II. Interoperability: definitions and related literature

Since the concepts of interoperability and portability have been widely used in different contexts and are not necessarily always well distinguished, it is worth providing a clarification of their respective features and implications.Footnote ³⁰

Interoperability can be broadly defined as the ability of two or more products or services to work together despite differences in interface, execution or coding language.Footnote ³¹ More specifically, full interoperability involves the interchangeability, compatibility and usability of services and products offered by different companies.Footnote ³² Indeed, as noted by Crémer, de Montjoye and Schweitzer, three sub-categories of interoperability can be identified in addition to the concept of data portability.Footnote ³³ First, protocol interoperability (or partial interoperability) refers to the ability of different products and services to work together in a complementary fashion. This form of interoperability allows smooth interaction between different and potentially complementary services or products provided by different manufactures. Second, full protocol interoperability ensures that two or more substitute services can interoperate through a more fundamental interconnection and alignment of features (such as messaging systems or mobile ecosystems). Partial and full protocol interoperability should be understood as existing on a continuum.Footnote ³⁴ While the former requires that only some or a subset of all features are shared with other players, the latter involves a deeper level of integration and standardisation between operators. Third, data interoperability refers to the ability to share and access data on a continuous, often reciprocal, real-time basis (usually through APIs). ^{Footnote 35}

Conversely, data portability is the ability to port from data holder A to data holder B a bulk of data created during the use of a service by an individual. As clarified by Schnurr, data portability differs from data interoperability because it comes with a one-off transfer at a specified point in time.Footnote ³⁶ In order to be effective and enable consumer switching, data portability requires that the information is available in a structured, commonly used and machine-readable format but does not require the systemic use of APIs.

An additional clarification regards the distinction between vertical and horizontal interoperability.Footnote ³⁷ While the former (ie interoperability within a platform/ecosystem) enables downstream integration across the value chain between complementary products as well as within a digital infrastructure provided upstream, the latter (ie interoperability between platforms/ecosystems) requires that similar services and products can smoothly interoperate between each other so as to share direct network effects. As such, horizontal interoperability can be conflated with full protocol interoperability, whereas vertical interoperability relies to a large extent on protocol interoperability.

The case for horizontal and/or vertical interoperability has become a much-debated issue regarding competition policy in digital markets. Indeed, whether horizontal interoperability represents the proper regulatory solution to ensure effective data sharing and promote technological innovation is controversial.

Notably, on the premises that interoperability increases network effects for all players, Crémer, Rey and Tirole argue that interoperability can level the playing field between small and large players, hence increasing contestability and competition.Footnote ³⁸ More recently, Crawford et al maintain that such obligations are necessary to avoid the economic risks arising from firm-specific network effects (eg lock-in dynamics and market tipping).Footnote ³⁹ However, Bourreau points out that interoperability and multi-homing may represent two substitute means to enhance competition and improve contestability in digital markets.Footnote ⁴⁰ More specifically, mandating horizontal interoperability can have ambivalent impacts on competition.Footnote ⁴¹ Bourreau and Krämer show that, as homogenisation restricts differentiation and innovation opportunities, mandating horizontal interoperability could reduce existing incentives for multi-homing and ultimately hinder competition.Footnote ⁴² By analysing the consolidation processes used by US securities clearinghouses and depositories, Awrey and Macey argue that horizontal interoperability requirements could help dominant firms to take advantage of a frictionless environment with low barriers to entry, ultimately entrenching their monopoly power. ^{Footnote 43}

Furthermore, if multi-homing is possible without significant costs, the potential welfare gains from horizontal interoperability obligations are limited in digital markets where innovation is occurring at a fast pace.Footnote ⁴⁴ Moreover, forcing market players who have already developed their own services to implement new horizontal interoperability obligations would be highly costly, complex and time-consuming, especially in terms of regulatory monitoring and enforcement.Footnote ⁴⁵ Finally, as interconnected networks should use the same encryption method, horizontal interoperability may affect security and privacy.

In light of these considerations, concerns have been raised by the European Commission itself for the DMA proposal to make number-independent interpersonal communication services and social network services offered by gatekeepers horizontally interoperable.Footnote ⁴⁶ Alongside several related technical issues, it is argued that this measure would be doomed to hinder innovation, incentives to invest and service differentiation, ultimately damaging consumer welfare.

