Red tape, innovation and the future of GDPR

Argu­ments around Brex­it have large­ly focused on sov­er­eign­ty, fish­ing, flags and num­bers on red bus­es — nos­tal­gic, deeply embed­ded mark­ers of nation­hood that kin­dle heat­ed emo­tions and vicious debate. But some of the more direct impli­ca­tions could be felt in a far more con­tem­po­rary sphere: how com­pa­nies digest and use your per­son­al data.

Since 2018, this has been sub­ject to the EU’s Gen­er­al Data Pro­tec­tion Reg­u­la­tion (GDPR). Most inter­net users will have noticed on their first vis­it to a web­site a pop-up ban­ner that asks for their “con­sent” or to “accept cook­ies”; that’s GDPR in action. The idea is that busi­ness­es need to jus­ti­fy what they do with per­son­al data, so they must ask you before they track your behav­iour online and sell some ver­sion of your infor­ma­tion to oth­ers. 

But data is also the lifeblood of many emer­gent tech­nolo­gies, not least arti­fi­cial intel­li­gence. There’s a sen­ti­ment that ask­ing busi­ness­es to pirou­ette around dig­i­tal red tape to col­lect mar­gin­al amounts of addi­tion­al data might be a lit­tle unnec­es­sary. 

Now that West­min­ster isn’t so behold­en to Brus­sels’ leg­is­la­tion, it looks like the UK might move away from some of that cook­ie-click­er jurispru­dence.

A lighter touch for business

Back in June, a group of Con­ser­v­a­tive MPs, includ­ing Iain Dun­can Smith, There­sa Vil­liers and George Free­man, showed their stripes as TIGRR. This Task­force on Inno­va­tion, Growth and Reg­u­la­to­ry Reform roared into the leg­isla­tive debate by declar­ing that GDPR “over­whelms peo­ple with con­sent requests and com­plex­i­ty they can­not under­stand, while unnec­es­sar­i­ly restrict­ing the use of data for worth­while pur­pos­es”.

Free­man, speak­ing to Racon­teur, says their pro­posed new data reg­u­la­tion frame­work “bet­ter pro­tects the rights of cit­i­zens and cus­tomers, cre­ates gen­uine lia­bil­i­ties to encour­age Big Tech to take their wider respon­si­bil­i­ties to soci­ety more seri­ous­ly and bet­ter facil­i­tates dig­i­tal inno­va­tion”.

On 25 August, it looked like some of those moot­ed reforms would soon become real­i­ty. Oliv­er Dow­den, the cul­ture min­is­ter, told the Tele­graph that the “data div­i­dend” of Brex­it would be “one of the big prizes of leav­ing”. He promised a “light touch” approach that avoid­ed “box tick­ing” and allowed the UK to har­ness the pow­er of data as the new oil.

GDPR is pret­ty much uni­ver­sal­ly accept­ed as a default stan­dard. Most coun­tries look at it and say “we need some­thing like that”

The next day, Dowden’s office – the Depart­ment for Cul­ture, Media and Sport (DCMS) –announced plans to pur­sue new data part­ner­ships with advanced economies includ­ing the US, Aus­tralia, Sin­ga­pore and South Korea. In doing so, it hopes to “unlock more trade and inno­va­tion by reduc­ing unnec­es­sary bar­ri­ers and bur­dens on inter­na­tion­al data trans­fers, there­by open­ing up glob­al mar­kets to UK busi­ness­es”. The ben­e­fits for cit­i­zens, as con­sumers, would be “faster, cheap­er and more reli­able prod­ucts and ser­vices from around the world”.

Free­man wel­comes this “bold move” away from the EU’s approach, which he says ties the lit­tle guys up in GDPR com­pli­ance bureau­cra­cy while leav­ing many cit­i­zens, con­sumers and small busi­ness­es vul­ner­a­ble to real dan­gers on the web.

But there are some who wor­ry that such box-tick­ing — imper­fect, annoy­ing and bureau­crat­ic as it might be — serves an impor­tant role in pro­tect­ing indi­vid­u­als’ rights.

GDPR’s weekend hat

There’s a rea­son the UK has a more lib­er­al approach to data pri­va­cy, says Adam Rose, who heads up law firm Mish­con de Reya’s data prac­tice. “His­tor­i­cal­ly, almost the entire con­ti­nent of main­land Europe was gov­erned at some point by Nazis or Com­mu­nists and if you’re on the wrong list that could result in you being killed. We’ve been very lucky in the UK, we’ve not had that,” he says.

Rose has spent almost three decades in the field. In recent years he has rep­re­sent­ed busi­ness­es seek­ing coun­sel on what they can or can­not do under GDPR, as well as indi­vid­u­als look­ing for clar­i­ty about and con­trol over their own data. In his view, GDPR is like oth­er EU laws inso­far as it cre­ates “sign­posts” instead of hard bor­ders. To his under­stand­ing, it shouldn’t cre­ate too much dif­fi­cul­ty for inno­v­a­tive busi­ness­es, “[it] just sets out a frame­work, in which you can do what you want to do.” 

