The First Privacy Law of the Big Data Era Is Here, and It Has Both Tencent and Facebook Nervous

What exactly does the EU's GDPR cover?

Once again, a company says people are spreading rumors about it.

On April 12, a screenshot began circulating showing that QQ International would stop operating in Europe. The official link in the screenshot also explained that "due to operational needs, QQ will cease operations starting May 20." It was widely assumed this was meant to sidestep the EU's forthcoming General Data Protection Regulation (GDPR).

A day later, Tencent posted a statement on Weibo saying its own earlier announcement was in fact a rumor, and telling users not to believe it. Open the announcement link now and the text has been changed: the current version will stop working on May 20, but service will resume once users upgrade to the next major version. The announcement says nothing about when that update will be released.

What exactly happened isn't clear, but Tencent's contradictory announcements did get people in China paying attention to the EU's GDPR. On May 25, the General Data Protection Regulation (GDPR for short) takes effect — a 260-page regulation drafted by the European Commission.

Chinese companies aren't the only ones worried about GDPR. Just as word of QQ International shutting down in Europe was spreading, Mark Zuckerberg was in Washington facing a second five-hour round of congressional questioning. Written in bold on the notepad in front of him was a piece of advice from his advisers: "Don't say we already comply with GDPR."

They have reason to worry. Wired magazine wrote that GDPR lays the foundation for global data protection for the next decade, setting rules and limits on nearly every step tech companies take to make money from personal data.

For the internet giants, a European market of several hundred million people is not something to walk away from. But failing to comply with GDPR can cost a company as much as 4% of its annual revenue in fines. Take Tencent: last year its full-year revenue was $36.387 billion, so if QQ International broke GDPR, the fine could run as high as $1.46 billion. And if the offender is a small company with thin profits, the EU has that covered too — GDPR fines start at 20 million euros.

After the Facebook data-leak scandal broke, the US Congress also began discussing the possibility of data-protection legislation. And it is already watching Europe, which got there first.

At the Facebook hearings, members of Congress brought up GDPR again and again. Zuckerberg gave a long answer stressing that Facebook would roll out data-protection rules worldwide at the same standard as the EU's GDPR.

It's easy to imagine that the US won't be the only legislature the EU's new law inspires.

Before this, internet companies were of course subject to the law, but when it came to collecting and using user data, they largely made their own rules — and by now we all know what that meant: whatever made money.

GDPR could change that, and its effects won't stop at Europe's borders.

The First Privacy Law of the Big Data Era Brings 6 Big Changes

On January 25, 2012, a huge lobbying coalition made up mainly of the American internet giants — Google, Amazon and Facebook — descended on the European Parliament's headquarters in Brussels for a long campaign of lobbying.

It was here that the European Parliament first published a draft of the General Data Protection Regulation, a draft whose contents signaled that personal data protection was being raised to an unprecedented level.

Why would a law drafted by the European Parliament make tech companies in the US so nervous?

We've pulled out the six provisions that affect users most, so you can see exactly what GDPR changes.

1. GDPR widens the range of user data that is protected

Before GDPR, the definition of user data was vague in both EU and US law. The EU's earliest Data Protection Directive defined user data as covering only things like login names, passwords and purchase records.

Right at its start, GDPR spells out which types of private data it protects, including:

• Basic identity information, such as name, address and ID number;
• Online data, such as location, IP address, cookie data and RFID tags;
• Health and genetic data;
• Biometric data, such as fingerprints and irises;
• Racial or ethnic data;
• Political opinions;
• Sexual orientation.

On protecting this data, GDPR states plainly that service providers may not process it without the user's consent. In other words, they can't use it to sell ads without permission.

That covers most digital information that can identify a user, directly or indirectly. It draws the boundaries of what personal data needs protecting entirely from the user's point of view.

2. It doesn't matter where a company is headquartered — if it serves the EU, it's covered

Another big difference with GDPR is that its jurisdiction isn't drawn strictly along national lines, but by where the data is.

This breaks with the tradition of tech companies only having to obey the laws of their home country, and instead thinks about enforcement from the user's side.

GDPR requires any non-EU company or organization that provides products or services to EU residents — or that merely collects or monitors their data — to comply, no matter where that company or organization sits.

Traditionally, legal jurisdiction has been divided by country or region. Silicon Valley companies obey US law, but because the internet isn't bound by geography, they can push their services out to the whole world.

GDPR's rules clearly fit the nature of the internet, a virtual world without borders, much better. So although it is an EU data-protection regulation, it applies to any company anywhere in the world that serves EU residents.

