Facebook is rolling out stronger privacy protections to users ahead of the introduction of Europe’s General Data Protection Regulation (GDPR), but Mark Zuckerberg will not promise all future changes will apply to the company’s American users.
Although the initial tranche of changes, announced last week, will be available worldwide, Zuckerberg refused to commit to GDPR becoming the standard for the social network across the world.
The General Data Protection Regulation (GDPR), which came into force on 25 May 2018, replaced the patchwork of national data protection laws across the EU with a unified system that greatly increased the fines regulators could issue, strengthened the requirements for consent to data processing, and created a new pan-European data regulator called the European Data Protection Board.
The regulation governs the processing and storage of EU citizens' data whether or not the company has operations in the EU. To ensure companies comply, GDPR also gives data regulators the power to fine up to €20m, or 4% of annual global turnover. In the UK, the previous maximum fine was £500,000; the post-GDPR record currently stands at more than £180m, for a data breach reported by British Airways in 2018.
Data breaches must be reported within 72 hours to a data regulator, and affected individuals must be notified unless the data stolen is unreadable. Fines can also be levied against companies that act on data without explicit and informed user consent, or who fail to ensure that consent can be withdrawn at any time.
GDPR also refined and enshrined in law the concept of the "right to be forgotten", renaming it as the "right to erasure", and gave EU citizens the right to data portability, allowing them to take data from one organisation and give it to another.
He told Reuters that Facebook was working on a version of the data protection law that would work globally, bringing some European privacy guarantees worldwide, but the 33-year-old billionaire demurred when asked what parts of the law he would not extend worldwide.
“We’re still nailing down details on this, but it should directionally be, in spirit, the whole thing,” Zuckerberg said. He did not elaborate.
His comments suggest that in some ways, American users will continue to find themselves with weaker privacy protections than their European counterparts.
Privacy advocacy groups have been urging Facebook and its Silicon Valley competitors such as Alphabet Inc’s Google to apply EU data laws worldwide, largely without success.
“We want Facebook and Google and all the other companies to immediately adopt in the United States and worldwide any new protections that they implement in Europe,” said Jeff Chester, executive director of the Center for Digital Democracy, in Washington.
Zuckerberg has agreed to testify in front of Congress, the first of several such hearings he is expected to appear before, on Wednesday 11 April. Representatives Greg Walden and Frank Pallone, the ranking members of the House Energy and Commerce committee, said the hearing will focus on the Facebook’s “use and protection of user data”.
Even while Facebook introduces its long-planned tweaks to comply with GDPR, the social network is also rushing to introduce a second set of privacy tools following the Cambridge Analytica files, which revealed the company’s historical lack of clarity over how and why user data was shared with third parties.
The latest post-scandal change offers users the ability to remove applications from the Facebook platform in bulk quantities. Integrations with external developers were responsible for the initial removal of data from Facebook’s platform that eventually found its way into the hands of Cambridge Analytica, an election consultancy. But it has always been hard for users to manage the settings related to how much data gets shared with external providers, particularly if those users have been on the site for many years.
Now, alongside a tool that was previously promised, which deactivates an app if the user hasn’t accessed it in three months, Facebook allows users to remove apps in large numbers, making it easier to clean up their privacy settings.
The new settings can be accessed by visiting the main settings, then clicking on “apps”, and checking multiple apps that should be removed.
