Reason.com

Free Minds & Free Markets

Sundar Pichai: Google Supports an American Data Privacy Law

The tech giant actually stands to gain by legally hamstringing competition with tough regulations.

Sundar Pichai, Google CEOJeff Malet Photography/NewscomThe tech world is buzzing after another round of executive grilling on the Hill. This time, Google CEO Sundar Pichai was in the House Judiciary hotseat for his company's data and algorithmic practices, after previously eschewing invitation to testify. Much of the congressional chorus was familiar: Republicans chastised Google for anti-conservative bias, Democrats hounded the search giant for insufficient actions against hate speech and Russian bots. Pichai was at turns acquiescent and evasive, as is typical of these now routine spectacles.

There were some unique bones of contention that stood out in this testimony.

Commentators noted Pichai's seeming discomfort with bipartisan questions about Google's much-derided "Project Dragonfly." The company reportedly had big plans for a renewed foray into the Chinese search market, complete with all of the surveillance bells and whistles necessary to maintain a good working relationship with the People's Republic of China. Pichai told the committee that Google has "no plans" to collaborate with the Chinese government, but later admitted that the company previously had "over 100" people working on the apparently scrapped super snooper.

Both parties were also keen to drill down on exactly what and how Google tracks data, particularly when it comes to our locations. Fueled by an earlier controversy over covert location tracking and a recent New York Times investigation into de-masking individual location data, representatives asked whether Google could tell when someone walked from one side of a room to the other, and whether Google could specify that person's identity. (Pichai responded that he didn't know the answer to either.)

What has gone less commented upon, however, was the Google CEO's admission that his company supports strong federal data privacy legislation.

Right now, the U.S. lacks dedicated data privacy legislation. The Federal Trade Commission (FTC) has become the top federal cop on the beat, investigating companies when their data practices are found to be deceptive or unfair, for instance when a company violates its own terms of service. Specialized agencies may promulgate their own data standards practices as well; the Securities and Exchange Commission issues guidelines for institutions handling financial data, for example.

Otherwise, data privacy oversight is largely state-based. A few states with strong data privacy laws can become the de facto standard for most of the country, as is the case with Illinois's biometric practices law and California's recent Consumer Privacy Act (CCPA), which is slated to go into effect in 2020.

There is a movement afoot to supplant the current patchwork of data standards with a single, federal focus.

Some privacy advocates want the US to take the tack of the European Union, whose stringent General Data Privacy Regulation (GDPR) went into effect earlier this year. Google may not be what comes to mind when you think of "privacy hawks," but the company is among these ranks for self-interested reasons.

The GDPR's many problems are by now well understood. The vague and expansive legislation has introduced regulatory uncertainty for businesses operating in member states. The combination of unclear wording and extreme financial penalties means that companies must spend billions of dollars to maybe be considered compliant.

This may be a headache for large firms, but hardly insurmountable: they have the deep pockets and armies of lawyers needed to stay on the right side of the law. But GDPR can be a death knell for small or not-yet-formed ventures, many of which are not even data-focused tech companies, who could never hope to spend enough money to comply.

Indeed, many companies and online platforms have decided to just shut their doors to Europe completely rather than risk the $25 million or 4 percent of annual revenue at stake for inadvertently running afoul of the GDPR. There are more unseen casualties as well. We will never know the developments that could have been that the GDPR prematurely quashed.

Consequently, the GDPR has had the unintended (but wholly predictable) consequence of consolidating market power behind the mega firms that privacy advocates hoped to take down. There is a reason that the GDPR earned its informal nickname of the "Google Data Protection Regulation": small adtech vendors lost dramatic EU market share after the GDPR was implemented. Only Google's market share increased.

It makes sense why Google would support another "GDPR" in the US. Last week, Pichai publicly confirmed these suspicions.

During the hearing, Rep. Eric Swalwell asked Pichai whether he thought the US should adopt a national GDPR-style data framework, requiring that users affirmatively "know, understand and consent" to all data usage. Pichai responded that he thought global regulatory harmonization is a good idea. But he didn't just offer vague platitudes: he said he actively supported the GDPR as a "well thought-out" law and thought it was a good idea to bring to the States.

Is anyone surprised? Although the company had to spend billions of dollars to try to be compliant with the GDPR, so did its competition. Google is one of the most well-capitalized companies in the world. It can afford compliance costs, its upstart competitors probably cannot. Furthermore, Google has already implemented a relatively strict interpretation of GDPR compliance, which means it may not have much more work to do for a similar stateside bill. It is easy to see why the company may want to replicate this process in the US.

There is another layer of congressional chicanery at hand. I mentioned that many groups desire a federal solution for data issues. Other tech companies, most notably Facebook, publicly support federal data legislation. But these companies support a voluntary standards-based approach to supplant the GDPR-style CCPA before it goes into effect in January of 2020.

Depending on the final wording, this approach could be vastly superior to the CCPA. But Google and other companies may actually prefer a GDPR-style "active consent" approach because it could handicap competitors like Facebook, whose trustworthiness among the public is at an all-time low.

Google may enjoy some good PR for seeming to support "strong data protections" in the US. But don't be fooled. As the experience with the GDPR suggests, implementing heavy federal data regulations will only redound to the search giant's benefit.

Photo Credit: Jeff Malet Photography/Newscom

Editor's Note: We invite comments and request that they be civil and on-topic. We do not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments do not represent the views of Reason.com or Reason Foundation. We reserve the right to delete any comment for any reason at any time. Report abuses.

  • $park¥ The Misanthrope||

    I'm glad the government will be stepping in to save me from the evil Google megacorp.

  • perlchpr||

    It's really a pity that Google dropped the "don't" from their original company motto.

