Speaker 1: Welcome to Tech Stuff, a production from I Heart Radio.
Speaker 1: Hey there, and welcome to tech Stuff. I'm your host
Speaker 1: Jonathan Strickland. I'm an executive producer with I Heart Radio.
Speaker 1: And how the tech are you so? Not long ago,
Speaker 1: David Meyer wrote a piece titled even Facebook's critics don't
Speaker 1: grasp how much troubled meta is in and he wrote
Speaker 1: it for Fast Company. And if you've been keeping up
Speaker 1: with meta slash Facebook, you probably have a long list
Speaker 1: of things that Meyer could have been referring to. Could
Speaker 1: it be that various governments, such as the United States
Speaker 1: are frequently scrutinizing meta and calling company leaders to appear
Speaker 1: before legislative bodies to answer tough questions. Could it be
Speaker 1: the fact that TikTok continues to dominate as the social
Speaker 1: platform favored by younger people, meaning that meta slash Facebook's
Speaker 1: user base is slowly aging out and it's not replacing
Speaker 1: it when new younger users. Is it that the company
Speaker 1: jumped the gun in an effort to be the front
Speaker 1: runner to define whatever the heck the metaverse is going
Speaker 1: to be? Well, all of those are factors that should
Speaker 1: be matters of concern for Facebook executives and for shareholders.
Speaker 1: But what Meyer was talking about with something else, something
Speaker 1: involving privacy and the law and a change that happened
Speaker 1: a couple of years ago that has affected everything. So
Speaker 1: on July twenty twenty, the European Union's Court of Justice
Speaker 1: made a decision that would have enormous consequences. It concluded
Speaker 1: that an earlier data transfer process called the EU US
Speaker 1: Privacy Shield was not sufficient to protect the private data
Speaker 1: of EU citizens, and that it would thus be struck down.
Speaker 1: It would be invalidated. This has massive repercussions for companies
Speaker 1: like Meta, not just Mata, in fact, as repercussions for
Speaker 1: any company that operates within the EU, but in fact
Speaker 1: has it's you know, any kind of data transfers that
Speaker 1: exit the EU. So Mark Zuckerberg said essentially that unless
Speaker 1: the EU changes the stance or makes an exception for
Speaker 1: the company, platforms like Facebook and Instagram will have to
Speaker 1: pull out of the European Union. That sounds kind of
Speaker 1: like they're making a threat, right, like somehow you know
Speaker 1: Zuckerberg saying, Hey, if you don't play by my rules,
Speaker 1: I'm taking my ball and going home. But really this
Speaker 1: is more of a plea. It's really more, please, please,
Speaker 1: please don't do this, because I can't do my thing
Speaker 1: if you do. So. Today I thought I would talk
Speaker 1: about what the privacy shield was, why it existed, why
Speaker 1: the EU decided it wasn't sufficient, what they're planning in
Speaker 1: its place, and what all this means for come Benese
Speaker 1: like Meta. To do that, we actually have to look
Speaker 1: back at the history of the EU and its stands
Speaker 1: on data privacy and security. Now, depending on how you
Speaker 1: look at it, the EU really traces its history back
Speaker 1: to the conclusion of World War Two, but the single
Speaker 1: market that we would refer to as the European Union
Speaker 1: would not formally emerge until nine Now. Around that same time,
Speaker 1: there was a growing general awareness about the Internet, in
Speaker 1: large part helped by the introduction of something new called
Speaker 1: the Worldwide Web, and it would take a few years
Speaker 1: for the Web and the Internet at large to really
Speaker 1: gain a foothold in the minds of the mainstream public,
Speaker 1: but some leaders in the EU were already dealing with
Speaker 1: concepts like data privacy. Data privacy doesn't just require you know,
Speaker 1: digital transfers, right like, you don't have to have that
Speaker 1: be part of the process for data privacy to be
Speaker 1: a concern, and in fact, the countries that made up
Speaker 1: the European Union had already been concerned about protecting EU
Speaker 1: citizen privacy when dealing with companies that existed outside the
Speaker 1: European Union. How can you guarantee that their private data
Speaker 1: remains safe when it's going into the hands of companies
Speaker 1: that aren't based in the European Union itself. That had
Speaker 1: already been a concern, but the EU member states knew
Speaker 1: that there needed to be put in place laws that
Speaker 1: could protect citizen data, that there are fundamental rights associated
Speaker 1: with data that have to be protected. To that end,
Speaker 1: the EU built upon an earlier, non binding list of
Speaker 1: guiding principles relating to protecting citizen information. These principles included
Speaker 1: pretty common stuff like alerting someone as to win their
Speaker 1: data would be collected, a requesting consent before the disclose
Speaker 1: that information to some other party. So if you were
Speaker 1: to collect an e uses and information, you would then
Speaker 1: have to get their consent before you could share it
Speaker 1: with someone else, and various other concepts that are pretty
Speaker 1: common to what we see in in privacy protection laws.
