Facebook is about to get hit with regulation, just not from US

Facebook’s efforts to save face over its data policy may be less about responding to outrage and more because it has been forced to by European lawmakers who tackled the digital economy when the U.S. wouldn’t.

Critics have called on Facebook for more transparency — and additional regulation from Congress — since the Cambridge Analytica scandal, where a consulting firm that worked with President Trump was able to harvest the data of 50 million users, many without their consent.

Founder Mark Zuckerberg blamed old policies for the scandal, and the California-based tech giant offered its own solution this week by announcing that it will make privacy tools for users easier to find and give users a means of controlling how their data is used.

Facebook said the changes came after it heard the digital yells of its billions of users, though the measures it proposes are in line with privacy demands from the European Union that must be implemented in the coming months.

RELATED: Cambridge Analytica scandal

15 PHOTOS
Cambridge Analytica scandal
See Gallery
Cambridge Analytica scandal
A man fixes posters depicting Cambridge Analytica's CEO Alexander Nix behind bars, with the slogan 'Our Data Not His. Go Straight To Jail' to the entrance of the company's offices in central London on March 20, 2018. The European Parliament on Tuesday invited Facebook chief Mark Zuckerberg to speak following revelations that a firm working for Donald Trump's US presidential campaign harvested data on 50 million users. Facebook has faced worldwide criticism over the claims that Cambridge Analytica, the UK data analysis firm hired by Trump's 2016 campaign, harvested and misused data on 50 million members. / AFP PHOTO / Daniel LEAL-OLIVAS (Photo credit should read DANIEL LEAL-OLIVAS/AFP/Getty Images)
PARIS, FRANCE - MARCH 20: In this photo illustration the logo of the strategic communication company 'Cambridge Analytica' is seen on the screen of an iPhone in front of a computer screen showing a Facebook logo on March 20, 2018 in Paris, France. Cambridge Analytica is accused of collecting the personal information of 50 million users of the Facebook social network without their consent and would have used it to develop software to predict and influence voter voting during the campaign American election according to the New York Times and the Guardian. Facebook share price fell by more than 5% Monday shortly after the opening of Wall Street. (Photo Illustration by Chesnot/Getty Images)
LONDON, UNITED KINGDOM - MARCH 20: A protester called Heiko Khoo sticks posters of Alexander Nix behind bars onto the windows of the offices in a demonstration against Cambridge Analytica on March 20, 2018 in London, England. PHOTOGRAPH BY Matthew Chattle / Barcroft Images (Photo credit should read Matthew Chattle / Barcroft Images / Barcroft Media via Getty Images)
Christopher Wylie, a whistleblower who formerly worked with Cambridge Analytica, the consulting firm that is said to have harvested private information from more than 50 million Facebook users, speaks at the Frontline Club in London, Britain, March 20, 2018. REUTERS/Henry Nicholls
A man films Christopher Wylie, a whistleblower who formerly worked with Cambridge Analytica, the consulting firm that is said to have harvested private information from more than 50 million Facebook users, for a Facebook live cast as he speaks at the Frontline Club in London, Britain, March 20, 2018. REUTERS/Henry Nicholls
Christopher Wylie, a whistleblower who formerly worked with Cambridge Analytica, the consulting firm that is said to have harvested private information from more than 50 million Facebook users, arrives at the Frontline Club in London, Britain, March 20, 2018. REUTERS/Henry Nicholls
A man wheels storage crates from the building that houses the offices of Cambridge Analytica in central London, Britain, March 20, 2018. REUTERS/Henry Nicholls
People walk past the building housing the offices of Cambridge Analytica in central London, Britain, March 20, 2018. REUTERS/Henry Nicholls
People walk past the building housing the offices of Cambridge Analytica in central London, Britain, March 20, 2018. REUTERS/Henry Nicholls
Alexander Nix, CEO of Cambridge Analytica arrives at the offices of Cambridge Analytica in central London, Britain, March 20, 2018. REUTERS/Henry Nicholls
A man films Christopher Wylie, a whistleblower who formerly worked with Cambridge Analytica, the consulting firm that is said to have harvested private information from more than 50 million Facebook users, for a Facebook live cast as he speaks at the Frontline Club in London, Britain, March 20, 2018. REUTERS/Henry Nicholls
NEW YORK, NY - MARCH 19: Traders and financial professionals work ahead of the closing bell on the floor of the New York Stock Exchange (NYSE), March 19, 2018 in New York City. The Dow Jones industrial average dropped over 330 points on Monday. Shares of Facebook dropped nearly 7 percent after news broke that analytics firm Cambridge Analytica was able to collect information on 50 million people's Facebook profiles without their consent. (Photo by Drew Angerer/Getty Images)
PARIS, FRANCE - MARCH 20: In this photo illustration the logo of the strategic communication company 'Cambridge Analytica' is seen on the screen of an iPhone on March 20, 2018 in Paris, France. Cambridge Analytica is accused of collecting the personal information of 50 million users of the Facebook social network without their consent and would have used it to develop software to predict and influence voter voting during the campaign American election according to the New York Times and the Guardian. Facebook share price fell by more than 5% Monday shortly after the opening of Wall Street. (Photo Illustration by Chesnot/Getty Images)
NEW YORK, NY - MARCH 19: Traders and financial professionals work ahead of the closing bell on the floor of the New York Stock Exchange (NYSE), March 19, 2018 in New York City. The Dow Jones industrial average dropped over 330 points on Monday. Shares of Facebook dropped nearly 7 percent after news broke that analytics firm Cambridge Analytica was able to collect information on 50 million people's Facebook profiles without their consent. (Photo by Drew Angerer/Getty Images)
HOLBORN, UNITED KINGDOM - MARCH 20: Chief executive of Cambridge Analytica Alexander Nix arrives at the office near Holborn on March 20, 2018 in Holborn, England. PHOTOGRAPH BY Matthew Chattle / Barcroft Images (Photo credit should read Matthew Chattle / Barcroft Images / Barcroft Media via Getty Images)
HIDE CAPTION
SHOW CAPTION
of
SEE ALL
BACK TO SLIDE

