One size fits one? The challenge of “tailored” regulation in digital markets in the UK

It is perhaps not entirely surprising, given intervening events, that it took the UK government close to four years from the publication in July 2019 of the Competition and Markets Authority’s (“CMA”) first Digital Markets Strategy paper[1] to finally publish the Digital Markets, Competition and Consumers Bill (the “DMCC”).[2]

There are three main parts to the DMCC: first, new powers specific to the regulation of firms with Strategic Market Status in digital markets (“SMS Firms”); second, some more broadly applicable changes to the UK’s competition rules; and third, new consumer protection and enforcement powers. This article focuses on the new powers to regulate SMS Firms. 

Background

The CMA has had concerns about the unique challenges of consumer protection and competition law enforcement in digital markets for some time. It launched its first digital markets-specific market study[3] into online platforms and digital advertising markets in July 2019; with the aims (inter alia) of building knowledge in digital business models and considering potential future remedies.[4] In March 2020, the CMA was asked to lead a Digital Markets Taskforce (“DMT") to provide advice to the UK government about the regulation of digital markets, which subsequently published its recommendations to the UK government to address issues such as the “lack of effective competition” in digital markets and the “accumulation and strengthening of markets power by a small number of digitals firms”.[5] By February 2021, in acknowledgment of the significant changes to digital markets, at least in part brought about by the global Covid-19 pandemic, the CMA set out a refreshed strategy for regulating digital markets and technologies.[6] The DMCC itself was not published until April 2023 and is not expected to come into force until Spring 2024 at the earliest.  

The DMCC aims to "establish a tailored, evidenced-based and proportionate approach to regulating the largest and most powerful digital firms to ensure effective competition that benefits everyone."[7] The obvious challenge is how to future-proof legislation intended to regulate markets which are constantly evolving at such a significant pace.

What are the CMA’s new digital markets powers?

The DMCC creates new powers for the CMA to identify and regulate SMS Firms in digital markets. This is a notable change from the way in which the CMA’s competition powers have previously operated under Chapter 1 and Chapter 2 of the Competition Act 1998 (as amended). The digital markets provisions of the DMCC are designed to regulate the conduct of a small number of very powerful firms rather than having the broader application of the current competition rules, which continue to apply in parallel.

The recently established Digital Markets Unit (“DMU”) (housed within the CMA) oversees enforcement. A company will be an SMS Firm if it has: (i) “substantial and entrenched” market power (in respect of which the DMU is required to carry out a forward-looking assessment of “at least 5 years”), (ii) a position of “strategic significance” in relation to the digital activity it carries out, (iii) a global turnover of more than £25 billion or a UK turnover of more than £1 billion, and (iv) carries on a digital activity linked to the UK (i.e., a significant number of UK users, carries on business in the UK or the digital activity is likely to have an immediate, substantial and foreseeable effect on trade in the UK).

The DMU has indicated that it does not anticipate that a large number of firms will be designated SMS Firms, given the aim is to target firms and activities where the harm is, and is likely to be, greatest. Once a firm is so designated, that designation will last for a period of five years.

It is difficult to avoid comparisons between the DMCC’s digital markets-specific provisions and the European Union’s (“EU”) Digital Markets Act (“DMA”); which, alongside the Digital Services Act (“DSA”), formally entered into force on 1 November 2022 and largely became applicable from 2 May 2023. So far, six companies have been designated as “gatekeepers”[8] and the rules apply to those companies in so far as they deliver “core platform services”[9] and meet either the quantitative thresholds in Article 3(2) DMA or are caught by a qualitative assessment under Article 3(6) DMA. However, it is too early to properly evaluate the impact of the EU’s new rules, particularly as the gatekeepers have until 6 March 2024 to comply with the DMA’s provisions.

Once a company has been designated an SMS Firm in the UK, the DMU will have the power to impose conduct requirements on that company in relation to digital activities. The conduct requirements must be aligned with one or more of three objectives set out in the DMCC[10]: (i) fair dealing[11]; (ii) open choices[12]; and (iii) trust and transparency for users of the relevant digital activity.[13] The conduct requirements must also be of a “permitted type”[14]; which contains positive and negative requirements. The positive requirements include that the SMS Firms must trade on fair and reasonable terms, provide clear and accurate information to users, and present options or default settings in a way that allows users to make informed and effective decisions in their best interests. The negative requirements prevent SMS Firms from applying discriminatory terms to certain users or categories of users, treating their own products more favourably than other companies’ products, or restricting interoperability between a service offered and digital content/products offered by other companies.