Speaker 1: They had been around before the rise of the Internet,
Speaker 1: but because they were non binding, they didn't really have
Speaker 1: any teeth to them. It was like, it would be
Speaker 1: nice if everyone agreed to obey these things, but there
Speaker 1: was no requirement to do so. The EU decided to
Speaker 1: formally establish data privacy rules, though these would have limitations
Speaker 1: to which we'll talk about and that. These rules became
Speaker 1: known as the Data Protection Directive or dp D. This
Speaker 1: directive set out the parameters for when and how entities
Speaker 1: would be allowed to collect European Union citizen information and
Speaker 1: how they could use it. Specifically, you know, how they
Speaker 1: would be allowed to use it if it required a
Speaker 1: transfer outside the EU and U, and also how they
Speaker 1: were to alert citizens of things like collecting their data.
Speaker 1: Each member's state of the EU was responsible for establishing
Speaker 1: a supervisory department to make sure that all parties were
Speaker 1: complying with this directive, and the directive stated that the
Speaker 1: only time data could be shared with countries outside the
Speaker 1: European Union is when those countries could adequately protect the
Speaker 1: data's security. So if a if a country or company
Speaker 1: was unable to do that, then by this directive, it
Speaker 1: would not be allowed to transfer information outside the EU
Speaker 1: now right away. These rules created challenges both within and
Speaker 1: without the EU and when you really break it all down,
Speaker 1: all traffic on the Internet is information, and a lot
Speaker 1: of that information ends up including personal identification information or
Speaker 1: at least personally identify alable information. So you might argue
Speaker 1: that personal information should only include stuff like, you know,
Speaker 1: a legal information like a person's name, or their address,
Speaker 1: or their birth date or maybe the hospital where they
Speaker 1: were born. That kind of stuff. You know, information that
Speaker 1: relates directly to that individual, and when you take this
Speaker 1: information in a hole, it's more or less unique to
Speaker 1: that person. I have to say more or less simply
Speaker 1: because you know, weird stuff. Anyway, that kind of information
Speaker 1: is absolutely important. It is worthy of being protected, and
Speaker 1: it's very easy to define. Right. You could say, this
Speaker 1: information directly corresponds to this individual, therefore we need to
Speaker 1: protect it. But then there's also other information that, well,
Speaker 1: not specifically about a particular individual, could collectively identify that
Speaker 1: person all the same, So an IP address could be
Speaker 1: part of that. You might argue that's personal information, or
Speaker 1: you might argue, well, IP addresses aren't fully reliable because
Speaker 1: you could use something like a VPN which would hide
Speaker 1: your IP address, so you can't just rely on that
Speaker 1: to identify a person. However, it falls into this gray area.
Speaker 1: But then there's stuff like the person's browsing behaviors, you know,
Speaker 1: what they like, what they don't like, how long they
Speaker 1: stay on a page. All of these things can actually
Speaker 1: start to create a digital fingerprint that points to a
Speaker 1: specific person. And it sounds wild, but it really doesn't
Speaker 1: take that many points of data to narrow down folks
Speaker 1: and figure out who created those data points. In the
Speaker 1: old days, doing that would have been tough simply because
Speaker 1: you're talking about a lot of data being generated and
Speaker 1: then trying to suss out what is signaled based on
Speaker 1: all the noise, you know, to actually analyze that information
Speaker 1: to get something useful out of it. It was a
Speaker 1: time consuming process and it just you know, when you
Speaker 1: look at it from a return on investment standpoint. In
Speaker 1: the old days, it just it makes sense, right, unless
Speaker 1: you were going after someone specific for nefarious purposes. You
Speaker 1: wouldn't do that for just anybody because it was too
Speaker 1: much effort. However, we have gotten a lot better at
Speaker 1: analyzing enormous data sets in a short amount of time
Speaker 1: using things like artificial intelligence and machine learning and various algorithms,
Speaker 1: so this has become less of an obstacle. It's not
Speaker 1: like science fiction level yet, but it's pretty darn close.
