As expected, the European Court of Justice has ruled that the long-standing safe harbour data sharing agreement between the US and EU no longer provides the EU citizen with the reasonable safety that one might expect, limiting the access of US companies to European citizen data.
On the face of it to the consumer, this sounds like positive news – an added level of online privacy blocking US tech giants from using and storing personal data. But will it actually make a difference in practice? A whole new DP EU regulation is on its way in 2018 to try to put the likes of Facebook back in their box, but their reaction suggests they fundamentally disagree with its principle.
What are the underlying implications for UK business?
Although essentially intended to stop companies such as Facebook and Google from exploiting EU data, or at least to make them endeavour to adhere to EU DP regulations and practices, the effects of the EUCJ’s “safe harbour” ruling will be felt by many lower down the chain.
The potential issues will affect British companies that currently allow US organisations to hold their data, whether for operational or administrative purposes. The ruling will require companies to seek alternatives, disrupting “business as usual”, and naturally, incurring costs. US companies are also likely to be discouraged from making inroads into the UK market as it will be more expensive and harder to fulfil. Ultimately, this is bad news for the UK economy.
For US companies trying to operate in the UK from the US, marketing poses a new challenge. My business, REaD Group, for instance, allows some US companies to hold its suppression files – this will have to stop. Without appropriate data hygiene, the quality of direct marketing to UK consumers is likely to regress to substandard levels, albeit there is an argument that suggests that they won’t be able to access UK data, period. As an example, the US currently has none of its own data suppression products. A lack of access to accurate data files only means more junk mail being sent to more people who simply don’t want it, have moved house or who have died.
On the flip side, this could present a business opportunity for UK PLC. Since US companies won’t have access to UK data, they might have to call upon UK companies to undertake marketing activity on their behalf. For the sake of businesses and consumers alike, let’s hope this is the case. In terms of sophistication and responsible marketing, the UK direct marketing industry is miles ahead of that in the US where volume is more important than accuracy. So unless American companies wish to regress to substandard levels of marketing in the UK – damaging relationships with British consumers and wasting millions in the process – they must call upon UK companies to undertake marketing activity on their behalf.
This means employing locally-based companies, applying local standards, and utilising local knowledge to target the UK market. If this becomes the case, then not only will businesses in the UK profit, but we can expect the standard of US companies marketing in the UK to improve, to the benefit of consumers across the UK.
The critical factor here is about “reasonable expectations”. Is it reasonable for someone to visit a UK-based price comparison on Wednesday and to get a sales call from Wisconsin on Sunday? Likewise, is it reasonable that a British citizen browsing the internet in the UK is snooped on by the National Security Agency? I would suggest that that is in no way reasonable and we cautiously welcome this ruling.
Mark Roy is chairman of independent data communications group, REaD Group. Follow him on Twitter @MarkSRoy
To get weekly news analysis, job alerts and event notifications direct to your inbox, sign up free for Media and Tech Network membership.
All Guardian Media and Tech Network content is editorially independent except for pieces labelled “Brought to you by” – find out more here.