That is exactly why Silicon Valley tech companies, and even Chinese internet companies, have started paying close attention to it.

In fact, regulating by the region served has already been proposed by several countries, China's Cybersecurity Law among them.

3. The fines are enormous — big companies could pay billions of dollars

"Penalties are set at a minimum of 20 million euros or 4% of the company's annual revenue, whichever is higher."

That is the bill the EU hands companies that break GDPR. For a concrete sense of what that means, Apple is a good example.

Apple's annual revenue has topped $200 billion in each of the past two years, so if Apple broke GDPR, the fine could reach $8 billion. Not many companies would be willing to shoulder a fine that size.

By contrast, if Apple violated a privacy rule of the same order in the US, the fine would usually be only a few hundred thousand to a few million dollars.

The EU has handed tech companies enormous bills before: on June 27, 2017, the European Commission announced that Google had broken its rules and fined it $2.7 billion.

European Commission President Barroso has said the point of these fines is to make tech companies see how serious a privacy violation is, so that they eventually fix their internal processes and protect the information of EU residents.

4. Tech companies can't bury their data-use terms in a user agreement as thick as a dictionary

The first big change Barroso mentioned is that internet companies must get a user's explicit consent before using their data.

That may sound no different from how things work now — we already have to click "agree" on a user agreement to use a free service. Except that almost nobody reads those complicated agreements carefully.

GDPR requires companies to tell users plainly, before collecting and using personal data, how that data will be collected and used, and to get the user's explicit consent first.

"Explicit consent" here means it can't be bundled into the user agreement. It has to be spelled out separately inside the website or app, with the user's consent obtained there, and the user must be able to withdraw and manage that consent easily at any time.

Just half a month ago, Facebook updated its privacy tools, letting users view or delete the personal information Facebook holds on them, delete search history, set ad preferences, and set who can see their posts, among other things.

Alongside those updates it launched a tool called "Access Your Information," which lets users look at comments or posts they have shared and choose to delete them.

Facebook said the tools had been planned for a May release, timed to comply with GDPR, but the Cambridge Analytica affair forced it to move them up.

Apple issued a statement at the same time saying it would update Apple ID over the coming months so users could download a copy of all the data stored in it, temporarily deactivate the account, and delete its contents for good.

5. Users can demand that all their personal data be deleted

Facebook and Apple both stress that stored user data can be wiped completely, and that traces back to a right the EU has debated for a long time — the right to be forgotten.

The idea has been raised inside the EU since 2006: once a user withdraws consent for a company or organization to use their personal data, that company or organization must immediately and unconditionally delete all of it.

In GDPR, the right to be forgotten is treated as a basic human right. The regulation requires tech companies to be able to delete a user's data from their systems quickly and unconditionally. That also protects users from unknown consequences of personal data left lying around.

Put another way: when an EU resident asks to have their Sina Weibo account and its associated content deleted, Weibo must unconditionally delete every piece of information in that account and keep no other backups, and every analytics or advertising company involved must delete what it has stored too.

The idea was highly controversial at first, with the US and the EU far apart. Then in 2014, the Spanish citizen González sued Google Spain, demanding the removal from Google's search results of two news reports about money he owed, on the grounds that he had already paid the debt off.

After appeals from several sides and rounds of deliberation, the EU's court ruled that the right to be forgotten is part of human rights and ordered Google to remove the reports about González. That established how much the right to be forgotten matters. By May 2014, Google had removed 139,000 URLs, and 95% of the requests came from ordinary users.

But deleting data isn't as simple as hitting delete on a computer.

The whole process is neither clean nor easy to carry out. In a large company especially, user information is often spread across marketing, sales, customer service and even finance and supply-chain systems, and can also sit in local files.

Once a particular user's data has to be erased completely, the company has to rely on a data-synchronization mechanism to make sure nothing is missed — and right now that is a very hard and very expensive operation.

That's one reason the tech giants have resisted GDPR so hard.

6. Offering an option to share less isn't enough — it has to be the default

It isn't only about deleting after the fact. GDPR is called the law that will govern how user data is used for the next decade because it forces companies to think about handling personal privacy data at the earliest stage of designing a business.

There are two requirements here. First, when tech companies design new business systems, processes and services from now on, the parts that handle personal data must be designed the way GDPR demands. Companies must also be able to produce information proving they have met that requirement.

Product manager or planner, you now have to know GDPR's detailed requirements, so that protecting user data gets weighed at the same time as the product's needs.