Speaker 1: So now some of the technical restrictions that meant we
Speaker 1: didn't have to worry about this so much in the
Speaker 1: past aren't really a thing anymore. Anyway, The euse directive
Speaker 1: meant that the United States, that the country you know,
Speaker 1: where the Internet got its start, would need to figure
Speaker 1: out a way to comply with this set of rules
Speaker 1: if it wanted to allow information to pass between the
Speaker 1: US and the EU. Because a lot of these companies,
Speaker 1: their servers all exist within the United States, so by
Speaker 1: the nature of their business this any any information that
Speaker 1: would be coming from the European Union would have to
Speaker 1: go across the Atlantic to a server in the US.
Speaker 1: To that end, some EU officials began to piece together
Speaker 1: what would become known as the International Safe Harbor Privacy Principles.
Speaker 1: Now we're going to take a quick break, but when
Speaker 1: we come back, I'll talk a bit about Safe Harbor,
Speaker 1: what it was meant to do, and why it no
Speaker 1: longer is a thing. But first, these messages, the International
Speaker 1: Safe Harbor Privacy Principles. What the heck was this? Well,
Speaker 1: it was a program that US companies could apply to join.
Speaker 1: The companies would apply for certification, and that certification essentially
Speaker 1: said these companies are taking the necessary steps to protect
Speaker 1: user data so they can be considered to be compliant
Speaker 1: with the Data Protection Directive that the EU had obviously passed.
Speaker 1: So ultimately, the goal here was to prevent the accidental
Speaker 1: disclosure of EU citizen private information that happened to be
Speaker 1: stored on servers within the United States so it's outside
Speaker 1: the e use control. This was the system by which
Speaker 1: companies would guarantee they would make sure that data would
Speaker 1: remain safe. The Safe Harbor system became effective in two thousand.
Speaker 1: It took several years for it to formalize and then
Speaker 1: to be enacted, and US companies that receive certification under
Speaker 1: Safe Harbor and then registered with the EU would be
Speaker 1: allowed to operate things that would transfer data between the
Speaker 1: U S and EU without much trouble. Oh and in
Speaker 1: order to qualify, those companies would also have to be
Speaker 1: companies that were regulated by the United States FTC, Federal
Speaker 1: Trade Commission, or the Department of Transportation. Those were the
Speaker 1: only companies that could qualify for Safe Harbor. Anything that
Speaker 1: didn't fall into those categories was an exception, and that
Speaker 1: actually cuts back on a lot of businesses, believe it
Speaker 1: or not. Now, something that I'm sure will not surprise
Speaker 1: many of you out there is that various reviews that
Speaker 1: were done on this system showed that a lot of
Speaker 1: the participating US companies were not complying with the program,
Speaker 1: at least not to the extent that they should. Companies
Speaker 1: were found to be reluctant to actually enforce the principles
Speaker 1: defined by the Safe Harbor program, and questions arose as
Speaker 1: to whether or not the industry could really be self regulating,
Speaker 1: like can we trust these companies to regulate themselves? And
Speaker 1: of course we can't. All right, so quick side rant,
Speaker 1: But this applies directly to the topic. So, the currency
Speaker 1: of the modern world isn't bitcoin, It's not any other
Speaker 1: cryptocurrency because it goes a level deeper than that. The
Speaker 1: currency of the modern world is information. Data is valuable
Speaker 1: you or data is valuable. If it weren't companies like
Speaker 1: Meta Slash, Facebook or Google, they wouldn't even exist if
Speaker 1: your data had no value. These companies depend upon us
Speaker 1: generating information, which the companies can then leverage in various ways. Now,
Speaker 1: an obvious way they do this is through advertising, specifically
Speaker 1: targeted advertising. You know, by analyzing the information I generate,
Speaker 1: a platform like Facebook or Google can suss out what
Speaker 1: matters to me and to compare my experience with ads
Speaker 1: that are more likely to get my attention and my action.
