Digital Policy Issues

Privacy, the treatment of information related to users, customers or employees, and data security, governance and handling mandates, are increasingly active digital public policy issues nationally and globally. Implementation of the European Union’s General Data Protection Regulation (GDPR) and preparation for the entry into force of the landmark California Consumer Privacy Act were highlights of 2019, while the expectation that the Congress would move forward on bipartisan comprehensive privacy legislation or a large number of states would mimic California did not come to pass.

While expectations coming into 2020 were for more of the same -- accelerated GDPR enforcement in Europe, in particular targeting large digital platforms, proliferation of activity in U.S. States, more countries attempting to enact national privacy and data security regimes confirming to GDPR standards, and potentially even U.S. Federal legislation -- the reality has been the COVID pandemic becoming an almost singular focus on digital privacy officials as attention has turned to the potential for a wide range of contract tracing technologies to assist in pandemic response.

Privacy and Data Security in the United States - Federal and State Competition At a time when the global public policy trend appears driven in most cases by the EU and their GDPR, the differences in the US model appear more distinct than ever. Rather than a single GDPR-style set of data-related user rights and corporate compliance requirements governed by a single dedicated data and privacy regulator, the US has a system of federal and state laws, regulations, regulators and enforcers, including unique regulatory regimes for various industries including health care and financial services. While many privacy policy advocates claim that the US model is unquestionably deficient, there are experts who make the case that the mix of legal and regulatory standards combined with concrete enforcement actions has provided a very similar set of protections to the European model.

Regardless of the validity of the historical comparison between the US and EU models, the combined effect of the GDPR becoming law and California enacting the California Consumer Protection Act in mid-2018 for implementation in 2020, dramatically increased corporate interest in the enactment of some type of comprehensive federal privacy and data security legislation. A number of corporate and congressional leaders who had traditionally been minimally interested in federal privacy legislation appeared to shift their thinking in a direction of more support for legislation that would establish a single set of federal requirements, supersede state laws and create a regulatory situation relatively consistent with the GDPR requirements. However, despite public reporting of bipartisan efforts in the US Senate and House of Representatives, no meaningful congressional legislation has emerged. Major hurdles include the applicability of new unified mandates to a wide range of businesses and types of data, the treatment of industries governed by existing industry-specific regimes such as banking and health care, the enforcement models, especially litigation and “private right of action”, and whether varied state laws will be pre-empted.

The enactment of the California Consumer Protection Act in June 2018, which established a single set of data collection, handling, use and compliance requirements for companies doing business in California or with at least 50,000 Californians, placed renewed attention on the potential role of state-level privacy and data mandates. Not only did the California law raise interest in Washington, DC on federal privacy legislation, but it appeared to provide some momentum to legislative efforts in other states. The states of Maine and Nevada followed California in enacting state bills, while the state legislatures in Washington and Illinois are deep into consideration of new legislation. However, a flood of state privacy laws with various onerous provisions have not emerged since California's law passed.

EU Regulation and International Trends

The EU General Data Protection Regulation went into effect in mid-2018, establishing a single standard for the collection, handling, use and compliance requirements for all businesses, regardless of location, when handling personal data related European citizens. The ensuing year has witnessed a range of trends related to implementation. This has included private litigation aimed at companies for non-compliance, especially the largest digital platforms such as Google and Facebook, large volumes of private complaints and questions filed with state privacy regulators leading to widespread reviews of corporate practices and policies, and litigation challenging the One Stop Shop enforcement model.

Following on the heels of the GDPR is the anticipated ePrivacy Regulation which is expected to replace the 2002 ePrivacy Directive. The ePrivacy Regulation is more targeted than the GDPR, applying a range of privacy standards to communications technologies, including, telecommunications, digital and online communications and messaging. The ePrivacy Regulation was passed by the European Council in May 2019 and final negotiations between the Council and the European Parliament are expected. The regulation is not likely to go into effect until 2021.

