Your personal information can be profitable to a company and deeply personal to you. Those interests do not always line up.
The European Union offers a stronger foundation for protecting consumers. Its privacy framework gives people rights and places limits on what organizations can do with their information, even when collecting more of it would be profitable.
Americans should expect that same starting point.
Privacy begins with rights
The EU recognizes personal data protection as a fundamental right. Its General Data Protection Regulation, or GDPR, turns that principle into obligations for organizations handling personal information.
The United States has developed a more fragmented approach. As the Congressional Research Service explains in its overview of data protection law, federal protections grew around particular sectors and activities. State laws add another layer. That means the information involved, the organization handling it and where you live can affect your protection.
Some states have made meaningful progress. California gives consumers rights to access, correct and delete personal information, with exceptions, and to opt out of its sale or sharing. Calling the U.S. completely unregulated would be wrong.
But people should not have to understand a patchwork of laws to know how much control they have over information about themselves.
Companies should justify what they collect
The GDPR requires a lawful basis for processing personal data. Consent is one basis. A necessary part of a contract, a legal obligation or a qualifying legitimate interest can also provide grounds, among others.
So the distinction is more substantial than “Europe requires an opt-in and America allows an opt-out.” Neither system fits that description in every situation.
Under the GDPR, organizations must also limit collection to what is necessary, identify the purpose and avoid keeping information longer than needed. Privacy safeguards must be considered in the design and default settings of a service.
An online retailer needs an address to deliver an order. That need does not give it unlimited permission to use the address for unrelated purposes.
This puts responsibility on the organization collecting the information. Consumers should not have to discover every use of their data and then chase down each company to stop it.
California’s opt-out rules are valuable. But being able to stop certain uses and requiring businesses to justify their practices from the beginning address different parts of the problem. Consumers benefit from both.
Control must continue after collection
Under the GDPR, people have rights to access and correct their information, seek deletion in specified circumstances and object to certain uses. These rights have conditions and exceptions. A bank, for example, may have to retain records to meet a legal obligation.
Even with those limits, the principle matters. Handing over information for a service should not mean surrendering all control over what happens to it afterward.
That control matters to us as citizens as well as customers. Information about our lives deserves protection whether we are shopping, applying for work or participating in public debate.
Enforcement should change behavior
The EU’s independent national data protection authorities investigate complaints and enforce the rules, with the European Data Protection Board supporting consistent application across countries.
For certain serious violations, GDPR fines can reach €20 million or 4% of a company’s worldwide annual turnover, whichever is higher. Regulators can also restrict or ban processing.
The U.S. can take substantial action too. The FTC announced a $5 billion Facebook penalty in July 2019, along with restrictions on the company’s practices.
Still, adding up fines does not tell us which system protects people better. We should ask whether harmful practices stop and whether people can actually exercise their rights.
The EU framework needs effective enforcement to deliver on its promises. Rights mean little if exercising them becomes exhausting.
Profit should depend on respecting privacy
I have spent my career in media and marketing. I understand the value of reaching the right audience. I also believe that a business should be able to explain why it needs our information and accept meaningful limits on its use.
European businesses still compete, advertise and earn profits under the GDPR. The argument for stronger privacy rules is that commercial value should come with responsibility to the person providing it.
That is why I favor the EU’s foundation: enforceable rights, limits on collection and responsibility placed on the organizations using our data.
Our information has value. Our ability to control what happens to it should have value too.
