GDPR may trigger global ripple effect

‘Protect citizens in data jungle’

PARIS, May 15, (AFP): The EU’s new data protection rules that enter into force later this month are having an impact around the world as firms, including in the United States and China, move to comply.

While all firms globally are required to comply with the provisions of the General Data Protection Regulation (GDPR) when it comes to the data of Europeans, the rules may have a wider impact if firms decide to extend the protections to all users.

Major US platforms such as Facebook, Twitter, Instagram and Airbnb have begun to notify their users in Europe of modifications of their user terms in order to comply with the new EU rules.

Under GDPR firms user consent for use of their personal data must be freely “given, specific, informed and unambiguous”.

Facebook has recently begun asking its European users that they approve the use of their data in order provide them with more pertinent advertisements as well as permission for facial recognition.

But it is still not clear which US firms will apply GDPR to all their users and which will do so only for Europe.

“We intend to make all the same controls and settings available everywhere, not only in Europe,” Facebook’s chief executive Mark Zuckerberg told reporters last month as the crisis exploded over the use of user data for political purposes by the firm Cambridge Analytica.

“Is it going to be exactly the same format? Probably not,” he added.

For Sam Pfeifle, content director at the International Association of Privacy Professionals (IAPP), some US firms will have no other choice but to extend European protections to all users.

“For some companies being able to discern where their customers are coming from and segregate the data is very difficult and perhaps too difficult to make it worth it,” he said.

Some companies are transforming this pragmatic decision into a marketing advantage, telling their US clients they are offering European-level data protection, said Pfeifle.

Other companies are taking the opposite approach — deciding they would rather part ways with European users entirely rather than go through the effort of complying with the GDPR.

Jourova

Reactions

This is what the online role-playing game Ragnarok decided to do, sparking indignant reactions from European users who will find themselves cut off from May 25.

In China, there are fewer sensitivities about privacy, and the EU regulation will certainly be viewed more as a constraint than a marketing advantage.

“Of course we will respect the GDPR for our European clients,” said a European working for a major Chinese internet firm on condition of anonymity.

But for Chinese users, the application of such privacy guards is likely for another day.

The Chinese “don’t have any reticence handing over their personal data if they see they are of some value” such as in new services or discounts, said the European executive, speaking on condition of anonymity.

Chinese internet titans are currently testing a system that assigns every citizen a social credit system that goes beyond a regular credit rating of a person’s finances and payment history by evaluating their behaviour and preferences as well as their personal relationships.

But it isn’t impossible that the European effort to codify and organise the respect for privacy will have an influence even in China, where internet users have occasionally lashed out.

At the beginning of the year Beijing said it had reprimanded several Chinese tech firms for inadequate protection of user data following a controversy implicating Alipay, the top Chinese payments platform linked to online commerce giant Alibaba.

Users reacted angrily after discovering the platform had been set up to automatically share user data with a credit rating service.

Alipay’s parent company Ant Financial apologised and redesigned the service so users had to opt in to use it.

Urgency

Meanwhile, the Facebook scandal has laid bare the urgency of protecting personal information in a digital “jungle,” the EU’s justice minister said before new European data rules become law.

In an interview with AFP, Vera Jourova said the scandal was a wake-up call for critics who had seen the European Union as too quick to regulate online data.

“It explained that we really are living in the kind of jungle where we are losing ourselves,” Jourova said in Brussels.

“We have been providing the information about our private life, about our identity, about the intimate things,” she said.

“It goes to the black box. And we don’t have a clue what is happening there, who can abuse it, who can sell it to somebody,” Jourova added.

The General Data Protection Regulation (GDPR) entering force on May 25 sets down the rights of individuals, such as one where they explicitly grant permission for their data to be used.

They also have the right to know who is processing their information and for what purpose as well as to have information deleted.

Silicon Valley giants like Facebook, Google and Twitter as well as banks and public bodies will have to comply with the rules or face massive fines.

Facebook chief Mark Zuckerberg himself conceded the GDPR’s importance after research firm Cambridge Analytica plundered the personal data of tens of millions of the social network’s users for the 2016 US presidential election.

Jourova said Zuckerberg’s support triggered an “efficient campaign” for the GDPR in a way that she would have been hard pressed to do herself.

She said the GDPR would have applied in the Cambridge Analytica case because it requires firms to obtain the explicit consent of users for their personal data.

The case “really opened the eyes of many people who were criticising Europe being too paranoid, too overregulated,” she said.

But she learnt from the US press that the United States had much to learn from an old world it had seen as too “apocalyptic” but now views as “more visionary” about data protection. She sees the EU as a benchmark for data protection. “By negotiating the possibility of data transfers outside Europe we are in fact pushing other countries to increase the standards,” Jourova said.