European tech and democracy - Heather Brunner,Julian David,David Galbraith,Julia Powles,TJ McIntyre

So today we're going to talk in general terms about the European environment, the legal environment, the regulatory environment, what it means for businesses here, how much we'll be able to change that to promote the growth of more large companies within Europe, and the social impact of that. We're going to start with a brief presentation from each of our speakers. They're going to talk about themselves, just introduce where they're coming from, set out the big issues as they see them for a few minutes each. Having done that, we're then going to have a Q&A about the wider issues that this presents, and then at the end we'll have time for a few questions from the audience and hopefully we can develop that a little bit further. So without further ado, I'll hand over to Heather to introduce her viewpoint.

Well, I think that I'm from TechUK, which is the trade association for digital tech companies in the UK. So we're chips to click, so we have Intel and ARM, and we have Google, Facebook, and pretty much everything in between. And we cover the application of digital technology to every part of UK economy and society. And essentially, we also look at Europe as a big factor in the UK tech success. And a lot of statistics just came out, and something came out even this morning when I was coming on the plane about London being the top power city in the world ahead of New York and ahead of the other European cities. And part of that is getting the right mix of how to get innovation and competition going. And that's something that we really push very hard on, particularly in the context of the European Union and what continental European countries sometimes seem to have as their vision. It is about three areas, as Heather said, about security and it's about privacy, but it's also about managing data and who owns the data and what your rights are in data. You've got to get that right on a spectrum. But we're very engaged in saying, okay, what's good in Europe, what's wrong in Europe. And when you look at the stats, the EU is a 500 million person market, it's bigger than the North American market, and yet you have 75% revenues in North America and so you send the rest of the world, and that's a pattern that happens a lot. So what we want to see is more stuff growing inside that 500 million market, but it won't unless Europe actually shapes up and embraces the idea of innovation and the idea of openness. So we published this recently, eight principles for this. So it's about first, embrace change. You spend too much time looking back, protecting what's there, worrying about that. The second is embrace global. There's a lot of talk, particularly in places like Germany, about digital sovereignty. We don't want digital sovereignty, we want digital leadership. So we want to be able to take European businesses and go to the world the same way that North American businesses do and other businesses do. And it's got to be easier to do this stuff. If anybody's got involved in regulation or whatever in large parts of Europe, it's hard, it's expensive, it's difficult. And then you've got to make things simpler, got to be easy to do. Stop worrying about technologies that are there now because they will change. The other thing is focusing on which platforms or what technologies are at any particular time, forget it, it's going to change. Leave space for innovation to overcome that. Use the right tools for the job. So it's about competition and managed platforms with competition. Again, a little plug for the UK Competition and Markets Authority, they get this. They're going around Europe talking about, you know, a platform, a dominant platform's got a huge market share isn't necessarily a bad thing because it does enable other companies and it's convenient, easy for business, but you've got to manage the competition aspects. Watch out for unintended consequences. You know, right to be forgotten, supposed to be something that manages Google, that actually has huge implications around the space. And for goodness sake, get a move on. We've been talking about GDPR, the data protection regulation in Europe, for four, maybe five years. I mean, come on, let's get this stuff done at web speed now. So that's the scene setter. I would like to put David, I know you've got some very strong views on this as well.