III. The role of standards

A second layer of complexity involves the relationship between interoperability and standards.

Interoperability relies on standardisation in order to be effective. Different manufacturers and application developers can benefit from open access and interoperability requirements as long as technical protocols and APIs are designed in a homogeneous way, guaranteeing effective data access and smooth interconnection with the underpinning digital infrastructure. Standards serve exactly this purpose by providing a set of technical rules and characteristics that allow devices not only to connect and integrate, but also to ensure the quality and security of IoT interactions. Moreover, from the perspective of competition policy, well-designed standards prevent the risk of third-party providers being surreptitiously undermined in comparison to proprietary services through lower levels of interoperability.

When it comes to the design and implementation of standards, two main distinctions arise.

With regards to the implementation aspect, standards can be open or closed, depending on whether developers retain control over access to and implementation of the underlying technologies. While the former are open source and freely available to manufacturers and services providers willing to enter the market with interoperable products, proprietary standards often require a licence for the intellectual property owned by developers and may also come with proprietary enhancements for administering access to specific market niches.

Depending on how they are developed, standards can be industry-led or formal. The former are designed by market players which (independently or collectively) voluntarily agree to define common procedures and characteristics for products and services in a timely fashion. When these solutions are broadly adopted by the market participants, they are considered de facto standards as their implementation is substantially unavoidable for manufacturers. Conversely, formal standards are developed with a top-down approach by standard development organisations (SDOs) officially appointed by policymakers and regulators. ^{Footnote 47} They are usually developed via processes that are transparent and open to broad participation by the industry and by stakeholders under the coordination and rules set by the competent SDOs. While formal standardisation prioritises consensus and social welfare implications over efficiency, industry-led standards focus on agility, speed and the need for a positive reaction from the market participants in order to succeed.

The policy choice between voluntary and mandatory standardisation initiatives involves relevant trade-offs. Technical expertise and flexibility considerations support bottom-up spontaneous standardisation processes. Moreover, there is a risk that mandating specific solutions in markets at an early stage of development may undermine innovation and lower incentives to invest.Footnote ⁴⁸ On the other side, technology fragmentation or the lack of open standards available on the market, as well as the need to ensure prompt and effective data sharing, may justify top-down interventions and mandatory standards.Footnote ⁴⁹ Indeed, standardisation may be a complex and time-consuming process because of the difficulties in reaching an agreement when several players are involved with different and potentially conflicting incentives.

These trade-offs also emerge from the recent EU Commission’s IoT sector inquiry, in which the majority of participants expressed the need to prioritise standardisation over proprietary solutions in order to guarantee higher levels of interoperability.Footnote ⁵⁰ The Commission noted that the IoT standardisation environment is strongly heterogeneous, as smart devices and services rely on a mix of protocols, open standards, open sources and proprietary technologies, depending on the different technology layers implemented in smart devices.Footnote ⁵¹ While formal standards prevail only at the level of basic connectivity technologies (eg Bluetooth and Wi-Fi), de facto standards have emerged in the field of operating systems, wearable devices and user interfaces.Footnote ⁵² Technology fragmentation and de facto standards can exacerbate the costs and complexity of interoperability. As things stand, manufacturers risk having to make redundant investments in order to comply with heterogeneous APIs and certification processes, ultimately leading to the poor reusability of technical solutions and imposing major hurdles to product innovation.Footnote ⁵³ Furthermore, recent competition inquiries into payment and financial services outlined the risk that API standard fragmentation could translate into higher barriers to entry for new entrants.Footnote ⁵⁴

Therefore, the Commission, on the one hand, has praised open standardisation and encouraged dialogue and interaction between IoT players in order to develop industry-wide standards,Footnote ⁵⁵ but, on the other hand, has recognised that intense standardisation activities by a high number of competing SDOs and private partnerships/industry organisations in the IoT sector might also lead to a lack of transparency and ultimately undermine interoperability.Footnote ⁵⁶

