Private Data, Public Rules

The World’s Biggest Internet Markets Are Planning Laws To Protect Personal Data. But Their Approaches Differ Wildly 

Jan 28th 2012 
HONG KONG, MUNICH AND SAN FRANCISCO 
From The Print Edition 
Courtesy Of "The Economist"

FIRST came the yodelling, then the pain. The online entrepreneurs and venture capitalists at DLD, a geeks’ shindig this month in Munich, barely had time to recover from their traditional Bavarian entertainment before Viviane Reding, the European Union’s justice commissioner, introduced a new privacy regulation. Ms Reding termed personal data the “currency” of the digital economy. “And like any currency it needs stability and trust,” Ms Reding told the assembled digerati.

The EU’s effort (formally published on January 25th) is part of a global government crackdown on the commercial use of personal information. A White House report, out soon, is expected to advocate a consumer-privacy law. China has issued several draft guidelines on the issue and India has a privacy bill in the works. But their approaches differ dramatically. As data whizz across borders, creating workable rules for business out of varying national standards will be hard.

Europe’s new privacy regulation is one of the most sweeping. Its first goal is to build a “digital single market”. That will be a welcome change from the patchwork of rules that has grown up since the previous privacy directive in 1995. When Google’s Street View mapping service accidentally captured personal data from some open, unsecured Wi-Fi networks in the houses it photographed, some EU countries told the firm to delete the data. Others told it to hold the information indefinitely.

The Commission hopes that when the new regulation comes into effect (probably in 2016) it will clear up this mess. A firm based in, say, Ireland will be able to obey Irish law and do business across the EU, without worrying whether it is in line with other countries’ rules. A new European Data Protection Board will enforce the regime. And if a company faces judicial proceedings in two member states, the courts will be obliged to communicate. Ms Reding expects these changes to save business €2.3 billion ($3 billion) a year.

But the new regime is tougher as well as being uniform. Firms must gain proper consent (defined strictly) before using and processing data. They may collect no more information than is necessary and keep it only while they need it. Children’s data gain extra safeguards. Users must be able to move information from one service provider to another (for example, an address book between two social networks).

The EU’s 500m residents will also win a brand new right: to be forgotten. Users can not only request that a company show what data it holds on them; they can also demand that it deletes all copies. Critics say this is impractical, vague, and over-ambitious. It is hard to say where one man’s data end and another’s begin. And once something is online, it is virtually impossible to ensure that all copies are deleted. Small firms will struggle; even big ones will find the planned penalties steep.

Even more contentiously, the directive covers any firm that does business with Europeans, even if it is based outside the EU. America’s Department of Commerce sent the Commission a strong 15-page protest, saying that the directive “could hinder commercial interoperability while unintentionally diminishing consumer privacy protection”.

An Ocean Of Data

That stance reflects differences in American and European attitudes towards data protection, and indeed to regulation in general. America has avoided overly prescriptive privacy legislation, believing that companies should generally regulate themselves. Only when firms fail at self-regulation does the Federal Trade Commission (FTC) step in. It has broad powers to tackle unfair and deceptive practices, and has not hesitated to use them. In recent rulings, Google and Facebook agreed to a biennial audit of their privacy policies and practices for the next 20 years.

European sensitivities are different. A Eurobarometer poll last year found that 62% of Europeans do not trust internet companies to protect their personal information. A big reason is history. In the 1930s Dutch officials compiled an impressive national registry. This later enabled the Nazis to identify 73% of Dutch Jews, compared with just 25% in less efficient France, notes Viktor Mayer-Schönberger of Oxford University in his book “Delete: The Virtue of Forgetting in the Digital Age”.

For the global digital economy, differences in privacy laws are a kind of trade barrier and a costly brake on innovation. In the past Europe and America reached a compromise with the “safe harbour” framework of 2000. As long as American companies adhered to certain principles based on the 1995 directive, they could do business in the EU.

The arrangement has worked well, but America now worries that when its new rules come in the EU may want to rejig the deal. America might have more bargaining power if it had its own privacy law on the statute books, some experts argue; in any case public concern about data protection is growing there. On January 24th Google triggered an outcry when it announced that from March it will share data gleaned from people logged into any of its services with all of its businesses, whether those users like it or not.

The administration is hurrying to catch up. In its report, the White House will recommend a legal framework for privacy, plus new codes of conduct. The chances of legislation passing in an election year are slim, even on what is usually a bipartisan issue. Talks among business lobbies, privacy activists and regulators may at least produce non-statutory codes, though without the imminent threat of legislation some companies may dawdle.

The FTC will also release a privacy report later this year. This will look broadly at the use of personal data being scooped up by companies on- and offline. Among other things, it is likely to applaud progress in letting internet users take steps to block tracking by tweaking their web browsers. It will probably support a tougher regime for brokers of consumer data, and an industry initiative to give web pages special icons that people can use to prevent firms from tracking their activity.

America and Europe will set the global standards. But other countries’ privacy rules matter too. China and India will soon have more people online than Europe and America have citizens. Neither Asian country has yet passed formal national legislation, but both are considering it—with every indication that their new laws will outdo even Europe in their severity.

India’s draft privacy bill will set up a data-protection authority, call for consent before personal data can be processed, and create a formal “right to privacy”. Critics say the bill is too broad and that clauses protecting an individual’s “honour and good name” could be used for censorship.

China’s draft Personal Information Protection Law was proposed in 2003, but has since languished, leading to both regional experimentation and some big ad hoc rulings from ministries. The resulting hotch-potch leaves businesses and consumers confused. But in January 2011 the Ministry of Industry and Information Technology issued draft rules on data protection that restrict the ability of organisations to transfer personal data without specific prior informed consent.

These define personal information broadly, as anything that can identify an individual either on its own, or in combination with other data. They also appear to forbid the export of personal information—even, on one reading, from one division of a company to another. That could hamper multinationals which need to send data across national borders. And it could hit outsourcers trying to deal with their customers. A further danger is that China’s regulations are often arbitrarily or selectively enforced. Some information-processing firms are said to have moved their operations to Hong Kong, which has laxer and more predictable rules.

Building a single European data-protection regime is hard enough. Harmonising it smoothly with America will be harder. Reaching deals with Indian bureaucrats and Chinese mandarins set to defend the interests and the data of their countries’ rapidly growing online firms may be downright impossible. Welcome to the new world of data geopolitics.