Unsurprisingly, the conduct requirements appear to have been inspired by the types of conduct in digital markets which have been the subject of regulatory investigations and infringement decisions in the competition context (both at the UK and EU level). For example, the conduct requirement in s20(3)(b) DMCC prohibiting a SMS Firm from using its position in relation to the relevant digital activity to treat its own products more favourably than those of other undertakings, has some striking similarities with the conduct being investigated by the CMA in its ongoing Apple App Store investigation[15] and Amazon’s use of third-party seller data, in respect of which the CMA very recently accepted commitments.[16] Ensuring language is sufficiently broad to capture novel forms of problematic conduct is a perennial legislative challenge. However, this should be mitigated (at least to some extent) by the ability to amend the “permitted types” of conduct requirement in this section of the DMCC to add other positive or negative requirements.

The CMA has wide ranging powers, and considerable autonomy regarding how it exercises those powers. It has the power to: investigate breaches of the conduct requirements (a so-called “conduct investigation”[17]); adopt enforcement orders – imposing such obligations on the SMS Firm “as it (the CMA) considers appropriate” to stop the breach, prevent it from happening again and address any damage caused by the breach[18]; and accept commitments by SMS Firms to make changes to their conduct. The DMCC expressly envisages exemptions to certain conduct under investigation where there are “countervailing benefits”[19]to users or potential users of the digital activity in question. There are three conditions for such an exemption, which broadly mirror those required under section 9 of the Competition Act 1998 (or, from an EU perspective, Article 101(3)): (i) the benefits must outweigh any actual or likely detrimental impact on competition; (ii) the conduct must be indispensable and proportionate to the realisation of those benefits and (iii) the conduct must not eliminate or prevent effective competition.

The fines that the CMA can levy for breaches of the conduct requirements are large – up to 10% of the total turnover of the undertaking or its corporate group; or 5% of such turnover per day. The potential for appeals to be brought is limited to a judicial review by the UK Competition Appeal Tribunal, which are generally narrow in scope. In addition, where these conduct requirements are breached, consumers will have the ability to bring private damages claims against the relevant company – including, potentially, by way of opt-out collective proceedings – which may further increase the company’s liability and thus contribute to an overall deterrent effect. The incentives to remain compliant are clear.

What will the conduct requirements include? 

One of the benefits of the approach under the DMCC is that the conduct requirements will be tailored to the SMS Firm to which they apply, meaning they should be very specific and, hopefully, as a result, be effective. The CMA is also under a duty to keep the conduct requirements imposed under ongoing review, which should mean that requirements are varied promptly if they are not proving effective. However, the requirement in the DMCC for the CMA to carry out a public consultation on the conduct requirement before it is imposed leaves open the potential for very significant delay while the consultation is underway and representations received in response to the consultation are considered.

Pro-Competition Interventions 

In addition to the above conduct requirement powers, the CMA will also have powers to carry out what is called a “pro-competition intervention” (or “PCI”) to address the factors causing a firm to have entrenched market power. These provisions appear to extend beyond the CMA’s existing powers in the competition sphere to conduct market studies and market investigations. Unlike the conduct requirements, they are not limited to specific remedies and can include a broad range of behavioural and, even, structural remedies.

The CMA can make a PCI where, following an initial PCI investigation, it considers that: (i) there are factors relating to a relevant digital activity that are having an adverse effect on competition; and (ii) making the PCI might remedy, mitigate or prevent that adverse effect on competition.[20] The CMA will have nine months to complete its PCI investigation.[21] If the CMA issues a PCI investigation notice (describing the PCI the CMA intends to make and giving reasons), the CMA will then have four months to make the PCI. At that point, the PCI could be a recommendation to a public body or a “pro-competition order”, which may include any provision which the CMA can already make under Schedule 8 of the Enterprise Act 2002 and, again, comes with a duty to conduct a public consultation on its terms.[22]

Unlike the conduct requirements, PCIs are designed to tackle the broader underlying causes of market failure. How these will be used in practice remains to be seen, but it may reasonably be anticipated that they will form part of a two-sided regulatory framework in which, on the one hand, conduct requirements provide firm-specific rules which must be complied with or significant financial penalties will be imposed; and on the other, PCIs – which give the CMA the power to intervene at a market-level – are used to address structural issues where conduct requirements are likely to be ineffective.

Why does the CMA need new powers? 

Sarah Cardell, the (then-Interim) Chief Executive of the CMA, identified three issues with existing competition laws in a November 2022 speech.[23] She noted that the unprecedented scale and scope of firms like Google, Amazon, Microsoft, Meta and Apple gives them a strategic position creating a situation of dependency – and potential exploitation – for the people and businesses who rely on them, as well as the risk that they can act to deter innovative competitors. From the CMA’s perspective, the problem with existing competition laws is that they are primarily backwards-looking; they lack the specificity needed to address particular and emerging concerns in digital markets, and they tend towards one-off remedies and long-running adversarial processes. The DMCC aims to address these shortcomings.  