In this scenario, European policymakers did not take a clear stance towards standardisation. Notably, while acknowledging the importance of interconnection for the flourishing of competition in IoT and data-enabled environments, there is no clear indication as to how standards should be developed and implemented in order to ensure workable interoperability across digital markets. Indeed, the DMA merely states that, “where appropriate and necessary”, the Commission may mandate European standardisation bodies to develop appropriate standards. ^{Footnote 57} With regards to number-independent interpersonal communications services, gatekeepers are obliged to provide the necessary technical interfaces or similar solutions that facilitate interoperability, upon request and free of charge.Footnote ⁵⁸ Similarly, the Data Act proposal rules out the possibility of mandating the adoption of technical standards or interfaces. However, it provides the Commission with the power to delegate the adoption of European harmonised standards for the interoperability of data-processing services.Footnote ⁵⁹ Furthermore, the Commission pledges to adopt common specifications by way of implementing acts in case harmonised standards are missing or existing standards are insufficient.Footnote ⁶⁰

On a related note, the UK Open Banking initiative stands out as one of the most advanced cases of mandated interoperability in the digital economy.Footnote ⁶¹ Open Banking is commonly seen as a secure environment that allows consumers to share bank transaction data with trusted third parties who can analyse such information to offer them new services or make payments on their behalf. Therefore, it has the potential to strengthen the consumer bargaining position in relation to financial service providers by facilitating choice and improving the quality of data-enabled products.Footnote ⁶²

The global attention gained by the Open Banking project convinced the UK Government to expand third-party data access and API standardisation to a broader range of financial services and products, thereby launching the Open Finance project.Footnote ⁶³ This initiative is part of the broader Smart Data strategy under which the UK Government is looking to expand data access tools in all regulated markets.Footnote ⁶⁴

Against this background, this paper aims to contribute to the literature on interoperability and standards by assessing whether the Open Banking standardisation approach may serve as a valuable blueprint for tackling some of the competitive issues underpinning IoT business environments.

IV. The Open Banking experience

Following a review of retail banking, in 2017 the UK Competition and Markets Authority (CMA) found that incumbent banks, which had consistently retained an 80% market share of the retail banking market over the years, were exploiting consumer inertia and barriers to entry in order to enjoy monopolistic rents, jeopardising data-enabled innovation.Footnote ⁶⁵ In order to tackle these competitive weaknesses, the CMA made full use of its market investigation powers to ease the functioning of the access-to-account rule enshrined in the PSD2.

This piece of legislation mandated banks to allow customers to share their account transaction data with trusted third parties but left them free to do so while adopting the method they preferred.Footnote ⁶⁶ As a result, access-seekers would have to face major transaction costs as they would either have to develop applications working with many different API standards or rely on technical service providers to interoperate with different banks. Moreover, the incumbents had a clear incentive not to cooperate in the implementation of the access-to-account rule and to keep their own infrastructure as closed as possible to potential rivals.Footnote ⁶⁷

To address these concerns, the CMA required the nine major banks in Great Britain and Northern Ireland to agree on common and open API standards, data formats and security protocols that would allow new entrants to calibrate their applications according to a single set of specifications.Footnote ⁶⁸ The CMA entrusted a special-purpose organisation (the Open Banking Implementation Entity) with the task of reaching an agreement between the banks, consumer representatives and fintech third-party providers on the appropriate standards for implementing financial data access. The CMA also appointed an Implementation Trustee, having the power to impose binding decisions on all nine major banks subject to the order in the case of no deal.Footnote ⁶⁹ As such, this remedy imposed full protocol interoperability with reference to the payment data infrastructure of banks and other account providers.

The common standard approach allowed the UK to gain a leading position in the worldwide adoption of financial data sharing.Footnote ⁷⁰ Significantly, the CMA order secured the adoption of Open Banking by preventing incumbents from delaying and frustrating the implementation of the access-to-account rule. Furthermore, account providers that were not subject to the remedy also decided to comply with PSD2 by adopting free API standards rather than developing their own. As of August 2021, there were 119 firms with live-to-market Open Banking-enabled products and services, while the Open Banking ecosystem accrued approximately 3 million users in Great Britain and Northern Ireland.Footnote ⁷¹

After taking stock of the UK experience, Australia introduced an even more ambitious economy-wide data-sharing framework (ie the Consumer Data Right; CDR), which gives consumers the right to share their data between any kinds of service providers of their choosing.Footnote ⁷² In 2019, this regime was initially implemented within the banking sector. The Australian Competition and Consumer Commission required the four major banks in Australia to share product reference data with accredited data recipients and mandated the adoption of a single set of API standards for data sharing. ^{Footnote 73} Furthermore, the Australian Government established the Data Standards Body to deliver open standards supporting the CDR. Within this entity, various working groups open to participation with any stakeholders are now designing and testing open standards.

