The new EU General Data Protection Regulation goes into effect May 25th, 2018.  You may have recently received notices of changes to privacy policies by Google, Twitter, and other tech companies.  The reason: the GDPR.  It attempts to create uniform rules for how personal data is managed in EU countries. The European continent’s first piece of legislation pertaining to the protection of personal data was the “Convention 108”, adopted in 1981 by the Council of Europe (a different international institution that the EU which brings together 47 countries). Later, in 1995, the European Union passed its directive “on the protection of individuals with regard to the processing of personal data and on the free movement of such data”.  Unlike the 1995 personal data directive, which must be implemented by EU countries in their nationals laws, the new GDPR is EU law that applies without reliance on national implementing laws.  The GDPR is also broader than the personal data directive.  The key changes are discussed below.  

OVERVIEW OF KEY CHANGES BY GDPR

1. Extensive territorial scope: controllers of data with no establishment in the EU can still be subject to the Regulation for processing related to the offering of goods and services in the EU, or to the monitoring of the behavior of data subjects located in the EU.

• No longer matters whether controllers actually process data within the EU.
• If an EU citizen's data is processed, the controller is subject to the GDPR.  

2. Enhanced rights of data subjects:

• New right to ‘data portability’: in certain situations, controllers will be bound to transmit personal data to new controllers, on the request of data subjects who may wish to switch from on service to another;
• Upgraded rights to erasure (‘right to be forgotten’) and to restriction of processing;
• Substantial increase of the number of information items which must be provided to data subjects, including in particular the retention period of the collected data;
• More stringent conditions for a valid consent (where required): it will have to be freely given, specific, informed and unambiguous, by statement or by affirmative action.

3. Redesigned obligations for controllers and processors:

• Auto-compliance and accountability: controllers and processors must ensure and be able to demonstrate that they have implemented any technical and organizational measures in order to ensure that the processing carried out comply with the Regulation. Such demonstration may be helped through adhesion to codes of conducts, or through certifications;
• The end of prior notifications: the obligation to notify the competent supervising authority prior to each processing is replaced by an obligation to keep detailed records of processing activities;
• Data by design and by default: controllers and processors will be expressly bound to respect these principles which is viewed as an effective means for compliance;
• Specific measures to be implemented in certain situations: (i) appointment of a data protection officer; (ii) privacy impact assessments; and (iii) notification of data breaches to supervising authorities and to concerned data subjects;
• Other new obligations related in particular to the (i) joint controller regime (the breakdown of the different responsibilities will have to be determined); and to (ii) the choice of data processors and to the contracts between controllers and processors.

4. Reinforcement and clarification of the supervising authorities’ roles and powers:

• Administrative fines up to 20 million Euros or 4% of the worldwide annual turnover of the preceding financial year;
• For cross-border processing, a lead authority will handle issues in accordance to a new co-operation procedure between it and other concerned supervising authorities (which will remain competent alone in certain situations);
• Supervisory authorities will have to offer each other mutual assistance, and may conduct joint operations when necessary;
• A new entity, the “European Data Protection Board”, will replace the Article 29 Working Party and will be in charge of providing opinions to supervising authorities on certain matters, of ensuring consistent application of the Regulation (by supervising authorities) in particular through a dispute resolution mechanisms, of issuing guidelines, of encouraging the drawing-up of codes of conducts etc.

On December 14, 2017, the United States Federal Communications Commission (FCC) voted to repeal Obama's net neutrality protections. These now-eliminated protections include barring internet providers from slowing down or blocking access to online content, and prohibiting internet providers from promoting their own content. Ajit Pai, Chairman of the FCC, stated "[the repeal] is not going to destroy the internet. It is not going to end the internet as we know it. It is not going to kill democracy. It is not going to stifle free expression online."

Others, have voiced strong opinions against the repeal. "This is a matter of enormous importance with significant implications for our entire economy and therefore merits the most thorough, deliberate, and thoughtful process that can be provided," stated Maine Senators Susan Collins, Republican, and Angus King, independent. The FCC also received millions of comments supporting current net neutrality protections.

States have voiced their stance against the FCC's net neutrality protection repeals. New York Attorney General Eric Schneiderman has declared intentions to sue to stop the FCC’s rollback of net neutrality, stating "We will be filing a claim to preserve protections for New Yorkers and all Americans. And we’ll be working aggressively to stop the FCC’s leadership from doing any further damage to the internet and to our economy.” Washington State Attorney Bob Ferguson also announced his intention to take action, stating "Today, I am announcing my intention to file a legal challenge to the FCC’s decision to roll back net neutrality, along with attorneys general across the country." Other states, including Oregon, Illinois, Iowa, and Massachusetts, will join the lawsuit as well.
 

This week, in Google Inc. v. Equustek Solutions, Inc., Canada's Supreme Court upheld (in a 7-2 decision) the grant of a preliminary injunction against Google to remove a link to a website that allegedly infringed the intellectual property of a small tech company.  The IP controversy was not against Google as a party, but the lower court ordered Google to remove the link to the defendant's website from access worldwide.  Google had delisted the website from searches in Canada (at google.ca).  But the Supreme Court of Canada upheld the grant of a worldwide preliminary injunction that affects people around the world.  [Download the decision.]

The Supreme Court reasoned: 

•  Google’s argument that a global injunction violates international comity because it is possible that the order could not have been obtained in a foreign jurisdiction, or that to comply with it would result in Google violating the laws of that jurisdiction, is theoretical. If Google has evidence that complying with such an injunction would require it to violate the laws of another jurisdiction, including interfering with freedom of expression, it is always free to apply to the British Columbia courts to vary the interlocutory order accordingly. To date, Google has made no such application. In the absence of an evidentiary foundation, and given Google’s right to seek a rectifying order, it is not equitable to deny E the extraterritorial scope it needs to make the remedy effective, or even to put the onus on it to demonstrate, country by country, where such an order is legally permissible.
• D and its representatives have ignored all previous court orders made against them, have left British Columbia, and continue to operate their business from unknown locations outside Canada. E has made efforts to locate D with limited success. D is only able to survive — at the expense of E’s survival — on Google’s search engine which directs potential customers to D’s websites. This makes Google the determinative player in allowing the harm to occur. On balance, since the world‑wide injunction is the only effective way to mitigate the harm to E pending the trial, the only way, in fact, to preserve E itself pending the resolution of the underlying litigation, and since any countervailing harm to Google is minimal to non‑existent, the interlocutory injunction should be upheld.

Commentators, such as Michael Geist, pointed out the danger in the Canadian approach: if each country (isuch as China or Iran) used the same power to issue worldwide injunctions against Google, there would be a race to the bottom and massive censorship online. 

◢

In a survey of 65 countries, Freedom House has reported that internet freedom across the world has been in a decline for the past six years, with two-thirds of internet users living under a government that has censored internet. Freedom House has ranked China, Syria, and Iran as countries with the most restrictive internet laws. 

Many countries have blocked secure messaging apps. WhatsApp was blocked most of all messaging apps, being restricted in 12 countries this year. The number of governments that restricted access to social media and communication services increased from 15 to 24. Governments have also blocked materials related to LGBT rights and photos that made fun of countries' leaders. [Download the Report]