THE new European data privacy rules that took effect last May 25 will not drastically change the way we live online, but these will make us think about cookies, at least.
No, not the cookies that we turn to in moments of stress, but the ones that our computers receive from the websites we visit, which then send back information on what we browse for, what we buy, and what else catches our attention online. We’re all like Hansel, dropping crumbs to mark our path, but instead of helping us find our way back home, these crumbs lead companies that sell gadgets, diets, vacations, erectile dysfunction drugs, and whatnot our way.
You may have received emails about privacy policy updates in recent weeks, as companies rushed to comply with the General Data Protection Regulation (GDPR). Twitter, for example, explained how you can “opt out of ads personalization.” Whether it came from a newspaper (The Financial Times), a guided meditation app (Headspace), or Twitter itself, a recurring message was that while you can turn off cookies along with other trackers like beacons and tags, it would mean getting served generic ads, instead of those that appear to match your interests and behavior online. The ads, the FT’s notice points out, won’t be as “relevant to you.”
In a nutshell, the GDPR requires companies to get the consent of European Union citizens before collecting personal data about them. It also asks these companies and institutions to require only the least amount of users’ personal data to keep their sites working.
We are not directly affected yet in the Philippines, except for those who run websites that hope to attract individuals based in the EU. But it’s worth noting that Japan and South Korea are getting ready to follow EU legislators’ lead in this experiment in online privacy and consumer protection.
The EU is also expected to try to limit access to its citizens and consumers unless its would-be trade partners are GDPR-compliant. That’s something Philippine legislators might want to examine, now that they’ve gotten other priorities out of the way, like setting penalties for those who throw hard objects at moving motor vehicles. (What about while the vehicles are parked? That’s for another essay.)
To avoid fines, which can go as high as US$23 million or four percent of revenues from last year, whichever is higher, some American media companies like The Los Angeles Times have suspended EU residents’ access to their sites while they figure out how to comply with the GDPR. Others are already under fire this early. Facebook, whose CEO Mark Zuckerberg faced the EU Parliament last week, was asked to explain why his company moved its data storage facilities from Ireland to the US before the GDPR kicked in, in effect transferring EU citizens’ personal data outside of the EU without seeking their permission to do so.
But that’s one of the challenges the EU will face with its GDPR. It has taken a bold and necessary step in protecting its citizens from the risks of trading privacy for convenience. How well it can enforce these new rules is another matter. More importantly, how many of its online citizens will invest the time and attention needed to make the most out of these rules? Author Tim Wu addresses this issue in “The Attention Merchants”, in which he points out the many times institutions and regulators have sounded the death knell for advertising in the last century, but were eventually proven wrong.
“These things have a logic of their own: Advertising always becomes less annoying and intrusive, and people rediscover their taste for ‘free’ stuff,” Wu wrote. “It is hard to imagine that a business with such a marvelously simple premise—capture people’s attention in exchange for a little fun and then resell it to firms sponsoring the amusement—might simply wither away.”
@isoldeamante