How Silicon Valley gamed the world's toughest privacy rules
How Silicon Valley gamed the world's toughest privacy
rules
Europe's data protection overhaul was supposed to help
citizens. Instead, it’s helped Big Tech.
By MARK SCOTT, LAURENS CERULUS and STEVEN OVERLY 05/25/2019
06:43 AM EDT
When Europe’s tough privacy rules came into force on May
25, 2018, policymakers and industry executives expected a series of dominoes
would soon start to fall.
Global technology giants like Facebook would feel the
heat of fines of up to 4 percent of their total yearly revenue. Companies like
Google would think twice before pushing ahead with aggressive new ways of
collecting people’s data. Smaller rivals would be given greater space to
compete.
But a year later, none of those dominoes has yet fallen,
according to interviews with senior policymakers, tech executives and privacy
campaigners.
Big fines and sweeping enforcement actions have been
largely absent, as under-resourced European regulators struggle to define their
mission — and take time to build investigations that will probably end up in
court.
New forms of data collection, including Facebook’s
reintroduction of its facial recognition technology in Europe and Google’s
efforts to harvest information on third-party websites, have been given new
leases on life under Europe’s General Data Protection Regulation, or GDPR.
Smaller firms — whose fortunes were of special concern to
the framers of the region’s privacy revamp — also have suffered from the
relatively high compliance costs and the perception, at least among some
investors, that they can’t compete with Silicon Valley’s biggest names.
“Big companies like Facebook are 10 steps ahead of
everyone else, and 100 steps ahead of regulators,” declared Paul-Olivier
Dehaye, a privacy expert who helped uncover Facebook’s Cambridge Analytica
scandal. “There are very big questions about what they’re doing.”
The patchy record of Europe’s data protection overhaul —
on the one-year anniversary of its implementation — has given industry an
opportunity to blunt similar efforts outside the European Union to emulate the
region’s new privacy rules.
Campaigners and some lawmakers from Colombia to South
Africa and even the United States clamor to import similar protections,
claiming that only strict restrictions will grant citizens sufficient control
over their data.
But aggressive industry lobbying in capitals worldwide
has worked hard to frame Europe’s laws as overly cumbersome, particularly for
small companies, with technology groups warning other politicians not to merely
copy Europe in the rejiggering of their own local privacy standards.
“A lot of small and medium sized businesses are still
struggling,” said John Miller, vice president of policy at the Information
Technology Industry Council, a trade group in Washington DC that represents
many of Silicon Valley’s biggest names. “How do we protect the rights of
consumers here without making the law quite so onerous?”
GDPR, one year on
It was not supposed to be this way.
When Europe unveiled its privacy revamp, European
officials hailed it as a major victory for consumers — a message that
piggybacked on the public's growing awareness of their data rights after
Facebook’s Cambridge Analytica scandal, in which roughly 87 million of its
users worldwide had their data misused during political campaigns.
Policymakers like Andrea Jelinek, an Austrian official in
charge of a pan-regional group of EU data protection regulators, gave evidence
to the U.S. Congress on how Europe had implemented its new laws. Mark
Zuckerberg, Facebook’s chief executive, promised to offer European-style
protections to all of his company’s 2.2 billion global users.
But since the region's standards came into force a year
ago, few companies have yet had their wings clipped by the new regulation — and
some of the world's largest tech companies have used their significant in-house
regulatory and financial muscle to turn Europe's privacy push to their
advantage.
So far, almost 100,000 privacy complaints have been filed
with national privacy regulators, though only a few have led to meaningful
penalties, according to the International Association of Privacy Professionals,
an industry trade body. Total fines have now reached roughly €56 million —
about $63 million — although almost all of that came from a one-off €50 million
levy against Google by French officials (the search giant is appealing that
decision).
National agencies — often small, obscure regulatory
off-shoots that lack the manpower or legal resources to keep large
multinationals at bay — have struggled to give Europe's privacy rules real
bite, despite widespread government efforts to increase their yearly budgets.
Officials urge restraint, saying that it will take time for the full force of
Europe's privacy rules to take effect and that companies are already changing
how they collect people's data because of potential blockbuster fines.
"Even after 12 months, the reality is that there is
no consensus or clear harmonization for how data should be processed,"
said Ahmed Baladi, co-chair of the privacy, cybersecurity and consumer
protection unit at Gibson Dunn, a law firm, in Paris. "We still need more
guidance from national authorities."
Facebook and Google
Into this void has stepped Big Tech.
Ahead of Europe’s privacy overhaul, Facebook spent months
preparing to restart its facial recognition service in the region — technology
that the company believes now meets the region's beefed-up standards. Ireland's
data protection agency, which oversees the social media giant's activities in
the EU, has yet to take a position on the matter.
