Search Results

ICLE Director of Innovation Policy Kristian Stout took part in a virtual panel hosted by the Center for Data Innovation about whether the “automated decision opt-out” features of the EU’s General Data Protection Regulation (GDPR) could be improved without harming users. The full clip is embedded below. 

(This issue brief is a joint publication of the International Center for Law & Economics and the Progressive Policy Institute)

Executive Summary

Data is, logically enough, one of the pillars supporting the modern digital economy. It is, however, not terribly useful on its own. Only once it has been collected, analyzed, combined, and deployed in novel ways does data obtain its highest utility. This is to say, a large part of the value of data is its ability to flow throughout the global connected economy in real time, permitting individuals and firms to develop novel insights that would not otherwise be possible, and to operate at a higher level of efficiency and safety.

Although the global transmission of data is critical to every industry and scientific endeavor, those data flows increasingly run into barriers of various sorts when they seek to cross national borders. Most typically, these barriers take the form of data-localization requirements.

Data localization is an umbrella term that refers to a variety of requirements that nations set to govern how data is created, stored, and transmitted within their jurisdiction. The aim of data-localization policies is to restrict the flow of data across a nation’s borders, often justified on grounds of protecting national security interests and/or sensitive information about citizens.

Data-localization requirements have in recent years been at the center of a series of legal disputes between the United States and the European Union (EU) that potentially threaten the future of transatlantic data flows. In October 2015, in a decision known as Schrems I, the Court of Justice of the European Union (CJEU) overturned the International Safe Harbor Privacy Principles, which had for the prior 15 years governed customer data transmitted between the United States and the EU. The principles were replaced in February 2016 by a new framework agreement known as the EU–US Privacy Shield, until the CJEU declared that, too, to be invalid in a July 2020 decision known as Schrems II. (Both complaints were brought by Austrian privacy advocate Max Schrems).

The current threatened disruption to transatlantic data flows highlights the size of the problem caused by data-localization policies. According to one estimate, transatlantic trade generates upward of $5.6 trillion in annual commercial sales, of which at least $333 billion is related to digitally enabled services.[3] Some estimates suggest that moderate increases in data-localization requirements would result in a €116 billion reduction in exports from the EU.

One difficulty in precisely quantifying the full impact of strict data-localization practices is that the list of industries engaged in digitally enabled trade extends well beyond those that explicitly trade in data. This is because “it is increasingly difficult to separate services and goods with the rise of the ‘Internet of Things’ and the greater bundling of goods and services. At the same time, goods are being substituted by services … further shifting the regulatory boundaries between what is treated as goods and services.” Thus, there is reason to believe that the true value of digitally enabled trade to the global economy is underestimated.

Moreover, as we discuss infra, there is reason to suspect that data flows and digitally enabled trade have contributed a good deal of unmeasured economic activity that partially offsets the lower-than-expected measured productivity growth seen in the both the European Union and the United States over the last decade and a half. In particular, heavy investment in research and development by firms globally has facilitated substituting the relatively more efficient work of employees at firms for unpaid labor by individuals. And global data flows have facilitated the creation of larger, more efficient worldwide networks that optimize time use by firms and individuals, and the development of resilient networks that can withstand shocks to the system like the COVID-19 pandemic.

In the Schrems II decision, the court found that provisions of U.S. national security law and the surveillance powers it grants to intelligence agencies do not protect the data of EU citizens sufficiently to justify deeming U.S. laws as providing adequate protection (known as an “adequacy” decision). In addition to a national “adequacy” decision, the EU General Data Protection Regulation (GDPR) also permits firms that wish to transfer data to the United States to rely on “standard contractual clauses” (SCC) that guarantee protection of citizen data. However, a prominent view in European policy circles—voiced, for example, by the European Parliament—is that, after Schrems II, no SCC can provide a lawful basis for data transfers to the United States.

Shortly after the Schrems II decision, the Irish Data Protection Commission (IDPC) issued a preliminary draft decision against Facebook that proposed to invalidate the company’s SCCs, largely on the same grounds that the CJEU used when invalidating the Privacy Shield. This matter is still pending, but a decision from the IDPC is expected imminently, with the worst-case result being an order that Facebook suspend all transatlantic data transfers that depend upon SCCs. Narrowly speaking, the IDPC decision only immediately affects Facebook. However, if the draft decision is finalized, the SCCs of every other firm that transfers data across the Atlantic may be subject to invalidation under the same legal reasoning.

