There are negotiations afoot that could soon affect hundreds of billions of dollars in cross-border trade – and guess what: it’s got nothing to do with NAFTA or the escalating trade fight between the US and China. Next month, officials from Washington and Brussels will sit down to review the state of the US-EU Privacy Shield, a data-sharing pact between the US and the European Union that underpins more than $260 billion of annual digital trade between the two regions.
This year’s review is likely to be contentious. Privacy Shield is what allows US companies to handle the personal data of EU citizens, despite US privacy protections not technically being up to snuff under the EU’s strict data rules. Europe isn’t happy with how things are going.
Washington’s lack of progress appointing key privacy officials, the US decision to renew the government’s electronic surveillance authorities without safeguards for EU citizens, and this past spring’s Cambridge Analytica fiasco are all sore points in this year’s review.
The debate over Privacy Shield highlights a broader problem: The US is one of the only major economies that doesn’t directly regulate the flow of information across its borders (as the Europeans do for privacy concerns, and the Chinese and Russians do for reasons of national security). It’s a kind of American exceptionalism that is nearing its sell-by date. US consumers have grown more concerned about privacy following a string of high-profile data breaches and revelations about social media’s role as a conduit for disinformation. A growing number of executives in Silicon Valley, members of Congress, and some in the Trump administration are worried about a confusing and expensive patchwork of data regimes, or fear the US risks becoming a rule taker as other countries like Brazil hew to Europe’s stricter approach.
As the US belatedly wakes up to the need to do more, the fight over who should be regulated and how could get messy. Better data protections would restore the balance of power between the internet giants that profit from personal data and the people who supply it. But rules that force companies to take greater precautions or give users greater control over how firms can use their sensitive data could also make it harder for the next generation of innovative internet companies to compete against industry leaders that can afford the extra burdens of compliance.