Beyond Europe, numerous national governments are engaged in reviews of privacy and data security policies in a manner that seems to include creating as much consistency with the EU’s GDPR standards in order to facilitate cross-border commerce and reduce compliance difficulties caused by overlapping and inconsistent regulatory models. Examples include major markets such as Brazil, Australia, Japan and Korea. Countries with very large domestic digital markets, including India and Indonesia, are actively debating enactment of new digital data security and privacy laws, with the proposal in India raising major concerns with civil libertarians and global digital firms concerned with a range of provisions. In addition, issues relate to privacy and data have become a regular topic area of competition policy discussions related to the digital mega-platforms such as Google, Facebook, Amazon and Apple. On early test of the link between user data practices of the largest platforms in the context of competition law involves the German Federal Cartel Office's case targeting Facebook's internal data practices, which was challenged by Facebook in court and resulted in an interim decision in August 2019 questioning the Cartel Office's premise.

Net Neutrality is an Internet public policy issue that has engaged public officials, telecommunications and Internet businesses, activists and user groups for almost fifteen years. At a high level, the debate revolves around whether Internet access service providers, generally thought of as telecommunications or network businesses, should have an ability to sell a form of premium access to a network company’s Internet consumer customers to Internet content or application businesses willing to pay for that upgraded access to consumers.

Some oppose that kind of business model flexibility because it would change the “level playing field” that consumers using the Internet have experienced when they traditionally chose which services to frequent. Others believe that no level playing field on the Internet ever actually existed and believe that government mandates on Internet-related network services will undermine technology innovation. In the United States, the issue has been impacted by multiple rules from the Federal Communications Commission, related lawsuits and many efforts at legislation. The issue has also been raised in countries around the world, in particular in the context of “zero rating plans”. Finally, concern with corporate “gatekeepers” impacting Internet user freedoms has more recently been raised in the context of the some of the largest Internet platform businesses, leading to discussions of Platform Neutrality.

The response to the COVID pandemic, with a wide range of shutdown and work-from-home orders imposed by governments globally resulted in meaningful uptake of digital tools for remote work, schooling and entertainment, raising concerns regarding bandwidth constraints and the capability of digital networks to meet new demands. It has appeared that network providers in markets with both stronger and weaker net neutrality requirements have been able to meet demands, although there were reports that most of the larger digital video services providers did voluntarily reduce streaming rates to reduce congestion.

Digital businesses have challenged traditional local, state and national tax regimes by changing business models and expanding the type of enterprises that can participate various lines of business. Two of the biggest changes powered by digital business models has been dramatic expansions of the ability to engage in business over great distances, allowing many more services to be provided in part, or in whole, from remote locations, even from foreign countries. The second has been an expansion of opportunities available to very small enterprises. Both of these trends challenge traditional tax models.

Digital Services Taxes

National governments from Europe to Australia have responded with a host of different tax proposals aimed at digital businesses, often summarized under the term “Digital Services Taxes” (DST). This was a major point of debate in the EU in mid-2018, with national governments failing to come to agreement on a single EU-wide digital services tax proposal. Concerns were expressed by a handful of smaller EU countries, in particular Nordic states, but also the Netherlands and Ireland, along with vocal bipartisan opposition from the United States, including the Trump Administration. The EU-wide proposal was put on hold, national governments were free to move on their own, and there was vocal support from all corners for a multilateral "solution".

National DST efforts were kick-started by France’s enactment of a 3% DST in mid-2019, which targeted large digital platforms, most of which are U.S.-based. A number of countries in Europe and Asia, led by Italy, Spain, the UK, Turkey and India followed with various proposals. The U.S. Government has consistently responded to national DST proposals with tariff threats and pushed for a global deal that does not discriminate against Internet platforms. There remains hope that a series of national taxes, and potentially tariff retaliation, can be avoided with a multilateral deal, and most hopes are pinned on an OECD plan that emerged from "Base Erosion and Profit Shifting" (BEPS) work. However, by mid-2020, not only are countries like the UK and India moving forward with national levies, but global officials such as the Tax Minister of France, Finance Minister of Indonesia and Economic Commissioner of the EU have recently argued that the robust success of digital businesses during the COVID pandemic increases the urgency of new digital taxes. A tax and trade war driven by unilateral digital tax measures could be very harmful to a weakened global economy.

