Enhanced Privacy Duties for Dominant Technology Companies

Mark MacCarthy

DOI: https://doi.org/10.2139/ssrn.3656664

2020-01-01

SSRN Electronic Journal

Abstract:This paper explores two case studies in order to extract the elements of a legislative approach in the United States for stronger privacy regulation for dominant technology companies. The Federal Communication Commission’s initial broadband privacy rules required broadband companies to obtain opt-in consent for data use beyond what was needed for providing broadband service. The agency reasoned that broadband customers faced restricted choice in their selection of a broadband service provider. While these rules have been repealed, their logic is useful in constructing the conditions under which stronger rules might apply and the nature of the additional protection needed. In an abuse of dominance case, the German Federal Cartel Office required Facebook to get separate affirmative consent from its users for combining third-party and affiliate data with data from its own social network service. Because of its dominance in social media, the FCO said, the take-it-or-leave it offering Facebook provided did not amount to obtaining genuine consent under the European General Data Protection Regulation. Upon appeal, a higher court has rejected the FCO’s arguments for bringing the case and it awaits final court disposition. This case illustrates the possibility that the condition of dominance in a particular market can affect the application of data protection rules, in this case the interpretation of what constitutes valid consent, fulfillment of a contract and legitimate interest as legal bases for data processing. Informed by these two cases, this paper outlines a new privacy law for dominant technology companies in the United States. It would establish enhanced privacy duties for dominant technology companies to ensure that the consumer interest in effective data protection is vindicated in a context where consumers are less able to exercise their general privacy rights. When there are no or few or weak marketplace alternatives, users do not really have the option of walking away from a dominant service provider whose data practices they do not like. The paper proposes that dominant technology companies would need to have a legal basis for their data use and describes consent, contractual necessity and legitimate interest as three possible bases. In addition, dominant technology companies would not be allowed to use unreasonably deceptive, abusive or dangerous designs, as described in Woodward Hartzag’s recent work. Furthermore, they would be required to satisfy enhanced duties of information fiduciaries as outlined in Jack Balkin’s work. The law would also hold open the possibility of banning specific data uses. The law would put in the hands of an industry-specialist regulatory agency the authority to take into account several legislative factors to determine when to apply enhanced duties to technology companies. The specialist agency would also be authorized to write and enforce implementing regulations in connection with consent, contractual necessity, legitimate interest, harmful technology designs, information fiduciary duties, and the option of prohibiting specific data uses to protect the privacy interests of customers of dominant technology companies.