Data, the European Approach

In an earlier blog, we saw the American attitude towards data and how it became the philosophy of the Internet, simply because the US was the first country on the Net and also its biggest market. Over time, the EU became a big market too. A significant difference in European views is rooted in the fact that few, if any, big Internet companies are European. Thus, the lobbying against data/privacy laws in the EU was far less (though the big American ones do lobby in EU), explains Rahul Matthan in The Third Way.

 

The EU attitude data is far more citizen-centric. Even before the Internet, that was the case in (Western) Europe largely because of their experience with fascism, Nazism and communism over the past century.

 

That history culminated in the GDPR doctrine for EU, a “full blown regulation… which became the most advanced data protection framework”. It says (1) all data about an individual belongs to that individual, not the company that collected it, (2) any data gathered must be the minimum possible relevant to the activity at hand, (3) it is the responsibility of the entity gathering the data to keep it secure.

 

Matthan looks into the effectiveness (or not) of the EU approach. Since data belongs to the individual, his consent is needed along with a declaration of what the data would be used for. While good in theory, reality is different. Getting consent repeatedly is hard, so companies ask for a blanket consent form. Since nobody is sure how the future may be, what other data may be relevant etc, they declare and collect everything possible. Individuals, if they want to avail the service (a tour, a cruise, WhatsApp usage), often have no real choice – if they don’t agree to the terms, they can’t use the service. Plus, if a company tried to actually tell you everything they intend to do with the data, how long they will retain it etc, then their Terms and Conditions become so long nobody can read (or understand) them and people just press Accept!

 

The second part (collect only what you need) is also hard to check. How does anyone, government or citizen, even track or check how the data was used? What if an algorithm starts using new data points in a creative way for some purpose? With AI, the problem is worse – nobody, not even the programmers, fully understands how the algorithm works.

 

The EU approach is impractical, concludes Matthan. Worse, regulations move far more slowly than the speed at which tech evolves. By the time the regulation comes into force, the world has moved on and new regulations are needed.

 

Which brings him to the eponymous third way of his book, i.e., India’s approach. We will look into that next.