Last week, Facebook announced it would cease using facial recognition technology on European Union users and delete all data following complaints from member states and an inquiry by the Irish Data Commissioner. While the Electronic Privacy Information Center (EPIC) filed a complaint with the Federal Trade Commission here in the U.S. over Facebook’s use of the same technology, the complaint remains pending — repeating a familiar narrative of online giants facing higher levels of scrutiny in European Union countries than in the United States.
In the U.S. numerous agencies enforce a “patchwork” of laws defining online privacy protections in different sectors, leaving some areas with very little oversight and users without a clear path to pursue if they feel their rights have been violated. It’s a different story in the E.U., where online privacy policy is guided by the Data Protection Directive — a sort of bill of rights for online users that provides member nations with guidelines for national level laws guaranteeing a base level of control for users.
European protections are on the cusp of becoming even more robust with proposed regulation this year that would implement rules superseding national level laws and extending the scope of protections to apply to all foreign companies processing the data of EU residents. The new regulation also comes with some teeth: Penalties up to two percent of global revenues for offending companies.
To put that into perspective, this summer Google agreed to pay the largest Federal Trade Commission settlement ever to an individual company: It amounted to five hours of 2011 revenues. Under the proposed European Commission Data Protection rules it could have amounted to one hundred seventy-five hours of revenue.