At the same time, internet companies often say users are allowed to do this or that. They know perfectly well that most people never change the default setting.

So another GDPR principle is this: when personal data might be called on by requests at several different levels inside a system, process or service, the default must be the option that shares the least — sharing nothing at all.

Simply put: if the Taobao account linked to your Weibo wants your likes in order to recommend products, by default Weibo may not share anything directly. It can only ask again at a higher level of request, which usually needs the user's consent.

This provision of GDPR has also created a new job — the data protection officer (DPO).

GDPR requires companies to appoint a data protection officer to carry out their GDPR plan and monitor how far it has got. The role also requires the DPO to report directly to company leadership, and to be responsible for rolling out the measures that keep the company from breaking GDPR.

Beyond these hard rules for company processes, GDPR also draws lines around privacy protection that used to be blurry.

Children have data-protection rights too: GDPR requires companies to get parental consent before processing the personal data of children under 16 for online services. Member states may legislate a lower age of consent, but not below 13.

It also sets rules for events like hacking attacks that can lead to data leaks.

Once a company discovers a data breach, it must report any leak that could pose a risk to individuals to the data protection authority (DPA) within 72 hours, and must notify the affected individuals without undue delay.

When Zuckerberg responded to the Cambridge Analytica affair, he said Facebook had learned three years earlier, from a Guardian reporter, that Cambridge Analytica had improperly obtained Facebook user data — and that Facebook had not dealt with it in time.

Facebook isn't alone. The ride-hailing app Uber and the US credit-services company Equifax have both had customer data stolen, and neither disclosed it in time; Uber's management at the time even chose to quietly pay the hackers to make the problem go away.

GDPR Continues More Than 20 Years of EU Data-Protection Lawmaking

So GDPR's strict clauses weren't dreamed up out of nothing. They were drawn from the mistakes behind the many data leaks of the past twenty years.

The EU's data-protection history goes back to the 1990s. In 1995, the EU passed the Data Protection Directive, also known as the "95 Directive" — the first time clear standards were set for member states legislating to protect personal data.

In 1995, the idea of personal data was limited to relatively simple things: usernames, home addresses, postal codes. All the 95 Directive granted users was a right of access — the right to see their information and correct any errors in it, so that it stayed accurate.

But the growth of the internet, and especially the fast growth of the mobile internet over the past 20 years, meant the law written back then couldn't cover the endless stream of new developments and loopholes.

In 2002, the EU decided for the first time to amend the 95 Directive. On July 12 that year, the new Privacy and Electronic Communications Directive was published.

It set out detailed rules barring tech companies from storing and using user data without consent, and said service providers should guarantee users' right to know — for instance, telling users what data was being collected and what would be done with it next, and that they had the right to refuse.

That is basically the foundation of today's privacy provisions, but the Privacy and Electronic Communications Directive was still rough at the level of practical operation, and it lacked clear penalties for violations, so it never made tech companies take it seriously.

Cookies are a common internet technology for tracking and identifying users. After 2000, e-commerce sites like eBay became popular around the world, and while users browsed with their browsers, sites could store cookies on the user's own computer to identify and record their logins, browsing and purchases.

Users could switch cookies off by hand, but for the vast majority of them, if a site used cookies to record information without a clear notice, there was no easy way to know they were being recorded at all.

At the time, recording a user's login password and purchases was something the user agreement treated as agreed to by default. Sites sorted that information to recommend products — but it also left openings for security problems like hackers cracking accounts.

On November 25, 2009, the EU made another significant revision to its personal-data protections, passing the EU Cookie Directive and setting it to take effect across the EU on May 25, 2011.

The EU Cookie Directive required that a site keep cookies off for a first-time user, and only turn them on once the user explicitly agreed. That put the user's right to know into more concrete terms.

The privacy research firm TRUSTe reported in an October 2012 study that before the EU Cookie Directive arrived, only 12% of the UK's top 50 sites followed the cookie-setting requirement — a pop-up window, or a cookie notice or explanation in a designated header or footer. In France and Germany, not one of the top 50 sites complied.

Open Gumtree, the UK's biggest local-services site, today and you'll see a cookie notice right at the top, hard to miss.

The EU kept passing amending directives to improve the protection of user data, but all of them were still built on the basic framework of the 1995 Data Protection Directive.

In October 2008, Facebook announced it was setting up its international headquarters in Dublin, Ireland, and began pushing its social network across Europe. Figures from the internet research firm comScore showed that a year later, three-quarters of Europe's internet users had become Facebook users. Twitter followed Facebook into Europe.

