Earlier this month, the European Commission approved the U.S.-EU Privacy Shield, a new framework to govern the transfer of personal data from the European Union to the United States in support of transatlantic commerce. Despite getting a stamp of approval, it is largely expected to face legal challenges and ongoing scrutiny.
While the shield is intended to assure confidence in privacy protection, the U.S. is poised to throw a significant monkey wrench into the terms and assumptions on which the agreement was made, leaving some U.S. and European leaders scratching their heads. Online privacy regulations in the U.S. are being turned upside down in the wake of the net neutrality debate thanks to the Federal Communications Commission's controversial reclassification of Internet Service Providers as utilities under outdated telecommunication rules that aren't a fit for a modern Internet. This new classification strips privacy authority from the Federal Trade Commission — the long-established U.S. agency overseer of privacy regulations on which the Privacy Shield was based.
Now, the FCC is pursuing a completely different and less flexible set of rules only on ISPs- rules very different than the existing FTC protections that apply to "edge providers" like mobile app Pokemon GO, Netflix and Facebook. By this fall, consumers could have two very different sets of privacy protections while online given that the majority of tracking happens at the edge, which wouldn't be covered by the FCC rules.
At a recent Senate hearing, several experts expressed concern that such a fragmented privacy policy in the U.S. will create more uncertainty and doubt in the Privacy Shield, which would have impacts on the global marketplace.
Jon Leibowitz, former FTC chairman under President Obama and current co-chair of the 21st Century Privacy Coalition, told federal lawmakers, "I absolutely agree. The Commerce Department and others are relying on the FTC approach and if it's being questioned as not strong enough, I think that does not potentially bode well as the Privacy Shield goes through the European Union vote."
Dean Garfield, president and CEO of the Information Technology Industry Council concurred, "I think it would add a layer of confusion that would be unhelpful. The Privacy Shield recognizes that there is some distinction between the privacy regime in the U.S. and the security regime in the U.S. and in Europe, but that they're essentially equivalent. That's a recognition that the FTC's framework and principals are well established. It would be highly ironic and certainly unhelpful if because of another regulatory agency, that agreement that has just been put in place would be called into question because we're now questioning whether the privacy regime in the U.S. is one that's workable."
This bifurcated approach to online privacy protection also hasn't been lost on our European partners, who have expressed serious concerns and confusion about the different roles of the FCC vs. FTC in light of the Commission's proposed rules.
In its own review of the proposed Privacy Shield, the European Data Protection Supervisor noted, "In the light of recent developments on U.S. enforcement, we also recommend clarification of the respective roles of the FCC and the FTC over broadband Internet service providers." In addition, at least ten Members of the European Parliament followed up with written questions to the European Commission requesting an opinion on whether it will rely on the FTC blueprint to determine that U.S. privacy rules are "essentially equivalent" to the EU's rules.
These concerns were also outlined in a recent opinion column, in which Amjad Bashir, UK Member of the European Parliament noted, "What we are seeing now in the United States is a glaring double standard. In discussions with the EU, the Americans insist that FTC rules are fair and robust, providing protection that is as good as what is on offer in Europe, and that the problem largely stems from a misunderstanding. However, in domestic discussions, the authorities have decided that these same rules are not good enough for US citizens."
Alicia Richart, former executive advisor of the Ministry of Industry, Energy and Tourism in Spain has also expressed concern. "The US has long held that its data protection rules meet the EU's privacy requirements and adequately protect EU citizens' data," Richart said. "Its sudden change of stance domestically can only lead to further doubts and questions from the side of the Europeans. While the global data economy needs the two regions to work together and show leadership on these issues, instead we are seeing them drift apart."
As the Internet continues to proliferate around the world, many nations are looking to the U.S. to take a strong leadership role in tackling its challenges, privacy chief among them. Unfortunately, the FCC is making America look weak and confused. It is ignoring the expertise of the FTC and creating a disjointed and fractured marketplace, imposing one set of very different privacy rules on Internet service providers under the guise of "empower[ing] consumers," while disregarding entirely the web's biggest data collectors. As evidenced by the growing concern over mixed messages out of Washington, there are serious issues to be addressed with the FCC's involvement in privacy regulation, and it is vital that the international impact is also considered before allowing the FCC to blindly proceed.
Drew Johnson is National Director for Protect Internet Freedom, a grassroots, nonprofit organization of 1.6 million supporters dedicated to defending a truly free and open Internet, and preserving it as a tool for democratic distribution of information, societal change, and technological innovation. Thinking of submitting an op-ed to the Washington Examiner? Be sure to read our guidelines on submissions.