So I was in the States for 12 years and moved back to Europe, working for consumer internet companies and then worked for a FinTech investment firm. And FinTech was seen as one of those very strategic things for Europe. When we looked at the data, the numbers are terrifying. What's happened is the notion of a unicorn, which is a billion-dollar company, has concealed a bigger structural fault, which is the unicorns are not the top of the food chain. So the companies at the top of the food chain are above 50 billion dollars, whereas unicorns are a billion dollars. And if you look at the market capitalization of the top pure-play internet companies by continent, in the Americas it's a trillion dollars, in Asia it's half a trillion dollars, in Africa 60 billion dollars, and in Europe it's less than 20 billion dollars. So this is the equivalent of the Industrial Revolution where there are no car companies in Europe. It's that bad. And we're seeing that even when Europe does produce multi-billion dollar companies, they then get acquired by the animals further up the food chain. It's just what's just happened with the Candy Crush maker. So that's the bad news, that looks terrifying, until you then look at the wider picture. And the wider picture is that if this really is a bit like the Industrial Revolution, we're going through a period into the information age, then we're not just looking at internet companies, we're looking at things which are digital era companies. So that might be, you know, the second phase of the internet has been Airbnb and Uber, are these tech companies or a taxi company? And beyond that, is Tesla even a technology company or is it a car company? So once you start to look and include these other companies, Europe actually has the potential to create these things at the top of the food chain. So a good example would be Inditex, which owns Zara, which is a hundred billion dollar company, or H&M, or IKEA, or these things. And if these companies have the scale to acquire other companies and stimulate the ecosystem to really push back a bit against the US platforms, otherwise Europe really can't be Europe and can't do all the things that make Europe a bit different from the US, like create a tempered society where people have certain social benefits that they don't in the US.

Julia, that's a nice pick up for me. So I'm an academic at the University of Cambridge and I write for The Guardian, have for the last year. And I particularly came in because we have, I think, quite a visionary leader in our tech team who is very interested in the implications of tech beyond the sort of quite narrow tech press and the social implications of these enterprises at the top of the food chain. We have this incredible monopolization in internet space and I think it's probably even pre-industrial revolution, we're in the middle ages, the renaissance hasn't come. The companies that are growing do quite disturbing things to the centralization of information. I've written quite a lot about Google and I think that we really, in Europe, regulators are sort of at the edges, they don't quite know what they're doing. But what we're essentially dealing with is a centralization of all of our information, search and knowledge bases. With Facebook, we have the sort of trading on social derivatives of ourselves and the long-term trajectory of these companies is to move into micro-financialization of everyday aspects of life that were never meant to be financialized. And I think that the consequences of that for a really equal society are quite worrying. Also with Uber, for example, the rise of Uber shows, I think, a business model of regulatory arbitrage which is effectively engaged in outsourcing city and public infrastructure functions to the myth of the algorithm that knows more than we could possibly regulate or manage. And I think that how regulators come to this, we've got a bit of a kneecapped regulatory system in Europe where we have regulators in Brussels where we really need to get behind, I think, as in Europe, get behind what those regulators are doing. But they have got a twin mission that they want to stimulate growth and jobs at the same time as trying to perform regulatory functions. And this is what has hampered something like the data protection reform, which in the end is carrying a lot of legacy problems that aren't really addressing the essence of what it is to have, I think, sovereignty at an individual level, not in an atomized and sort of selfish way, but in a way that gives you control and autonomy in the world in an increasingly programmable world. Where we had, the last two days circulating around a lot of talk around this exciting potential of data and we're all going to be able to predict what we want and need before we even want or need it. And I think that we want to keep ourselves in that equation. There was a lot of talk there about privacy, data protection, and I have to admit to a certain interest here because Digital Rights, the organization which I chair, was a party to the recent Max Schrems decision that some of you might have heard of, which resulted in striking down safe harbor agreements between Europe and the United States and the consequences that follow from that. So I'd like to throw it open to our panel to ask what is their perspective on this as a driver for growth in Europe, as a civil rights issue, and also possibly as a competitive differentiation. One of the concerns a lot of people have expressed is that US firms in particular don't exercise adequate control over data, they're not adequately regulated, how your personal data is used. Is this an area where there is a potential competitive advantage, or if not a competitive advantage, can we at least have a harmonization of privacy standards? Who would like to take that?