Given the UK and Australian experiences, many other jurisdictions have developed a considerable interest in following suit. Conversely, the EU has refrained from publicly mandating API standardisation and has left banks free to come up with their own data-sharing interfaces or to take part in privately led standardisation initiatives.Footnote ⁷⁴ The underpinning rationale of this choice hinged on the concern that a common API standard could jeopardise innovation and dynamic competition between standards. However, when launching the Digital Finance Strategy and the Retail Payments Strategy in 2020, the European Commission recognised that the lack of API interoperability hindered newcomers, and so it committed to establish an Open Finance framework by the end of 2024 as well as to review the PSD2.Footnote ⁷⁵

V. Open Banking as a blueprint for IoT interoperability regulation?

Some elements suggest that the Open Banking approach could serve as best practice for implement workable interoperability in the IoT universe.

In particular, Open Banking resembles the IoT in terms of its competitive dynamics and interoperability features as it builds on smooth data-sharing mechanisms and connections between different service providers in the context of vertically integrated platforms. Indeed, similarly to the retail payment market, the IoT sector encompasses various service providers connected between each other, and the role of intermediaries (either banks or leading technology platforms) enabling machine and user interaction is of the utmost importance for the network to thrive.

Furthermore, information is a key input not only for competing in financial services, but also for designing and producing smart products that can meaningfully interoperate within leading digital ecosystems. Therefore, the type of information that leading technology platforms and financial institutions hold and the way they use it are pivotal for the potential flourishing of the IoT and financial technology. Given the gateway role that such incumbents may play in the viability of data-enabled products and services, a data bottleneck problem may affect both IoT environments and retail financial markets. In this respect, users’ data may sometimes constitute a significant barrier for newcomers wanting to enter either the retail financial or the IoT markets.

Moreover, both the retail financial and the IoT sectors feature fragile market dynamics that are greatly dependent on users’ trust. Therefore, the ability of infrastructure orchestrators to maintain high levels of cybersecurity, personal data protection and user engagement is particularly relevant.Footnote ⁷⁶ Ultimately, the financial and IoT universes are multi-sided markets where technical failures and unexpected changes can trigger crises of confidence, leading to death spirals for platform-based business models. Thus, both environments share a common need to avoid degradation of network quality due to poorly secured interoperability mechanisms.

The suggestion of looking at Open Banking as a useful case study for IoT interoperability and standardisation is supported by a recent market study conducted by the CMA, which explicitly referred to Open Banking as a model to ensure the successful rollout of electric vehicles (EVs) and related charging infrastructure.Footnote ⁷⁷ Indeed, since EVs are considered “physical products that obtain, generate or collect … data concerning their performance, use or environment and that are able to communicate that data via publicly available electronic communications services”, they are explicitly included in the scope of the Data Act. EV smart charging requires effective data sharing among several stakeholders. A lack of interoperability due to differing standards limits consumer choice about where to charge and how to pay. Therefore, similarly to what has happened in IoT environments, the main regulatory challenges relate to the policy choices involving interoperability and standardisation. In particular, policymakers have been called to assess the option of mandated rather than spontaneous API adoption by providers in order to deliver effective interoperability.Footnote ⁷⁸

However, since interoperability is context dependent, some important differences between retail financial markets and the IoT should not be overlooked. The banking industry is indeed much more mature than the IoT and so mandated interoperability was justified by the empirical identification of a market failure. Furthermore, the banking industry is characterised by a relative high number of legacy incumbents. Hence, if each bank were allowed to adopt different data-sharing interfaces, newcomers would face extremely high transaction costs. ^{Footnote 79} Conversely, the IoT has witnessed a much quicker worldwide consolidation process, and the market viability of IoT service providers and smart device manufacturers currently depends on smooth access to a small number of dominant technology platforms (ie Alphabet, Amazon and Apple).Footnote ⁸⁰

For these reasons, we advance a proposal for ecosystem-tailored standardisation that relies on the Open Banking approach but introducing adaptations to the specific features of the sector at issue.