Speaker 1: That is money right there that is incredibly valuable to
Speaker 1: these platforms. It's incredibly valuable to the advertisers and to
Speaker 1: their clients. So my information does have value. Yours does too.
Speaker 1: But even beyond targeted advertising, this information has incredible value.
Speaker 1: Through real time analysis of browsing data across millions or
Speaker 1: hundreds of millions of users, platforms can detect and respond
Speaker 1: to trends before anyone is even aware that there is
Speaker 1: a trend there. So I think back to the description
Speaker 1: of chaos theory that says, imagine the flap of butterflies
Speaker 1: wings in South America setting into motion the variables that
Speaker 1: are necessary to generate a typhoon that hits Southeast Asia.
Speaker 1: That it without that one instigating event, the variables are
Speaker 1: not in the right place to make that happen. Well,
Speaker 1: think for a moment about how many people use platforms
Speaker 1: like Google or Amazon or Facebook individually that users. Data
Speaker 1: is valuable, right, but collectively across all users, that can
Speaker 1: drive corporate strategy. So there should be absolutely no surprise
Speaker 1: that companies are eager to exploit information personal information. It's
Speaker 1: key to their business model and their success. Which is
Speaker 1: why it's also not a big surprise that a lot
Speaker 1: of companies were slacking off when it came to self
Speaker 1: regulation and complying with the principles of safe harbor. If
Speaker 1: the companies could get away with it, if they could
Speaker 1: operate without having to actually worry about complying with these rules,
Speaker 1: then they do it. And I'm sure there were no
Speaker 1: shortage of companies that weren't being outright nefarious or flaunting
Speaker 1: the law or anything like that. But we're falling short
Speaker 1: of holding up to their end of the bargain, you know,
Speaker 1: because it's also hard to do. It's hard to pull
Speaker 1: off and still do business in a way that is
Speaker 1: cost effective. Right, in order to comply with these rules,
Speaker 1: you do have to spend some money, honestly, was what
Speaker 1: it really comes down to. It might not be money money,
Speaker 1: it might be more assets and resources or time or whatever,
Speaker 1: but it's ultimately a cost. Whatever the reason, it was
Speaker 1: clear that this particular approach to protecting information wasn't sufficient
Speaker 1: if the EU actually wanted to keep EU citizen information
Speaker 1: secure and servers that weren't even in the European Union
Speaker 1: all right. Flash forward to two thousand and twelve, the
Speaker 1: EU decided it needed to take another stab at creating
Speaker 1: a unified data protection law to replace the Data Protection Directive.
Speaker 1: So the Director had ultimately been too lucy goosey, and
Speaker 1: that meant that different member nations had different principles and
Speaker 1: enforcement strategies. It was two piecemeal and it wasn't unified
Speaker 1: the way a European Union needed to be. So this
Speaker 1: new law would resolve the various differences between the different
Speaker 1: implementations and the member states of the EU and create
Speaker 1: a more coherent policy that it was EU wide and
Speaker 1: would protect citizen data privacy. That took four years two
Speaker 1: actually formalize, but in April fourteen sixteen, the EU approved
Speaker 1: the new set of rules called the General Data Protection
Speaker 1: Regulation or g d p R, and this became a
Speaker 1: truly huge deal for any company outside the EU that
Speaker 1: wanted to do business inside the EU, particularly for Internet
Speaker 1: based companies. The rules covered any entity that processed or
Speaker 1: transmitted data from within the EU to somewhere else. A
Speaker 1: whole bunch of other stuff was in those rules too,
Speaker 1: But I've done episodes about g d p R in
Speaker 1: the past, so we're just gonna say this was a
Speaker 1: more broad, sweeping, and yet unified approach to data privacy,
Speaker 1: and it created big old headaches for companies around the
Speaker 1: world to ensure that they were compliant with g DPR.