An interesting tangent is the potential effort by some U.S. State governments to establish a sort of domestic state DST to increase tax collection on remote digital advertising on platforms like Google, Facebook and Amazon, which was led by Maryland in its 2020 state legislative session, although the new digital advertising tax was vetoed by the Governor.

Sales Taxes and VAT Collection

The Internet, and global digital commerce platforms (eBay, Amazon, Etsy, Mercado Libre, Alibaba) has dramatically increased the ability of small enterprises to sell directly to consumers in foreign markets. This development has challenged national and state consumer-focused sales taxes, including national VAT regimes, and state-level sales taxes in the United States. Traditional retail businesses fearing foreign competition that claim can evade taxes, and governments fearing the loss of revenue, have been partnering in efforts to expand the application of local sales taxes to remote enterprises selling over the Internet.

In the United States, where sales taxes are a combination of state and local tax regimes spread across thousands of jurisdictions, the cross-border enforcement of sales tax collection mandates on remote retail businesses was prohibited by the 1992 Quill Decision of the US Supreme Court. However, the Quill Decision was overturned by the US Supreme Court in June 2018 through the Supreme Court's Wayfair Decision, ending the long-standing prohibition of sales taxes being imposed on out-of-state retailers. Since June 2018, most states have proceeded to impose their state sales taxes on retailers of various sizes. Of greater impact has been the trend pursued by many states to impose sales taxes on sales of even very small remote retailers through "marketplace mandates" which require Internet commerce marketplace businesses to collect and remit sales taxes on all sales made in the state. By mid-2020, the final handful of states that have sales taxes were moving to implement marketplace tax collection mandates to ease compliance and increase tax collection on sales by small remote businesses. The "next big issue" on this front is likely to be the expansion of sales taxes and digital marketplace collection to services.

Outside of the United States, a number of major markets are moving to address challenges to their own forms of sales taxes (often called a Value Added Tax or Goods and Services Tax) through similar schemes. Many countries VAT or GST regimes included some form of a "low value threshold" exempting individual package shipments coming from other countries from local taxes, including sales-type taxes. The reasoning was that attempting to tax individual packages, often entering the country through the postal system, was not worth the trouble in terms of enforcement costs. However, with the increase of cross-border commerce enabled by global commerce platforms, countries from Australia and New Zealand to Europe are changing (even eliminating) their tax-free low value thresholds and applying their sales taxes to all imports, even very low-cost packages. National governments are turning to collection mandates on Internet commerce marketplaces as a way to address compliance concerns. Australia's regime went into effect in mid-2018 and the EU is in the midst of implementing a similar system. The result is that the exports of even the smallest, foreign, Internet-enabled sellers are being taxed.

Collection of Hotel, Labor and Other Taxes

The emergence of digital platforms enabling a range of commercial activities that have been taxed and the national and local level has raised similar concerns among traditional businesses and governments that have been raised in the context of sales and VAT taxes and Internet retail. Hotel services are often taxed at meaningful rates, and therefore the increasing popularity of home and room "sharing" via platforms like AirBNB, has resulted in aggressive lobbying campaigns in markets around the world to require non-traditional short-term rental platforms to collect taxes similar traditional hotels. Similar tax collection mandates have been raised with regards to employment-style taxes and digital work platforms, car rental taxes in the context of car sharing platforms, and taxi-type taxes in the context of "ride sharing platforms". These trends are underway in national, state and local markets around the world.

The emergence of a relatively small number of extraordinarily large digital platform businesses has challenged traditional legal and economic thinking on competition and antitrust law. Sometimes the analysis has been focused on just the few, high-profile, mega-platforms, but there are advocates for significant change in well-established competition law frameworks and principles that are actively pushing for more fundamental changes. Some argue that digital business models are different and traditional legal and economic concepts need to be adjusted to account for digital businesses. The issue is active in the United States, UK, the European Union, Japan and Australia, to name just a few.

