CYIL vol. 12 (2021)

michal petr

CYIL 12 (2021)

The Role of Competition Policy in Cybersecurity Michal Petr

Abstract: In the last months, dozens of antitrust proceedings against top technology firms have been opened throughout the world, including Amazon, Apple and Google. It has been claimed in several jurisdictions, including the EU and the US, that current antitrust legislation needs to be amended in order to fit the current reality of ubiquitous technology. Competition law is thus frequently perceived as a tool of choice to address all the market problems in the on-line world. We argue in this Article that the role of competition law should not be stretched too far beyond its current boundaries, and that specific, non- antitrust regulation might often provide more appropriate means to remedy the market failures. We discuss this on recent examples from cybersecurity and data privacy. Resumé: V posledních měsících byla po celém světě zahájena vyšetřování možného po- rušení soutěžního práva ze strany největších technologických gigantů, včetně společností Amazon, Apple a Google. V mnoha jurisdikcích, včetně Evropské unie a Spojených států, probíhá debata, zda je třeba soutěžní právo novelizovat tak, aby odpovídalo dnešní realitě všudypřítomných technologií. Soutěžní právo je tak často považována za základní nástroj, který má řešit všechny tržní problémy on-line světa. V tomto článku ale argumentujeme, že působnost soutěžního práva by neměla být příliš rozšiřována za jeho stávající hranice a že specifická regulace nezaložená na soutěžním právu může být pro řešení některých tržních selhání adekvátnější, jak ukazujeme na nedávných příkladech z oblasti kybernetické bez- pečnosti a ochrany dat. Key words: Abuse of Dominance; Anticompetitive Conduct of States; Competition law; Cybersecurity; Data Privacy About the Author: Doc. JUDr. Michal Petr, PhD., is an associate professor at the Faculty of Law of the Palacky University in Olomouc, Czech Republic. He specializes in economic aspects of EU integration, in particular competition law, sectoral regulation, and public procurement. Before his academic career, he worked at the Czech Competition Authority as its Vice Chairman. I. Introduction Competition law is frequently called upon to intervene in areas where – arguably – it was originally not intended to apply. Thus recently, Amnesty International asked the Commission to take into account human rights implications while assessing the Google / Fitbit merger. 1 Cybersecurity may be becoming one of such areas. Intuitively, there is not much connecting cybersecurity and competition policy. On a closer look, however, these two policies are entwined. The question this Article will try to answer is whether competition law, as is stands today, provides an adequate tool to tackle the cybersecurity, and more broadly, also data privacy problems. 1 See the Amnesty International’s letter addressed to the European Commission from 27 November 2020, published at: https://www.amnesty.eu/wp-content/uploads/2020/11/Google-Fitbit-merger-complaint-to-the-EU- Commission-FINAL.pdf (accessed 1 September 2021).

212