1. The EU's GDPR privacy regulation comes into force today. Pretty well everyone - whether they like it or hate it - is treating it as a set of rules. That's a very limited perspective. It's not just a set of rules - it's a set of political opportunities.
2. Take this NYT article by Alison Cool - nytimes.com/2018/05/15/opi… . It complains that the GDPR is complex and ambiguous and that no-one understands it. For many actors, that is not a bug but a feature - they are struggling to define the ambiguities in ways that advantage them.
3. Facebook has made GDPR compliance a big part of its PR response to the Cambridge Analytica and Russian trolls disaster. But it is interpreting GDPR in an aggressively minimalistic way, looking to get the advantages of apparent compliance while not changing business model.
4. This is already leading to countermoves. @maxschrems launched two cases against Facebook this morning under new provisions of the GDPR, claiming that Facebook's 'take our service or leave it' version of consent was illegal. He is directly challenging Facebook's business model.
5. The argument is that the forms of data sharing that people are being asked to consent to are not necessary to the service that Facebook provides to individuals, even if they are necessary to the advertising market that Facebook makes money from.
6. This is a fundamental attack on the "two sided market" profit model that e-commerce companies have pioneered of providing services to individuals, while watching their behavior and feeding up access or data to advertisers.
7. Facebook has tried to maintain for years that advertising and services are inseparable. Now, these claims are going to be subjected to serious judicial scrutiny.
8. It isn't clear who is going to _win_ in the long term. @ANewman_forward and I have a forthcoming book (Princeton 2019) that looks at these dynamics in EU-US fights over privacy. @ANewman_forward and Nik Kalyanpur have a separate article dropbox.com/s/8mea1wjx78vv… showing how
9. Big US companies would have succeeded in shaping the GDPR to their satisfaction had it not been for the @snowden revelations. Yet we are now seeing how a stronger GDPR provides opportunities for activists like Schrems to challenge the core activities of massive US firms
10. In front of a European Court of Justice that has turned out to be newly activist on privacy issues. We are also likely to see other such changes as e.g. European national data protection regulators create their own structures for coordinating and building collective power.
11. So the real impact of GDPR doesn't depend on what firms are doing to comply with it this morning. It depends on a variety of political and legal battles that are going to be fought over the next several years using the new tools that the GDPR provides. Finis.
12. Postscript - details of the Schrems cases here - irishtimes.com/business/techn…
Make that one case against Facebook, two cases against subsidiaries, and one case against Android.