Despite the previous ban, Facebook's facial recognition
technology is now permitted in Europe because users are actively given the
choice to opt into the service. The social networking giant also restarted the
sharing of some data between WhatsApp, its popular messaging service, and
Facebook — a practice that had similarly been outlawed in some states in the
28-country bloc.
Even now, some privacy regulators aren't convinced that
people understand how their data may be used and that others could still have
their digital information collected without consent. Facebook denies it stores
data on individuals who have not chosen to use its facial recognition
technology.
"Processing of biometric data such as in automatic
facial recognition comes with substantial risks," Johannes Caspar, head of
the Hamburg privacy regulator, said in an email. "Facial recognition must
be strictly limited to those users who have opted in to that technology."
Google also moved quickly to cement its position in the
data economy.
Weeks before Europe's new rules became law, the search
giant contacted all websites, both inside the EU and elsewhere, that relied on
the company's dominant advertising services, informing these publishers that
they would now have to solicit people's consent to collect data on Google's
behalf.
Under Europe's new privacy standards, the tech giant must
get people's permission to target them with digital advertising. But by forcing
publishers to do this work for Google — the search giant said if websites did
not comply, they would not be able to use the company's advertising services —
it added an additional line to the company's revamped privacy settings, which
allowed Google to take ownership of people's data from publishers that it then
could use for its own undefined purposes.
In response, the tech giant said these changes were
necessary under Europe's new data protection rules, and that it had not taken
greater control over data collected by publishers worldwide.
Yet in a sign of potential future privacy woes for
Google, an investigation into the legality of such practices is expected to be
announced in the coming weeks, according to an industry executive with
knowledge of the matter.
For Jason Kint, chief executive of Digital Content Next,
a trade body for publishers including The New York Times and the Guardian (Axel
Springer, which co-owns the European edition of POLITICO, is also a member),
Google's request represented a land grab for lucrative data that websites
routinely had collected on their users — a crucial resource for newspapers
increasingly going digital in search of much-needed revenues.
"It forced our members to give Google secondary use
of their data," said Kint. "They're supposed to be transparent about
what they're using the data for, but we don't really know."
First Europe, now the world
The first shots in the global privacy war were fired in
Europe. But as policymakers from New Delhi to Brasilia turn their attention to
reining in Big Tech's use of data, the EU's standards are now at the center of
cut-throat lobbying worldwide.
That's particularly true in the United States, where
lawmakers and tech executives agree on the need for new privacy rules after
years of Silicon Valley’s dismissal of such protections.
In recent months, Congress has held multiple hearings on
privacy, and politicians are engaged in negotiations over a wide-ranging data
protection bill. But Republicans and Democrats are still divided on key
principles, including if a federal law should override existing state-based
rules and if individual consumers should have the right to sue tech firms over
privacy violations.
Those sticking points may threaten to derail the push for
national legislation — but the fact talks are happening after years of lack of
interest can be attributed, in part, to the global influence of Europe’s
privacy rules.
"There has been a dramatic change both in the
attitudes toward the tech firms and, I would say, in the views of European privacy
law,” said Marc Rotenberg, executive director of the Electronic Privacy
Information Center, a campaigning group in Washington, D.C. "Lawmakers are
genuinely asking whether the U.S. needs a law similar to Europe."
With negotiations in Washington stalled, particularly
ahead of the U.S. presidential election in 2020, attention has shifted toward
U.S. states, many of which are mulling wide-ranging privacy legislation that
often mirror sections of Europe's rules.
In California, which became the first U.S. state to pass
wide-ranging data privacy legislation last year, lobbyists have until 2020 to
soften the proposal's impact on the likes of Google and Facebook by adding
industry-friendly provisions to exempt certain kinds of data collection.
Companies also successfully petitioned the state's attorney general to remove
the right for citizens to directly sue firms for illegally collecting their
digital information.
In Washington state, lawmakers went a step further by
specifically name-checking Europe's privacy standards in proposals that
narrowly failed to pass the legislature in late April.
But whereas in Europe, people are automatically given the
right to not have their information collected unless they give explicit consent
to companies, the U.S. proposals, by default, had given businesses the right to
harvest such data without needing to seek users' permission. That raised
concerns among privacy groups that U.S. lawmakers were co-opting Europe's
privacy reboot without offering the same fundamental rights to U.S. citizens —
criticisms that the bill's backers deny.
"GDPR is the global standard," said Reuven
Carlyle, a Washington state senator who co-sponsored the recent privacy
legislation. "But the history of deployment of technology in the United
States is more aligned to the 'opt out' approach. Without that, you
fundamentally alter the value proposition of innovation."
This report first appeared on POLITICO.EU on May 22,
2019.
Comments
Post a Comment