The Ethical Data Practices Framework and its Implications for Data Privacy Relations between the United States and the European Union

Private companies are data-rich. But market pressures to collect more, store more, and analyze more consumer data can often make them ethically bankrupt in the way of proactively protecting consumer privacy rights. The recognized need to codify data privacy rights into law as global commerce and compute power exploded in the 2000s were foundational motivations for establishing a new privacy regime within the European Union (EU). Since its enforcement in 2018, the General Data Protection Regulation (GDPR) has since become a beacon for omnibus data privacy and protection law(Dove 2018). While only applicable to processing and controlling data involving citizens of EU Member States (Becker et al.), the GDPR has nevertheless shaped privacy policies and norms worldwide, including in the United States. Indeed, GDPR’s legislative influence is evident in State-based consumer privacy laws in California, Virginia, Connecticut, and Colorado, among others (US State Privacy Legislation Tracker 2023). Some have argued a GDPR-inspired regulation in the U.S. should be endeavored (Nayyar 2023), or establishing “one comprehensive privacy standard worldwide for the collection and processing of personal data” (Voss and Houser 2019). Yet differences in regulatory approaches to federal data privacy, protection, and security between the United States and the EU have grown starker since GDPR, and at times have significantly strained the transatlantic transfer of personal data.

The Ethical Data Practices Framework advanced in the target article by McCoy and colleagues (2023) is timely in the political history of data privacy relations between the EU and U.S. The authors take a pragmatic approach to helping companies respect substantive - minimizing harm, fairly distributing benefits and burdens, and respecting individual autonomy - as well as procedural - transparency, accountability, and inclusion - ethical principles in routine company operations that involve processing and sharing personal data. Five imperatives activate these principles in practice, including

• Minimize collection and retention of personal data;

• Offer fewer but more meaningful choices about data;

• Provide meaningful disclosure;

• Assess the social impact of data practices; and

• Ensure meaningful stakeholder engagement (McCoy et al. 2023).

In what follows, I provide a brief historical accounting of the past 20 years of data privacy negotiations between the U.S. and EU. I weave in commentary about the implementation potential and challenges of self-governing frameworks like the Ethical Data Practices Framework to sustaining healthy data privacy relations between these economic powers moving forward. I draw on findings from ongoing empirical work to justify why accountability mechanisms, in specific, are needed to orient companies towards the ethical data practices we know individuals want and care about.

Safe Harbour (2000–2014)

Regulation (EU) 2016/6792 sets out the rules for the transfer of personal data from controllers or processors in the EU to other countries. Legislators further acknowledged that such data flows are “essential for the expansion of cross-border trade and international cooperation,” insofar as “the level of protection afforded to personal data in the Union must not be undermined by transfers to third countries or international organisations.” Article 45(3) of the same Regulation grants the European Commission the authority to determine whether “a third country, a territory or one or more specified sectors (emphasis added) within a third country, ensure(s) an adequate level of protection” that is functionally equivalent to the protections afforded under the GDPR. The adequacy of protections for inbound personal data transfers from the EU to the US has been legally challenged no fewer than three times, and the U.S. has struggled to maintain its adequacy status ever since.

The Safe Harbour arrangement was among the earliest official data privacy agreements between the U.S. and EU. It was enacted in July 2000, and was administered by Department of Commerce and enforced by the U.S. Federal Trade Commission (FTC). Under Safe Harbour, U.S. companies could voluntarily sign onto the arrangement if they self-certified with the Department of Commerce that company privacy policies incorporated the Safe Harbour Privacy Principles and agreed to make these policies transparent. After more than a decade in effect, the EU Parliament invalidated Safe Harbour in March 2014. In that instance, private U.S. companies were chiefly to blame. U.S. intelligence agencies that unlawfully processed personal data on account of national security were also found to violate the Safe Harbour terms.

Parliament’s decision to end Safe Harbour rested in part on the ineffectiveness of self-certification and the FTC’s failure to hold companies accountable for Safe Harbour violations among private U.S. companies. The events that led to Safe Harbour’s dissolution is consequential, in my view, for the implementation potential of the Ethical Data Practices Framework because the Framework similarly relies on companies to self-monitor their activities according to the practices outlined therein. History could be a prophetic tool here. If U.S. companies were willing to violate legally binding privacy terms overseen and enforced by their own national regulators then, what has changed to compel companies to adopt voluntary data ethics practices and track their own progress on them now? It is therefore skeptical that ethically rigorous and practically-informed frameworks, which I consider the Ethical Data Practices Framework to be, can fully achieve their goals without strong accountability measures attached.

Expectation of accountability

A practical imperative that helps keep firms accountable to the social impacts of their data practices seem to be absent from the list McCoy and colleagues suggest. An embedded mechanism for accountability could be a natural outgrowth of practical imperative (4) Assess the social impact of data practices and would ideally establish penalties for, as well as track progress on the corrections made when firms “burden, exclude, exploit, or discriminate against members of disadvantaged groups.”

