For those on the margins of the privacy community, there is a narrative that repeats about the EU General Data Protection Regulation that goes something like this: The GDPR is a tremendous burden. It's going to change the way the internet works forever. Tech companies are desperate to fight it.
A recent New York Times article flogged a lot of these. "Tech Giants Brace for Europe's New Data Privacy Rules." Oh noes! First, the Amero-centrism of the piece isn't surprising, I guess, as the NYT is fundamentally a U.S. paper, but there are tech giants that are NOT in Silicon Valley, ya know. Spotify is pretty big. King makes a few games you play. Deliveroo. Trivago. They're all, like, in the EU already.
But the funniest part for me was this two-paragraph juxtaposition:
European officials said the coming rules are forcing American tech giants to take a step back.
“There has not been any pushback from American companies,” said Věra Jourová, the European Commissioner for Justice, Consumers and Gender Equality. “If anything, they seem very eager to understand how exactly they can comply with the regulation.”
Does that quote really support the sentence that precedes it?
I've been getting this question a lot from various journalists and others I've met with here in Europe recently: "How much of a burden will the GDPR represent? Which products won't be offered because of it?"
I think those are the wrong questions. Sure, there might be a service or two that has to be rethought or rejiggered. We heard about Facebook's suicide prevention service not being rolled out in the EU because of GDPR concerns. But I think, in many ways, privacy professionals and IT professionals think the GDPR is the best thing since sliced bread and the tech companies that actually have their acts together are really embracing the GDPR. Finally, the tough IT and privacy questions that should have been getting asked and answered all along are being addressed.
All of a sudden, the whole organization is actually listening! Yes, we do in fact need to get some order and structure around our data processes. Yes, privacy is in fact vital to our business interests. Yes, it would be nice if we had confidence in what we can do with each piece of personal data, rather than having some vague idea that what we're doing might be illegal. Yes, knowing exactly what consent is attached to what piece of personal data is pretty handy, actually.
You mean we should have contracts with our vendors outlining exactly what they can do with the data that we share with them? GREAT IDEA.
Oh, you think we should encrypt data at rest and in transit. WHY DIDN'T I THINK OF THAT?
You think our customers might like us more if the value exchange of data for services was more transparent and they didn't have a vague idea that we were sort of abusing them? YOU DON'T SAY.
For privacy pros, the GDPR isn't a burden or a headache, it's a big older brother who just showed up at the playground who agrees with you that, yes, we are going to play kickball and you're going to go first and get to be the pitcher and everyone is going to like it and have fun.
Which isn't to say that the rest of the organization now resents the privacy and IT teams, although I do think there's some of that here and there. No one likes to change the way they do things. But the business leaders, the C-suite, understands that this is the future of the internet. The halcyon Wild West days of data as the new oil are ending in much the same way we don't make cars that get 12 miles to the gallon anymore.
A sense of responsibility has set in. That was happening regardless of the GDPR, of course. Consumers were becoming more savvy and there's good evidence that opaque apps that hoover up your data and don't deliver value aren't getting very far anymore anyway. But the GDPR has ramped up that realization and leveled the playing field in many ways.
Won't it be better to compete on product and delivery, rather than on who has the sneakiest data mining team? Wouldn't you rather work on your value exchange instead of your duplicity (to be particularly cynical)?
I think most people who truly love and value the opportunity the internet provides are perfectly happy with the GDPR — even if a few bits of it are a pain in the butt.
But, you know what? Big brothers can sometimes be a pain in the butt, too.