In the meantime, the CMA has continued to use its existing powers to investigate potential market failures in the digital sphere, including launching a market investigation in relation to cloud services[24] and continuing its Adtech investigation into Google.[25] This may raise question around the necessity of the new powers included in the DMCC. For example, while the DMCC will allow the CMA to conduct forward-looking investigations, the CMA’s existing powers under the Competition Act 1998 allow it to examine the effect of a dominant undertaking’s conduct on existing and potential competition – which permits consideration of future effects on the market. Similarly, existing competition legislation is clearly capable of extending to the novel forms of abuse seen in digital markets. While the limitation of challenging penalties and other decisions by way of judicial review may decrease protracted legal battles (at least in so far as the regulator is concerned), much will depend on the CMA’s resources and appetite to conduct investigations and consultations, and issue decisions.

The other form of action which has proven highly effective in securing change where there are competition issues in digital markets is that of private enforcement. The absence of final infringement decisions from the CMA has not prevented a significant number of standalone abuse of dominance claims being pursued in the UK’s Competition Appeal Tribunal on both on a collective and individual basis. While private entities and individuals will be able to enforce the provisions of the DMCC, the CMA must first specify the conduct requirements which an SMS Firm must comply with before any private enforcement action can take place.

In conclusion, the DMCC may provide the CMA with a helpful toolkit in what is a rapidly changing landscape in which consumers and competitors face, now and in the future, real harms. It offers the CMA significant powers and the ability to take targeted and flexible action. Given the challenges the CMA faces in this area as explored in this article, it will need to act decisively in order to use these tools effectively. Indeed, one size may not necessary fit all.

*Lesley Hannah is Partner and Alex Cooper is an Associate in London 

Footnotes

[1] CMA, The CMA’s Digital Markets Strategy (July 2019), https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/814709/cma_digital_strategy_2019.pdf
[2] Digital Markets, Competition and Consumers Bill (2023). Parliament: House of Commons. Bill no. 294, https://publications.parliament.uk/pa/bills/cbill/58-03/0294/220294.pdf 
[3] In the UK, the CMA has the power under the Enterprise Act 2002 to investigate UK markets to review how competition is working (or not).
[4] CMA, Market Study Notice: Online Platforms and digital advertising (3 July 2019), https://assets.publishing.service.gov.uk/media/5d1b28b2ed915d0bc413ba80/Market_Study_Notice.pdf
[5] CMA, A new pro-competition regime for digital markets: Advice of the Digital Markets Taskforce (December 2020), https://assets.publishing.service.gov.uk/media/5fce7567e90e07562f98286c/Digital_Taskforce_-_Advice.pdf
[6] CMA, The CMA’s Digital Markets Strategy: February 2021 refresh (February 2021), https://assets.publishing.service.gov.uk/media/60225628d3bf7f70bd76399d/Digital_Markets_Strategy.pdf
[7] CMA, Press Release: New bill to stamp out unfair practices and promote competition in digital markets (25 April 2023), https://www.gov.uk/government/news/new-bill-to-stamp-out-unfair-practices-and-promote-competition-in-digital-markets
[8] Amazon, Apple, Alphabet (Google), Bytedance (TikTok), Meta (Facebook) and Microsoft.
[9] As defined at Article 2(2) DMA
[10] Section 19(5) DMCC.
[11] Section 19(6) DMCC.
[12] Section 19(7) DMCC.
[13] Section 19(8) DMCC.
[14] Set out in section 20 DMCC.
[15] CMA, Investigation into Apple AppStore (4 March 2021, last updated 2 August 2023), https://www.gov.uk/cma-cases/investigation-into-apple-appstore  
[16] Commitments adopted on 3 November 2023. See CMA, Investigation into Amazon’s Marketplace (6 July 2022, last updated 3 November 2023), https://www.gov.uk/cma-cases/investigation-into-amazons-marketplace
[17] Section 26 DMCC.
[18] Section 31(1) DMCC.
[19] Section 29 DMCC.
[20] Section 44(1) DMCC.
[21] A PCI Investigation may be commenced where the CMA has “reasonable grounds to consider that a factor or combination of factors relating to a relevant digital activity may be having an adverse effect on competition”. Section 45(1) DMCC.
[22] Section 52 DMCC.
[23] CMA, Sarah Cardell, Speech: Ensuring digital market outcomes that benefit people, businesses and the wider UK economy (28 November 2022), https://www.gov.uk/government/speeches/sarah-cardell-ensuring-digital-market-outcomes-that-benefit-people-businesses-and-the-wider-uk-economy
[24] CMA, Press Release: CMA launches market investigation into cloud services (5 October 2023), https://www.gov.uk/government/news/cma-launches-market-investigation-into-cloud-services
[25] CMA, Investigation into suspected anti-competitive conduct by Google in ad tech (26 May 2022, last updated 10 March 2023), https://www.gov.uk/cma-cases/investigation-into-suspected-anti-competitive-conduct-by-google-in-ad-tech