protection framework to identify data-driven harms and formulate remedial measures such as keeping the databases of merging entities siloed.

4 Conclusion

The data-driven revenue models of digital platforms affect competition regulation at every step: from delineation of the relevant market to assessing the actual market power of companies and their anti-competitive conduct. But antitrust law in India is yet to systematically consider and integrate these concerns into its investigations. Given the rapid growth of digital platforms in the country, the CCI must keep abreast of these complex market dynamics. It cannot do so if it persists with a siloed approach. The synergistic approach that we advocate for would not necessarily lead to the Competition Commission of India broadening the scope of antitrust law beyond the çonsumer welfare standard. Rather, as we have shown, data protection concerns could neatly fold into considerations of consumer harm.

Although India's data protection bill is yet to be passed, effective mechanisms for the Commission working with the proposed Data Protection Authority are crucial. The regulatory bodies will need to be mindful of the practical pitfalls of a synergistic approach. Experience shows that regulators have often been tied up in regulatory turf battles due to unclear mapping of jurisdictions and significant overlaps; CCI’s turf battle with the Telecom Regulatory Authority of India is a case in point. Such conflicts between competition and data protection authorities would increase policy uncertainty, degrade effective enforcement and impose costs on the entities being regulated. Thus, the practical implementation of a more integrated approach is an area that requires further research.