GDPR reverses US law by making companies justify data activities under regulation

Evidence

Many hopes today are pinned on the new body of EU regulation known as the General Data Protection Regulation (GDPR), which became enforceable in May 2018. The EU approach fundamentally differs from that of the US in that companies must justify their data activities within the GDPR’s regulatory framework. The regulations introduce several key new substantive and procedural features, including a requirement to notify people when personal data is breached, a high threshold for the definition of “consent” that puts limits on a company’s reliance on this tactic to approve personal data use, a prohibition on making personal information public by default, a requirement to use privacy by design when building systems, a right to erasure of data, and expanded protections against decision making authored by automated systems that imposes “consequential” effects on a person’s life. The new regulatory framework also imposes substantial fines for violations, which will rise to a possible 4 percent of a company’s global revenue, and it allows for class-action lawsuits in which users can combine to assert their rights to privacy and data protection. — Shoshana Zuboff, The Age of Surveillance Capitalism, 1536

Categorization

• DEFINE: Useful compact breakdown of GDPR’s enforcement features: consent threshold, privacy by design, right to erasure, automated-decisioning limits, 4 percent revenue fines.
• SEED: The ‘4 percent of global revenue’ fine and the GDPR-vs-US regulatory philosophy of who must justify data use could anchor a short explainer on how Europe and America diverge on data rights.
• XREF: connects to: Overwhelming US majorities favor rights-to-be-forgotten style data control — Shoshana Zuboff, The Age of Surveillance Capitalism, 188

Broader Connections

• Overwhelming US majorities favor rights-to-be-forgotten style data control #contradicts (0.70) — Shoshana Zuboff, The Age of Surveillance Capitalism, 188