Navigating the Future Tribulations and Triumphs of Transatlantic Digital Policy
Ken Propp
Security, Europe
A crisis is brewing over possible interruption in transatlantic commercial data transfers.
Hopes are high in Brussels and Washington for restoring a more constructive transatlantic economic relationship. In early December, the European Commission presented some ideas for rebuilding ties with the United States. President-elect Joe Biden and his nominee for secretary of state Antony Blinken are confirmed transatlanticists, so the stage seems to be set for rapprochement. The prospect of better economic relations may not quickly materialize, however. Two difficult issues—data privacy and digital services tax—have the potential to throw the “reset” off-track before it has a chance to even be properly launched.
A crisis is brewing over possible interruption in transatlantic commercial data transfers. Last summer, the European Court of Justice (ECJ) handed down a sweeping judgment invalidating overnight the EU-U.S. Privacy Shield Framework, used by more than five thousand companies to send personal data to the United States for commercial purposes, over concerns about lack of legal protection for Europeans if their transferred data was surveilled by the U.S. National Security Agency.
Anxiety grew in November when the European Data Protection Board (EDPB) advised companies that transfer to the United States utilizing contractual privacy protection clauses—the principal alternative to the Privacy Shield—should employ end-to-end encryption to keep the NSA at bay. The EDPB added that since end-to-end encryption is not feasible for certain data transfers, to cloud service providers or within a corporate group for purposes like customer service, they should not occur at all. Public comment on this aspect of the EDPB draft recommendations, including from European business groups, has been critical. Final guidance is due early in 2021. Unless Europe’s data protection regulators accept that some risk of government surveillance accompanies the movement of data beyond the EU’s borders, companies may lose the ability to rely on standard contract clauses for important categories of transatlantic data transfers.
The U.S. government has been working quietly and urgently with the European Commission to respond to the ECJ criticisms of protections for foreigners in U.S. surveillance law. It reportedly delivered a proposal to Brussels in December envisaging a series of reforms that could be made quickly by executive action rather than by the lengthy process of changing U.S. statute. Even if negotiations advance steadily, it seems inevitable that the Biden administration will need to complete the task of re-establishing commercial data transfers under the Privacy Shield and stabilizing the use of standard contract clauses. Data transfer agreements between Washington and Brussels have had a checkered history over the years, so the result this time is sure to face further challenge at the ECJ as well.
Conflict also looms in a second area—digital services tax—where European governments have extended their reach over U.S. platform giants. France and several other European countries, including Austria, the Czech Republic, Italy, Spain, and the United Kingdom, have imposed or are considering taxes on revenues earned in their territories by digital service providers that may not have a physical presence there. These novel taxes fall almost exclusively on U.S. companies.
In July 2020, the US Trade Representative (USTR) found France’s digital service tax (DST) unreasonable and discriminatory under US trade law and identified $1.3 billion worth of French luxury goods on which additional 25% import duties would be imposed. However, USTR suspended implementation of the duties for six months, in order to allow time for multilateral resolution of the underlying tax issues at the Organization for Economic Cooperation and Development (OECD). On January 6, it reached the same finding of discrimination with respect to Italy, India and Turkey, but deferred identifying penalties for those countries. Similar probes into Austria, the Czech Republic, the European Union, Spain and the United Kingdom are nearing completion, as well as into two countries outside Europe, Brazil and Indonesia.
France had deferred collection of its DST for most of 2020, also in deference to the OECD talks. But when the Trump administration withdrew from the negotiations late in 2020, the French Ministry of Finance sent annual tax bills to a series of large U.S. technology companies, including Amazon, Facebook, and Google, for an amount estimated at $450 million.
On Jan. 6, USTR blinked, deciding not to move forward with immediate imposition of the hefty duties on imported French handbags, cosmetics and soaps. While the agency attributed the move to a desire to coordinate its action on France’s DST with ongoing proceedings affecting other countries, some observers instead perceived a desire not to commence another trade war with Europe just as the Trump administration heads for the exit door. Rep. Suzan Delbene (D-Wash.), a leading Democrat on digital trade issues, appreciated the de-escalation, remarking “I would hope that folks would understand that we have a chance to work together on this with the new administration.”
Nonetheless, if the Biden administration follows through with duties against as many as a half-dozen member states of the European Union, the question of a unified response inevitably would be placed squarely on the EU’s agenda. The European Commission previously considered—and rejected—a French proposal for a DST adopted at the EU level, but more recently its Trade Commissioner has indicated a willingness to take up the subject anew in response to U.S. retaliatory trade measures.
The new administration will also have to grapple with the implications of a series of EU digital legislative initiatives launched in late 2020. Together they give form to European Commission president Ursula von der Leyen’s ambition to create “a Europe fit for the digital age” and to establish European “technological sovereignty”. Three separate legislative proposals have been put forward: the Data Governance Act (DGA), to facilitate the sharing of public sector and industrial data; the Digital Services Act (DSA), to govern platforms’ content management practices; and the Digital Markets Act (DMA), to set specialized competition rules for large platform companies. And the commission’s efforts are by no means complete: 2021 should bring a much-anticipated proposal on AI regulation, among other work in the pipeline.
Although features of these proposals would impose significant new burdens on U.S. companies, they should not be seen solely as transatlantic trade challenges. Rather, they reflect the careful analysis that Europe brings to regulating the digital economy, and in that sense can lead to a useful, cross-fertilizing debate with the United States. For example, the DSA contains revised rules on intermediary liability for platforms that host third-party data, refining the protections found in current EU e-commerce law. Companies must remove hosted content as soon as they become aware of its illegality, and they must cooperate in a structured fashion with law enforcement agencies. As Congress wrestles with possible reform of the counterpart provision in U.S. law, Section 230 of the Communications Decency Act, surely it would be worth a glance across the ocean to compare how other advanced democracies are rethinking the same liability issues.
The year 2021 will begin a long slog in Brussels towards the enactment of the commission’s new digital legislative proposals. The member states of the European Union will work behind closed doors to develop unified positions on the commission proposals, balancing their differing attitudes toward market intervention. In parallel, the European Parliament will engage in a more transparent process to arrive at its corresponding positions. Lobbyists will be busy in both venues. Only thereafter will the commission, council, and parliament sit down to reconcile their respective positions and arrive at final versions. The EU’s elaborate and deliberate legislative process will afford ample opportunity for the U.S. government to articulate in Brussels its equities in developing compatible transatlantic approaches to digital regulation.
It all adds up to a very full transatlantic digital policy agenda. Resolving percolating disagreements over data flows and digital tax will be the first order of business, but Washington also must find a constructive way to engage with Brussels on the array of other regulatory challenges posed by the dynamic digital economy.
Atlantic Council Senior Fellow Ken Propp is former counsel at the EU embassy to the EU.