The general data protection regulation, which has come into effect, has prompted a number of prestigious US-based websites including the Los Angeles Times and Chicago Tribune to shut off access to internet users in the EU.
Visitors to newspapers owned by Tronc Inc – formerly Tribune Publishing – which also includes the New York Daily News, the Baltimore Sun, Orlando Sentinel and the San Diego Union-Tribune, are being redirected to a page with the message: “Unfortunately, our website is currently unavailable in most European countries.
“We are engaged on the issue and committed to looking at options that support our full range of digital offerings to the EU market. We continue to identify technical compliance solutions that will provide all readers with our award-winning journalism.”
Other services have announced that they are permanently deleting the accounts of European-based users in order to comply with the internationally applicable regulation, introduced on Friday, which strengthens the rules around how companies are able to use, store and process personal data.
The move has renewed fears that the law, and others like it, could “Balkanise” the internet and lead to the creation of a two-tier system, with EU-based web users excluded from services and sites offered elsewhere in the world.
In a briefing note, risk management firm Russell Group said international data regulation could “blow the lid off global digitally connected trade”. The company compared GDPR to previous efforts by less liberal polities, including Russia and China, to enforce national laws on international companies.
“Russia, for example, enforces data localisation laws so that citizens’ datasets have to remain in the country,” the group wrote. “Enforcing its laws, Russia has banned access to LinkedIn since 2016 and threatens to block Facebook in 2018 unless it agrees to comply with the data localisation laws.”
How has becoming compliant played out in your workplace? What short and long term effects will the process have on the business?
You can share your experiences by filling in this encrypted form – anonymously if you wish. Your responses will only be seen by the Guardian and we’ll feature some of your responses in our reporting. You can read terms of service here.
Prof Gina Neff, of the University of Oxford’s Internet Institute, argued that Balkanisation was the wrong metaphor. “The internet is already shaped by very different kinds of geographies, cultures, and political regimes,” Neff said. “For example, the ‘great firewall’ means a vastly different way of navigating the internet has emerged in China.
“Cultural differences around the world mean people use a seemingly similar site like Facebook in different localised ways. A history of strong regulation of news content means Germany has been much less vulnerable to misinformation campaigns than other countries have.”
Others were more hopeful. Doug Winter, a York-based tech executive, said any temporary Balkanisation would gradually be reversed as other nations followed the lead of the EU – and that the companies that are blocking the continent are generally ones that Europeans won’t be missing.
“There are whole classes of business, such as advert-targeting middleware (also at least 20% evil), who are keeping their heads down right now. You have not received an email from them. They are non-compliant, but do not have a direct consumer relationship.
“They’ll be depending on their corporate customers (who could be considered the controllers) to gain appropriate consent or have other GDPR-reasonable causes for data processing. They don’t. These businesses might also end up ditching Europe, for the same reason.”
Lukasz Olejnik, a privacy expert, dismissed concerns, pointing out that far more common than blocking EU users was companies such as Microsoft offering GDPR protections worldwide.
“Withdrawing operations from Europe or blocking European users is not a serious threat in the long run,” he said. “We’re speaking about 500 million of potential users. The mass hysteria and outright disinformation regarding GDPR is unfounded and actively harmful.”
