The European Union and Internet Data Privacy
The European Union has begun the process of possibly strengthening its digital privacy laws, with far ranging implications for Europe and the rest of the globe. Image courtesy of futureatlas.com
As more companies jump across national borders and expand their reach globally, a complex question arises as to which laws they must follow when doing business in foreign markets. The European Union has recently signaled that it will be toughening its data privacy laws, which will apply to all internet companies doing business with E.U. consumers. One key issue is what degree of control individuals have over their digital data, ranging from pictures on Facebook to web searches and surfing habits stored by Google. The E.U. wants to allow individuals the power to delete their data, which internet companies would otherwise store and monetize through targeted ads. This movement in favor of individual privacy is in stark contrast to American laws that grant individuals little ownership of their online data.
While not specifically mentioned by E.U. regulators, it is American companies such as Google and Facebook that would be most significantly affected by the new laws. As our Weekly Focus explains, individuals’ control over their own digital data would alter the business model used by internet companies that gain significant revenue from tracking users’ behavior and habits. Furthermore, the increasing divergence between E.U. and American law raises concerns over how companies are expected to operate. The proposed E.U. laws would create a wide gap between existing U.S. data privacy laws and E.U. data privacy laws with negative implications for companies attempting to compete in multiple regulatory environments.
Data Privacy in the U.S. and E.U: An Ocean of Difference
There are a variety of differences between the laws regarding data privacy in the European Union and the United States, with the E.U. generally allowing more rights to the individual. With no single law providing comprehensive treatment to the issue, America takes a more ad-hoc approach to data protection, often relying on a combination of public regulation, private self-regulation, and legislation. Most confidentiality laws on the books, such as the Health Insurance Portability and Accountability Act (HIPAA), deal with specific arenas, such as medical records, where particular restrictions apply. While the Bill of Rights does provide some form of an implicit right to privacy, as discussed in the 1965 Supreme Court case Griswold v. Connecticut, how this right extends to the digital realm is far from certain. Adding to this uncertainty is the fact that most internet companies tend to be wary of further oversight and lobby heavily against it, which has slowed, if not altogether eliminated, any legislative progress on regulating the collection of consumer data. This has led to an environment generally unfriendly to individuals controlling their own information online, with most leeway given to the companies managing and storing that information.
In contrast, data protection in the E.U. stems largely from a bill passed in 1995, dubbed the Data Protection Directive. This law, reaffirming European nations’ respect for all citizens' “private and family life,” places far more power in the hands of the individual. By granting users the right to both remove and correct any personal information about them online, as well as by barring companies from transferring data either to another company or across national borders, consumers in Europe have broad safeguards to ensure their digital privacy.
Disagreements
These differences in information protection laws have historically been settled by the Safe Harbor Principles, an opt-in program signed by the U.S. and the E.U. in 2000. This framework ensures that all participating companies will automatically be granted approval of all data transfers, and declares that any claims brought by an E.U. citizen against an American business will be heard in American courts with few exceptions. While there are few requirements for organizations that wish to take part, compliance has been rather limited. A 2004 E.U. review found that “less than half of [participating] organisations post privacy policies that reflect all seven Safe Harbor Principles.”
This discrepancy between American and European approaches to digital privacy have been severely criticized by the European justice commissioner, Viviane Reding, who is calling for all non-E.U. companies to abide by the continent’s stricter data privacy rules. If this demand becomes reality, it will profoundly affect American online businesses, especially Facebook and Google. With the former embracing a notoriously difficult process for completely removing one's personal data, and the latter’s' reputation for vacuuming up users’ online habits to refine its search algorithms, a legal shift towards E.U.-style regulation would force unwelcome change on both companies. With both Facebook and Google effectively dependent on monetizing consumers’ online behavior and habits, complying with the letter of E.U. law could force a change to their business models. This could alter their services, by creating a more legally opaque means for consumers to “opt-in” in the case of Facebook, or Google having to change the means and methods of data collection. Either change would be unfavorable to both companies, and so it is plain to see why they have little to no interest in adhering to the relatively strict legal standard embodied by the European Unions’s Data Protection Directive.
What Lies Ahead
The outcome of this potential legislation will be important in setting a precedent for how the E.U. and the U.S. resolve differences over regulations and laws, particularly with individual companies stretched in between the two. While it is doubtful that Google would be forced to give up targeted ads or Facebook be pushed behind a paywall, E.U. regulations would force both companies to alter their basic approach. Regional differences in digital legality, such as this, are likely to become an increasingly large part of political interaction across the Atlantic. As businesses innovate, finding new and different ways to collect information from and serve consumers, the potential for legal confusion is high, especially if the United States and E.U. continue to diverge in their approach. As this cross-border tug of war begins, the pace of innovation may slow or shift into markets with better defined laws on the matter, such as Asia. While American companies have long held the dominant position among internet companies, Chinese search giant Baidu has begun to gain international market share. It remains to be seen what the impact of these disagreements over privacy law will have, but it is certain we’ll be ‘searching’ for the answer for some time to come.