Data Regulation Could Create A New, Happier Internet

The European Union’s new privacy laws could hamstring the internet and might make it better.

So far, the biggest perceived effect of the most important data-privacy law ever has been a sharp increase in emails from social networks and web services alerting me that those endless contractual walls of text you thoughtlessly click okay on—privacy policies, data policies, and/or terms of service—will change, most of them conspicuously on the same date, May 25, 2018. Almost none of them mention what, exactly, has led to this mass update: the European Union’s General Data Protection Regulation, or GDPR.

GDPR becomes law, as keen deductive minds might gather, on May 25, two years after it was adopted by the European Parliament and just a few months after Facebook’s Cambridge Analytica scandal turned data privacy into a top issue for every ambitious politician and excitable journalist in the U.S. and Europe. Its expansive scope will force corporations to change the way they do business; if it works well, it will likely serve as a model for much needed privacy legislation in the U.S. And even if Congress fails to follow Europe’s lead, the law could potentially shift the balance of power online. Somewhere inside the emails that I and millions of others have reflexively ignored is the beginning of a process that will transform the face of the internet.

What does the GDPR do? First, it creates a set of legal responsibilities for data-gathering and data-processing companies, and second, it creates rights around personal data. Those rights protect anyone geographically within the E.U. or anyone outside it whose data is being harvested or processed by any company established in the E.U. The GDPR effectively turns the global nature of the internet to its advantage: There are not many internet companies that have no offices or employees or users somewhere in Europe.