EU Parliament's Own Website Violates The GDPR

from the whoopsy dept

We've been pointing out for a while that, however well-intentioned the GDPR may be, and however important the general concept of protecting user's private data is, that still doesn't make the GDPR any less ridiculous. Indeed, we've pointed out that the setup of the GDPR is such that it's becoming a regulatory nightmare because the compliance costs are high, and the setup of the rules are so vague that the liability risk remains high. I know that some people keep insisting that the requirements to be compliant aren't actually that difficult. Indeed, EU Commissioner Vera Journova recently claimed that complying with the GDPR was so easy that even she could do it.

Upon hearing that, software engineer Matthias Gliwka wondered if the EU was actually complying with its own "so easy" GDPR rules. Turns out, not so much. As Gilwka noted, the EU Parliament's own website appears to violate the GDPR.

It took me less than five minutes to spot a violation: on the website of the EU Parliament Google Analytics is being used to track the visitors without the neccesary anonymizeIP flag, which in turn causes Google to store the complete IP address without anonymizing the last octet. You can take a look for yourself by checking the source code of this page (archived version in case it gets fixed in the meantime).

This is a violation of the GDPR, since the personal data (IP address) in conjunction with analytics data is being stored on Google’s servers without consent or any other legal basis.

Oops. This, of course, is not to mock the EU Parliament for screwing up, but rather to highlight the fact that when politicians and regulators insist that certain regulations are "easy" to comply with, they often have no idea what they're talking about -- and the GDPR is a case in point. Over the past couple months, nearly every startup company I've spoken to has discussed the GDPR, and for nearly every single one they have no idea if they're actually in compliance. Many have spent ridiculous sums on lawyers and self-described GDPR experts, but still are working almost entirely blind on how the GDPR will play out in practice.

That is not a good recipe for innovation. Nor, frankly, is it a good recipe for protecting your data. No matter how much you think that the GDPR means that websites will better protect your data, it is not particularly helpful when complying with the rules is both expensive and unclear. That the EU Parliament's own website couldn't figure this out is just a shining example of why the GDPR is such a problem.

Related to that, the fallout from the GDPR is already being felt -- and it's not being felt by Google and Facebook and the other internet giants that everyone celebrating the GDPR often point to. Instead, it's hitting smaller sites really, really hard. Google and Facebook are fine. They can handle the GDPR. Everyone else is freaked out.

Filed Under: eu, eu parliament, gdpr, regulations, tracking, vera journova

The GDPR: Ghastly, Dumb, Paralyzing Regulation It's Hard To Celebrate

from the if-you-like-privacy-and-the-Internet-demand-better dept

Happy GDPR day! At least if you can manage to be happy about a cumbersome, punitive, unprecedentedly extraterritorial legal regime that hijacks the resources of businesses everywhere without actually delivering privacy protection commensurate with the enormous toll attempts to comply with it extract. It's a regulatory response due significant criticism, including for how it poorly advances the important policy goals purportedly prompting it.

In terms of policy goals, there's no quarrel that user privacy is important. And it's not controversial to say that many providers of digital products and services to date may have been… let's just say, insufficiently attentive to how those products and services handled user privacy. Data-handling is an important design consideration that should always be given serious attention. To the extent the GDPR encourages this sort of "privacy by design," it is something to praise.

But that noble mission is overwhelmed by the rest of the regulatory structure not nearly so adeptly focused on achieving this end, which ultimately impugns the overall effort. Just because a regulatory response may be motivated by a worthwhile policy value, or even incorporate a few constructive requirements, it is not automatically a good regulatory response. Unless the goal is to ruin, rather than regulate, knotty policy problems need nuanced solutions, and when the costs of complying with a regulatory response drown out the intended benefit it can't be considered a good, or even effective, policy response. Here, even if all the GDPR requirements were constructive ones – and while some are, some are quite troubling – as a regulatory regime it's still exceptionally problematic, in particular given the enormous costs of compliance. Instead of encouraging entities to produce more privacy-protective products and services, it's instead diverted their resources, forcing them to spend significant sums of money seeking advice or make their own guesses on how to act based on assumptions that may not be correct. These guesses themselves can be costly if it results in resources being spent needlessly, or for enormous sums to be put in jeopardy if the guesses turn out to be wrong.