Users' private information shifted from basic login passwords and purchase records to a daily stream of shares, photos, likes and browsing history. But at that point, none of the laws governing private user data had clearly adapted to the change.

The EU wanted a completely new, comprehensive framework to replace the one built twenty years earlier, which could no longer meet the needs of the mobile internet era.

On January 25, 2012, a draft of GDPR landed on the European Commission's table for the first time.

The Absence of Big Internet Companies Made Legislating Easier in Europe — but Other Regions Are Starting to Notice Too

Senator Bill Nelson, who chaired the congressional questioning of Zuckerberg, said as the hearing opened: "If Facebook and other social media companies don't play by the rules, then none of us will have any privacy left."

In practice, though, US regulation and scrutiny of social media has never been as strict as Europe's.

Because Silicon Valley's tech companies have gone global, tech services inside EU countries are largely a US monopoly — social media like Facebook and Instagram, or ride-hailing apps like Uber, are the services EU residents actually use.

Europe has no large internet companies of its own at the moment, which makes data-privacy rules relatively easy to push through and turn into law. And with a well-developed legal system and an emphasis on human rights, the EU has consistently acted earlier, and set more of a benchmark, in defending users' rights.

After the strict GDPR draft was published in 2012, it drew more than 4,400 proposed amendments — a number rarely seen in EU lawmaking — most of them from American internet companies. Debating those amendments alone took four years, but GDPR passed in the end with more than 640 votes in favor and 10 against.

In the US, meanwhile, Silicon Valley's tech companies spend heavily on lobbying Congress every year to make sure they escape strict regulation.

By a 2015 count in the US press, American tech companies spend as much as $2.6 billion a year on lobbying — more than the US Congress's own annual budget (the House at $1.2 billion, the Senate at $860 million). For big companies, the return on lobbying spending can run as high as 220 times.

Amazon and Google spend the most. Since Trump took office in particular, tech companies have set new lobbying records every year, trying to close the policy gap between themselves and the White House.

A report from the investment bank Bank of America Merrill Lynch shows that in the US, tech stocks are currently the least-regulated sector, facing only 27,000 regulatory rules, against 215,000 for manufacturing and 128,000 for finance.

But that is starting to change. GDPR's content, written entirely from the user's point of view, has been widely praised by American civil-rights groups, and more and more US media are debating whether strict rules like GDPR should be brought to the US.

Jeff Chester of the nonprofit Center for Democracy and Technology said in an interview: "The clock is starting, and we're going to see Congress finally act because of the pressure." He thinks Zuckerberg's hearing is an important doorway to helping the public understand the question of user privacy. Public anger is building, and this is the start of America's internet privacy war, not the end.

Om Malik, a partner at the Silicon Valley venture firm True Ventures, said he is quite sure Silicon Valley will be hit by regulation. "It wouldn't even be surprising if Amazon, Google and Facebook end up driving all of this. Legislation would keep smaller competitors from collecting data, and give them a commercial advantage."

Gene Kimmelman, president of the Washington consumer-rights group Public Knowledge, disagrees. He argues that even with a strong bipartisan consensus, getting a law passed is a big problem, and legislating in this environment will be very hard. He predicts it could take the US years to produce a law as strict as GDPR.

At the same time, several other countries have begun legislating to keep data from leaving their borders. China and Russia are both early movers, though their emphasis is quite different from GDPR's. In China, Apple has been required to keep iCloud user data inside the country, so that a state-owned company can manage it.

Russia introduced an amendment to its internet information management law in 2014. It requires foreign communication services, search engines and social networks to store Russian users' personal data inside Russia, and requires internet service providers to register with the government.

In early April last year, the chat app Zello was blocked for missing registration paperwork. Line, BlackBerry Messenger and the chat app vChat were blocked one after another after that.

Strict Data Protection Protects Users, but It May Also Feed Monopolies

For a long stretch after the internet was born, regulating internet data was mostly left to the tech companies themselves.

Back then, legislation offered only a vague notion of protecting user data, with no clear, specific requirements. Internet companies revised their user agreements step by step, trying to mine business opportunities out of user information while dodging as much legal liability as they could.

Through those user agreements, internet companies got users, step by step, to let more of their own data be exposed, so the companies could analyze what users liked and use algorithms to recommend the content they liked in their feeds.

