Europe's New Online Privacy Rules Could Protect U.S. Users Too

9 hours ago
Originally published on April 16, 2018 8:38 pm

The European Union is preparing to implement sweeping privacy rules next month, but these new protections of individuals' information may set a new standard around the world — including in the U.S.

Beginning May 25, under the new General Data Protection Regulation, companies that collect or mine personal data must ask users for consent. No longer will firms be able to bury disclosures about pervasive tracking in hard-to-read legal disclaimers.

"We're not entirely satisfied with that's in there," says Estelle Massé, an analyst with the digital advocacy group Access Now, tells NPR's Ari Shapiro. "However, it's a great improvement from the previous law and it's also a great basis for the use of data in the digital age."

What counts as "personal" won't just be attributes like race, height, weight and religion, but also an individual's IP address or browsing history.

Rayna Stamboliyska, a data protection specialist based in Paris, says that under the new rules, the Internet is a place where no means no. She compares digital consent to sexual consent.

"Before you even put your cookie on my computer, or in my mobile device, you have to make sure I consent to being followed," she explains.

A cookie is a small piece of data a website might slip into your smartphone or laptop to keep track of what you're doing online. Right now, without clearly asking your permission, she says, many sites are watching your every move. Under Europe's new directive, that's not OK. Consent must be given, and it can be taken away.

Stamboliyska gives a simple example. Say you want to buy a new pair of shoes. You're fine with marketers slipping a Zappos ad into your morning news feed. But then later, you're done shopping. Under GDPR, you must have a way to say: "Look, I'm fed up of your shoes. Now just stop profiling me, and stop following me. And please do remove the data you have of me because I no longer want you to keep it."

Europe didn't create Internet giants like Google or Facebook, but now it's engineering a legal way to control them. Companies that violate the new rules face penalties of up to 4 percent of their global annual revenue or 20 million euros (about $25 million), whichever is higher.

Stamboliyska says that for too long, American companies have gotten away with too little oversight. In a recent scandal, Facebook lost control over the data of 87 million users.

CEO Mark Zuckerberg said he was sorry, but Stamboliyska says: "We don't need your apology. We need you to be respectful."

Last week, the Facebook chief told Congress he plans "to make all the same controls and settings available everywhere, not just in Europe." Tech giants Microsoft and Google have indicated they are also extending Europe's privacy rights to users around the world.

Michael Cohen, a lawyer based in Minneapolis, advises American media and Internet companies that operate in Europe. How exactly U.S. firms deal with new rules on the collection and storage of personal data is a work in progress. The GDPR is, he says, "aspirational, meaning that of course we would like to strive for what's considered the gold standard."

If users in Europe start to see really simple language and get truly easy-to-follow prompts, he says, Americans might want what the Europeans have.

Internet users will start to see notices from their news, music, gaming and other apps in the coming days and weeks.

Copyright 2018 NPR. To see more, visit


Democrats in the House and Senate are calling for an investigation into the National Park Service. They say the Trump administration has a pattern of restricting and censoring climate change science. And they point to a report on sea level rise written for the National Park Service as the latest example. Rae Ellen Bichell of member station KUNC visited the scientist who wrote it.

RAE ELLEN BICHELL, BYLINE: When I arrived at Maria Caffrey's house, her husband was about to take their baby out for a stroll.


MARIA CAFFREY: Cover her little feet.

BICHELL: Her baby is called Katherine. But Caffrey's professional baby is an 86-page report on the National Park Service. She's been toiling over it for the better part of six years. Caffrey's a climate scientist with the University of Colorado. But she also contracted with the service to study how intensifying storms and rising seas might impact more than a hundred National Park Service sites, places like the National Mall in Washington, D.C.

CAFFREY: Oh, it would create flooding across a massive area.

BICHELL: She came up with four outcomes for each site.

CAFFREY: There's a best-case scenario for if us and other nations decide to get together and reduce our CO2 emissions.

BICHELL: And then there's the worst-case scenario if we continue with business as usual. Compiling this report was a long slog. But finally, right before the 2016 presidential election, she turned in the final draft. And the National Park Service has been sitting on it ever since.

CAFFREY: Yeah. Yeah.

BICHELL: The Center for Investigative Reporting requested public records on the study, which show that it had been edited in a very specific way. She shows me on her laptop.

CAFFREY: OK, so they wanted to take out this.

BICHELL: Mentions of climate change being caused by humans have been systematically deleted - words like anthropogenic, the scientist way of saying human-caused. Sounds small...

ROMANY WEBB: But they're really important words.

BICHELL: That's Romany Webb, a climate law fellow at Columbia Law School.

WEBB: And if we remove them, it really impairs public understanding about what's causing climate change and what we can do to fix it.

BICHELL: Webb runs a site at Columbia called the Silencing Science Tracker. It tracks government attempts to restrict or prevent scientific research. So far they have more than 120 entries.

WEBB: And rising pretty much every day.

BICHELL: The National Park Service responded to our requests for an interview with a brief email saying they'll provide more information when the report is final. Meanwhile, Secretary of the Interior Ryan Zinke said he's never seen the report.


RYAN ZINKE: So I want an investigation into how that document got around to the press, it got - before even we had a chance to look at it.

BICHELL: Caffrey says there's a reason the press has the document.

CAFFREY: I was legally required to release these records.

BICHELL: She works for a public university, so it had to comply with record requests. It's unclear now what will happen with Caffrey's report on sea level rise. But while this report seems theoretical for now, baby Katherine could live through all the changes her mom's predicting. By 2100 she'll be 83.

CAFFREY: When the next big storm strikes a major city, she can think of mommy and how she warned people.

BICHELL: Or at least how she and others tried.

CAFFREY: I really am trying very hard.

BICHELL: But she's worried about what will happen to her report and how it may impact her future as a scientist. For NPR News, I'm Rae Ellen Bichell.

CHANG: That story comes to us from the Mountain West News Bureau. Transcript provided by NPR, Copyright NPR.