The rational panic we see in the flurry of emails we've all been getting, with subject lines of varying degrees of grief, and often with plaintive appeals to re-join previously vibrant subscriber communities now being split apart by regulatory pressure, reveals fundamental defects in the regulation's implementation. As does the blocking of EU users by terrified entities afraid that doing so is the only way to cope with the GDPR's troubling scope.

The GDPR's list of infirmities is long, ranging from its complexity and corresponding ambiguity, to some notably expensive requirements, to the lack of harmonization among crucial aspects of member states' local implementations, to the failure of many of these member states to produce these local regulations at any point usefully in advance of today, and to the GDPR's untested global reach. And they fairly raise the concern that the GDPR is poorly tailored to its overall policy purpose. A sound regulatory structure, especially one trying to advance something as important as user privacy, should not be this hard to comport with, and the consequences for not doing so should not be so dire for the Internet remaining the vibrant tool for community and communication that many people – in Europe and elsewhere – wish it to remain being.

Filed Under: eu, gdpr, innovation, regulations

Rupert Murdoch Believes In The Free Market... Until His Company Is Struggling: Then He Wants To Regulate Competitors

from the hypocrite dept

Oh, Rupert Murdoch. When we last checked in with him, he was literally begging Facebook to pay News Corp. money because (he claimed) News Corp was "enhancing the value and integrity of Facebook." We noted at the time that Murdoch -- a staunch public defender of free market capitalism and a loud opponent of "socialism" -- seemed to be a bit hypocritical in effectively demanding a corporate handout from other, more successful companies, when his own company had struggled for years to adapt to the internet.

He's not done yet. Apparently, if Facebook (and, one presumes, Google) don't want to just hand him money for nothing, he's now demanding that they be heavily regulated:

Robert Thomson, the CEO of Murdoch’s company, News Corp., took a step beyond criticism last week in an investor call, when he advocated the creation of an “algorithm review board,” which would essentially regulate the secret formulas platforms use to determine, among other things, what news is shown to which people.

What a fucking hypocrite. Just compare this to what Murdoch was saying just a few years ago about free markets, competition, regulation and s haring:

But while we’ve won the efficiency argument, we have yet to persuade people that the market does better because it is more moral — or that socialism fails because it is largely immoral in its denial of fundamental freedoms.

To the contrary, too many people think that the market succeeds because it is based on a vice — greed. And that socialism is better, because it is based on a virtue — sharing.

Naturally, they conclude from this one of two things: that the way to make capitalism more just and more humane is to temper it by injecting a large dollop of government-mandated sharing, or that, like President Obama, government is better.

Or how about this gem:

How often do you hear the same people who say they are for free trade then push for stronger anti-dumping laws, a backdoor form of protectionism?

How often do we hear the same politicians who say they believe in free markets go on to carve out a special tax credit for some industry they favor?

Oh, Rupert, why it happens all the time. Sometimes from people like yourself.

Crony capitalism is not capitalism. It’s cronyism.

Yes. So why are you trying to get your crony's to regulate your competitors who have done a much better job than you in the market?

The market succeeds because it gives people incentives to put their own wants and needs aside to address the wants and needs of others. To succeed, you have to produce something that other people are willing to pay for.

And if he fails to get people to pay for it, Rupert Murdoch will run to the government, demanding that more successful companies just pay him, and then will also advocate for heavily regulating those companies while pretending to be for the free market and against cronyism.

What’s fair about taking money from people who’ve earned it and giving it to people who didn’t?

Says the guy demanding money he didn't earn from internet companies...

In short, as we work for freer markets, we must also work to persuade our fellow citizens that we do so not simply because a free market is more efficient but because it is fair and just and right.