Speaker 1: In fact, to this day, that's still a big thing. Ultimately,
Speaker 1: that's at the heart of the meta problem we were
Speaker 1: talking about. It was g d p R that would
Speaker 1: necessitate things like a pop up message that would alert
Speaker 1: users to a sites reliance on web cookies, for example,
Speaker 1: because that's a type of tracking. It would also require
Speaker 1: foreign services to expressly ask for the consent of users
Speaker 1: in order to collect their data. And you know, companies
Speaker 1: tried to find in different creative ways to get around
Speaker 1: that to maximize the number of people who had quote
Speaker 1: unquote uh agree to this by making it a difficult
Speaker 1: thing to opt out of. That doesn't fly very well
Speaker 1: on the g d PR. There are a lot of
Speaker 1: regulatory agencies that pounce on that kind of practice. They're
Speaker 1: also supposed to explain how information is going to be used,
Speaker 1: and to give people the opportunity to opt out of
Speaker 1: any data collection and that kind of thing. So the
Speaker 1: g d p R replaced the Data Protection Directive and
Speaker 1: became enforceable in all right now in the meantime where
Speaker 1: that was happening, the Safe Harbor Principles, which remember this
Speaker 1: was a framework that companies could follow in order to
Speaker 1: be considered UH safe under g d p R rules
Speaker 1: that had already been invalidated by the EU in ten
Speaker 1: They said, well, you know, Data Protection Directive is not
Speaker 1: sufficient and Safe Harbor, which was designed to work within
Speaker 1: Data protet Action Directive that by extension, is not sufficient,
Speaker 1: so it doesn't apply anymore. It was not robust enough
Speaker 1: to satisfy the requirements of the upcoming g DPR. So
Speaker 1: the European Commission and the United States government negotiated a
Speaker 1: new political agreement to codify rules on how commercial transatlantic
Speaker 1: exchanges of personal information from EU citizens to U S
Speaker 1: servers could actually happen. Those rules would become known as
Speaker 1: the EU US Privacy Shield. Like the Safe Harbor Principles,
Speaker 1: this was really meant to create a framework in which
Speaker 1: companies could operate legally within the European Union. US companies
Speaker 1: that gather user data would have to comply with this
Speaker 1: set of rules in order to make services available to
Speaker 1: citizens in the EU, Otherwise they would be violating privacy
Speaker 1: law in Europe. Like the previous system, the Privacy Shield
Speaker 1: includes guiding principles that all organizations are expected to follow.
Speaker 1: While it beefed up some other protections incorporated into the
Speaker 1: previous systems, critics were worried that there were still some
Speaker 1: big gaps in the Privacy Shield process and that ultimately
Speaker 1: it would get challenged and struck down by the European Commission,
Speaker 1: and those concerns likely went into overdrive in twenty seventeen
Speaker 1: when then President Donald Trump signed an executive order that
Speaker 1: denied US privacy protections to anyone who is not a
Speaker 1: US citizen or resident. So, in other words, according to
Speaker 1: that executive order, US companies would not be held accountable
Speaker 1: for guaranteeing data privacy and security for any non US
Speaker 1: citizens or residents. Considering that g DPR demands that any
Speaker 1: entity that transfers e U citizen data overseas must protect
Speaker 1: that information, that was a problem. By the way. Joe
Speaker 1: Biden would later rescind that executive order in one but
Speaker 1: by then things that already changed in Europe. So we're
Speaker 1: going to talk about those chain ages and how Privacy
Speaker 1: Shield would follow in the footsteps of Safe Harbor and
Speaker 1: get invalidated after we come back from these messages. So,
Speaker 1: as I was alluding before the break the critics of
Speaker 1: the Privacy Shield process who said this is not going
Speaker 1: to be seen as sufficient, that we're absolutely right. The
Speaker 1: EU Commission reviewed the Privacy Shield policy in twenty and
Speaker 1: determined that it was not enough to protect EU citizen
Speaker 1: private data and struck it down. Specifically, there were concerns
Speaker 1: that the US government would be able to conduct surveillance
Speaker 1: on EU citizen data and that under EU law that
Speaker 1: was a violation of of human rights and freedom rights
Speaker 1: of EU citizens. So there was a need to formulate
Speaker 1: yet another data privacy framework that would address this issue,
Speaker 1: and that's kind of where we are now. See, without
Speaker 1: a framework, it becomes very difficult to do business in
Speaker 1: the European Union. The framework, you know, it smooths things out,
Speaker 1: it speeds things up because it's it's one point one
Speaker 1: system that companies in say, well specifically the United States,
Speaker 1: can go through in order to qualify to do business
Speaker 1: in the EU and be considered compliant with the rules
Speaker 1: of g d p R. So this new framework is
Speaker 1: still taking shape. It doesn't exist yet, it is in
Speaker 1: the process of existing, and it will take even longer
Speaker 1: for the EU to formalize and adopt and enforce that
Speaker 1: rule once it is finished. In the meantime, we're in
Speaker 1: an era where things are really unstable now. One way
Speaker 1: companies have managed to continue to operate in the absence
Speaker 1: of a formal framework is to file what are called
Speaker 1: standard contractual clauses or sc c s with the EU.
