As the European Union finalises new digital-era laws, its legacy of world-leading privacy and data protection is at stake. Starting next week, the European Commission will kick off the introduction of landmark legislative proposals on data governance, digital market competition, and artificial intelligence. The discussions happening now and over the next few months have implications for the future of the General Data Protection Regulation and the rights this flagship law protects. With Google already (predictably) meddling in the debate, it is imperative that regulators understand what the pitfalls are and how to avoid them.
In a world where largely unregulated data collection, exploitation, and abuse are broadly damaging human rights and our democracies, the GDPR has become the gold standard for protecting our personal data, with other countries following our lead. Pushing through this Regulation was a huge victory for privacy advocates, who fought an unprecedented level of corporate lobbying to support the vital and necessary safeguards that now protect the 500 million people living in the EU. Now, however, it may be the EU itself that weakens these protections and erodes our rights.
Problematic framing: do not treat data as a product when data protection is a right
The first new legislation out of the gate will be the Data Governance Act, which the European Commission is set to publish on November 24. According to Commissioner Thierry Breton, the new Data Strategy aims to ensure the EU “wins the battle of non-personal data” after losing the “race on personal data”. We strongly object to that narrative.
While countries like the US have fostered the growth of privacy-invasive data harvesting business models that have led to repeated data breaches and scandals such as Cambridge Analytica, the EU stood against the tide, adopting strong data protection rules that put people before profits. Far from “losing” a race to monetise our personal data at any and all cost to our societies, the EU is ensuring that business models are not based in stripping us of our rights. That’s a win, and it puts the EU at the leading edge of privacy-protective technological innovation.
It would be a grave mistake for the EU to abandon this approach. Unfortunately, from what we have seen of the leaked proposed text, the Data Governance Act introduces vaguely defined concepts such as “data altruism” and “data re-use” that threaten people’s ability to control how their personal information is being used. And it is not the only new legislation that has troubling framing and implications for data protection. The forthcoming Digital Markets Act will likely consider data an “asset”. New proposals on artificial intelligence likewise centre data as a “fuel for innovation”.
There is no question that data is valuable. But regulators must not forget that protecting data is and will remain a fundamental right across the EU.
Digital Markets Act: do not overlook data protection in analysis of market power
As the EU seeks to address important structural competition issues through the Digital Markets Act — which we and many other digital rights groups generally support — it should examine the relationship between unlawful data harvesting practices and the way companies use this data to establish market power. When companies abuse our personal data to consolidate power, they should be required to delete this information. The EU must look at competition and data protection as two sides of the same coin.
Artificial intelligence: do ground innovation in human rights
As for the proposals on artificial intelligence, the EU still needs to decide what type of AI development it wants to promote. The indiscriminate uptake of AI is not a positive value in itself. The use of automated decision-making systems is neither always compatible with fundamental rights nor the best solution for societal problems such as violent speech online. The EU’s current approach to AI will not bring about trust nor excellence in these systems, and the European Commission should do much more to ensure that both the private and public sector respect and promote human rights in the context of artificial intelligence.
The bottom line: we cannot allow companies to diverge from data protection law and undermine fundamental rights for the sake of innovation. For innovation to bring value to people, it must be grounded in human rights.
Lobbying: prepare for Google et al. to defend the damaging status quo
With these new legislations in the pipeline, the EU should continue to look at the GDPR as a model for upholding rights while it heeds lessons from when the law was negotiated. Be prepared for aggressive lobbying.
We have already seen the avalanche of meetings, events, and papers around the launch of the Data Governance Act, Digital Markets Act, and the Digital Services Act, largely dominated by industry. Recently, an internal lobbying document from Google revealed the company’s tactics for creating internal disagreements within the European Commission. Google is also leveraging its membership in many trade associations to deliver its messages all over Brussels, often without having its name explicitly attached. One of these groups recently published a Google-funded study claiming that the Digital Services Act would cost two million jobs and €85 billion per year in lost Gross Domestic Product.
All of this sounds very familiar. We heard nearly identical claims about the GDPR. As companies like Google inevitably defend their current harmful business models, the EU must resist and present legislative proposals that protect our rights and benefit all economic actors.
Let’s build the digital future without backtracking on human rights
The European Union must not lose sight of its leadership role in defending privacy and data protection by advancing proposals that threaten to bin its legacy. We stand behind the EU institutions to defend and further advance these rights. As the Data Governance Act, Digital Markets Act , Digital Services Act, and AI proposals collectively design the next stage of the EU digital single market, let’s make sure this design puts people and our fundamental rights first.