The authors identify data access committees (DAC) as one oversight body that could counteract this exploitation, exclusion, and discrimination in a company’s data practices. Companies that establish their own DAC be borrowing from oversight models that are more typical in the public sector, including research institutions like the NIH (see for example (Data Access Committee - National Institute of Allergy and Infectious Diseases 2023; Database of Genotypes and Phenotypes (dbGaP) - Data Access Committee 2023; NIMH Data Archive - CCF 2023). DACs are charged with ensuring only authorized users access appropriately permissioned data for ethically approved purposes (Cheah and Piasecki 2020). I found in my own stakeholder-engaged research with data access committees and institutional stewards of genomic data that DACs rarely solicit “input from users or affected groups” or include community representatives in decisions related to data access and use (manuscript forthcoming). Nor would adding such representatives to DAC membership necessarily guarantee ethical secondary use for all data accessed. US- and EU-based DACs are commonly misunderstood as ethics and inclusion bodies when they are actually compliance bodies (Lawson et al. 2023), for better or for worse. At present, DACs are less than ideal sites for stakeholder engagement, and tasking them with holding companies accountable for the social impacts of company data practices may be misplaced.

History, again, may provide important insight. When leadership and organizational changes were announced at Twitter and Facebook, ethics teams were first to be let go (Knight 2023).

The literature on AI ethics and related algorithmic justice initiatives exemplify how difficult implementation is proving to be (Jobin et al. 2019). This implementation gap in AI ethics ties directly to an accountability gap whereby just identifying what is ethical practice is a substantial task for companies, let alone strategizing how to embed them into workflows post hoc.

U.S. – EU Privacy Shield (2016–2020)

It took more than two years for the EU and U.S. to strike a new transatlantic data transfer agreement. The resulting U.S.-EU Privacy Shield (EU Commission and United States agree on new framework for transatlantic data flows: EU-US Privacy Shield 2023) strengthened data protection obligations for U.S. companies and established stricter monitoring protocols for the U.S. regulators. It also clarified the conditions of use, limitations, and oversight of EU personal data on behalf of U.S. public authorities and established new redress possibilities for Europeans to levy civil complaints against unlawful data processing or controlling by U.S. offenders. In the absence of a formal adequacy decision, U.S. based companies could benefit from data transfer privileges as if they had an adequacy designation. Using standard contractual clauses allowable under the U.S.-EU Privacy Shield, U.S. companies that self-certified could receive, transfer and process personal data from the EU insofar as they honored the rights of EU citizens to know, correct and delete personal information collected about them, among other requirements. The Privacy Shield furthermore codified the de minimis principle and eliminated indefinite storage, whereby only information that was necessary and proportionate for a specific business purpose could be stored.

These restricted data transfer privileges were, however, short-lived when, in July 2020, the Court of Justice of the European Union suspended the Privacy Shield. Legislators argue the Privacy Shield inadequately protected EU citizens from unlawful surveillance by U.S. federal intelligence and law enforcement agencies. The U.S. had been without a recognized EU data transfer agreement until July 10, 2023.

EU-U.S. Data Privacy Framework (2023 - )

According to the European Commission’s latest decision, the US ensures an “adequate level of protection – comparable to that of the European Union – for personal data transferred from the EU to US companies under the new EU-U.S. Data Privacy Framework (Commission Implementing Decision: Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework 2023). The new Privacy Framework enables safe data flows safely from the EU to US companies participating in the Framework, without requiring additional data protection safeguards (Adequacy decision for safe EU-US data flows 2023) but instead introducing new binding safeguards. It also restricts access to EU data for US intelligence services only to what is “necessary and proportionate,” and establishes a new legal remedy for EU individuals through the Data Protection Review Court (DPRC). Legislators claim the “new safeguards in the area of government access to data will complement the obligations that US companies importing data from EU will have to subscribe to” (Adequacy decision for safe EU-US data flows 2023) and will order the immediate deletion of personal data found to be in violation of the new Framework.

In this way, McCoy and colleagues could use new EU-U.S. Data Privacy Framework as a complementary source for practical guidance as it offers a U.S. translation of sorts for general data protection principles.

Writing the next chapter of privacy relations between the U.S. and EU

While Ethical Data Practices Framework would have no legal bearing on transatlantic data transfers, it could result in reputational gains for companies that overall make the U.S. a more trustworthy destination for EU data.

Demonstrating why firms to treat regulatory compliance with data privacy laws as the floor, rather than the ceiling of good business practice is critical to aligning those practices with public values on ethical data sharing and use. The Ethical Data Practices Framework provides a starting point for firms in this regard, but additional tools are needed to substantiate this value proposition. For example, what effect does the adoption of a de minimis approach to consumer data collection and processing have on revenues? Do improved transparency practices improve consumer retention or confer specific advantages in a competitive market space? Clearer answers to these questions will help firms marshal support around the practices McCoy and colleagues propose, enriching opportunities for the public and firms to benefit proportionately.