Speaker 1: You can think of this as essentially being a legal agreement,
Speaker 1: and that this legal agreement provides a guarantee that the
Speaker 1: non EU company is taking pains to conform to g
Speaker 1: d p R requirements, so it's essentially saying, you know,
Speaker 1: we're obeying the rules. Securing sccs can be time consuming
Speaker 1: and it isn't a smooth process, at least not as
Speaker 1: smooth as being able to just apply to a framework
Speaker 1: like Privacy Shield or Safe Harbor, so it can be
Speaker 1: a bit of a headache. And now let's talk about
Speaker 1: Ireland and its Data Protection Commission or DPC, because this
Speaker 1: relates directly to the Meta story. The DPC determined back
Speaker 1: in twenty that two of Meta's platforms, namely face Book
Speaker 1: and Instagram, relied on a data controller that could not
Speaker 1: provide a guarantee that data from Irish citizens would be
Speaker 1: protected from US government surveillance, and so by extension that
Speaker 1: would violate data privacy laws in the EU. That would
Speaker 1: also mean that Meta would not qualify for an sc C,
Speaker 1: at least in terms of Facebook and Instagram. WhatsApp, a
Speaker 1: totally different platform, uses a completely different data controller and
Speaker 1: is not part of this like WhatsApp, can operate in
Speaker 1: the EU find because it is not subject to the
Speaker 1: same vulnerabilities that Facebook and Instagram are. Then, last month,
Speaker 1: which for those listening in the future would be July
Speaker 1: of two thousand twenty two, the DPC, this regulatory agency
Speaker 1: in Ireland, filed an updated draft order to shut down
Speaker 1: Instagram and Facebook services in the U and filed that
Speaker 1: with other regulators within the EU. So the other member
Speaker 1: states that have regulated Tory agencies, they all received a
Speaker 1: filing of this updated draft decision. While the contents of
Speaker 1: that order weren't made entirely public, it did become clear
Speaker 1: that DPC was telling other regulators that they should halt
Speaker 1: Facebook and Instagram's ability to transfer EU citizen data to
Speaker 1: the US because it could not guarantee safety against US surveillance.
Speaker 1: This would effectively shut down Facebook and Instagram within the
Speaker 1: European Union and to EU citizens. So let's get into
Speaker 1: some complicated political stuff now. Under Article sixty of the
Speaker 1: g d p R, the rest of the EU's data
Speaker 1: protection agencies have four weeks from that filing to comment
Speaker 1: on the dpc's conclusion. Uh. Those four weeks are up
Speaker 1: this week, by the way. So if after four weeks
Speaker 1: there are no objections to the dpc's decision, which is
Speaker 1: again to essentially shutter Facebook and Instagram within the EU,
Speaker 1: that decision then becomes binding YEWSA. Now, if there are objections,
Speaker 1: which you know likely there are some, then the DPC,
Speaker 1: the Irish regulatory agency, has two weeks to respond and
Speaker 1: address any objections, or alternatively, they can choose not to
Speaker 1: change anything and just submit their decision to the European
Speaker 1: Data Protection Board or e d p B. This is
Speaker 1: like the overall regulatory agency the agency of regulatory agencies,
Speaker 1: and the e d p B would then decide whether
Speaker 1: or not the decision should apply across the European Union.
Speaker 1: The e d p B, which by the way is
Speaker 1: hard to say quickly, would have one month to make
Speaker 1: that decision, uh, though it could also request a month
Speaker 1: extension if the board determined that the matter is complicated
Speaker 1: enough to warrant more consideration, So two months maximum to
Speaker 1: decide on this matter. At that point, After a month
Speaker 1: or two months if it's extended, the board would go
Speaker 1: to a vote. If the vote passes in either direction
Speaker 1: by two thirds majority, then that's the decision. So you
Speaker 1: have to have a two thirds majority for there to
Speaker 1: be a clear decision on the matter. If it doesn't
Speaker 1: get two thirds, then the whole thing is given another
Speaker 1: two weeks of debate and then it goes to another vote,
Speaker 1: and then this one just requires a simple majority. So
Speaker 1: it does get bureaucratically complicated. If like all of this
Speaker 1: plays out, now, will that happen? That's hard to say.
