Comments of the International Center for Law & Economics”

Markets involving data and personal information have unique characteristics, but do not present such novel challenges that the well-developed tools of antitrust are incapable of incorporating them. Nonetheless, some critics continue to press for misguided antitrust intervention into data markets, often based on fundamental misunderstandings. 

For a start, commonly repeated analogies between data and oil are highly misleading. Oil is physical commodity that is highly rivalrous (a user cannot use oil without impairing others’ ability to use the same oil) and readily excludable (it can easily be stored in ways that prevent use by non-authorized parties). By contrast, data is simply information that bears some of the traits of a public good: it is often non-rivalrous in consumption (the same information may be used by multiple parties without any degradation) and difficult to appropriate because it is difficult to prevent others’ use of the same data, it is difficult to ensure optimal investment in its creation). Moreover, in most instances, it is not data that is scarce, but the expertise required to generate and analyze it. In any case, most successful internet companies started life with little to no data. This suggests that data is more a byproduct of the ongoing operation of internet platforms than it is a critical input for their creation.

Further, data is unlikely to constitute a barrier to entry, and even less likely to amount to an essential facility. As George Stigler famously argued, a barrier to entry is “[a] cost of producing that must be borne by a firm which seeks to enter an industry but is not borne by firms already in the industry.” There is no reason that the cost of obtaining data for a new entrant should be any higher than it was for an incumbent. In fact, the opposite will often turn out to be true.

Other ills that allegedly plague data-rich markets (and the merits of proposed solutions) are equally dubious. This is notably the case for the relationship between mandated data portability and competition. Contrary to what some scholars have advanced, it is far from clear that mandated data portability will increase consumer welfare in data-reliant markets. Not only is this type of portability unlikely to significantly affect switching costs for consumers but, even if it did, this would have ambiguous consumer welfare consequences (as is generally the case for consumer lock-in and regulatory interventions to overcome it). To make matters worse, mandated data portability is not without its risks. Most notably, data portability poses data security and user privacy risks.

Likewise, fears of costly price discrimination and widespread algorithmic collusion are greatly overblown. While it is true that big data may have a transformative effect on firms’ ability to price discriminate, there is no strong reason to believe that this would have a detrimental effect on consumer welfare. Instead, as with all forms of price discrimination, it may potentially expand output and allow less well-off consumers to participate in markets they might otherwise be priced out of. Similarly, the idea that big data and algorithms will lead to collusion is deeply flawed. Fears of collusion rest on the faulty premise that online marketplaces and the use of big data will dramatically increase transparency, thus facilitating collusion. In fact, the opposite is just as likely (and, in any case, the manifest benefits of increased transparency, likely outweigh the speculative costs).

In short, the advent of data-enabled markets does not have implications that support the calls for a significant expansion of antitrust tools and antitrust enforcement being made. Data is not irrelevant, of course, but it is just one amongst a plethora of factors that enforcement authorities and courts should consider when they analyze firms’ behavior.

Click here to read the full comments.

Summary

Although the FTC is well-staffed with highly skilled economists, its approach to data security is disappointingly light on economic analysis. The unfortunate result of this lacuna is an approach to these complex issues lacking in analytical rigor and the humility borne of analysis grounded in sound economics. In particular, the Commission’s “reasonableness” approach to assessing whether data security practices are unfair under Section 5 of the FTC Act lacks all but the most superficial trappings of the well-established law and economics of torts, from which the concept is borrowed.

In actuality, however, the Commission’s manufactured “reasonableness” standard — which, as its name suggests, purports to evaluate data security practices under a negligence-like framework — actually amounts in effect to a rule of strict liability for any company that collects personally identifiable data. This is manifestly not what Section 5 intends.

In its recent LabMD opinion, the Commission describes its approach as “cost-benefit analysis.” But simply listing out (some) costs and benefits is not the same thing as analyzing them. Recognizing that tradeoffs exist is a good start, but it is not a sufficient end, and “reasonableness” — if it is to be anything other than the mercurial preferences of three FTC commissioners — must contain analytical content.

Persistent and unyielding uncertainty over the contours of the FTC’s data security standard means that companies may be required to accept the reality that, no matter what they do short of the extremes, liability is possible. Worse, there is no way reliably to judge whether conduct (short of obvious fringe cases) is even likely to increase liability risk.

The FTC’s recent LabMD case highlights the scope of the problem and the lack of economic analytical rigor endemic to the FTC’s purported data security standard. To be sure, other factors also contribute to the lack of certainty and sufficient rigor, (i.e., matters of process at the agency), but at root sits a “standardless” standard, masquerading as an economic framework.

This paper explores these defects, paying particular attention to the FTC’s decision in LabMD and subsequent district court proceedings in the case.