Long-Stable Competition Law in the United States and the New Brandesians

The degree of legal and economic consensus on the principles of competition law in the United States has been striking since the overhaul of thinking in the 1970’s and 80’s based on ideas popularized by Judge Robert Bork and the Chicago School of Economics. However, especially among progressives, increasing concentration in many industries over recent decades, with potential impacts on broader trends in employment, wages and economic concentration, has led to challenges to general principles of antitrust law. One noteworthy line of thinking is self-identified as the New Brandeis movement, which has called for restoring many of the policy prescriptions of pre-1970’s antitrust law which some summarize as believing that “Big Is Bad”. Bipartisan concerns over a wide range of issues involving the largest digital platform businesses has resulted in a series of hearings providing opportunities to antitrust experts and advocates to make their case regarding the state of competition and the law. The Federal Trade Commission (FTC) held 14-part series of hearings on Competition and Consumer Protection in the 21st Century from September of 2018 to June of 2019, a broad review exploring competition topics directly, indirectly, and not-at-all related to digital industries. Congressional hearings, in 2018 in the US Senate and 2019 US House, have focused more directly on issues related to the largest digital platforms, as are task force-style reviews set up in the FTC and Department of Justice in the 2019.

The range of hearings has revealed relatively widespread agreement that the various antitrust reviews conducted as the current mega-platforms grew into their present state, were inadequate. Experts on all sides speak to need for greater recognition of the importance of data, the use of acquisitions to undermine emerging competitors, the importance of the innovation climate, and how broadly to think about consumer prices, especially in two-sided markets. However, there remains little consensus on the need for drastic rethinking or any type of legal overhaul with many defenders of the prevailing jurisprudence simply tweaked to address the mega-platforms. Finally, recent US Supreme Court decision such as American Express v. Ohio (2018) and Apple v. Pepper (2019) remind analysts that judges will continue to play a critical role in terms of the application of antitrust law to two-sided markets and platforms.

The largest digital platforms -- Google, Facebook, Amazon and Apple, along with Microsoft and Netflix in some cases -- have been under increasingly bipartisan scrutiny in the United States. The Department of Justice and Federal Trade Commission both have company-specific and broader digital economy investigations and reviews underway, and major coalitions of State Attorneys General and deep into investigations of Google and Facebook in particular.  Investigations of those two platforms appear most intense due, likely, to their very large market shares in Internet search and social networks, as well as, in the case of Google, with the fact their 2011-2012 FTC investigation and a decade of competition law cases in Europe (Search Dominance [Shopping], Advertising and Android) has resulted in a large body of evidence, complainants and legal thinking for investigators to build on.

Global Competition Law and Digital Platforms

The appropriate application of competition policy to the largest digital platforms is being considered in major markets globally. National competition authorities in Australia, the UK, Korea and Japan are engaged in high-level overviews of large digital platforms. The communications and advertising platforms Facebook and Google are at the center of many reviews due to their extraordinarily large markets shares in “social media” and “Internet search” and billion-plus active users. The Australian Competition and Consumer Commission (ACCC) has been engaged in a comprehensive deep dive review of Google and Facebook’s impact on markets in Australia, media, journalism and advertising, with a set of 23 recommendations released in mid-2019 and the Australian Government putting out their follow-on action plan in late 2019.  An ACCC-driven endeavor to create some new form of digital advertising revenue sharing where Google, Facebook and potentially other social media platforms (Twitter, TikTok?) pay traditional media firms in Australia for linking to content is on the docket for 2020.  That idea is quickly gaining traction in markets globally, where traditional media firms believe getting paid by large digital platforms is an excellent idea.

In Europe, the European Commission, and national competition authorities in Germany, Austria and Italy have taken on specific cases related to digital giants including Google, Facebook, Amazon and Apple, covering topics such as search, data and privacy practices, leveraging and various tax issues. The European Commission’s review of Google’s search, advertising and mobile operating system conduct have been underway for nearly a decade, with each resulting in major fines and appeals by Google.