Henry FarrellVerified account

2. There's a new narrative about Facebook's embrace of #GDPR (@alexstamos gives one recent version of it) - that GDPR is good for companies like Facebook, because it is complex and easier for big companies to comply with than small upstart competitors. Not altogether wrong,

3. but not really right either. Facebook's ginger embrace of European style legislation is making lemonade out of lemons. Zuckerberg would surely have preferred a world with no privacy legislation, where companies were left to self regulate, and market mechanisms predominated.

4. This was the world that US negotiators wanted in their first big fight with Europe over privacy, two decades ago, when the EU introduced the ancestor legislation to GDPR, the Data Protection Directive. US resisted fiercely, pushing for self regulatory approach.

5. Europeans pushed back - and they finally arrived at an ungainly compromise - the Safe Harbor arrangement (for more, see http://www.henryfarrell.net/IO.pdf  ), combining self-regulation with a state regulatory backstop. Europeans hoped that this would build a foundation for a new US law

6. (after all, if US companies had to comply with EU regs, they would want to impose a similar burden on their domestic competitors), while US hoped that it would be a Trojan horse sneaking self-regulatory principles into European jurisprudence.

7. For a long time, it looked like US had won. US e-commerce companies built a vast international empire with relatively little regulatory oversight - and the Safe Harbor allowed them to facially comply with European privacy law without really shifting their business model.

8. European privacy activists (and some regulators) hated Safe Harbor, but at best could hope to change it around the margins. The EU set out to update its privacy legislation, leading to the #GDPR - and was quickly swarmed by US tech company lobbyists pushing to water it down.

10. Second, it opened up a connection between the threat of US surveillance, and the Safe Harbor, which was supposed to support transatlantic commercial data exchange. @maxschrems astutely saw how @snowden revelations could be weaponized against #Facebook.

11. He took a case against Facebook's use of Safe Harbor, and got the European Court of Justice to effectively revoke Safe Harbor - and vastly enhanced the power of activists and national privacy regulators to push back against future Safe Harbor type agreements.

12. All these developments had consequences in US too, where activists in California started to push for GDPR-lite legislation. And GDRP implementation added to the hell that Facebook has found itself in the last couple of years. A powerful GDPR has further empowered activists.

13. Minutes after it came into effect, Schrems' organization @NOYBeu used it to take a series of cases that set out to use GDPR's consent standard to drive a sharpened dagger into the heart of Facebook's business model.

15. The consequence of this is that GDPR is not a harbor for companies like Facebook - it is a storm. It is not a predictable framework, but an ever-expanding tornado of action possibilities for judges, activists and regulators who don't like what Facebook is doing.

16. And things are only going to get worse as the EU's competition policy and privacy policy become ever more closely linked, creating even more threats to Facebook and other big tech companies in the Commission's cross-hairs - http://www.europarl.europa.eu/doceo/document/E-8-2019-000001-ASW_EN.docx …

17. So why then would Facebook want GDPR-like legislation in the US too? The answer is that it could provide greater predictability. European legislation isn't going to go away, as US negotiators and tech firms wanted - and the US absence of legislation is now a liability.

18. It provides opportunities for European activists and regulators to argue that the US is a "Wild West" (as one EU official described it to us) - and that Europe needs to manage the chaos. A US GDPR would be a potent counterargument and counter-force.

19. It would also provide Facebook and other US tech firms many opportunities to water down the legislation so as to provide something closer to the friendly legal harbor of predictability and limited requirements that they would in fact prefer.

20. And, very importantly, it would probably pre-empt state level legislation, closing off another portal to unpredictable and various requirements and opportunity structures for activists and others looking to constrain big tech.

21. So - surprisingly, the European bet is paying off two decades later. The US is likely to converge on a (substantially watered down) version of European privacy rules and formal legislation. That may in turn provide a platform for new battles in the US.