So I think it really does illustrate the unintended consequences thing because there were two aspects about the safe harbor case. The first was that there is an opinion about how data is treated in the US versus how it's treated in Europe, and coming from the UK where we have an investigatory powers bill being announced today, you know, there's some interesting questions of is the US actually worse than in some parts of Europe. But the second thing about it was that there was an agreement which was across Europe and what happened was that the court said no there isn't an agreement, which is of course you have the Irish Data Protection Authority, you override any European agreement. So what's the implication of that? It's not actually going to affect the big American companies, what it's going to do is make it, if it goes to its logic, it's going to be that any European startup or any incoming startup has now got a choice of, they can actually deal with 28 data protection authorities in order to bring something to bear. And if you think about this on the point you were making, David, about the other industries, because a retailer is also an information source, it does as much with information about its products and about its customers as many of the internet companies do. So for me this is a really interesting point, is Europe actually going to start to behave like a single market or is it going to behave like a provincial collection which might even subdivide? I mean, some parts of Germany are actually saying there isn't even a German Data Protection Authority, there are different protection authorities inside the Federal Republic. So yeah, I think Europe needs to think this one through. I mean, to my mind it's a form of protectionism which is irrelevant almost what the details are of this, is there's now an incentive for there to be a European level set of protections against the US, for example. US platforms are dominant, the Chinese deliberately created their own versions of internet companies and blocked the US. Europe didn't do that, but Europe now belatedly these things are creeping in where maybe there'll be more and more of these what look like protectionist measures. Whether that's good or bad, I don't know. One of the things that could happen, for example, that would be good is it will make you create a single market. At the moment you can't ship goods around Europe like you can around the US, you can't data roam the way you can in the US, you can't pay the same social charges if you commute between different countries. You could though. There's not a lot that binds Europe together. There are some things like insurance is a single market in Europe which it isn't in the US, payment systems are unified throughout Europe and they are in the US. So there are some good aspects, but I think there will be a general trend towards a more European view on digital marketplaces and more protection between the US and Europe.

So it's interesting this protectionist argument and using privacy as, there's a common argument that privacy protection in Europe is protectionist. I think I would counter that the way that the internet has evolved involves a different kind of protectionism, which is that US-style free speech which is uninhibited and is really, if you look at the physical infrastructure of the internet, old imperial shipping lanes are basically the cable infrastructure of the internet. We have global companies operating in one language and using as a mode of sort of roll out. And yeah, it's great, we access Wikipedia and it looks the same everywhere you go, but the implications of that in terms of who provides the hardware and the infrastructure of those services and where the money goes are quite worrying, I think, as a sort of global colonial infrastructure, to be a bit controversial. And I think that the safe harbor ruling was a triumph for fundamental rights. I think that the practical implications weren't thought through, particularly in not having any transition period. But what I think has been really a shame is that in the last two weeks, I interviewed Max Schrems a day after the decision, we had a beer and it seemed all very grand. And I was hoping that there would be some creativity out of the decision because what it effectively says is that companies need to ensure that they're meeting data protection law, which is what, and everyone says, well, we didn't, the rules are changing all the time, but the rules have been in place since '95. The issue is that they've never really been properly enforced. And what the ruling requires is that individuals know where their data is going and who is accessing it and has some guarantees against or knowledge of surreptitious surveillance. Now, companies in many regions of the world are aware of this and there's ways that you can provide transparency and accountability. I'm working on various research projects on this which don't involve completely relocating infrastructure but involve data tagging, which involve more meaningful terms and conditions so that people can choose and know where their services are. And I think the reason this is so important is that we've kind of bought this rhetoric of the free speech internet and one single internet, but as everything is becoming connected, and this was something you said, David, there's every difference in the world between sharing and accessing information on Wikipedia and the information that's going between me and my coffee machine and having that, every coffee machine in Dublin routed through Silicon Valley and the implications that, or the washing machines, imagine if all the washing machines, coffee machines, and that sort of way, eventually again on that micro-financialization, if you think of, oh well, you get a free coffee machine but it only works if you provide certain data and if you're grumpy on a certain day it means you're going to purchase certain things and you get push notifications. And I think these are the kinds of business realities of what almost a free-flow, privacy-less tech infrastructure that we have developed, we've got used to, hasn't really had any pushback. And when the courts have to step in on fundamental rights grounds, I think it shows that we really aren't in a phase of technology that is really about what works for citizens, it's what works to make citizens transparent, but it doesn't necessarily make companies and governments transparent in the same way. And I think that is what data protection ideally should be about, is making sure that we are not the transparent operators in this and that we know where things are going, particularly when they're about intimate details.

