Legal confusion on internet privacy
Sharply differing attitudes towards privacy in Europe and America are a headache for the world's internet giants
Jun 17th 2010 | SAN FRANCISCO
WATCHDOGS are growling at the web giants, and sometimes biting them. In May European data-protection agencies wrote to Google, Microsoft and Yahoo! demanding independent proof that they were making promised changes to protect the privacy of users' search history. They also urged Google to store sensitive search data for only six months instead of nine.
In April ten privacy and data-protection commissioners from countries including Canada, Germany and Britain wrote a public letter to Eric Schmidt, Google's boss, demanding changes in Google Buzz, the firm's social-networking service, which had been criticised for dipping into users' Gmail accounts to find "followers" for them without clearly explaining what it was doing. Google promptly complied.
Such run-ins with regulators are likely to multiply--and limit the freedom of global internet firms. It is not just that online privacy has become a controversial issue. More importantly, privacy rules are national, but data flows lightly and instantly across borders, often thanks to companies like Google and Facebook, which manage vast databases.
A recent scandal dubbed "Wi-Figate" exemplifies the problem. Google (accidentally, it insists) gathered data from unsecured Wi-Fi networks in people's homes as part of a project to capture images of streets around the world. A number of regulators launched investigations. Yet their reaction varied widely, even within the European Union, where member states have supposedly aligned their stance on online privacy. Some European watchdogs ordered Google to preserve the data it had collected in their bailiwicks; others demanded that information related to their countries be destroyed (see table).
Despite such differences within Europe, the gap is much greater between Europe and America, home to many of the world's largest online social networks and search engines. European regulations are inspired by the conviction that data privacy is a fundamental human right and that individuals should be in control of how their data are used. America, on the other hand, takes a more relaxed view, allowing people to use a patchwork-quilt of consumer-protection laws to seek redress if they feel their privacy has been violated. Companies that handle users' data are largely expected to police themselves.
Some experts say this dichotomy explains why Silicon Valley firms that strike out abroad have sometimes been the targets of European Union data watchdogs. Jules Polonetsky of the Future of Privacy Forum, a think tank, says that many American firms have yet to learn that showing up in Europe and extolling the virtues of self-regulation is likely to be as ineffective as rightwing politicians denouncing anti-discrimination laws back home.
Transatlantic friction between companies and regulators has grown as Europe's data guardians have become more assertive. Francesca Bignami, a professor at George Washington University's law school, says that the explosion of digital technologies has made it impossible for watchdogs to keep a close eye on every web company operating in their backyard. So instead they are relying more on scapegoating prominent wrongdoers in the hope that this will deter others.
But regulators such as Peter Schaar, who heads Germany's federal data-protection agency, say the gulf is exaggerated. Some European countries, he points out, now have rules that make companies who suffer big losses of customer data to report these to the authorities. The inspiration for these measures comes from America.
Yet even Mr Schaar admits that the internet's global scale means that there will need to be changes on both sides of the Atlantic. He hints that Europe might adopt a more flexible regulatory stance if America were to create what amounts to an independent data-protection body along European lines. In Europe, where the flagship Data Protection Directive came into effect in 1995, before firms such as Google and Facebook were even founded, the European Commission is conducting a review of its privacy policies. In America Congress has begun debating a new privacy bill and the Federal Trade Commission is considering an overhaul of its rules. David Vladeck, the head of the FTC's Bureau of Consumer Protection, has acknowledged that "existing privacy frameworks have limitations".
Even if America and Europe do narrow their differences, internet firms will still have to grapple with other data watchdogs. In Asia countries that belong to APEC are trying to develop a set of regional guidelines for privacy rules under an initiative known as the Data Privacy Pathfinder. Some countries such as Australia and New Zealand have longstanding privacy laws, but many emerging nations have yet to roll out fully fledged versions of their own. Mr Polonetsky sees Asia as "a new privacy battleground", with America and Europe both keen to tempt countries towards their own regulatory model.
Privacy laws are somewhat more common in Latin America, where countries such as Argentina and Chile boast relatively strict European-style regimes. Mexico, which last year made data privacy a constitutional right, is also pushing through a new federal data-privacy law. The likely outcome is a mix of European and American privacy frameworks, predicts Katitza Rodriguez of the Electronic Frontier Foundation, a privacy group.
Canada already has something of a hybrid privacy regime, which may explain why its data-protection commissioner, Jennifer Stoddart, has been so influential on the international stage. She marshalled the signatories of the Google Buzz letter and took Facebook to task last year for breaching Canada's data privacy laws, which led the company to change its policies.
Ms Stoddart argues that American companies often trip up on data-privacy issues because of "their brimming optimism that the whole world wants what they have rolled out in America." Yet the same optimism has helped to create global companies that have brought huge benefits to consumers, while also presenting privacy regulators with tough choices. Shoehorning such firms into antiquated privacy frameworks will not benefit either them or their users.