Speaker 1: Let's take a few different scenarios in turn. So Ireland's
Speaker 1: DPC filed the decision in early July, it's already been
Speaker 1: four weeks. So if no other data protection agency in
Speaker 1: the EU has objected to the dpc's conclusion whom the
Speaker 1: decision becomes binding and will know really soon. If some
Speaker 1: data protection agency objected, well, then that adds another two
Speaker 1: weeks for the DPC to respond, at which point, if
Speaker 1: there are no other objections, boom, decision becomes binding or
Speaker 1: the DPC might submit this decision to the overall agency,
Speaker 1: the e d p B. And boy, how do these
Speaker 1: initialisms are really getting clunky? And the e d p
Speaker 1: B would have at least one month at most two
Speaker 1: to come to a vote on the matter. If the
Speaker 1: vote fails to gain two thirds majority in either direction,
Speaker 1: then again another two weeks and then it goes to
Speaker 1: another vote with majority rules. Meta has indicated that it
Speaker 1: might have to shut down its services of Facebook and
Speaker 1: Instagram in the EU anyway, at least until the new
Speaker 1: framework takes effect. The new framework is called the Transatlantic
Speaker 1: Data Privacy Framework, and even then it's uncertain because, after all,
Speaker 1: the European Commission has already determined that two seating frameworks,
Speaker 1: safe Harbor and Privacy Shield, that were meant to be
Speaker 1: in in compliance with EU law, we're lacking and both
Speaker 1: of those got struck down, So there's no guarantee that
Speaker 1: the same thing would not happen yet. Again, this raises
Speaker 1: the question if it's even possible for a company like
Speaker 1: Meta to operate these services in the EU, at least
Speaker 1: the way it has been doing without a massive overhaul
Speaker 1: and its data handling services. Maybe if Meta were to
Speaker 1: establish EU centric servers that were separate from everything else,
Speaker 1: it was not sending EU data to any place outside
Speaker 1: the European Union. It was like a EU specific version
Speaker 1: of Facebook and an EU specific version of Instagram. Maybe
Speaker 1: then it would be fine, but that would be kind
Speaker 1: of ridiculous. Also, I have a feeling that a lot
Speaker 1: of users would be upset that they wouldn't be able
Speaker 1: to access or interact with stuff outside the EU. Or
Speaker 1: if Meta were able to guarantee that it's, you know,
Speaker 1: the the agencies that are handling data from the EU
Speaker 1: to the US were in fact, uh protected against US surveillance,
Speaker 1: then maybe it would be all right. But it can't,
Speaker 1: at least not now. Now. It's possible that this new framework,
Speaker 1: once enacted, would allow METTA to continue operating Facebook and
Speaker 1: Instagram within the EU through some sort of exception, though
Speaker 1: again there's no guarantee that this framework will withstand court scrutiny.
Speaker 1: Over time. This is the situation that Meyer referred to
Speaker 1: in that article in Fast Company that Meta may have
Speaker 1: no choice but to stop offering Facebook and Instagram services
Speaker 1: to EU citizens. Meyer also quotes a Facebook investor named
Speaker 1: Robert mcnami who snarkily said that this could be a
Speaker 1: real disaster for Meta because users would soon figure out
Speaker 1: that they're much better off without access to those platforms.
Speaker 1: I happen to agree with macnamy as someone who got
Speaker 1: off of Instagram and Facebook. Um, I feel like I'm
Speaker 1: better off for doing that. Better off in the larger sense.