Along the way, Facebook, which got there first, apologized again and again and was forgiven again and again, and internet companies around the world copied what it did. QDaily went through that process in detail in a story last week.

Now the problem has finally blown up, and it will show up in the internet giants' financial numbers.

"The tobacco industry (1992), the financial industry (2010) and the biotech industry (2015) have all shown that waves of regulation lead to underinvestment," Michael Hartnett, chief investment strategist at Bank of America Merrill Lynch, wrote in a research report. He listed a series of reasons for cutting tech-stock holdings this year, and the expected increase in regulatory pressure was the tenth and last of them.

The report noted that regulatory measures coming in the US and EU countries — raising online sales taxes, for instance — could cost tech companies around 4% of their revenue.

The high costs of strict personal-data protection, the complexity of authorizing data use (especially data sharing between companies), and the risk of excessive government oversight will all raise the operating cost of managing a company's information assets significantly.

At the same time, the data laws in the EU, China, Russia and elsewhere, which all govern data by where the user is, will further change internet companies' global businesses.

A survey by the research firm Ovum found that 52% of tech-company managers expect to face fines for violations. And the management consultancy Oliver Wyman reported that the EU could collect as much as $6 billion in fines in the first year.

The giants will pay a price. But their position may end up more secure than before.

The rapid expansion of every major internet service today can be traced back to collecting more information and pushing past privacy boundaries: scanning address books, using chat logs and email content to serve ads, trading user data with other companies, using user agreements to get people to "voluntarily" hand over more and more data.

As those practices come under regulation one by one, user data will be safer — but it also means new companies will find it harder and harder to get data. Meanwhile the data today's giants have already collected, and the analysis they have already built of every one of us, is still there. They also have more profit to absorb the added cost of data regulation.

These big companies' earnings will take a hit, but their already highly dominant positions will become even harder to challenge.

The same thing has already happened in banking, insurance, energy and cars.

Data Privacy Gets Protected, but GDPR Doesn't Solve the Other Harms of Using Data

The political news outlet Vox says GDPR matters at a deeper level because it will broadly address the user-data problems every industry in the world has to face — including governments and political institutions that use data to strengthen their control.

Before the internet, what government oversight could actually do was extremely limited. It was hard for a government to get hold of citizens' personal data on a large scale; what it had was simple information that had to be registered, like names and addresses.

Now, as people's lives and information have moved onto the internet, the reach of that oversight has widened step by step.

Under Prime Minister Narendra Modi, India is collecting large amounts of sensitive data from its citizens, including using biometric devices to track how public-sector employees perform at work. China too is accumulating vast amounts of data on its citizens — facial data, video of their movements in public places and more — and will ultimately use it to build a "social credit" ranking.

The PRISM affair in the US made citizens aware that the government was violating personal data privacy through tech companies, and civil-rights groups like the EFF have kept calling for laws to protect private information.

There will be more and more legislation. But don't count on it to limit government power.

There is also the question of what technology does to human behavior.

The computer scientist Jaron Lanier summed up the problems social networks pose for society as a whole at this month's TED conference.

Lanier cited a possibility the 1950s computer scientist Norbert Wiener had explored: a global computer system, with people carrying devices around every day that give them feedback based on their behavior, so that all of human behavior gets reshaped by the system. Such a society would be far too insane to survive.

Lanier said Wiener wasn't very worried about it at the time, because he thought it was technically out of reach — a thought experiment, nothing more. The room burst out laughing. Today everyone has exactly that device.

Yes: the convenience of the mobile internet has put too much of people's lives, thoughts and information onto the network. Internet companies use algorithms to analyze that data so you'll spend more time on their platform, because that's how you see more ads.

As computers get smarter and algorithms more precise, every piece of design and every piece of content exists to keep you on the small screen one minute longer. The stimulus works. It's like the classic Pavlov case in psychology: ring a bell every time before feeding a dog, and eventually the bell alone makes the dog salivate — the bell has become a conditioned "stimulus." In a sense, social media has become a kind of "symbolic stimulus" for human beings.

Technology doesn't only get everyone to spend more time online. It also encourages everyone to publish content that helps consume even more time, which brings the platform more ad revenue. At the same time, not everything we do can be quantified as data. But in internet products driven by targeted advertising, information that can't be turned into data does not exist.

Under that mechanism, the information that spreads furthest is always the kind that earns the platform money, or the kind that those in power want to get across — not necessarily the kind that helps the audience.

Protecting data matters, and GDPR should limit big companies' abuse of it. But the problems data creates are not over.

Cover image: sabemos.es