Tech braces for EU privacy storm

130606_nsa_fisc_ap_605.jpg

The real threat to Silicon Valley these days isn’t Washington. It’s Brussels.

As Capitol Hill tries to move past a government shutdown, the European Parliament is preparing to tackle legislation next week that would redefine privacy standards and restrict how American tech companies do business in one of their biggest markets.

Recent leaks about the National Security Agency’s interactions with Internet companies have complicated an already tense relationship between the U.S. and Europe over privacy protections. The data protection vote could prove one of the most tangible tests yet of tech’s global clout.

( Sign up for POLITICO’s Morning Tech tip sheet)

And that’s only one brush fire for an industry facing a trans-Atlantic flare-up.

The NSA revelations have stoked European efforts to suspend a deal that allows the transfer of data overseas. Officials are weighing regulations on cloud computing, an arena American companies now dominate. And the industry can only guess at the fallout in closed-door trade talks between the U.S. and the European Union.

Tech “is definitely feeling the pain,” said the Center for Democracy & Technology’s Justin Brookman, who recently returned from Brussels. “And they recognize there is no great solution.”

The reason for the angst: Europe represents major business for tech. Google claimed 86 percent of EU searches in 2012, according to data from digital analytic company comScore. Facebook reported 272 million European users in its second quarter, a big chunk of its more than 1 billion customers.

( Also on POLITICO: DOJ fights quick Supreme Court review of NSA program)

Most major tech companies have set up shop in Brussels. Some already face EU inquiries. Google is still trying to settle a three-year European Commission investigation into its search practices. And European regulators just asked Microsoft to tweak some of its Hotmail and Bing policies.

Google and Facebook declined to discuss efforts in Europe to counter the privacy backlash. Microsoft and Yahoo, also named in the reports about NSA surveillance, did not respond to requests for comment.

But Facebook founder Mark Zuckerberg just last month lashed out at the feds for throwing tech to the wolves.

“The government’s [initial] comment was, ‘Oh don’t worry. Basically, we’re not spying on any Americans,’” he said. “Oh, wonderful, that’s really helpful to companies who are trying to serve people around the world and really going to inspire confidence in American Internet companies.”

( Also on POLITICO: Tech titans’ muted response on NSA data mining)

These companies’ damage-control efforts in the U.S. — calls for transparency and lawsuits demanding the government allow the release of more information about the national security requests they receive — aren’t just for their American users. They also send a signal to Europe and other international markets alarmed by the scope of U.S. surveillance.

“It is challenging in that you need to have communication and interaction with lots more folks because the issues are at the surface and have been raised to a much higher level of attention,” said Computer & Communications Industry Association President Ed Black. The workload has increased, he said, but “the message from our standpoint has not changed.”

That message, expressed most forcefully during the lobbying blitz leading up to the Oct. 21 European data protection vote, centers on the perils of a heavily regulated Internet.

The EU, which considers privacy a fundamental human right, is working to overhaul its 18-year-old data law. The new plan would streamline a decentralized privacy system down to one regulator. But the revised rules would also set stricter privacy requirements and serve as a model for other countries. Viviane Reding, the European commissioner for justice, fundamental rights and citizenship, has labeled it “the Union’s response to fears of surveillance.”

Tech companies have worked to water down the 119-page proposal, which would expand the definition of personal data and give Internet users more authority over the use of their information. It could also, for the first time, fine businesses up to 2 percent of annual global sales for violating the rules.

“It’s such a broad framework that it threatens to make Europe into an innovation-free zone,” said David LeDuc, senior director of public policy at the Software & Information Industry Association. “It’s hard to emphasize how challenging it could be for companies to comply with.”

European lawmakers have delayed the vote three times and offered more than 3,000 amendments since the proposal’s release in January 2012. If the Civil Liberties Committee approves the regulations, they will still need to win approval from a divided European Council and the full European Parliament.

“The biggest concern is that, in Europe, the right to privacy and data protection is a primary right,” said Joe McNamee, the executive director of Brussels-based European Digital Rights. “And [a variety of interest groups] have persuaded a significant amount of parliamentarians to propose measures that fundamentally undermine this right.”

The data protection fight has brought U.S.-style lobbying to Brussels, he said, and led to the creation of an “onion lobby” where firms hide within trade organizations and larger coalitions.

That’s just one battle.

A European Parliament committee this month recommended suspending Safe Harbor, a process that allows data to flow between the U.S. and the EU despite their differing privacy rules. Tech says any attempt to remove such a cornerstone agreement would kill its business in Europe.

As global tensions mount, American officials have started jumping to tech’s defense.

Federal Trade Commission member Julie Brill, at a September speech in Brussels, tried to assuage concerns. Safe harbor, she said, is an “easy target” for Europe after the NSA leaks but is not necessarily “the right target.” Brill emphasized that Safe Harbor, while not designed to address national security issues, does ensure the FTC is “the cop on the beat for commercial privacy issues.”

Former Commerce Department General Counsel Cameron Kerry, in a speech before he left office, derided proposals that would upend American cloud computing services or restrict the location of data. European lawmakers have proposed amendments in recent months that would bar the transfer of data between clouds in the U.S. and EU without special conditions.

“The digital world does not need another Great Firewall — in Europe or elsewhere,” Kerry said.

The White House is working on legislation to boost online privacy, a possible means to gain leverage in Europe. A basic American privacy framework could prove helpful in the nascent trade negotiations between the U.S. and EU. But it’s unclear just how much privacy and data protection will get addressed in the talks, known as the Transatlantic Trade and Investment Partnership.

“There are no global trade talks that say anything about privacy as it relates to free flow,” said Susan Aaronson, an associate research professor of international affairs at George Washington University. [The data protection regulations] and TTIP are the only game in town.”

The NSA story continues to ripple outside Europe. Brazil has just announced that it will launch a secure email system to protect the country from prying governments. Its leaders also indicate they will move toward the local storage of data and lay underwater fiber optic cable directly to Europe and South America to avoid U.S. surveillance. A handful of other countries are considering similar types of data storage.

Such actions present a boost to privacy supporters and a wallop for tech companies.

“With a very complex regulatory requirement, you don’t have the global scalability which the whole Internet premise was based upon,” said Daniel Castro, a senior analyst with the Information Technology & Innovation Foundation. “What we are really trying to understand is how this will change the long-term trajectory.”

Next week’s vote could offer one of the first glimpses.