The U.S.-EU Privacy Debate: Conventional Wisdom Is Wrong

This week’s IAPP Global Privacy Summit will provide ample opportunity to further explore privacy on the books and even more so, privacy on the ground, with Professors Bamberger and Mulligan arriving in Washington together with leading European and global regulators. On Thursday, Bamberger and Mulligan will debate their most recent paper, Privacy in Europe: Initial Data on Governance Choices and Corporate Practices, with Giovanni Buttarelli, the Assistant EDPS. Some of the cross-border issues will also be discussed on Friday, in a special keynote conversation with Isabelle Falque-Pierrotin, the President of the French CNIL and Chair of the Article 29 Working Party; Christopher Graham, the UK Information Commissioner; and Jacob Kohnstamm, the Dutch data protection commissioner (until recently, himself the Article 29 Working Party Chair). In addition, tomorrow, the Future of Privacy Forum will host its annual Privacy Papers for Policymakers event on Capitol Hill, featuring a presentation of Bamberger and Mulligan’s paper, to be followed by a discussion with the privacy commissioners of France, Mexico, the Netherlands, the United Kingdom and the Assistant EDPS. (Other papers selected for presentation include ones by Neil Richards and Adam Thierer).

Bamberger and Mulligan’s work finds that, in the U.S., privacy has become ingrained in organizational risk-management processes and driven by business considerations focusing on the preservation of consumer trust and corporate reputation. In contrast, in many European jurisdictions, privacy remains confined to legal compliance and focused on registration and reporting obligations targeted at regulatory agencies as opposed to the public at large. The development of privacy in the U.S. closely tracks the emergence of the privacy profession and its linchpin, the Chief Privacy Officer, which has become a senior executive role with strategic vision, access to the board and oversight over increasingly distributed teams of privacy experts, who are ingrained in every arm of a business, including product teams, designers and engineers.

The CPO is both internal and external facing, with internal responsibility for introducing privacy into larger risk management processes and the external engagement with policymakers, civil society, and – perhaps most important – similarly placed peers. Indeed, Bamberger and Mulligan quote one CPO who tells them “my team is not responsible for compliance, they’re responsible for enabling the compliance of the business.” This stands in contrast to the European Data Protection Officer, which – with certain exceptions in Germany – remains sidelined from business processes and relegated to legal compliance.

By incorporating multiple stakeholders, including not only companies and their regulators but also professional organizations, civil society, academics and the press, into privacy policymaking discourse, the U.S. has created an “environment for privacy,” which is far more dynamic and productive than one shaped by regulators alone.

Indeed, one fascinating lesson from the Bamberger and Mulligan scholarship is that the development of privacy in the U.S. “has been positively shaped by the incomplete, and comparatively late, institutionalization of privacy governance, in that it has allowed dynamism and adaptability in the face of rapid changes in the use and treatment of personal data.”

Thus they suggest that “changes in the field have arisen because, rather than in spite, of regulatory ambiguity.” Specifically, the FTC’s reliance on a standard-based regulatory mandate, requiring an assessment of “unfairness,” “reasonableness,” “consumer expectations,” and “countervailing benefits,” allowed for the development of a dynamic, consumer-focused, risk-management privacy processes. Such innate flexibility is essential in an area like privacy, which features still-nascent social norms that are as brittle as they are contextual.

Here, too, this organic development contrasts with the top-down European approach, which features highly detailed, technical legal mandates imposed by a staid bureaucracy and implemented by DPOs, whose “independence” becomes a double-edged sword, protecting them from corporate retribution but at the same time removing them from core organizational processes. As any parent who tries to educate a young child knows, children are ill served by strict and arbitrary mandates, such as “do x and y but not z,” but rather benefit from an iterative process that clarifies why doing x and y is better than doing z. This means – and should be an alarming lesson to the emerging European General Data Protection Regulation – that highly prescriptive legislative mandates actually foment less, not more privacy. In this vein, one Spanish DPO interviewed by Bamberger and Mulligan “blamed the compliance mentality for steering his company toward an inefficient and less privacy protective—but easily understandable—solution.”On the positive side, the expansive, organization-wide, risk-management approach to privacy is spilling over from U.S. organizations to the EU. This is happening through multinational businesses with robust global privacy programs; the activities of professional organizations such as the IAPP; and the evolution of certain EU DPAs to focus less on administrative reporting obligations and more on the creation of best practices and engagement of broader constituencies and the press.

As Bamberger and Mulligan note, “blending privacy into business unit decision-making from the start also offers a means for transforming privacy from a cost or limit to a function that must be integrated, along with other core specifications, into each product or service.”Surely this is what “Privacy by Design” means on the ground.

Photo: Jon McGovern via photopincc