Showing 7 of 34 Publications in GDPR

The Paradox of Choice Meets the Information Age

TOTM Barry Schwartz’s seminal work “The Paradox of Choice” has received substantial attention since its publication nearly 20 years ago. In it, Schwartz argued that, faced . . .

Barry Schwartz’s seminal work “The Paradox of Choice” has received substantial attention since its publication nearly 20 years ago. In it, Schwartz argued that, faced with an ever-increasing plethora of products to choose from, consumers often feel overwhelmed and seek to limit the number of choices they must make.

Read the full piece here.

Continue reading
Antitrust & Consumer Protection

Kristian Stout on GDPR

Presentations & Interviews ICLE Director of Innovation Policy Kristian Stout took part in a virtual panel hosted by the Center for Data Innovation about whether the “automated decision . . .

ICLE Director of Innovation Policy Kristian Stout took part in a virtual panel hosted by the Center for Data Innovation about whether the “automated decision opt-out” features of the EU’s General Data Protection Regulation (GDPR) could be improved without harming users. The full clip is embedded below. 

Continue reading
Data Security & Privacy

What You Need to Know About the EU’s New AI Regulation

TOTM The European Commission this week published its proposed Artificial Intelligence Regulation, setting out new rules for  “artificial intelligence systems” used within the European Union. The . . .

The European Commission this week published its proposed Artificial Intelligence Regulation, setting out new rules for  “artificial intelligence systems” used within the European Union. The regulation—the commission’s attempt to limit pernicious uses of AI without discouraging its adoption in beneficial cases—casts a wide net in defining AI to include essentially any software developed using machine learning. As a result, a host of software may fall under the regulation’s purview.

Read the full piece here

 

Continue reading
Innovation & the New Economy

Building the Digital Future: Can the EU Foster a Dynamic and Crime-Free Internet?

TOTM The European Commission has unveiled draft legislation that would overhaul the rules governing the online lives of its citizens. The draft rules are something of a mixed bag.

The European Commission has unveiled draft legislation (the Digital Services Act, or “DSA”) that would overhaul the rules governing the online lives of its citizens. The draft rules are something of a mixed bag. While online markets present important challenges for law enforcement, the DSA would significantly increase the cost of doing business in Europe and harm the very freedoms European lawmakers seek to protect. The draft’s newly proposed “Know Your Business Customer” (KYBC) obligations, however, will enable smoother operation of the liability regimes that currently apply to online intermediaries.

Read the full piece here.

 

Continue reading
Innovation & the New Economy

COVID-19 Exposes the Shallowness of Our Privacy Theories

TOTM The importance of testing and contact tracing to slow the spread of the novel coronavirus and resume normal life is now well established. The difference . . .

The importance of testing and contact tracing to slow the spread of the novel coronavirus and resume normal life is now well established. The difference between the communities that do it and the ones that don’t is disturbingly grim (see, e.g., South Korea versus Italy). In a large population like the U.S., contact tracing and alerts will have to be done in an automated way with the help of mobile service providers’ geolocation data. The intensive use of data in South Korea has led many commenters to claim that the strategy that’s been so effective there cannot be replicated in western countries with strong privacy laws.

Read the full piece here.

Continue reading
Data Security & Privacy

Comments on the California Consumer Privacy Act (CCPA)

Regulatory Comments We begin our analysis of the California Consumer Privacy Act (“CCPA”) with a discussion of the standardized regulatory impact assessment (SRIA) prepared for the AG’s Office by Berkeley Economic Advising and Research, LLC.

We begin our analysis of the California Consumer Privacy Act (“CCPA”) with a discussion of the standardized regulatory impact assessment (SRIA) prepared for the AG’s Office by Berkeley Economic Advising and Research, LLC. The bottom-line cost figures from this report are staggering: $55 billion in upfront costs and $16.5 billion in additional costs over the next decade. The analysis includes large benefits as well, but as we show in the full comments, the actual costs are even higher than the SRIA estimates and the benefits fall far short of making up for those costs.

We also draw on the the early evidence coming out of the EU related to GDPR enforcement and compliance to highlight some potential pitfalls that California is facing. In particular, after its first twelve month period in force, the compliance costs were astronomical; enforcement of individual “data rights” led to unintended con- sequences; “privacy protection” seems to have undermined market competition; and there have been large unseen — but not unmeasurable — costs in forgone startup investment.

Finally, we note that, despite the DC Circuit trimming the FCC’s 2018 Restoring Internet Freedom Order, the fact remains that the FCC still retains a conflict-preemption authority to specifically preempt state laws that are incompatible with its regulations. The DC Circuit only limited the FCC’s ability to generally preempt all potentially conflicting state laws, requiring that each preemption be challenged in a fact-intensive inquiry. Similarly, it is also possible that the broad extent of the CCPA’s rules, and their impositions on firms outside of California’s borders could lead to Dormant Commerce Clause challenges. Activities that “inherently require a uniform system of regulation” or that “impair the free flow of materials and products across state borders” violate the Dormant Commerce Clause. As the FCC noted in its RIF Order, Internet-based communications is such a type of activity.

We therefore offered the following suggestions:

  1. Clarify the definition of “personal information” so that it is not overinclusive of incidental information and also does not allow third-parties to claim rights over others’ data;
  2. Stress that the “valuation” of data is a difficult exercise, and the requirements to value data when offering different tiers of service shall be interpreted liberally;
  3. Clarify that the definition of a “business” does not mean that any firm that “receives for the business’s commercial purposes” an individual’s personal information includes firms that merely “receive” information on consumers as a normal part of operations. For example, a website that logs a user’s behavior through its site “receives” location, IP Address, and other information about that user, but should not be included in such a broad definition;
  4. Delay implementation until there is a broadly available means of ensuring that firms can reliably ascertain the validity of user data requests (i.e. that, as is happening under the GDPR, third- parties are not able to obtain information on the customers of firms by representing themselves as those customers); and
  5. Use the authority granted by the CCPA to establish a necessary exception in order to comply with applicable federal law to temporarily delay implementation until (1) it is determined that the law does not violate the Dormant Commerce Clause, and (2) the AG’s Office has the opportunity to consult with the FCC and ensure that the CCPA is not subject to conflict-preemption in light of the FCC’s authority over Internet communications.
Continue reading
Data Security & Privacy

The Good, Bad, and the Ugly of the EU’s Proposed Data Protection Regulation

TOTM Nearly all economists from across the political spectrum agree: free trade is good. Yet free trade agreements are not always the same thing as free . . .

Nearly all economists from across the political spectrum agree: free trade is good. Yet free trade agreements are not always the same thing as free trade. Whether we’re talking about the Trans-Pacific Partnership or the European Union’s Digital Single Market (DSM) initiative, the question is always whether the agreement in question is reducing barriers to trade, or actually enacting barriers to trade into law.

Read the full piece here

Continue reading
Data Security & Privacy