I think Julia's identified the key issue there, which is the threat to my coffee machine posed by that would be a denial of service attack that would shut me down. But I think Julian has something to say about those wider points.

Yeah, I did. The only thing I would say is I really hope it is the start of innovation and looking at this thing at a European level. But if you read, and you spoke to Max, so you know the judgment actually says you have to deal with 28 data protection authorities, not one, right, in Europe looking out for European citizens. But also with money, when things like money flows across borders at the moment, European data protection doesn't, that you can't both comply with US anti-money laundering laws and European data protection, you have to choose which law to break. So what happens, of course, is in the US if you break the anti-money laundering laws and you work for a bank, you go to jail, but if you break the data protection laws, the bank gets fined. So you as an individual are much more incentivized to comply with anti-money laundering laws than you are data protection.

One of the points that's coming out here as well is the idea of dominance, the idea that we have certain firms, there's a tendency towards natural monopolies in the information economy by the network effects you get from Google, from Facebook, from other large operators. Overwhelmingly these are US rather than European firms. And I think that raises a question as to, well, to what extent does European regulation help to protect a level playing field within the market? And particularly, to what extent will net neutrality rules in Europe protect that or not? As you might know, we've seen in the last two weeks the adoption of a new net neutrality deal by the European legislature. And not after the ink was dry on that, Deutsche Telekom came out and said that they were now looking at levying a charge on startups of approximately two percent of revenue with the view to guaranteeing better quality of service. So question for the panel, net neutrality being one example, but more generally European regulation in a wider sense, is that doing enough to protect the ability of small firms to come in and innovate, or are we seeing dominance which cannot effectively be challenged?

So I think net neutrality, the problem with net neutrality is really boring and no one really understands it, but it's hugely, hugely important. And the only analogy is that it's basically, net neutrality is basically a game between the telcos versus the internet companies. An internet company is basically a socialized network, a subsidized network, and then it's like more like a road network where you can build shops alongside it. The telco network is where one company, corporates own everything, they own the infrastructure as well, and it's much more like a railway network. Unfortunately, Europe likes railway networks and there is a psychological mechanism where the telcos can actually hold things back potentially. Ironically, it means that you have a less socialized infrastructure. So I think it's hugely important and hugely difficult to get the right result in Europe for cultural reasons and it's a train wreck.

Well, I think the telcos are a good example of what can go wrong if you have, you know, if you think about it, that everybody's worried about large international companies having dominant positions, but telcos in Europe by definition all have dominant positions. And again, back to our principles here, these guys are not looking at the future, they're looking at the established position and none of them is looking really to expand into other countries because they're not allowed to do that because of the regulatory dead hand which will come our way and data if we don't watch it. And so you get the same result, they then start to chisel their governments to push their particular angle and lo and behold you don't have a European approach to anything, you don't have a single market, you have this sort of vulcanization thing with some places with very backward-looking approaches. So again, we need to resist all this stuff, we need to open markets, we need to have a single market in Europe and it needs to do with that kind of thing. Net neutrality has got to be a balance, you know, there's got to be investment which people got to make so it's got to be a payback on the investment, but there's got to be openness to this essential business in a blur which is the internet. Again, I can't speak with expertise on the Irish situation, but again in the UK it seems okay, the market with the regulators are looking over it, seems to be okay, could be better, but it seems to be possible for companies to get going, to get starting up. And I see that in some other cities around Europe, but I also see some problems.

I think net neutrality was a missed opportunity in Europe, the regulation, but it's also one of those fights, I think it's a boring one, but it also is one where individuals don't really have a stake in the game. It's become a big cable versus big content battle and it also means that we miss the various other ways that the internet is really not neutral. So the dimension of the last mile access is one aspect of neutrality, but with these monopolies and some of the aspects that we don't regulate very well, Google, for example, resolves 40% of domain names, it has content delivery networks that make sure that you have access to Google faster than any other service in your local country. So there's all these other ways that the internet is really not neutral. And for the individual craftsperson at the end of the internet using the internet the way that they want, which is what net neutrality is, and that you'd have dumb pipes, smart ends, and everyone can do what they want, I think that's been dead and buried a long time ago. And what it's similar to is the competition aspect of having real non-discriminatory open markets. And I don't think regulators have any sort of levers on those broader aspects. And we look at the competition cases that are in Brussels, they're really at the edges of the problem, they're about how you lay out things on a web page rather than who has data hordes, are they being open to municipal innovation that would really bring local, culturally relevant solutions, or are they just getting siphoned and then every startup that comes along, they're just getting consumed by someone higher up in the food chain.

