Weather warning – Ofcom and the CMA see turbulence ahead in the cloud computing market
On 5 October 2023, Ofcom published its final report on its market study on cloud computing, and made a referral to the Competition and Markets Authority – which launched a market investigation on the same day. The forecast now shows chances of regulatory enforcement, with the prospect of private actions gathering on the horizon.
Background
In the modern hybrid working world, most companies and consumers are likely to have at least some experience of using cloud computing, which underpins streaming video, social networking, search tools, and online business functions such as document collaboration and analytics. Cloud services are also important to developing technologies, such as AI.
In traditional IT hosting services, entities own their own data centres and on-site hardware infrastructure containing user’s data. Cloud computing services use remote infrastructure – data centres in other locations – to host user’s programmes and data, which are then accessed via a network.
Cloud services are typically classified according to their service models:
- Infrastructure as a service (IaaS). Customers buy access to the server hardware and networking equipment, and use them to process workloads and store data.
- Platform as a service (PaaS). Customers buy access to a virtual environment in which they can build and run applications.
- Software as a service (SaaS). Customers buy complete applications which are integrated into the cloud – consumers are likely to be most familiar with applications such as WhatsApp, BBC iPlayer and Google Workspace.
Market participants often supply services across multiple models: for example, a service provider might own physical infrastructure, design platforms on the infrastructure, and design applications which use that infrastructure.
As part of Ofcom’s programme of work on digital markets, it announced a market study into cloud computing services in October 2022. Ofcom estimates that the market has grown – and is expected to grow – very rapidly (at around 30-45% per year since 2019), and generated revenues of up to £7.5bn in 2022. However, market power is concentrated in a very small number of entities having a very large combined market share: Microsoft and AWS (Amazon Web Services) together controlled between 70-80% of the market, with their closest competitor, Google, controlling 5-10%.
However, Ofcom found that a material number of customers faced barriers to switching providers, meaning that they could become ‘locked-in’ to a certain cloud service. Ofcom also found that customers often benefit from being able to adopt a ‘multi-cloud’ approach, in which they can use multiple suppliers alongside each other, giving them the best choice of software and hardware for their specific uses, but that market practices may prevent this. For example, Ofcom stated that it had found “evidence of differences in the way AWS and Microsoft make the functionality of their cloud infrastructure services available when combined with their own services compared to those of competitors. Sometimes functionality is made available to competitor services only after a delay, or in some cases not at all.”
The CMA Investigation
Alongside the publication of its final report, Ofcom made a referral to the Competition and Markets Authority (CMA), which has begun a market investigation into the area. The CMA has stated that it intends to focus its investigation on:
- Technical barriers – the way cloud services work together is technically complex, and customers seeking to use multiple cloud services or move between providers may need to reconfigure data and applications to do so;
- Egress fees, charged to customers by cloud providers to move their data out of the cloud;
- Spend discounts, offered to customers which commit to spend a certain amount with data providers, which the CMA states could prevent customers from using multiple cloud services or switching providers; and
- Software licensing practices, which may make it easier or cheaper for customers to use software from a cloud service provider on that provider’s cloud infrastructure.
The CMA published the responses it had received to its issues statement on 1 December 2023. Both Google and AWS submitted that Microsoft’s licensing practices – which were noted by Ofcom in its report and by the CMA in its issues statement – were anticompetitive. Microsoft, in its response, argued that it had already made changes to address concerns about its licensing practices.
The CMA’s market investigation is due to conclude on 5 April 2024. Given the stakes involved for the market participants, its findings may have significant consequences.
Comment
If the CMA concludes that there are adverse effects on competition in cloud computing, it will be able to prescribe remedies, including ordering companies to restrain the above-mentioned conduct, and, if the adverse effects are deemed sufficiently serious, ordering structural remedies such as divestments of businesses or assets. In markets such as cloud services, in which companies operate across multiple service models with apparently distinct products – and may derive uncompetitive benefits from doing so – that may not be too remote a possibility.
Perhaps regardless of the CMA’s final decision, private entities – finding that they are overpaying for services – may consider bringing litigation before the Competition Appeal Tribunal. The small number of entities holding a significant market share, and the widespread use of the products and services which are offered, may make such claims ripe either for individual or for group action.
It is notable that the CMA’s investigation comes amidst a wave of significant legal developments in the digital sector. The EU’s Digital Markets Act, which entered into force on 1 November 2022, regulates the ‘gatekeeper’ power of the largest companies in the digital sector, including Alphabet (Google’s parent company), Amazon, Apple, ByteDance, Meta and Microsoft. In the UK, the Digital Markets, Consumer and Competition Bill (DMCC), will give the CMA significant new powers to regulate “strategically significant” firms in the digital sector.
The DMCC is not expected to come into force until Spring 2024 – which coincides with the conclusion of the CMA’s market investigation. The CMA’s new powers have procedural steps which may delay their imposition: the proposed Codes of Conduct will require consultation, and the proposed pro-competition orders will only be implemented following a specific investigation. However, one might expect the CMA to be keen to use these new tools, and perhaps to have a particular focus on cloud computing at that time.