In his keynote address on the first day of the International Conference of Data Protection and Privacy Commissioners, Apple CEO Tim Cook not only professed total support for a GDPR-like U.S. federal privacy law, but he also called for his fellow tech companies to do the same:
“Some oppose any form of privacy legislation,” Cook said. “Others will endorse reform in public and then resist and undermine it behind closed doors.”
Well, public endorsements quickly followed here in Brussels. Facebook CPO Erin Egan was asked if Facebook would support a GDPR-like privacy law in the United States and she replied, unequivocally, “Yes.”
Google General Counsel Kent Walker was asked about Google’s position on a U.S. federal privacy bill and replied: “Yes, we’ve been on record for some time calling for comprehensive privacy legislation in the past years.” He pointed to Google’s recent release of principles it supports as part a federal bill.
Finally, Microsoft Corporate Vice President and Deputy General Counsel Julie Brill, also a former FTC commissioner, made note that Microsoft has extended many of the EU General Data Protection Regulation’s protections to its entire customer base and has been a supporter of a U.S. federal privacy bill since 2005. Particularly, Brill endorsed a “strong, robust, and horizontally effective baseline privacy legislation. … We’re using our voice as strongly as we can to encourage that to take place,” she said.
Thus, representatives of four of the top seven technology companies in the world stood on the floor of the European Parliament, in front of the world’s privacy regulators, and endorsed a new U.S. federal privacy bill in public. Are they resisting and undermining the effort in private? That would now require some gumption, indeed.
With the GDPR in place, it may simply be that these tech organizations have already put in so much effort to comply that international consistency would be welcome.
“The GDPR provided clarity about what the rules of the road should look like,” said Microsoft’s Brill. “It provided clarity about what companies should do to be accountable and transparent.” Organizations were forced to operationalize the principles of accessibility, accountability, and transparency, she said. “We think the U.S. law should incorporate those principles.”
Brill also took the opportunity to advocate for U.S. law to regulate the use of specific technologies, including facial recognition, “particularly when it’s used by law enforcement.”
EU Commissioner Věra Jourová, fresh off last week’s Privacy Shield review with the U.S. Department of Commerce, was encouraged by the tech companies’ remarks.
“I welcome these announcements” of support for a U.S. federal privacy bill, she said in her remarks to open day two of the ICDPPC’s open session, “and I hope this will materialize in a constructive approach in the U.S. debate. People around the world want their privacy protected. They want their data to be safe. And businesses recognize that strong privacy protections give them a competitive advantage.”
Similarly, CNIL President and former Article 29 Working Party Chair Isabelle Falque-Pierrotin noted in her address that she welcomes “the commitments to data protection and ethics” made by Apple, Facebook, Google, and Microsoft. “I can only be pleased to hear the GDPR has been a major step for these companies in advancing toward more privacy, using it as a model.”
And yet, despite all of this support being sounded on this side of the Atlantic Ocean, University of Pennsylvania ethics professor Anita Allen, who served in the Obama White House as an advisor on research ethics, said, “I see no sign that our Congress has any interest in developing a comprehensive privacy law.”
Which is not to say a new law isn’t needed, she said. “In the current situation, where you have Facebook and Google becoming virtual public utilities,” she said, “and consumers not understanding how they work, they’re easily taken advantage of. It’s an asymmetry of power and knowledge that makes people vulnerable. And that’s why I think there’s room for government regulation for some of the services we’re using today where information is being collected and put to use.”
If there was an indication of the Trump administration’s stance, it came from FTC Commissioner Noah Phillips, a recent Trump appointee. As part of a panel with other regulators around the world, moderated by U.K. ICO Elizabeth Denham, he said his personal opinion on regulation is that it should be done “only if necessary and then very carefully.”
“In the context of technology like AI,” he continued, “which is rapidly developing, it’s important to recognize that unduly prescriptive rules can have outcomes that we can’t predict. And they can entrench incumbents, which can hurt competition.”
Denham then asked him pointedly whether the U.S. has the right laws in place to regulate technology appropriately, “or are there gaps?”
“I think,” Phillips replied, “that is a big question we are debating right now in the United States.”