And following on from that, in my own case, my background is as a civil rights lawyer and one of the most interesting things to me is when you look at the monopolies that are developing or the dominant positions that are developing, you see for example Facebook censoring links it doesn't like, adopting a real name policy that can have very significant adverse effects on trans people and other vulnerable groups. You have Microsoft, for example, scanning all emails that it sends for certain types of contraband. You have arbitrary censorship at the level of certain ISPs operating on a voluntary basis with no statutory support for that. Is there a civil rights issue here as well where we're looking at these dominant positions grow up and we're now living in company towns where the company sets the rules and they may or may not be the rules set on by democratic society?

I think there are two things that need to work here, which is the first is there should be basic laws, we have basic laws that should be applied and they should be applied. And then there should also be transparency. You know, what regulators and legislators should be focused on is exposing what goes on and then the market will happen. And the tradition of startups is they just get on with things when they're getting going and then when they become to a position where they've actually got a market to hold on to and they start to have to think about how they're behaving and what makes them behave well, as we've discovered even with car companies and other companies, it's when people know what they're doing. You know, the conscience is that still small voice that tells you somebody's looking. And that's what needs to happen here and then the market and the consumer will actually do it.

It's interesting when you talk to people from tech companies and they say, oh, it's so challenging, we're on all these different countries and they all have different rules, so therefore we have our standard Facebook policy. And of course that is culturally influenced in its own way. And for a long time it will say search results, you mentioned the right to be forgotten, search results, if you look at some bizarre things that happen in auto-correct and auto-fill on Google around porn stars and around anything that's sexually related, and it's the same on Facebook. But then in Germany where there's huge pressure and an incredible local concern about Nazi speech and they make a claim, there's pressure from the government to get Facebook to do something about it, says, well, we can't, that's not a policy in the US. And they're completely different cultures and historically contingent societies that I think deserve to be able to have their standards applied in a local jurisdiction. So I think it was interesting going back on the Schrems case, Max commented that we were talking about the fragmentation argument and you get all this, I think it's a very unfortunate term that people talk about vulcanization of the internet. And as I mentioned with different levels, I think that your individual data store and your messages to people in your home should be very much local and then there are other services that deserve to be global. But in every other industry, cars, health, finance, you have different regulations, you'd have different plugs in different countries and it's a bit annoying, but it's also because there's differences and that's the beauty of a rich and diverse planet. And I think that sometimes gets lost in the enthusiasm for these wonderful services that I do think we'll look back on and say, wow, it's pretty crude, we're all on this platform called Facebook and we all just gave everything up to it.

On that note, we have a few minutes now for questions. So I think we have two roving mics and we have a lady over here and a lady over here. I think we're first.

I just want to hear why we are so afraid of being protectionist in Europe that we don't enforce our own laws. And I had to give you one example, for example, Norway in 2010, there was a thriving social network with millions of users and in schools all the kids were using it and the teachers were so annoyed about it that they actually forbade them to use it, but they forgot to forbid them to stop them from using Facebook. So now this Norwegian network is dead and Facebook is thriving. And this is not just a Norwegian story, it's the same in Germany, Holland, and many other places. And we are so afraid of being protectionist, isn't it about time that we are doing the same as all the others like China, US, Brazil, Russia?

We were actually going to be short on time, so perhaps you can take that and one or two more questions and then talk about them together. So who's next?

