Europe’s Top Digital-Privacy Watchdog Zeros In on U.S. Tech Giants
Europe’s Top Digital-Privacy Watchdog Zeros In on U.S.
Tech Giants
By MARK SCOTT JAN. 24, 2016
PARIS — The latest standoff between Europe and American
tech companies runs through a quiet street just north of the Louvre Museum, past
chic cafes and part of the French national library, to the ornate office of
Isabelle Falque-Pierrotin.
From here, Ms. Falque-Pierrotin has emerged as one of the
most important watchdogs for how companies like Facebook and Google handle the
billions of digital bits of personal data — like names, dates and contacts —
routinely collected on Europeans. Since 2011, she has been France’s top privacy
regulator, and for the last two years, she has led a group of European
data-protection officials. In those posts, Ms. Falque-Pierrotin has regularly
agitated companies to better safeguard people’s data.
Her role will come into even sharper focus in the coming
weeks. Ms. Falque-Pierrotin, empowered by Europe’s highest court, will be at
the heart of efforts to police how digital data is transferred outside of the
European Union, a central aspect of many European and American businesses. That
role will be amplified even further if, as is now widely expected, American and
European negotiators fail to reach a new data-transferring deal by Feb. 1.
The biggest American tech companies face intensifying
scrutiny by European regulators, with — pressure that could potentially curb
their sizable profits in the region and affect how they operate around the
world.
One thing is clear, she says: The practices of American
businesses, and tech companies in particular, are squarely in her sights.
“American companies do not have an immediate right to
collect data on our citizens,” Ms. Falque-Pierrotin, 56, a blunt-speaking career
civil servant, said recently in an interview, her voice increasingly animated.
“If they are on our soil, then they need to live with the consequences.”
Greater oversight fell to Europe’s national data
regulators in October, when the European Court of Justice annulled a
15-year-old pact known as safe harbor, which had allowed companies to move
information freely between the United States and Europe. The judges ruled that
Europeans’ data was not sufficiently protected when transferred to the United
States.
Shortly after, the national regulators, led by Ms.
Falque-Pierrotin, demanded that the European Commission and the Commerce
Department reach a new deal by Feb. 1. Negotiators have been talking almost
daily since October — including discussions in Brussels and Davos, Switzerland,
in recent days. Still, they remain at loggerheads over how American
intelligence agencies monitor Europeans’ digital profiles, according to several
officials, who would speak only on the condition of anonymity.
Failure to find a compromise, company executives and
officials warn, could disrupt billions of dollars of trade between two of the
world’s largest economies. Nearly all major multinational companies, including
manufacturers like General Electric and drug makers like Pfizer, routinely move
customer and employee data between regions.
The biggest impact, though, will be felt by United States
technology giants like Facebook and Google, which depend on reams of personal
data from people’s social media posts, search queries and online purchases to
fuel digital advertising businesses. Those efforts often lead to tensions in
Europe, where privacy is considered as sacrosanct as freedom of speech.
Deal or no deal, Ms. Falque-Pierrotin is in a position to
play a major role. If negotiators agree to a new pact, she and Europe’s other
privacy watchdogs will help decide whether the new agreement meets the region’s
tough standards. If no deal is reached, she could impose further restrictions
on how data is transferred across the Atlantic when European regulators gather
on Feb. 2.
“The French aren’t afraid to pick fights with companies,”
said Max Schrems, an Austrian law student who brought the original case that
upended the previous trans-Atlantic data-sharing agreement.
Ms. Falque-Pierrotin follows a long tradition of French
officials promoting strict privacy rights. In 2014, her peers elected her to
lead an increasingly powerful group of European privacy regulators — a position
that she is the forerunner to retain when new elections take place next month.
After receiving degrees from some of France’s top
business and civil service schools, Ms. Falque-Pierrotin has spent three
decades leapfrogging among government agencies and state-sponsored nonprofits.
In the late 1990s, though, she began focusing more on privacy and the digital
economy. She joined France’s data-protection authority in 2004 and quickly rose
within its ranks.
In person, Ms. Falque-Pierrotin comes across as
soft-spoken and formal. But her advocates and targets alike say she can be
tenacious, though fair-minded. In recent years, she has gained a reputation for
taking on some of the world’s largest tech companies, including Google.
The search giant will again take center stage in the
coming weeks when France’s data-protection watchdog is expected to fine the
company for failing to comply with its interpretation of Europe’s “right to be
forgotten” privacy ruling, according to two people with direct knowledge of the
matter, who would speak only on the condition of anonymity. While such a move is
a headache for a company like Google, the agency’s one-off maximum financial
penalty of 150,000 euros, or about $160,000, is essentially a mere rounding
error.
In a recent interview, Ms. Falque-Pierrotin said
Europeans should have the right to ask Google to remove links about themselves
from any search query worldwide. She declined to comment, though, about
potential fines. A Google spokesman also declined to comment on the fines.
Google has argued that the legal decision should apply only to European domains
like Google.fr in France, and not to its global websites like Google.com.
Even with the confrontation with Google, French privacy
experts say Ms. Falque-Pierrotin has regularly contacted local and
international companies. She has often taken a less combative approach than
other national watchdogs, they say, particularly those in Germany, where
officials have often been quick to blame American companies for flouting local
rules.
Ahmed Baladi, a lawyer at Allen & Overy who
represented Google in a previous French data-protection case, said Ms.
Falque-Pierrotin aggressively led her agency, known as the Commission Nationale
de l’Informatique et des Libertés, or CNIL. “But her strategy also has focused
on communication, not just enforcement,” he added.
That nuanced approach may prove handy as last-minute
discussions about a new trans-Atlantic data-transfer agreement flounder.
National authorities may start legal proceedings — and
potentially issue fines — against companies they think run afoul of Europe’s
tough data-protection rules if a new deal is not reached.
Ms. Falque-Pierrotin, for instance, has already received
complaints against several unnamed companies, though she is waiting until
February before deciding whether to begin investigations into how certain
companies move data from France to the United States.
Vera Jourova, Europe’s justice commissioner in charge of
the European negotiating team, still thinks a new data-sharing agreement can be
reached, but warns that “a deal will only be made if there’s an equitable
approach in the United States” to safeguard Europeans’ privacy rights.
Bruce Andrews, the deputy secretary of the Commerce
Department, dismissed Europe’s concerns, saying that the United States had
already offered the European Commission a number of guarantees on how its
citizens’ data would be treated.
“We’ve agreed to make major changes,” he said. “The U.S.
takes individuals’ privacy very seriously.”
In December, Ms. Falque-Pierrotin sent letters to several
American agencies, including the Commerce Department and the Federal Trade
Commission, asking for meetings to discuss the current impasse. She received
only a short response.
Not responding fully to Ms. Falque-Pierrotin’s entreaties
may prove costly. Already, the French regulator and other European agencies
have sent letters to international companies reminding them that the current
mechanisms for transferring data are on shaky legal ground.
A number of digital-rights advocates, including Mr.
Schrems, are also preparing new privacy cases if a data-transfer deal is not
reached by Feb. 1.
That will most likely cause more problems for American
tech giants, pushing Ms. Falque-Pierrotin and her European counterparts to
consider new investigations — and, eventually, fines. But her position on
protecting personal data continues to appear unwavering.
“Does the U.S. provide sufficient privacy guarantees?”
she said. “Until now, the answer is no.”
A version of this article appears in print on January 25,
2016, on page B1 of the New York edition with the headline: Europe Eyes U.S.
Tech Giants.
Comments
Post a Comment