Moving from the premise that common certification procedures, APIs and open standards are needed to ensure smooth data access and interoperability, we suggest that IoT ecosystem orchestrators should be asked to engage in standardisation processes that are transparent and open to broad participation by the industry and by stakeholders. Nonetheless, such a regulatory initiative should aim at ensuring interoperability within each ecosystem (rather than among ecosystems) in order to preserve differentiation and incentives to innovate. Therefore, leading IoT ecosystems should be required to implement vertical interoperability.

As orchestrators of key bottlenecks within the IoT economy, they can restrain other firms’ ability to benefit from network effects and obtain unchallenged access to users’ data. Furthermore, they are in a position to determine the requirements and certification processes by which access to and interoperability with their ecosystems take place. Moreover, as they usually are vertically integrated and compete with third-party providers over their own platforms, such a dual role may incentivise them to give preferential treatment to their own products and services (so called self-preferencing) by restricting interoperability for third-party services and devices. In this scenario, vertical interoperability would promote complementary innovation and the modular combination of services across the value chain.

Conversely, horizontal interoperability should be rejected as it could cause unintended consequences in terms of inter-ecosystem competition and dynamic innovation.Footnote ⁸¹ Indeed, it would force firms to provide substitutable services and products, preventing differentiation between ecosystems for the sake of delivering a level playing field among providers. In addition, horizontal interoperability could raise data security issues.

Moreover, digital ecosystem orchestrators should be required to design open interoperability standards together with third-party providers and manufacturers under the strict oversight of a publicly appointed supervisor. In the event of a failure to reach a compromise between the different stakeholders, the competent supervisory body would have the power to impose a solution on all parties. Similarly, the competent supervisor should be entrusted with the task of overseeing compliance over time from the side of both leading technology platforms and third-party manufacturers and service providers. As has already happened with the UK Open Banking experience, there is a serious risk that incumbents could try to surreptitiously undermine data transfers, with the final goal of watering down the competitive potential of interoperability.Footnote ⁸²

As long as public supervision and transparency are ensured, ecosystem-tailored standardisation could harness the skills and best practices developed by existing technical bodies. For instance, formal SDOs already opened several work streams for the development of IoT standards both in the EU and at the international level. The European Committee for Standardization (CEN) and the European Committee for Electrotechnical Standardization (CENELEC) actively cooperate with the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) to develop standards facilitating interoperability and communication between voice assistants, wearable devices and consumer IoT services as well as smart home devices.Footnote ⁸³ At the same time, several of the industry-led standardisation initiatives that emerged over the last decade could offer useful technical guidance. In 2019, Apple, Google and Amazon established a working group (now named Matter) within the Connectivity Standards Alliance to launch a new, royalty-free connectivity standard enabling compatibility among a wide range of smart home devices.Footnote ⁸⁴ Moreover, since 2014, the Thread Group alliance has been operating to provide network protocols to connect and control products for home automation.Footnote ⁸⁵ Finally, in 2019, both Amazon and the Linux Foundation launched initiatives (the Voice Interoperability Initiative and the Open Voice Network, respectively) to facilitate multi-homing and interconnection between voice assistants.Footnote ⁸⁶

Nevertheless, the proposal at stake would be time-consuming and resource-intensive to implement for both market supervisors and leading platform orchestrators. Engaging with the implementation of vertical interoperability requirements and the ex post standardisation of existing digital ecosystems is an extremely complex, cumbersome and costly task that could face strong resistance from the firms involved. A potential way to deal with this issue would be to require technology platforms to contribute with their finances to ecosystem-tailored supervisory costs. As has been shown by the UK Open Banking experience, adequate implementation, team resources and skills are crucial to achieving the pro-competitive goal of ecosystem-tailored standardisation.

