Digital Markets, Competition and Consumers Bill: UK tech sector competition rules

The highly anticipated Digital Markets, Competition and Consumers (DMCC) Bill, which was introduced into the UK parliament on 25 April 2023, covers three main subject areas: competition in digital markets – introducing new ‘ex ante’ competition rules aimed at large technology firms; changes to wider competition rules – which apply across all industry sectors; and consumer protection – enhancing enforcement powers and consumer rights.

In this article, we explain the new competition rules for the digital sector.

Background and summary

The introduction of the DMCC Bill into parliament marked the culmination of digital markets-focused work undertaken by the UK government and the Competition and Markets Authority (CMA) dating back to 2019, as well as long-running work on reforming the UK’s existing competition and consumer protection laws.

The new digital markets regime introduced by the DMCC Bill will be enforced by the CMA through its Digital Markets Unit (DMU). The DMU has been operating in ‘shadow’ form within the CMA, since its establishment in April 2021. Notably, the DMCC Bill refers only to the CMA, not the DMU. The DMU will remain an administrative unit within CMA and will not be a separate enforcement body in its own right.

The DMCC Bill builds on proposals announced previously by the UK government and clarifies certain aspects of the prior plans. For example, key concepts such as “digital activity”, “substantial and entrenched market power” and “strategic significance” are defined in the Bill. The draft legislation also sets out minimum turnover thresholds over which businesses may be designated as being subject to the new regime if they have a link to the UK.

To help foster a holistic multi-agency approach to digital regulation in the UK, the DMCC Bill also obliges the CMA to consult with certain regulators, such as the FCA, Ofcom, the ICO, Bank of England, and the PRA, when exercising its digital markets functions.

The digital markets regime: key features

The new rules will bind only those firms designated as having “strategic market status” (SMS) in respect of a digital activity. Each SMS firm will have to comply with its own specific set of conduct requirements. These will be developed and enforced by the CMA. 

Importantly, the new rules will not replace or disapply existing competition law and consumer protection rules – these will continue to apply to SMS firms alongside the digital markets regime.  Digital firms which are not designated will continue to be subject to existing competition and consumer protection laws, including rules prohibiting abuse of dominance.

In addition to imposing and enforcing conduct requirements tailored to each SMS firm, the CMA will also be able to investigate, of its own volition, potential competition issues in digital markets, even when there is no suspected breach of conduct requirements. Such investigation may lead to the CMA imposing pro-competition interventions (PCIs) on SMS firms.

Mandatory reporting obligations will apply to SMS firms in respect of proposed merger and acquisition (M&A) transactions that trigger specific thresholds around share of equity or voting rights and value of consideration.

Breaches of the new rules will be punishable by fines up to 10% of the company’s global annual turnover. The CMA will also be able to use other powers, such as making enforcement orders, interim orders or accepting commitments, or taking court action. There will also be scope for private enforcement, via court action, against SMS firms.

The new rules largely align with substantive objectives of the EU Digital Markets Act (DMA), but there are some important differences between the UK and EU regimes.

Obligations apply only to ‘designated’ digital firms

The new digital markets rules will only apply to firms that are designated as having SMS. The CMA may designate an undertaking, i.e. a digital firm, where five cumulative statutory criteria are met: where the undertaking: carries on a digital activity; which is linked to the UK; has substantial and entrenched market power and a position of strategic significance; and has annual group turnover exceeding £25 billion worldwide or £1 billion in the UK.

“Digital activity” is defined broadly and includes the provision of a service by means of the internet; one or more pieces of digital content; or any other activity for the purposes of providing a service over the internet or digital content.

The digital activity will be considered “linked to” the UK where either the digital activity has a significant number of UK users; the firm carries on business in the UK in relation to the digital activity; or the digital activity (or the way it is carried out) is likely to have an immediate, substantial, and foreseeable effect on trade in the UK. There is currently no further explanation of what an “immediate, substantial and foreseeable effect on trade” means in this context.

To decide whether an undertaking has “substantial and entrenched market power”, the CMA must carry out a forward-looking assessment, covering a period of at least five years, taking into account developments that would be expected or foreseeable if the firm in question were not designated as having SMS, and may affect the firm’s conduct in carrying out the digital activity. In other words, the CMA is required to conduct a counterfactual assessment as part of this designation criterion.

A “position of strategic significance” is held if one or more conditions prescribed in the DMCC Bill are met. These conditions are: the firm has achieved a position of significant size or scale in respect of the digital activity; the digital activity carried on by the undertaking is used by a significant number of other companies to run their business; the firm’s position in respect of the digital activity would allow it to extend its market power to other activities; or the firm’s position in respect of the digital activity allows it to determine or substantially influence the ways in which other companies conduct themselves, in respect of the digital activity or otherwise.

