PhD thesis defence by Natalia Moreno Belloso
Digital platforms have increasingly invoked cybersecurity and privacy as defences in the enforcement of EU competition law. As scrutiny under both Article 102 TFEU and the new Digital Markets Act (‘DMA’) has intensified, platforms have increasingly framed contested practices as necessary to safeguard the security and privacy of their devices and services and, ultimately, their users.
This thesis examines the extent to which EU competition law can accommodate cybersecurity and privacy considerations to justify business conduct that would otherwise violate the prohibition of abuse of dominance of Article 102 TFEU or the per se rules of the DMA.
To that end, the thesis analyses three possible justificatory avenues. First, it turns to the framework of objective justifications under Article 102 TFEU, encompassing the objective necessity defence, the efficiency defence, and the legitimate commercial interests defence. Second, it explores whether the Wouters doctrine of Article 101 TFEU, which operates as a regulatory exception tolerating competition restrictions necessary to pursue public interest objectives, could extend to digital platforms in light of the European Court of Justice’s 2023 sports trilogy. Third, it examines the DMA’s exceptions and to what extent they admit cybersecurity or privacy considerations.
The thesis shows that, under Article 102 TFEU, cybersecurity and privacy justifications remain, at best, theoretically admissible. In practice, such justifications face formidable obstacles, including an entrenched judicial scepticism toward dominant undertakings acting in the public interest as well as a structural evidentiary disadvantage. By contrast, the DMA explicitly carves out a legal space for such justifications. Both the text of the DMA and the European Commission’s early enforcement practice signal that platforms’ cybersecurity and privacy claims are likely to receive more serious consideration under the DMA than Article 102 TFEU. This relative flexibility, however, is inseparable from the DMA’s unprecedented scrutiny over how major digital platforms govern their ecosystems.
The Zoom link with be shared upon registration.