The EU’s General Data Protection Regulation, a vast and wide-reaching law about data and people's rights online, will come into effect in late May, and affect any company that handles the data of Europeans, including those based in the U.S.

Central parts of the law for individuals include a requirement that sites such as Facebook explain what data they are collecting in clear, non-lawyer terms, the right to erase one’s data and “purpose limitation” that restricts data from being used for anything other than what it was originally collected for, such as location data on Google Maps being used only to help someone get from A to B.

Data violations were previously punishable by smaller fines, though the new law will allow authorities to wallop companies for up to 4% of global annual turnover — in Facebook's case, more than $1 billion.

Also importantly, according to groups such as the privacy and data protection organization European Digital Rights (EDRi), it helps acknowledge a set of rights for people in the relatively lawless online world dominated by a small number of multinational companies.

“Ideally in 10 or 20 years from now all of the standards we have we’ll ask ‘How did we not have this before?’ I think that’s the next generation question, them saying ‘I heard about Cambridge Analytica in a history book, that’s crazy,’” said Diego Naranjo, a Spanish policy adviser to EDRi at its office in Brussels.

GDPR faces uncertainty about what it will look like when it is implemented and enforced by national governments in Berlin, Paris or Rome.

A common counterargument is that more regulation will stifle innovation and deter newcomers lacking the army of lawyers employed by big tech firms.

The law, which applies to governments as well as businesses, also makes a distinction for sensitive personal data, including someone's religion, political views and health. It is not clear how precise platforms such as Facebook will be in allowing users to control the data that is the center of its business model.

The law, which applies to governments as well as businesses, makes a distinction for sensitive personal data, including someone's religion, political views and health. It is not clear how precise platforms such as Facebook will be in allowing users to control the data that is the center of its business model.

The social media platform did not reply to a question about what the controls will look like, though said in a statement that “We'll make sure Facebook's products and services comply with the GDPR” and pointed to a speech from COO Sheryl Sandberg that her company would go beyond what's required in the law.

Facebook also did not answer a question about whether it would make its entire platform compliant with the new regulation or have different standards for Europe and for users in countries such as the United States, where there is no general data law.

The Obama administration made multiple attempts for a "Consumer Privacy Bill of Rights" that fizzled in Congress, and many data issues, such as an investigation into Facebook and Cambridge Analytica, are handled by the Federal Trade Commission rather than a specific data authority like those in Europe.

“One model is the U.S. model where you don't really have a data protection law and then the best example of a comprehensive data law is GDPR,” said Amba Kak, a policy fellow for Mozilla who is advocating for the passage of a data protection law in India.

A committee in India is currently drafting a law and looking at other countries for examples, though the leadership the U.S. has shown in creating technologies has been lacking when it comes todeveloping proper guidelines for the technology's use.

Dr. Brent Mittelstadt, a researcher at the Oxford Internet Institute, said that some mixture of self-regulation and state regulation is necessary to avoid situations such as with Cambridge Analytica, where users' data was unknowingly used for political purposes.

“You can't take the benefits of self-regulation and simultaneously make the claim, ‘Hey we were operating within the confines of the law, sorry if you have a problem with it,’” he said.

Experts say the tougher laws may be necessary because the average person should not have to be a techie to know that their data is safe online.

“When you use the elevator you were not checking the safety regulations for people who make elevators, you were just pressing the button and going in. That should be the same thing for the rest of our technologies,” Naranjo said.

Read Full Story