Furthermore, conceiving workable governance and enforcement of vertical interoperability obligations requires regulators to strike a delicate balance between the interests of incumbents and newcomers while dealing with limited public resources. The UK Open Banking experience allows us once again to better understand this issue as it was originally funded by incumbent banks. As the implementation roadmap set out by the CMA was substantially completed by the end of 2022, the UK Government started considering how to ensure the necessary supervision for enforcing the continuing obligations under the CMA’s Retail Banking Order to allow customers to access their data securely and to benefit from financial data sharing. ^{Footnote 87} For instance, the leading industry body for financial services (ie UK Finance) proposed to let the nine largest banks be free to withdraw from membership (and funding duties) after three years. ^{Footnote 88} This spurred a discussion as, according to several fintech firms, such a proposal would turn into an unfair leverage to manipulate the new supervisor’s activity, especially when it comes to the oversight of interoperability requirements and standardisation initiatives. ^{Footnote 89}

However, a substantial element differentiates our model from that of the UK Open Banking experience. Our proposal would not lead to a one-size-fits-all solution as the standards would be tailored to the specific features of each ecosystem. Indeed, as the IoT encompasses a wide range of heterogeneous products and services interconnected together within diverse digital ecosystems, it would not be appropriate to impose a single set of interoperability standards on the whole sector. Rather, the Open Banking paradigm could serve as a reference for delivering vertical interoperability tailored around the features of major digital ecosystems in the IoT universe. Adopting an ecosystem-based approach to standardisation would foster dynamic innovation and ecosystem diversification as platform operators would not be bound to deliver homogenous offers. Moreover, interoperability could work smoothly in a vertical fashion, thereby facilitating ecosystem entry by newcomers and reducing the risk of technological self-preferencing.

Overall, our proposal is set to complement the existent EU regulatory framework and to fill the gaps left open by the proposed Data Act, which only addressed interoperability for cloud service providers. Furthermore, by adopting a straightforward approach towards mandated standardisation to deliver on vertical interoperability, the solution at stake also complements the DMA, which already introduced some vertical obligations for app store gatekeepers. Indeed, the DMA only provides the Commission with the ability to force SDOs to facilitate the adoption by digital gatekeepers of appropriate standards as long as this is necessary to implement the vertical interoperability requirements needed to install third-party app stores and to side load apps, as well as to ensure access to the essential functionalities of operating systems or the hardware capabilities of a specific device. Moreover, our proposal would draw on the technical toolbox recently established by the Data Governance Act. As the European Data Innovation Board is entrusted with the fundamental task of identifying the relevant standards and interoperability requirements for cross-sector data sharing, it could serve as a foothold for launching the implementation of ecosystem-tailored standardisation.Footnote ⁹⁰

VI. Concluding remarks

The IoT is likely to bring about substantial changes across a large portion of worldwide economies. An increasingly number of products require interconnection within larger networks of smart devices; therefore, smooth access and interoperability with digital ecosystems are essential for third parties to engage within the IoT universe. At the same time, by exerting control over the interface between final users and application developers as well as device manufacturers, the orchestrators of these ecosystems may engage in anti-competitive behaviours and undermine the economic potential of the IoT.

To address these concerns, a wave of regulatory initiatives has progressively emerged in recent years to address the strategic role played by large platform-based digital ecosystems. In such a scenario, interoperability obligations are taking centre stage, promising to put an end to those network effects that work only in favour of the most prominent digital ecosystem owners. However, given that interoperability is context dependent, interventions should build on a careful assessment as to whether it is more desirable to aim for vertical rather than horizontal interoperability, as well as whether it would be preferable to rely on mandatory rather than voluntary standardisation.

Against this background, we put forward a twofold proposal. First, we argue that competition-orientated reforms in the IoT should aim to deliver vertical (within-ecosystem) interoperability. Horizontal (between-ecosystems) interoperability would, indeed, threaten platform design and governance, thus jeopardising business models, preventing their differentiation and ultimately reducing incentives to innovate. Second, we sound a note of caution against poorly designed legislative measures that fail to address the role of standardisation for delivering interoperability. In this regard, by taking stock of the Open Banking experience, we argue that industry-led standardisation under the oversight of independent public bodies is the correct solution for tackling interoperability challenges in the IoT universe. Under our proposal, leading IoT technology platform orchestrators would be expected to design open interoperability standards together with third-party providers and manufacturers. In this way, the hurdles of formal standardisation processes could be overcome while countering the risks of de facto standards being conveniently developed under the control of large technology platforms.

By implementing ecosystem-tailored standardisation, policymakers could strike a reasonable balance between the need to ensure contestability in digital markets and the overarching goal of preserving consumer welfare and innovation.