American Tech Companies Succumb to Global Privacy Demands - Outside the US

When in Rome...? Or, increasingly, Manila, Buenos Aires, Singapore, Johannesburg and pretty much everywhere else.

American tech companies are discovering that although the internet was supposed to make the world borderless, those pesky nation states and their idiosyncratic peoples still have a few personal predilections about how, what and where their data should be used - and by whom.

Americans seem preternaturally optimistic that it will all work out. They may be, depending on who's doing the assessment, either naive, clueless, unconcerned or simply more interested in the art of the deal than in the implications of how the info they traded for a cents-off coupon gets reused. 90% of Americans acknowledge that they have 'lost control' of how their data is collected and used.

But, elsewhere, especially Europe, the rules are getting stricter about who can and cannot use personal information for what purposes.

Why should these multi-gazillion dollar US enterprises give a hoot? Because most of their revenues and profits come from outside the US: 60% of Apple's revenue, 80% of Facebook's users, etc. Whoever pays for the tune, calls the tune. JL

Mark Scott reports in the New York Times:

Across the globe, countries are looking toward Europe for cues on how best to protect their citizens’ privacy. Tech giants like Google and Facebook may call Silicon Valley home, but they’re increasingly falling in step with international regulators.

FROM their glass-fronted office parks and start-up lofts in Silicon Valley, American tech companies oversee ever-expanding global empires.

Google has a bigger slice of the online search market in Europe than it does at home, where rivals like Microsoft still give it a run for its money. More than 80 percent of Facebook’s 1.3 billion users live outside the United States, with Brazil and India among the social network’s most important markets. And Apple, which generates roughly 60 percent of its revenue overseas, now sells more iPhones and iPads in Shanghai and St. Petersburg than it does in San Diego.

The world’s seemingly insatiable appetite for all things tech has made many of these giants among the most profitable companies in the world. But selling these products has also placed them largely at odds with global privacy rules that go far beyond what American lawmakers currently demand at home.

While the tech companies often rely on lengthy (frequently incomprehensible) consent forms and First Amendment rights to protect themselves against claims of misuse of their users’ online information, that defense does not hold up in large parts of the world, including Malaysia, South Africa, Brazil, Singapore, Hong Kong, Japan and Argentina.

That’s because the right to privacy — given almost the same weight as freedom of expression — is taken more seriously abroad, notably in Europe, where politicians are considering rules that would fine any company up to $125 million or 5 percent of its annual revenue if it flouted the region’s strict data protection rules.

And as people from Paraguay to the Philippines clamor for greater control over their postings on social networks, in online forums and across the Internet, many of these countries’ regulators are taking a page out of Europe’s privacy playbook. That includes lifting passages — almost word for word — from the region’s tough privacy regulations when writing their own national laws.

“Europe’s data protection rules have become the default privacy settings for the world,” said Billy Hawkes, the former data protection regulator for Ireland, whose role included policing the handling of online data of international users for companies with overseas operations run from Dublin like LinkedIn, Twitter and Dropbox. “People around the world are benefiting from the standards we’ve set here.”

Faced with the growing need to cater to a global audience — and to contend with international regulators who have put privacy front and center — American companies are being forced to comply with stricter protection standards that are frequently more onerous than those at home.

Facebook, for example, has repeatedly rewritten its privacy policies to give its global users a greater say in how their online data is used. Lawmakers and individuals in Europe — where all of its non-American customers are regulated — protested that the company routinely broke the region’s privacy rules when handling people’s personal information.

“Facebook just took its U.S. privacy policy and rolled it out in Europe,” said Max Schrems, an Austrian lawyer who has filed a class-action lawsuit against the social network involving more than 25,000 users for violating the region’s data protection laws when it sent individuals’ personal data to the United States, where domestic intelligence agencies could gain access to the information. “They never wanted to adapt their privacy rules to anywhere outside America.”

Microsoft claims that its cloud computing services (which allow people to store documents and photos on the Internet) now comply with Europe’s tough data protection rules — the only American company so far to receive such approval.

Google, meanwhile, is scrambling to comply with a recent European court ruling that allows anyone — whether in or out of the 28-member European Union — to ask that links to online information about themselves be removed from its global search results.

Although Google fought hard to block this so-called right to be forgotten, it lost the battle, and has scrubbed thousands of links from its search results to adhere to the European ruling. Advocates for the new standard are hoping to force the company to extend the practice across its entire global search business — and potentially to the United States.

“Americans really do care about these issues,” said Gus Hosein, a senior fellow at Privacy International, a London-based consumer advocacy group that campaigns for tougher privacy laws. “But right now, they have very limited rights that they can exert over how their data is used.”

For their part, Google and Facebook maintain that they follow the privacy standards wherever their users are, and that people can opt out of online advertising or delete online profiles if they want to stop using the companies’ services.

Across the globe, countries are looking toward Europe for cues on how best to protect their citizens’ privacy.

When Brazil recently unveiled the country’s new Internet bill of rights, for example, lawmakers demanded that tech companies obtain permission from users before sharing their data with online advertisers and marketers.

New rules in South Africa forbid sending people’s online information electronically to countries that do not replicate its stringent privacy laws, though the law has yet to be tested on whether data can be sent to the United States.

In South Korea, lawmakers also have created some of the world’s toughest data protection rules, giving people the right to access their online information held by tech companies whenever they want.

And while the United States does have some privacy rules related to minors, health care records and consumer protection, more than 90 percent of Americans say they have now lost control over how companies collect and use their online data, according to a recent poll by the Pew Research Center.

So for tech giants like Google and Facebook, the writing is on the wall. These companies may call Silicon Valley home, but they’re increasingly falling in step with international regulators.