Last year I was at SNW and talking to a storage admin from a large, international company who mentioned how data protection policies in EU were forcing them to limit where data gets copied and replicated. Some of their problem was due to different countries having dissimilar legislation regarding data privacy and protection.
However, their real concern was how to effectively and automatically sanitize this information. It seems they would like to analyze it off shore but still adhere to EU country’s data protection legislation.
Recently, there has been more discussions in the EU about data protection requirement (See NY Times post on Consumer Data Protection Laws, an Ocean Apart and the Ars Technica post Proposed EU data protection reform could start a “trade war”). It seems, EU proposals are becoming even more at odds with current US data protection environment.
Compartmentalized US data privacy
In the US, data protection seems much more compartmentalized and decentralized. We have data protection for health care information, video rentals, credit reports, etc. Each with their own provisions and protection regime.
This allows companies in different markets pretty much internal control over what they do with customer information but tightly regulates what happens with the data as it moves outside that environment.
Within such an data protection regime an internet company can gather all the information they want on a person’s interaction with their web services and that way better target services and advertising for the user.
EU’s broader data protection regime
In contrast, EU countries have a much broader regime in place that covers any and all personal information. The EU wants to ultimately control how much information can be gathered by a company about what a person does online and provide an expunge on demand capability directly to the individual.
EU’s proposed new rules would standardize data privacy rules across the 27 country region but would also strengthen them in the process. Doing so, would make it much harder to personalize services and the presumption is that the internet companies trying to do so would not make as much revenue in the EU because of this.
Although US companies and government officials have been lobbying heavily to change the new proposals it appears to be backfiring and causing a backlash. EU considers the US position to be biased to commerce and commercial interests whereas, US considers the EU position to be more biased to the individual.
US data privacy is evolving
On this side of the Atlantic, the privacy tide may be rising as well. Recently, the President has recently proposed a “Consumer Privacy Bill Of Rights” which would enshrine some of the same privacy rights present in the EU proposals. For instance, such a regime would include rights for individuals to see any and all information company’s have on them, rights to correct such information and rights to limit how much information companies collect on individuals.
This all sounds a lot closer to what the EU currently has and where they seem to want to go.
However, how this plays out in Congress and what ultimately emerges as data protection and privacy legislation is another matter. But for the moment it seems that governments on both sides of the Atlantic are pushing for more data protection not less.
Comments?