Finally, the “turnover condition” is satisfied if the CMA estimates that the total annual value of firm’s turnover exceeds £25 billion globally, or £1 billion in the UK. If the firm in question is part of a group, then the group’s turnover will be considered.

The five designation criteria are intended to capture only the largest digital firms which, in the CMA’s view, may have the potential to influence competition most significantly in the UK digital sector. The “substantial and entrenched market power” and “position of strategic significance” conditions are based on legal principles and decisional practice distilled from abuse of dominance cases under UK and EU competition law.

The “turnover condition” is the only bright-line threshold for SMS designation, however, and the other criteria give the CMA considerable flexibility in deciding whether a firm should be designated. More detail on how the CMA intends to interpret and apply the designation criteria is expected to be provided in future guidance.

Once the CMA begins the SMS designation process it will have nine months – extendable by up to three months, in certain circumstances – to make its designation decision. If it fails to designate a firm within this time, that firm will be deemed as not having been designated. The designation procedure involves public consultation, which can occur in parallel with a separate consultation on the conduct requirements that will apply to the designated firm – see below. The SMS designation will remain in force for five years unless it is revoked earlier. It may also be varied and should be kept under review by the CMA.

Conduct requirements

The CMA will have powers to formulate behavioural rules, known as conduct requirements, stipulating how the designated firm must act in relation to a relevant digital activity. Importantly - and in contrast to the DMA - the conduct requirements will be individually tailored to each SMS firm. Conduct requirements imposed under the DMCC Bill must comply with two key requirements: they must align with at least one of three objectives; and must be of a “permitted type”.

Objectives

The three objectives are:

• fair dealing: to help ensure users, or potential users, of the relevant digital activity are treated fairly and are able to interact, directly or indirectly, with the SMS firm on reasonable terms;
• ·open choices: to help ensure users, or potential users, of the relevant digital activity are able to choose freely and easily between the services or digital content provided by the SMS firm and services or digital content provided by other firms;
• trust and transparency: to help ensure users, or potential users, of the relevant digital activity have the information they require to enable them to understand the services/digital content provided by the SMS firm, including the terms on which they are provided, and make properly informed decisions about whether and how they interact with the SMS firm.

Permitted types of conduct requirements

These are listed in the DMCC Bill and may either oblige the SMS firm to act in a certain way or prevent the SMS firm from taking certain actions. They are largely inspired by prior abuse of dominance cases involving UK and EU competition law.

Examples of obligations to act in a certain way include duties to: trade on fair and reasonable terms, implement effective complaint- or dispute-handling processes, or provide clear, relevant, accurate and accessible information to users. Examples of obligations to refrain from taking certain actions include duties not to: apply discriminatory terms on certain or potential users, engage in self-preferencing, make access to other products conditional on use of the relevant designated activity, or restrict interoperability with other firm’s products.

Some permitted types of conduct requirements are particularly broad – such as preventing the SMS firm from “using data unfairly”. This may give the CMA broad discretion in how specific conduct requirements are formulated, interpreted, and applied; and could reduce legal certainty for designated firms.

Procedure and enforcement

The CMA must publicly consult before the conduct requirements are made final. Once finalised, the CMA will have an ongoing duty to keep conduct requirements under review – including whether the conduct requirements may need amendment, to what extent the SMS firm is complying, effectiveness of each conduct requirement, and whether the CMA should take enforcement action to pursue suspected breaches. 

A conduct investigation may be opened where the CMA has reasonable grounds to suspect breach of a conduct requirement. It will have six months to complete the investigation and then take action, such as making enforcement orders, interim enforcement orders, or accepting commitments. The CMA will also be able to resolve payment-related breaches of conduct requirements to deal on fair and reasonable terms through a “final offer mechanism”. The CMA has a duty to keep under review any enforcement orders, commitments, or final offer orders it makes.

Importantly, the CMA must close a conduct investigation if the designated firm successfully relies on the “countervailing benefits” exemption – demonstrating that its conduct brings about consumer benefits which outweigh any harm to competition resulting from a breach of the conduct requirement. This exemption reflects the weighing up of harm to competition versus consumer benefits under UK and EU competition laws.

Pro-competition interventions

The CMA will have broad powers to make pro-competition interventions (PCIs) in relation to a designated firm where, following a PCI investigation, an “adverse effect on competition” can be demonstrated and imposing the PCI would likely contribute to remedying, mitigating or preventing that adverse effect. PCIs can be implemented anywhere within a SMS firm, so long as the intervention relates to a concern in a designated digital activity.