  • Jerryskids||

    Are you suggesting regulatory agencies might be regulating in ways that benefit the big players in the regulated industries rather than fostering the competition that benefits the general public? Man, that's like the regulators are controlled by the regulated, like they've been "captured" or something. I hope the regulators at least get cushy jobs with the regulated companies once they leave office or something for their efforts to benefit those companies!

  • Leo Kovalensky II||

    It's interesting Jerry, because if you just randomly search for the words "regulatory" and "capture" I get a definition that defines what you're talking about as a "government failure." And we know that can't possibly be the case... right? Government failure???

    Regulatory capture is a form of government failure which occurs when a regulatory agency, created to act in the public interest, instead advances the commercial or political concerns of special interest groups that dominate the industry or sector it is charged with regulating.

  • $park¥ The Misanthrope||

    People named John insist this is necessary for my protection.

  • Leo Kovalensky II||

    Well to be fair... an entity referred to as "John"

  • $park¥ The Misanthrope||

    Ok, several entities called John. See below.

  • Chipper Morning Baculum||

    I hope the regulators at least get cushy jobs with the regulated companies once they leave office or something for their efforts to benefit those companies!

    And where do you think these regulators come from in the first place? Gotta have experience in an industry in order to regulate it, catch my drift? But according to history books, the regulators descend down from heaven for their term in office, and then ascend back up once they are done. For example, who they drank with in business school has no effect on their service. I mean, that would be silly.

  • loveconstitution1789||

    While laws for privacy are a good trend, Privacy needs a Constitutional Amendment. This way, future sessions of Congress cannot just rollback privacy protections.

    The government mostly walks all over the Constitution anyway but at least there is a pause because of what the Constitution says. The government just ignores laws.

  • Leo Kovalensky II||

    We already have the 9th.

    You have this backwards. The Constitution was never supposed to be a document to define our rights as people. It was supposed to define and limit the government. If the government wants power to snoop on data from private industries or regulate how data is used then it needs to amend the Constitution to grant the Congress this power, because it doesn't exist today.

  • loveconstitution1789||

    The Constitution grants rights. It grants the right to jury trial, to non-excessive bail, to have the assistance of counsel for his defense....

  • a ab abc abcd abcde abcdef ahf||

    The 4th amendment IS the privacy amendment. Government just chooses to not interpret it honestly.

  • Leo Kovalensky II||

    This is the case in every industry with every regulation. Regulations are a barrier to market entry, with large, established corporations benefiting from writing the rules and having large legal departments to comply. Startup companies who don't have such resources are snuffed out.

    Think about the last time that you saw a successful startup company in a well-established, already regulated field.

  • JFree||

    And yet - creating a global trade system with supranational regulation via WTO always seems to be deemed 'free trade' and benefits everyone at all times.

    I do think that the real rule of thumb is centralized regulation favors the big/established, decentralized regulation favors the small

  • Longtorso, Johnny||

    Break Up Google for the Public Good
    Google, that doesn't really consider itself American, that really isn't loyal to the country that gave it the ability to rise, that really isn't loyal to many American values, that is truly only loyal to itself and its left-wing worldview. That company, already collecting the most personal and identifiable data in the world, is not transparent about what it's doing with the data, and is positioned to become even more powerful in the new world order that the IoT is going to usher in.

    Now combine that power with the power of the world's largest police state—China—which is also the world's second largest economy and which has flatly stated it seeks to displace the United States. What could possibly go wrong?

  • chemjeff radical individualist||

    So, Google should be broken up with anti-trust laws, not because they are an actual monopoly, but because they are insufficiently pro-America. Is that about right?

    John Kerry called, he wants his talking point back.

    Actually, if you look at John Kerry's 2004 tax plan, it looks a lot like something your typical Trumpkin could support.

  • Leo Kovalensky II||

    Jeff, you simply don't get it... Owning the left is more important than any principles like believing in "free" markets or "free" speech.

  • chemjeff radical individualist||

    If only there was a name for an economic model in which private enterprise had to prove their loyalty to the state in order to receive the blessings of the state...

  • Longtorso, Johnny||

    This is the same Google jumping into bed with foreign governments and asking the US govt to 'regulate' the industry for their protection. Fuck them.

  • Leo Kovalensky II||

    The solution is to deny their rent-seeking request for regulation, not to break them up with force. Libertarianism really isn't that hard of a concept to grasp.

  • chemjeff radical individualist||

    You're still not under the impression that Johnny Longstorso here is a libertarian, are you?

  • Longtorso, Johnny||

    The government has too many ways of punishing its enemies and rewarding its friends for me to sit back and say its OK since Google is listed on a stock exchange somewhere.

  • a ab abc abcd abcde abcdef ahf||

    So your solution to the government being to big is to use the government to break up a private company.

  • Chipper Morning Baculum||

    Libertarianism really isn't that hard of a concept to grasp.

    I wish you were right, Leo. Alas, I fear you are not. Exhibit A: this comment section.

  • JFree||

    Google may enjoy some good PR for seeming to support "strong data protections" in the US. But don't be fooled. As the experience with the GDPR suggests, implementing heavy federal data regulations will only redound to the search giant's benefit.

    I'm not fooled by Google - but there is a huge potential problem here with this sort of status quo support. Because the status quo assumes that the data is Google's property. Change that assumption - that the data is YOUR property - and there is most certainly a role for government. Very different from the proposed role - and from the perpetual libertarian satisfaction with a corporatist status quo.

  • Sevo||

    "...and from the perpetual libertarian satisfaction with a corporatist status quo."

    Beat that strawman, you fucking idiot.

GET REASON MAGAZINE

Get Reason's print or digital edition before it’s posted online