Although this increasingly restrictive legal environment for data flows has been building for years, the recent problems are increasingly breaking into public view, as national DPAs grapple with the language of the GDPR and the Schrems decisions. The Hamburg DPA recently issued a public warning that the use of the popular video-conference application Zoom violates GDPR. The Portuguese DPA issued a resolution forbidding its National Institute of Statistics from transferring census data to the U.S.-based Cloudflare, because the SCCs in the contract between the two entities were deemed insufficient in light of Schrems II.

The European Data Protection Supervisor has initiated a program to “monitor compliance of European institutions, bodies, offices and agencies (EUIs) with the ‘Schrems II’ Judgement.” As part of this program, it opened an investigation into Amazon and Microsoft in order to determine if Microsoft’s Office 365 and the cloud-hosting services offered by both Amazon and Microsoft are compatible with GDPR post-Schrems II. Max Schrems, who brought the original complaint against Facebook, has through his privacy-activist group submitted at least 100 complaints as of August 2020 alone, which will undoubtedly result in scores of cases across multiple industries.

The United States and European Union are currently negotiating a replacement for the Privacy Shield agreement that would allow data flows between the two economic regions to continue. But EU representatives have warned that, in order to comply with GDPR, there will likely be nontrivial legislative changes necessary in the United States, particularly in the sensitive area of national-security monitoring. In effect, the European Union and the Unites States are being forced to rethink the boundaries of national law in the context of a digital global economy.

This issue brief first reviews the relevant literature on the importance of digital trade, as well as the difficulties in adequately measuring it. One implication of these measurement difficulties is that the impact of disruptions to data flows and digital trade are likely to be far greater than even the large effects discovered through traditional measurement suggest.

We then discuss the importance of network resilience, and the productivity or quasi-productivity gains that digital networks and data flows provide. After a review of the current policy and legal challenges facing digital trade and data flows, we finally urge the U.S. and EU negotiating parties to consider longer-term trade and policy changes that take seriously the role of data flows in the world economy.

Read the full issue brief here.

U.S. and European competition laws diverge in numerous ways that have important real-world effects. Understanding these differences is vital, particularly as lawmakers in the United States, and the rest of the world, consider adopting a more “European” approach to competition.

Read the full piece here.

The European Commission recently issued a formal Statement of Objections (SO) in which it charges Apple with antitrust breach. In a nutshell, the commission argues that Apple prevents app developers—in this case, Spotify—from using alternative in-app purchase systems (IAPs) other than Apple’s own, or steering them towards other, cheaper payment methods on another site. This, the commission says, results in higher prices for consumers in the audio streaming and ebook/audiobook markets.

Read the full piece here.

The Digital Markets Act (“DMA”) is a complex piece of regulation. It includes some great ideas (as tackling predatory innovation) while being surprisingly conservative (defined as “?the wish to resist great or sudden change” by the Oxford Dictionary).

Read the full piece here.

Background…

Some U.S. antitrust advocates, including members of Congress, recently have advocated the United States adopt a more European approach to antitrust policy. This comes as the European Commission itself is proposing a Digital Markets Act (DMA) that would impose new regulations on Big Tech platforms and ban many forms of conduct outright.

But…

Europe’s economies are less innovative, less dynamic, and ultimately, significantly poorer than the United States. Europe’s technology markets, in particular, are relatively stagnant. Regulating them directly is likely to make Europe’s problems with innovation worse, and would serve as a poor model for the United States to follow.

Read the full explainer here.

We can expect a decision very soon from the High Court of Ireland on last summer’s Irish Data Protection Commission (“IDPC”) decision that placed serious impediments in the way of using “standard contractual clauses” (SCC) to transfer data across the Atlantic. That decision, coupled with the July 2020 Court of Justice of the European Union (CJEU) decision to invalidate the Privacy Shield agreement between the European Union and the United States, has placed the future of transatlantic trade in jeopardy.

Read the full piece here.

