E.U. Hints Strongly at Tighter Regulation of Online Data Collection

The European Commission’s Consumer Affairs Commissioner Maglena Kuneva suggested Internet firms must clean up their act on online data collection, or risk tighter legislation.

Delivering a keynote speech at an E.U. roundtable event in Brussels yesterday, the commissioner invited industry itself to produce a framework through which consumer rights are protected, but clearly hinted that further E.U. legislation is a possibility. “If we fail to see an adequate response to consumer concerns on the issue of data collection and profiling, as a regulator, we will not shy away from our duties nor wait for a cataclysm to wake us up.”

Kuneva described online data as “the oil of the Internet and the currency of the digital world,” but warned that “from the point of view of commercial communications, the world wide Web is turning out to be the world wild west.”

The commissioner delivered her keynote to an audience of representatives from industry players and consumer groups, including Google’s Global Privacy Counsel Peter Fieischer, and Phorm’s Chief Privacy Officer Jeffrey Brooks Dobbs. Staff from Microsoft and a host of other online firms such as Amazon and eBay were also present.

The commissioner argued that online firms were collecting and utilizing data without the full knowledge or consent of consumers, and that the current situation with regard to privacy, profiling and targeting is “not satisfactory.”

“Currently, consumers have little awareness of what data is being collected, how and when it is being collected and what it is used for. And they are also not able to control this process. The current opt-out systems are partial, sometimes nowhere to be found, they are difficult or cumbersome and most of all, they are unstable. Avoiding tracking is currently technically difficult if not impossible,” she said.

Online targeting and profiling is, of course, nothing new, but Kuneva argued that current European laws are failing to keep pace with the development of the Internet. “The new reality is that, on the Internet consumers are in fact paying for services with their personal data and their exposure to ads. This amounts to a new kind of commercial exchange contractually established by the privacy policy. We must require of privacy policies that they submit to the same fairness and transparency standards that are commonly accepted in commercial contracts.”

The IAB U.K. issued a set of principles last month in an attempt to govern the data-centric practice of behavioral targeting. Industry giants such as Google, Microsoft, AOL, and Yahoo have signed up, alongside controversial ISP-level targeting firms such as Phorm and NebuAd.

Although behavioral firms insist that user data is kept anonymous, Kuneva suggested these measures are not sufficient to satisfy privacy concerns. “The current work on privacy has concentrated on eliminating personally identifiable information such as name or IP addresses from the public domain,” she said. “Consumer policy needs to go beyond that and address the fact that users have a profile and can be commercially targeted based on that profile, even if no one knows their actual name.”

In related news, Google itself recently launched a dedicated European Public Policy Blog, edited from Brussels, in order to better communicate with stakeholders and users on a more local level, it said.