Speaker 1: I do miss being able to interact with my friends
Speaker 1: in a concentrated, easy way. It does take a little
Speaker 1: more effort, and you quickly figure out which friends decide
Speaker 1: you're worth that effort, all right. Obviously, the loss of
Speaker 1: a market the size of the European Union would be
Speaker 1: a huge blow to Meta, a company that's already dealing
Speaker 1: with other crises. Not still too early to say if
Speaker 1: that's definitely gonna happen, But no matter what the outcome,
Speaker 1: this ongoing struggle to find ways for non EU companies
Speaker 1: to comply with EU privacy laws is going to be
Speaker 1: an enormous challenge it has been and it will continue
Speaker 1: to be. EU regulators and politicians are exceedingly wary about
Speaker 1: the sincerity of US companies when it comes to their
Speaker 1: claims of protecting information, and for good reason. There's lots
Speaker 1: of evidence to point that we should be suspicious of
Speaker 1: those kinds of claims. And while I have focused on
Speaker 1: Meta in this episode, the truth is those requirements apply
Speaker 1: to all non EU companies. H And I've been really
Speaker 1: focusing on the US here, but that applies to anything
Speaker 1: outside the EU. So doing business in the Internet age
Speaker 1: and doing business within the EU is going to require
Speaker 1: regular investment to assure the EU that companies are playing
Speaker 1: by the rules. And uh, that's just gonna be difficult.
Speaker 1: You have entire companies that exists as consulting firms to
Speaker 1: help other companies make sure that they are complying by
Speaker 1: the rules, because the cost of business if you're found
Speaker 1: by some regulatory agency in the EU too have fallen short,
Speaker 1: is enormous. That's what Meta is going through now. I
Speaker 1: don't know if Facebook and and Instagram or are not
Speaker 1: long for this world in the EU. UM, we will
Speaker 1: have to keep our eyes on it. It wouldn't surprise
Speaker 1: me if we see politicians struggle to make sure that
Speaker 1: there remains access within the EU for these platforms. They're
Speaker 1: incredibly popular, they're important for things like small businesses within
Speaker 1: the EU. But you know, you have the regulators and
Speaker 1: then you have the politicians, and politicians move slowly when
Speaker 1: it comes to creating these policies that sometimes get overturned
Speaker 1: later on, regulators move way faster. So it may see
Speaker 1: that we'll see in eruptions in service, perhaps with a return.
Speaker 1: I mean there you would have to imagine that Meta
Speaker 1: would want to return even if it's business is curtailed
Speaker 1: for you know, some indeterminate length of time, because you
Speaker 1: don't want to leave money on the table. Anyway, I
Speaker 1: thought that that was an interesting topic. It relates heavily
Speaker 1: to technology because ultimately it is very hard to guarantee
Speaker 1: data security. Uh, it's it's hard to do because often
Speaker 1: you come up with ways that data is really valuable
Speaker 1: you want to use it, and sometimes that breaks the
Speaker 1: rules or sometimes it's it's just hard because creating any
Speaker 1: secure system is incredibly difficult. If someone's really determined to
Speaker 1: get access to a secure system, often they can find
Speaker 1: a way. So yeah, a difficult difficult challenge and uh
Speaker 1: you know, the European Union has created laws that in
Speaker 1: many ways have made it difficult to innovate uh in
Speaker 1: in certain ways and also comply with those laws. That's
Speaker 1: not necessarily a bad thing, you know. It may be
Speaker 1: that whatever the innovation was isn't worth the trade off
Speaker 1: in privacy and security, but it also means that it
Speaker 1: creates this extra hurdle that innovators and companies and and
Speaker 1: all sorts of people have to get over in order
Speaker 1: to make their vision a reality. Um. Yeah, it's a
Speaker 1: balancing act. Well, that's it for this episode. If you
Speaker 1: have some sugestions for future episodes of tech Stuff, please
Speaker 1: reach out to me and let me know. One way
Speaker 1: to do that is to download the I Heart radio app.
Speaker 1: It is free to download. You can then search for
Speaker 1: tech Stuff, navigate over to the podcast page. There's a
Speaker 1: little microphone icon there. If you click on that, you
Speaker 1: can leave a voice message up to thirty seconds in
Speaker 1: length let me know what you would like to hear,
Speaker 1: or if you prefer, you can reach out on Twitter.
Speaker 1: The handle for the show is tech Stuff H s
Speaker 1: W and I'll talk to you again really soon. Tech
Speaker 1: Stuff is an i heart Radio production. For more podcasts
Speaker 1: from my heart Radio, visit the i heart Radio app,
Speaker 1: Apple Podcasts, or wherever you listen to your favorite shows.