Rose has devel­oped a frame­work for under­stand­ing data reg­u­la­tion. He sug­gests think­ing about the dif­fer­ent hats we wear dur­ing the week and the week­end. At work, it’s use­ful to be able to “rapa­cious­ly [gath­er] in this data about peo­ple’s spend­ing habits and eat­ing habits and move­ments”, but at the week­end, when you see a per­son­alised ad based on some­thing you didn’t know you’d shared with the world, you’re a “lit­tle more both­ered by this, you’re sit­ting at home won­der­ing ‘how did they know this about me?’” 

By recog­nis­ing that “you are the oth­er per­son for that oth­er part of the week, then GDPR prob­a­bly gets the bal­ance fair­ly right”, argues Rose.

Indeed, even those who deal with GDPR on a reg­u­lar basis admit that, by and large, the reg­u­la­tion makes sense. “[Our] research shows that most mar­keters and busi­ness­es think [GDPR] was a change for the bet­ter,” says John Mitchi­son, the direc­tor of pol­i­cy and com­pli­ance for The Data and Mar­ket­ing Asso­ci­a­tion (DMA), a trade body rep­re­sent­ing data-dri­ven mar­ket­ing firms and mar­keters in the UK. “Our research has also found it to be a huge ben­e­fit for con­sumers, and it has inevitably increased trust in data shar­ing.”

But there is also a finan­cial argu­ment for dereg­u­la­tion. In the­o­ry, at least, less red tape means more trade, and faster data flows imply more inno­va­tion. As the DCMS press release spec­i­fied, “esti­mates sug­gest there is as much as £11bn worth of trade that goes unre­alised around the world due to bar­ri­ers asso­ci­at­ed with data trans­fers”. It’s a sim­i­lar num­ber to the £9bn that was spent by large UK and US busi­ness­es prepar­ing for and com­ply­ing with GDPR.

The less pri­va­cy we have, the less pow­er we have and the more we are vul­ner­a­ble to abus­es of pow­er by oth­ers, in par­tic­u­lar by com­pa­nies and gov­ern­ments

Although the DMA’s Mitchi­son agrees with DCM­S’s objec­tives and has heard many busi­ness­es say they would ben­e­fit from a “more flex­i­ble inter­pre­ta­tion of the reg­u­la­tion”, he’s wary that stray­ing too far from GDPR’s stan­dards could cre­ate more dam­age than it fix­es. 

“The UK gov­ern­ment should not risk the EU revok­ing our Ade­qua­cy Sta­tus,” he says, refer­ring to the impor­tant agree­ment that allows for data trans­fers to take place in the EU. After all, 75% of UK data move­ment occurs with­in the EU, a rela­tion­ship worth more than £73bn.

Shifting attitudes to data

As both Mitchi­son and Rose sug­gest, one of the biggest ben­e­fits of GDPR may not have been on a polit­i­cal or an eco­nom­ic front but on an edu­ca­tion­al one. While cook­ie pop-ups are clum­sy and could soon be tech­no­log­i­cal­ly redun­dant, by mak­ing indi­vid­u­als take that con­sent­ing step, GDPR alerts us to the fact that we are reg­u­lar­ly siphon­ing away por­tions of our per­son­al data.

Since the Cam­bridge Ana­lyt­i­ca scan­dal, in par­tic­u­lar, pub­lic aware­ness and fears sur­round­ing data pri­va­cy have grown. Around the world, leg­is­la­tors are tak­ing inspi­ra­tion from GDPR and mov­ing towards more data pro­tec­tions for their cit­i­zens, not less, includ­ing some states in the US. Indeed, there aren’t any obvi­ous exam­ples of data dereg­u­la­tion in the mod­ern era. “Pri­va­cy is com­ing to the inter­net and cook­ies are going away,” the tech com­men­ta­tor Bene­dict Evans recent­ly wrote.

What’s more, due to the inte­grat­ed nature of the mod­ern econ­o­my, the more strin­gent major juris­dic­tions become the default for oth­er law­mak­ers and busi­ness­es. “GDPR is pret­ty much uni­ver­sal­ly accept­ed as a default stan­dard,” con­firms Rose. “Most coun­tries look at it and say ‘we need some­thing like that’.”

A week before the DCMS announce­ment, Chi­na pub­lished sweep­ing new data reg­u­la­tions of its own. The Stand­ing Com­mit­tee of the 13th Nation­al Peo­ple’s Con­gress stat­ed that “no organ­i­sa­tion or indi­vid­ual may infringe upon nat­ur­al per­sons’ per­son­al infor­ma­tion rights and inter­ests” and that “exces­sive per­son­al infor­ma­tion col­lec­tion is pro­hib­it­ed”. The reforms were inter­pret­ed both as a crack­down on the coun­try’s blos­som­ing tech scene and a recog­ni­tion of the poten­tial nation­al secu­ri­ty risk pre­sent­ed by the mass pri­vate col­lec­tion of data. 