The CMA must issue its final decision and findings within nine months of opening a PCI investigation – this period is extendable by three months. The resulting PCI measure must then be made by the CMA within four months after the CMA’s PCI decision is issued – this period is extendable by two months. In effect the CMA will have up to 18 months in total, including available extensions, to conduct a PCI investigation, issue its decision, and impose a PCI.

The PCI may take the form of a “pro-competition order” and/or a recommendation to another public body about steps it could take in respect of the designated firm. Under a pro-competition order, the CMA can impose a range of behavioural and structural remedies that mirror those the CMA can already impose following a market investigation under the Enterprise Act 2002, including the ability to implement ownership separation on SMS firms. Pro-competition orders may be trialled to help ensure they will effectively address any competition concerns identified by the CMA.

The CMA must publicly consult before making a PCI decision or imposing a pro-competition order, or varying or revoking such an order. The CMA will also be able to accept binding undertakings from SMS firms as an alternative to making pro-competition orders.

Mandatory merger reporting

SMS firms will be required to notify the CMA before closing an M&A transaction where:

• the SMS firm or a member of the SMS firm’s group acquires an equity or voting share, in a "UK-connected body corporate”, that increases from less than 15% to 15% or more, from 25% or less to more than 25%, or from 50% or less to more than 50%. This is known as “qualifying status”; and
• the value of consideration provided by the SMS firm or a member of the SMS firm’s group for the equity or voting share is at least £25 million.

Where the SMS firm or member of its group is forming a UK-based joint venture vehicle, the qualifying status requirement is simply 15% or more voting or equity share; and the value of consideration in the joint venture must be £25m or more.

A “UK-connected body corporate” – whether a target company or a joint venture vehicle being formed – is one which carries on activities in the UK or supplies goods or services to persons in the UK, or is intended to do so in the case of a newly formed joint venture.

The CMA will have five working days to assess whether the mandatory merger report is sufficient. A transaction cannot complete during this five-day waiting period. If an SMS firm fails to notify a reportable merger, without a reasonable cause, the CMA can impose fines up to 10% of the firm’s worldwide turnover.

The mandatory reporting requirements are intended to give the CMA sufficient information and time to decide, before the reported merger takes place, whether to review the proposed M&A transaction under the wider UK merger control regime in the Enterprise Act.

Investigation and enforcement

The DMCC Bill gives the CMA wide-ranging investigatory and enforcement powers to help ensure designated firms comply with the new regime.

Information-gathering

Broad information-gathering powers mirror those used by the CMA in antitrust investigations under the Competition Act 1998, including powers to request information and documents, to interview individuals, and to conduct dawn raids.

Additionally, the CMA may require an SMS firm to name a senior manager who will be responsible for ensuring compliance with information-gathering requests; will have powers to access premises, equipment, services, information or persons, to supervise the provision of information requested, to observe the firm’s conduct in relation to users, or to observe testing or demonstration by the SMS firm; and will be able to request skilled person reports to inform the exercise of CMA’s digital markets functions. 

Compliance

SMS firms will have to appoint a nominated officer, who is a senior manager, to oversee the firm’s ongoing compliance with the regime including compliance with conduct requirements, pro-competition orders, other type of orders such as enforcement, interim enforcement, or final offer orders, or any commitments the firm has given the CMA. The CMA will be able to request compliance reports from SMS firms to assist in its monitoring of compliance with the regime.

Penalties

For breaches of any conduct requirements, any pro-competition, enforcement, or final offer orders, or any commitments in relation to conduct requirements or PCIs, the CMA will be able to impose financial penalties of up to 10% of SMS firm’s annual global turnover, along with an additional 5% of daily global turnover for each day the breach continues. The CMA will also be able to seek disqualification, through court action, of company directors implicated in the SMS firm’s breach of any conduct requirement or PCI.

Firms can also be fined up to 1% of annual global turnover for failing to comply with information requests, with additional 5% daily global turnover penalties available for continued non-compliance. Civil and criminal penalties will be available to sanction anyone knowingly or recklessly providing false information to the CMA. The CMA will also be able to impose fixed civil penalties of up to £30,000, or a £15,000 daily fine for continuing non-compliance, on named senior managers who fail to ensure the firm complies with information requests.

Criminal offences that arise from hindering the CMA’s investigation – namely destroying or falsifying information, providing false or misleading information, or obstructing a dawn raid – may be attributed to the body corporate as well as an officer who is complicit. The firm and implicated officers may each be subject to criminal sanctions, including possible imprisonment of the individuals involved.

