Europe Moves to Shield Citizen Data

This is getting interesting. First the President of Brazil cancels her official visit to the US to protest electronic privacy violations. Now the European Parliament is considering legislation requiring that Google, Yahoo, Apple and others request permission from European authorities before complying with US warrants.

Given that US companies control most of the commercially useful data acquisition platforms as well, it is entirely plausible that the law's scope will be extended.

The issue appears to be less about privacy than about power. We would use the word 'control' but do not really believe anyone has much of that anymore. If privacy is going to be invaded for any reason - business or governmental - national authorities want a say in who gets what and when.

The days of US hegemony are over in many respects, but it seems that the NSA revelations coupled in terms of timing with those about use of athletes, celebrities and even children's personal information without permission or recompense is now being seriously challenged.

National security agencies may worry about safety and advertisers will moan about profits, but these latest developments do not necessarily signal the end of such data retrieval. What they do portend is the inevitable demand by citizen consumers for some say in how, when, by whom and, potentially, for how much, their information is accessed and applied. Get used to it. JL

James Kanter reports in the New York Times:

Lawmakers here have introduced a measure in the European Parliament that could require American companies like Google and Yahoo to seek clearance from European officials before complying with United States warrants seeking private data.

The measure, an amendment to a broader electronic privacy law pending in Parliament, is a response to Prism, the secret spying program led by the National Security Agency that came to light in June. Europeans were outraged by the revelations that some of the biggest American Internet companies, many of whose users live in Europe, were required by the United States authorities to share information in e-mail, Web searches and other online data.

Parliament’s Committee on Civil Liberties, Justice and Home Affairs may vote on the amendment as soon as Monday, said Jan Philipp Albrecht, the German member who is responsible for steering the legislation through the Parliament. His office later clarified that the vote could be delayed until Thursday. Once it wins approval by the committee, Mr. Albrecht may begin negotiations on the Parliament’s behalf with European governments, which are discussing their own version of new privacy rules.

But a European Union official, who spoke on condition of anonymity, said the vote could be further delayed if the United States intervened or if there was heavy lobbying by tech industry groups that oppose the bill.

The American government successfully lobbied against a similar move by European officials two years ago. The reports about the N.S.A.’s activities gave European privacy rights proponents new incentive to pursue the matter again.

Mr. Albrecht briefed reporters on the amendment on Thursday, saying it was meant to end a system in which European citizens have scant data protection from American law enforcement agencies.

“What happens today is that companies transfer personal data from Europe to a third state like the United States without having a legal base in European Union law,” he said. If the measure becomes law, Mr. Albrecht said, companies “will be forbidden to do that.”

A spokesman for the United States mission to the European Union declined to comment on Thursday. Messages seeking comment from Yahoo received no response. Google declined to comment.

The measure would obligate companies not based in the European Union to nonetheless comply with European data protection rules if they operate in Europe. Violators could face fines of as much as 5 percent of a company’s global annual revenue.

The amendment would require companies to seek approval from a “supervisory authority” in a bloc country before transferring data on a person’s individual electronic communications, whether phone calls, e-mails, Web searches or social media interactions, outside the union at the request of a foreign government or court.

The broader privacy legislation has been debated for more than two years. Mr. Albrecht said he would like a final draft of the legislation to be approved by the spring and to go into effect two years later.

That plan could be stymied by intense lobbying by Silicon Valley companies and other powerful groups in Brussels — and by sparring among European governments about how far to go in protecting privacy.

Ireland, Britain and other countries are concerned that the European Union is failing to take advantage of growth opportunities from Internet businesses that might help revive the economy. Apple, Facebook and Google all have European headquarters in Dublin.

Even if the new rules are approved, existing bilateral agreements between individual European governments and the United States might keep data flowing across the Atlantic as part of efforts to fight terror and crime.