In a new paper published by the Progressive Policy Institute, ICLE Senior Fellow Dirk Auer and PPI’s Caleb Watney make the case that while the EU desires to be at the forefront of developing regulations to manage emerging issues relevant to artificial intelligence, the European Commission’s leadership have failed to grapple meaningfully with the significant tradeoffs that regulation of these new technologies entails.

Unlike many other trading blocs (most notably the EU), the ASEAN nations are yet to agree upon a common, unified set of competition law provisions. Nevertheless, recent years have seen the ASEAN members embark upon various initiatives that seek to harmonize their competition regimes (though these stop well short of common rules). In 2016, for instance, the member states adopted the ASEAN Competition Action Plan (“ACAP”). Among other things, the plan seeks to ensure that all ASEAN states implement competition regimes that meet a set of minimal standards, and eventually to harmonize competition policy across the ASEAN region.

These ongoing efforts to modernize and harmonize ASEAN competition laws do not arise in a vacuum. Rather, they take place amid a longstanding effort by both the European Union and the United States to export their respective competition laws throughout the world:

The EU and the US . . . want the rest of the world to follow their respective regulatory models. Both jurisdictions have actively promoted their competition laws as “best practices” abroad, urging developed and developing countries alike to adopt domestic competition laws and build institutions to enforce them. They promote their models through a specialized network of competition regulators—the International Competition Network (ICN)—and also more general bodies—notably the Organization for Economic Cooperation and Development (OECD) and the United Nations Conference on Trade and Development (UNCTAD). They also employ bilateral tools in their promotion effort—including offering technical assistance to emerging competition law jurisdictions. In its trade agreements, the EU also explicitly conditions access to its markets on the adoption of a competition law, exporting its own law in the process, while the US relies primarily in its persuasive powers rather than on formal treaties in exporting its laws.

No doubt the EU and US competition regimes are the most developed and dominant exemplars; following the policies of one or both to some extent is virtually inevitable. But this raises a critical question: should the ASEAN countries attempt to mimic the competition regimes of other developed nations, notably those that are in force in the EU and the US? And, if so, which one of these regimes should they draw more inspiration from?

While we certainly do not purport to know what type of regime would best fit the idiosyncratic needs of the ASEAN countries, we seek to dispel the myth that the European model of competition enforcement would necessarily provide a superior blueprint. To the contrary, we show that the evolutionary, common-law-like regime that has emerged in the US has many strengths that are often overlooked by contemporary competition policy scholarship, and which might provide a particularly good fit for the economic and political realities of the ASEAN member states.

Our paper also falls squarely within a much broader debate. Over the past couple of years, there have been renewed calls for policymakers to reform existing competition regimes in order to better address the challenges that are, purportedly, posed by the emergence of the digital economy. This has notably resulted in a series of high-profile reports, papers, and draft legislation, concluding that more interventionist tools are required to effectively deal with competition issues in digital markets. The draft European Digital Markets Act, the US House Judiciary report on competition in digital markets, as well as the draft bill put forward by US Senator Amy Klobuchar all mark the culmination of this antitrust reform movement.

Although the connection is often implicit, these calls for reform ultimately seek to implement (and amplify) features that are currently at the forefront of European competition enforcement. Potential reforms thus include broadening the goals of competition policy, as well as relying more heavily on structural and behavioral presumptions (rather than outcome-oriented reasoning).

At times this desire to move closer to the EU model is more explicit. For example, writing in Vox, Matthew Yglesias ventured that “[o]ne idea [for remedying perceived problems with US antitrust] would be for the US to actually move to something more like the European system and abandon the consumer welfare standard.” In a similar vein, Bloomberg featured an article by economics writer Noah Smith heaping praise on the growing populist antitrust wave and its potential to roll back the consumer welfare standard. And, at least according to EU Commissioner Margrethe Vestager, the US executive branch agencies have expressed a “renewed deeper interest and curiosity as to what we are doing in Europe.”

In parallel to these calls for reform, scholars have also analyzed the evolution of competition legislation around the world (as well as regulation, more generally). These scholars observe that recent initiatives have tended to mimic the rules of the European Union, rather than the more laissez faire approach that is often associated with the US. This trend has been referred to as the “Brussels Effect.” Accordingly, these scholars predict a regulatory “race to the top”, where more stringent rules and regulations will become the norm. While ostensibly agnostic, this implicitly conveys a sense that “resistance is futile,” and that the European approach will inevitably continue to spread more rapidly than its US counterpart.