Court enforcement and appeals

By obtaining court orders, the CMA can enforce any orders and commitments made or accepted under the digital markets regime where the SMS firm fails to fully comply. The SMS firm or its officer may be ordered to pay all of the CMA’s costs associated with such proceedings.

The new regime also creates scope for private enforcement. Where an SMS firm has breached a conduct requirement, pro-competition order, or a related commitment, an aggrieved party may bring court action for breach of a statutory duty against the SMS firm, and seek damages, an injunction, or any other appropriate remedy.

Appeals against CMA decisions made under the new regime will be subject to review before the Competition Appeal Tribunal (CAT) on judicial review principles. This means only narrow grounds of appeal based on CMA procedural irregularities, unreasonableness etc. will apply; the CAT will not conduct a full merits-based assessment of the CMA’s decision. Financial penalties under appeal will be suspended pending final resolution.

UK vs EU divergence

The digital firms most likely to be designated as having SMS under the DMCC Bill will also likely be designated “gatekeepers” under the EU’s DMA regime and have to comply with both sets of rules. This will create additional complexity where the two regimes diverge. Key areas of divergence between the UK and EU rules include:

• the UK concept of “digital activity” appears wider than the more prescriptive DMA definition of “core platform services”;
• designation as a “gatekeeper” under the DMA regime is presumed if the firm provides a core platform service and meets quantitative criteria based on annual turnover and user numbers within the EU. In the UK, only the “turnover condition” for SMS designation is clear-cut, and the CMA retains considerable discretion when assessing other designation conditions. There will be scope to challenge a designation decision under both regimes, although different procedures will apply;
• “gatekeepers” must comply with a uniform list of dos and don’ts specified in the DMA, while SMS firms in the UK will each have bespoke conduct rules to comply with. Tailored conduct requirements may potentially be less burdensome for SMS firms than the EU’s one-size-fits-all approach, although the bespoke UK rules could reduce legal certainty as the CMA may vary or revoke conduct requirements, subject to consultation, while designation is in place;
• UK rules provide for a countervailing benefits exemption that an SMS firm may use to defend alleged breaches of its conduct requirements, while the DMA has no equivalent;
• the PCI procedure will allow the CMA to develop, design, trial, impose, and amend, a wide range of remedies – behavioural and structural – to address underlying competition concerns it may identify in digital markets. The European Commission also has powers to conduct market investigations, which are similar to PCI investigations, however the Commission may impose structural remedies only after investigating a gatekeeper that had engaged in “systematic non-compliance” – namely where the gatekeeper breached DMA rules at last three times within an eight year period;
• the UK and EU regimes provide for identical maximum penalty levels for substantive breaches of the rules – up to 10% of worldwide annual turnover and up to 5% of daily worldwide turnover for continuing breaches – although the DMA additionally allows maximum penalty levels to be doubled to 20% of annual worldwide turnover in cases of recidivism. The UK rules additionally provide for individuals to be fined and disqualified from acting as company directors, as well as for criminal offences where the CMA’s investigation has been hindered;
• CMA actions under the UK rules will be appealable only under the more limited judicial review standard; while Commission actions under the DMA will be fully reviewable on their merits by EU courts;
• the mandatory merger reporting obligation is more limited under the UK rules. SMS firms have to report anticipated M&A transactions to the CMA only where specific share of equity or voting rights and value of consideration thresholds are met. However, under the DMA, gatekeepers must inform the Commission of all proposed transactions involving a core platform service or a service in the digital sector or one which enables data collection. The Commission will liaise with EU member state competition authorities which may decide to make a reference under Article 22 of the EU Merger Regulation asking the Commission to call-in and review the proposed M&A deal; and
• we understand the DMU – which will drive CMA’s enforcement of the new UK rules – is expected to have a significantly larger number of dedicated staff than the Commission when it will initially handle DMA enforcement.

Next steps

The DMCC Bill is expected to be passed by the UK parliament in the next 12 months, and to come into force later in 2024. However, given the SMS designation process takes nine months, with a possible three-month extension, and that the CMA will also have to develop and consult on bespoke conduct requirements for each designated firm, the new digital markets rules are unlikely to become fully applicable until 2025.

The CMA is also expected to develop and publicly consult on supporting guidelines once the DMCC Bill is passed and before the new legislation begins to apply. Such guidelines will likely be particularly important for businesses and their legal advisers in navigating the new digital markets regime, especially as important provisions of the DMCC Bill are worded in broad terms that will give the CMA considerable discretion when carrying out its functions.

Co-written by Tadeusz Gielas of Pinsent Masons.