A question of security

We live in an age where ride-shar­ing, stream­ing and open-source sys­tems have upend­ed tra­di­tion­al con­cep­tions of own­er­ship and prop­er­ty. We inter­act with many things we don’t own, so should we wor­ry about own­ing those inter­ac­tions?

What’s more, we reg­u­lar­ly fun­nel infor­ma­tion into major com­pa­nies (Google, Ama­zon etc) that have fall­en afoul of GDPR’s own stan­dards. Indeed, almost any data that ends up in the US can be accessed by the country’s secu­ri­ty ser­vices, some­thing that makes Euro­pean pri­va­cy experts uncom­fort­able. The EU has had sim­i­lar con­cerns about the UK, but has, at least until now, giv­en its want-away neigh­bour the ben­e­fit of the doubt on the “ade­qua­cy” front.

Nonethe­less, the com­plex­i­ties of dig­i­tal life don’t mean we should give up on our rights to pri­va­cy. That’s because, for thinkers like Caris­sa Veliz, pri­va­cy is pow­er. She’s a pro­fes­sor of phi­los­o­phy at Oxford Uni­ver­si­ty who focus­es on the ethics of tech­nol­o­gy and AI in par­tic­u­lar. In her view, the lat­est announce­ments from DCMS are bad news. Doing away with leg­is­la­tion that was large­ly put in place to pro­tect the rights of cit­i­zens rep­re­sents a slip­pery slope. 

“The less pri­va­cy we have, the less pow­er we have,” she says, “and the more we are vul­ner­a­ble to abus­es of pow­er by oth­ers, in par­tic­u­lar by com­pa­nies and gov­ern­ments.”

Although Veliz acknowl­edges the the­o­ret­i­cal busi­ness case for Dow­den and TIGR­R’s light-touch approach, she’s “wor­ried that the UK might try to become what I call a data haven”. Even if the EU were to still grant the UK data ade­qua­cy, the harm could be rep­u­ta­tion­al instead of finan­cial. In an extreme case, the UK could become an off­shore hub for “data laun­der­ing”, a rogue state where less scrupu­lous busi­ness­es can turn data into cash. As Pro­fes­sor Veliz puts it, “even if they do get away with it, they’re huge­ly dam­ag­ing their image in front of the world.”

Instead of see­ing reg­u­la­tion like GDPR as a bar­ri­er to pros­per­i­ty, we could con­ceive of “red tape” as a nec­es­sary first step that inno­v­a­tive com­pa­nies must take before using per­son­al infor­ma­tion. We man­age to think like that in oth­er sec­tors. “Pri­va­cy and safe­ty are min­i­mum require­ments,” says Veliz. “If it takes up to 30 days a year to keep my data safe, that’s what it takes. What­ev­er it takes restau­rants to keep the restau­rant clean, then that’s what it takes.”

Innovation versus regulation

But the politi­cians behind the reforms think there’s an impor­tant nuance to make around pro­por­tion­al­i­ty and the scale of the busi­ness­es in ques­tion. “We don’t achieve cater­ing hygiene by requir­ing every din­er to sign away their con­sumer rights before they order a meal,” says Free­man. “All cater­ing estab­lish­ments have a legal duty to pro­vide pro­por­tion­ate hygiene. What’s expect­ed at a vil­lage crick­et club tea is dif­fer­ent to what’s accept­able at Lords.”

Indeed, Oliv­er Dow­den’s sug­ges­tion that “we should not expect exact­ly the same from a small fam­i­ly run busi­ness as we do from a mas­sive social media com­pa­ny” sug­gests a more equi­table approach to both pri­va­cy con­cerns and com­pe­ti­tion law.

Like all reg­u­la­tion that attempts to keep up with expo­nen­tial tech­nol­o­gy, data pro­tec­tion laws will often be over­tak­en by inno­va­tions in the pri­vate sec­tor. Every­one inter­viewed for this arti­cle agreed that in many ways GDPR has always been out of date. It was con­ceived before the likes of Google and Face­book became the giants that they are today. At the same time, new pri­va­cy-enhanc­ing tech­nolo­gies are already allow­ing many com­pa­nies to go beyond the legal min­i­mum.

Giv­ing small UK firms the oppor­tu­ni­ty to com­pete with major big data com­pa­nies could be a wel­come boost to the UK’s dig­i­tal sec­tor, but the gov­ern­ment should be wary of the neg­a­tive optics that dereg­u­la­tion could have for the Glob­al Britain brand. 

---