With these policy debates in mind, our paper argues that ASEAN member states should not be too quick to embrace the European model of competition enforcement – be it by adopting more expansive competition laws or by regulating competition in digital markets. While the above-referenced scholars and advocates tend to assert that a more-expansive, EU-oriented approach would improve economic conditions, economic logic and the apparent reality from Europe strongly suggest otherwise.

Antitrust is an attractive regulatory tool for a number of reasons. The vague, terse language of most antitrust laws (including those in both the US and EU) readily lend themselves to “interpretation” imbuing them with virtually limitless scope. Indeed, the urge to treat antitrust as a legal Swiss Army knife capable of correcting all manner of social and economic ills is apparently difficult to resist. Conflating size with market power, and market power with political power, many recent calls for regulation of the tech industry are framed in antitrust terms, even though they are mostly rooted in nothing recognizable as modern, economically informed antitrust legal claims or analysis.

But that attraction is precisely why everyone—and emerging economies like ASEAN members in particular—should care about the scope, process, and economics of antitrust and the extent of its politicization. Antitrust in the US has largely resisted the relentless effort to politicize it. Despite being rooted in vague and potentially expansive statutory language, US antitrust is economically grounded, evolutionary, and limited to a set of achievable social welfare goals. In the EU, by contrast, these sorts of constraints are far weaker.

This conclusion is in no way altered by the fact that US antitrust law has become the “outlier” of global antitrust enforcement, compared to the EU’s more “consensual” approach. What matters is a policy’s actual results, not whether it is widely adopted; the world is full of debunked beliefs that were once widely shared. And it is far from certain that the widespread adoption of the EU model is in any way indicative of superior results. It is equally (or even more) plausible that this model has proliferated because it naturally accommodates politically useful populist narratives—such as “big is bad,” robin hood fallacies and robber baron myths—that are constrained by the US’s more evidence based and rational antitrust decision-making. America’s isolation might thus be a testament to its success rather than an emblem of its failure.

The EU’s more aggressive pursuit of technology platforms under its antitrust laws demonstrates many of the problems with its approach in general. Endorsing the European approach to antitrust, in a naïve attempt to bring high-profile cases against large internet platforms, would prioritize political expediency over the rule of law. It would open the floodgates of antitrust litigation and facilitate deleterious tendencies, such as non-economic decision-making, rent-seeking, regulatory capture, and politically motivated enforcement.

Bringing international antitrust enforcement in line with that of the EU would thus unlock a veritable Pandora’s box of concerns that might otherwise be kept in check. Chief among them is the use of antitrust laws to evade democratically and judicially established rules and legal precedent. When considering this question, it is important to see beyond any particular set of firms that enforcement officials and politicians may currently be targeting. An antitrust law expanded to consider the full scope of soft concerns that the EU aims at will not be employed against only politically disfavored companies, companies in other jurisdictions, or in order to expediently “solve” otherwise political problems. Once antitrust is expanded beyond its economic constraints and imbued with political content, it ceases to be a uniquely valuable tool for addressing real economic harms to consumers, and becomes a tool for routing around legislative and judicial constraints.

Our paper proceeds as follows. Section II analyzes the high-level differences between the American and European approaches to competition policy. Notably, this Section shows that these regimes pursue different goals, rely to varying degrees on economic insights to inform their decision-making, afford very different degrees of judicial deference to antitrust authorities, and exhibit different degrees of politization. Section III shows that the US and Europe also differ substantially in terms of the conduct that may constitute an infringement of competition law—the EU system being significantly more restrictive. Section IV turns to question of competition in digital platform markets. It argues that European competition enforcement in the digital industry provides a cautionary tale that cuts against both the adoption of ex ante regulation and a relaxation of existing antitrust standards (such as the “consumer welfare standard”). Section V posits that reducing economic concentration—sometimes cited as a byproduct of European-style competition enforcement—should not be a self-standing goal of antitrust policy. Finally, Section VI argues that many of the economic and political characteristics of the ASEAN economy cut in favor of using the US model of competition enforcement as a blueprint for further development and harmonization of ASEAN competition law.

Read the full white paper here.