Europe Moves Ahead on Internet Personal Privacy Protections

The New York Times
February 3, 2013

The European Union is considering far-reaching privacy regulations that would give the citizens of its member countries significant control over how Web sites and marketing companies collect and use data about them. Years in the making, the effort stands in stark contrast to the much slower pace of discussions about online privacy laws in Washington.

Reports in The Times and elsewhere have documented the dubious but legal ways in which companies, including many that most people do not even know exist, build profiles of people’s behaviors, browsing histories and shopping habits by tracking them online and off, through data from retailers, for instance. Those profiles are then sold to marketers and others without the knowledge of the person whose information is being traded.

Europe has historically been more protective of personal information than the United States, which still has no general law to protect people’s privacy online while most E.U. nations do. The privacy policies of American companies are voluntary, with the exception of protection under federal laws for certain kinds of sensitive information like health records and data about children younger than 13. Now, European policy makers are proposing to harmonize new, tougher rules across the 27-member union.

Several proposals would go well beyond the voluntary policies of companies like Google. They would require companies to obtain permission before collecting personal data and specify exactly what information will be collected and how it will be used. If asked, companies would have to provide users with data that has been collected about them and allow them to fix mistakes. One proposal would include a so-called “right to be forgotten” that would make it mandatory for companies like Facebook to delete all information about users who want to wipe the slate clean.

Internet companies and the Obama administration are lobbying against some of the measures, which they argue would place onerous restrictions on services that people want to use and impede the sharing of information between Europe and the United States, particularly between law enforcement agencies. But privacy advocates say that those concerns are overblown and that most Internet companies and news sites would easily get the consent of users who already willingly hand them personal information.

Senior European leaders like Neelie Kroes, vice president of the European Commission, have promised that the final policy will protect consumers in ways that will not stifle new ideas and data sharing. The E.U. could approve a new privacy policy later this year.

Efforts to improve protections do not appear to be advancing in Washington. American policy makers have made little progress on a sensible proposal made by the Federal Trade Commission in 2010 known as “do not track.” Carried out properly, the measure would give users an easy way to prevent companies from surreptitiously amassing information about them to pitch them ads.

Ideally, Web browsers would have a default setting that barred tracking but allow consumers to opt for tracking, which many might do because they want to receive special offers. (The New York Times tracks users on its Web site but does not monitor their activities on other sites or sell their personal data to third parties.)

The Obama administration has talked with technology and marketing companies about creating voluntary industry standards. But the best way to ensure that Americans can keep their personal information private is through federal legislation backed by regulatory enforcement. Europe is setting an example of how that might be accomplished. While the United States is unlikely to go as far as the E.U., it needs to do a lot more.