Hi, DJ, and I just wanted to maybe point out an interesting contrast when you discuss open and closed systems. Open always seems to mean free enterprise and closed means regulation, yet a lot of the free enterprise is actually closed systems with our data. They take it in and we don't know what they do with it and we have no access to it. And as you pointed out, we don't actually understand what we're giving up at the time. It's a comment that maybe can be answered.

I think you want to be like China, you want to be like Russia, I mean, I just don't think protectionism is the answer. Never works in societies like that, but I don't think it works here. I don't know the Norwegian example, but honestly, a lot of the point about platforms is there is a convenience for the consumer in there being a big platform. The fact that everybody's on it, this has been the case in the tech industry for decades. It's the same with telco networks, it's the same with anything. If you can't get them, so what do you need to do here? You need to accept that that's going to happen. You need to ensure that the sort of laws that you want in your society are applied, and that's laws about behavior, that's laws about privacy, particularly about transparency. When you don't know what people are doing, then you're really storing up a problem. So you should force that, you should force competition law, and you've got to get subtle about it. You've got to understand, it's not just about where things are on a page, it is about who gets to manage the access and all the rest of it. These are things that can be done without taking away the idea that you can have a European-wide solution. The problem with a Norwegian Facebook and a Swedish Facebook and a Danish Facebook and an Icelandic Facebook, they just won't survive against what people want on the internet, which is they want access to the world. So we've got to make it easy for a Norwegian one to become big. And that's the Inditex example, that's the Lego example. I mean, how did Lego become so big? It wasn't by being protected, it was by being really good.

We have a question.

Can I make one kind of a comment on transparency? I think this is absolutely the heart of it. I think this is what regulators need to be doing and asking for things. And just a little story, I sat on this stage a year ago, we talked about the right to be forgotten. We've had a year and a half of very strong opinions about the right to be forgotten. And we had somebody from Google and there have now been over 350,000 Europeans have made requests to Google. We know about what 30 of those cases are, they're the ones that Google has released. And I asked on this stage to the Google person, you know, people are saying this is a terrible threat to free speech, but how do we know? I mean, surely the first question is what does the data tell us? You're the data gurus. We got a leak of information at the Guardian earlier this year which showed that counter to the 70% that they were claiming of these requests that came from public figures and criminals and so on, 95% of those requests are about individuals and their own personal privacy and they're not public figures, they're ordinary people with old information. So then I organized 80 academics to write a letter to Google six months ago asking for some more granular information and that we tried to push on the data protection authorities as well to step up to their task and say, rather than everyone having an abstract debate of opinion, let's just look at what it is. I'm prepared to revise my opinion if indeed it is the case that real information that's important to everyone is being delisted from Google search results. But my inclination and suspicion from everything I know anecdotally is that it's people's medical results, it's old out-of-date information. And that I think is a perfect example of what transparency really should be. And Google has this transparency report that is perfect for newspaper copy because it has 20 examples, but it doesn't really tell us anything quantitative and meaningful about the sorts of things that really impact all of us.

The stage manager will kill me if I go on for too long here, but we did say we'd give one more question. So over to you.

Just wanted to know from an advertising perspective, what you see as the future of merging of first and third party data for personalized messaging? Will there be a tipping point where people think it's invasive, it's an invasion of their privacy? And will it be user-led, will that kind of stopping of that be user-led through blocking, or will it be legislation-led, or what do you think?

I just saw some faces on the not answering questions, sorry. But based on what some other people have said, I've just come back from the US and one of the bizarre things is in San Francisco there's two and a half trillion dollars worth of companies there now and I used to live there and it looks poorer than it did before. There's a lot of social unrest and it's not very pleasant. And if this is a petri dish for what the future of the world looks like, it's not very pleasant actually. And one of the things that really defines Europe for me is it's the biggest single area on a map you could draw a line around it and say, well, you're probably not going to die of starvation here and you're going to get free health care and you're going to get certain social benefits. And I think much as I spent my entire life working for free market enterprises, I actually think it's gone so far now that Europe maybe needs to get involved a little bit on the rules of how to control the platforms so that we can create the kind of society that's just a bit better tempered.

We're well over time, but I hope you'll join me in thanking our excellent panel for their views. Thank you very much.