The timing couldn’t have been worse for the likes of Google, Facebook, Microsoft, and Yahoo! As Europe was reacting with outrage to fresh allegations of U.S. National Security Agency eavesdropping on its leaders and citizens, a European Parliament panel this week approved a draft of a new electronic-privacy law.
The law’s biggest impact, however, won’t be on spy agencies. It takes aim at Internet companies, who will face stiff penalties if found to have violated the privacy rights of European Union citizens in storing and handling their personal data. Fines could total €100 million ($137 million) or 5 percent of a company’s annual sales, whichever is greater.
European privacy regulators have already tangled with U.S. online companies, including a €100,000 fine France levied against Google for personal data collection by its Street View mapping service.
Continuing leaks from NSA whistle-blower Edward Snowden have underscored the broad reach of the agency’s alleged snooping in Europe, from looking at private citizens’ credit-card and bank-transfer records to listening in on mobile phone calls by German Chancellor Angela Merkel and other leaders. There have also been reports that British intelligence services hacked Belgian mobile provider Belgacom.
Although the proposed EU law focuses on companies’ use of personal data, the recent revelations make clear that some spying efforts “relate to economic interests, rather than strictly national security issues. That has had an impact on the atmosphere” during deliberations on the EU law, says Nick Pickles, director of Big Brother Watch, a British data-privacy advocacy group.
In defending NSA surveillance of Internet and mobile communications between Americans and foreigners, “the U.S. attitude has been that U.S. citizens have protection, but everyone else doesn’t,” Pickles says. Europe, likewise, wants to ensure that its citizens’ rights are protected when foreign Internet companies collect their personal data, he says.
Disclosures of U.S. spying in Europe could produce other economic fallout, Fran Burwell, a vice president at the Washington-based Atlantic Council, told Bloomberg News. For example, she says EU lawmakers have signaled that a proposed U.S.-European free trade pact “won’t be approved unless there’s an agreement between the U.S. and EU on the handling of personal data.”