META Meta Platforms Inc

By Suzanne Vranica 

The advertising business today is largely driven by people's personal information. Data is the lifeblood of tech platforms, publishers, ad agencies and ad tech companies. However, this marketing approach is facing plenty of pressure. Its biggest challenge yet: the General Data Protection Regulation.

Europe's sweeping new privacy law, which often requires companies to get users' consent to gather personal information, and requires companies to be more transparent about the data they collect and how it is used, is already causing headaches. Although GDPR went into full effect only on May 25, complaints about companies such as Google and Facebook are starting to be investigated, says Andrea Jelinek, the European Union's top privacy enforcer.

The potential penalties -- as much as 4% of global revenue for companies found to be noncompliant -- are daunting. Thus companies around the globe have scrambled to bring their practices in line with the new rules.

The Austrian-born Ms. Jelinek, who heads a new European Data Protection Board, spoke with The Wall Street Journal about the new complaints against the tech giants, the Cambridge Analytica scandal and whether lawmakers have the resources to enforce the new regulations. Edited excerpts follow.

Targeted ads

WSJ: Should targeted advertising, which often uses individuals' personal information, like location or a Web browsing history, continue to exist, or should the ad industry move away from that approach?

MS. JELINEK: Personally, I am not a fan of targeted advertising. I am sure the industry will come up with new models that are data-compliant. Maybe the ad industry will come up with something that's better or different than using your personal data.

WSJ: How many companies are currently under investigation?

MS. JELINEK: There are currently about 24 cross-border complaints that we are starting to investigate.

WSJ: What do the complaints involve?

MS. JELINEK: They involve forced consent, which is when consumers have no choice whether or not they give away their personal data. They are forced to accept data-collection policies to use certain services.

WSJ: Which companies are being probed?

MS. JELINEK: Companies such as Facebook, Google and services such as Instagram and WhatsApp, which are owned by Facebook.

[Editor's note: Facebook Chief Privacy Officer Erin Egan said last month: "We have prepared for the past 18 months to ensure we meet the requirements of the GDPR. We have made our policies clearer, our privacy settings easier to find, and introduced better tools for people to access, download, and delete their information. Our work to improve people's privacy doesn't stop on May 25th. For example, we're building Clear History: a way for everyone to see the websites and apps that send us information when you use them, clear this information from your account, and turn off our ability to store it associated with your account going forward."]

[Google didn't respond to a request for comment.]

WSJ: Does forced consent run afoul of the rules?

MS. JELINEK: The GDPR set very strict rules regarding consent, especially when the consent is asked in a "take it or leave it" approach. Since each case has its specificities, the answer might be different for each complaint. It is too soon to give any view on the cases. The final interpretation of EU law belongs to the European Court of Justice.

WSJ: How long will those investigations take, and will the companies be fined?

MS. JELINEK: The duration is impossible to say at this point. It is different from case to case. Not all investigations necessarily lead to fines.

WSJ: What apps do you use?

MS. JELINEK: I just use a little bit of Facebook because of professional reasons, and I use Instagram to follow my daughter. That's it.

Cambridge Analytica

WSJ: What are your thoughts on the Cambridge Analytica scandal, which involved the data firm's allegedly improperly obtaining data on tens of millions of Facebook users?

MS. JELINEK: We think Cambridge Analytica is just the tip of the iceberg.

WSJ: Y ou think more issues will be found?

MS. JELINEK: Could be, but we have to wait for the outcome of the investigation. If you think about what happened over the past few months, we keep getting more information and revelations. Facebook said, "We have to improve this." It's like a puzzle. They say, "We are going to improve," and then there are new revelations and then more revelations.

It's like a ladder, and it's a pity. It's a pity a billion-dollar company like this one isn't black and white about the data, the consumer, or the contracts they have with whom they are sharing the data.

[Editor's note: A spokeswoman for Facebook points out that the company has said it expects to find more bad apps as part of its ongoing investigations.]

WSJ: How has the Cambridge Analytica affair affected your thinking about privacy?

MS. JELINEK: I think that privacy and data protection is a fundamental right. It's that important. I think it's also important for the companies that they know they are responsible for the data they are collecting and for the data they are sharing.

WSJ: Do you think the scandal has made consumers more aware of the lack of privacy that exists today?

MS. JELINEK: Many people, for the first time, noticed that they could be affected. If you think that your personal data are affected, your privacy is affected and your life is affected, then the awareness rises. It was one of the reasons data-privacy concerns went mainstream.

WSJ: GDPR was supposed to limit the tech giants from pressuring people into relinquishing control of their data, but it seems to have strengthened Google and Facebook. Ad dollars have been directed to Google away from smaller ad exchanges because they cannot verify if people gave consent. Did you expect this law to benefit the tech giants?

MS. JELINEK: The smaller companies had the chance during the past two years to adapt like the larger ones have.

Enough resources?

WSJ: Do countries have the financial resources to really go after cash-flush digital giants like Google if they run afoul of the laws?

MS. JELINEK: Even if you have the deepest pockets, you have to be compliant with the law.

WSJ: Do you think European privacy laws will pressure U.S. lawmakers to put forth more privacy legislation?

MS. JELINEK: I think the U.S. administration and U.S. lawmakers know that data protection is becoming a main issue. It's becoming popular in the United States. U.S. citizens care about their personal data. They care about who they're giving it to and what the companies are doing with their data. I also am seeing interest and questions from U.S. companies regarding GDPR and how to be compliant.

Ms. Vranica is a news editor for The Wall Street Journal in New York. She can be reached at suzanne.vranica@wsj.com.

(END) Dow Jones Newswires

June 18, 2018 13:42 ET (17:42 GMT)

Copyright (c) 2018 Dow Jones & Company, Inc.