Yes, Rupert Murdoch believes this right up until his own companies have trouble adapting and competing. Then he goes running to government to regulate those companies who are actually succeeding.

There may be reasonable arguments for certain kinds of regulations. But Murdoch's only reason for calling for regulations of internet companies -- after whining about socialism and talking up free markets -- is pretty blatantly an attempt to whine for a handout for his own businesses that have failed to adapt to changing times.

Filed Under: algorithms, competition, free market, internet, regulations, rupert murdoch
Companies: facebook, google, news corp.

Want To Blog In Tanzania, Or Read Social Media In Uganda? Pay The Government, Please

from the consequences-of-lugambo dept

Although blogging may have lost its early excitement for many, in some countries it still represents a vital channel for news that may not be available elsewhere. For example, as Global Voices explains:

Blogging emerged in Tanzania around 2007 and became popular as an alternative news platform with educated, middle class people, as well as politicians and political parties. In Tanzania, where media historically holds strong ties to government interests, blogging opened up possibilities for individuals to establish private news outlets that proved immensely powerful in terms of reach and readership.

The current Tanzanian government is not very happy about this uncontrolled flow of information to the people. But instead of anything so crude as shutting down blogs directly, it has come up with a more subtle, but no less effective, approach:

On March 16, 2018, the United Republic of Tanzania issued the Electronic and Postal Communications (Online Content) Regulations demanding that bloggers must register and pay over USD $900 per year to publish online.

To put that in context, Tanzania's GDP per capita was under $900 in 2016, so the new fees are completely out of reach for the majority of people in the country. As Quartz notes, in addition, the registration process is onerous, and the fines for infringement serious:

applicants are expected to fill a form detailing the estimated cost of investment, the number of directors and stakeholders in the platform, their share of capital, staff qualifications, expected dates of commencing operations, besides future growth plans.

But even after providing this documentation, authorities still reserve the right to revoke a permit if a site publishes content that "causes annoyance, threatens harm or evil, encourages or incites crimes" or jeopardizes "national security or public health and safety." Officials could also force managers to remove "prohibited content" within 12 hours or face fines not less than five million shillings ($2,210) or a year in prison.

The situation is slightly easier in Tanzania's northern neighbor, Uganda. Under a new order there (pdf), "All online data communication service providers, including online publishers, online news platforms, online radio and television operators" are required to register with the Uganda Communications Commission. However, there's no mention of fees, or punishments for non-compliance. But if life for Ugandan bloggers seems to be easier than for those in Tanzania, a new daily tax on social media is designed to discourage ordinary users from engaging in what Ugandan President Yoweri Museveni calls "lugambo", or gossip, online. A report in the local Daily Monitor newspaper quotes the President as saying:

"I am not going to propose a tax on internet use for educational, research or reference purposes... these must remain free. However, olugambo on social media (opinions, prejudices, insults, friendly chats) and advertisements by Google and I do not know who else must pay tax because we need resources to cope with the consequences of their lugambo"

The amount of the daily tax is not clear -- a BBC report on the move says it might be either 100 or 200 Ugandan shillings ($0.013 or $0.027) a day -- and there are no details yet on how the new law will be enforced and the taxes collected for services deemed to involve "gossip". But as another Global Voices post notes, this social media tax is just the latest clampdown on the online world in Uganda. It quotes a January 2018 report from Unwanted Witness, a Ugandan NGO, which said:

2017 registered the highest number of Ugandans ever arrested for their online expression and these arrests are clearly targeted crackdown on free flow of information and speech on the Internet.

Different as they are, what the moves in Tanzania and Uganda both show is African governments coming up with new ways to muzzle online commentators that seek to tell people what the official media don't.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+.

Filed Under: blogging, free speech, internet, regulations, social media, tanzania, taxation, uganda

Cali Lawmakers Pushing For 72-Hour Bot Removal Requirements For Social Media Companies

from the bad-idea,-worse-implementation dept

Following in the footsteps of misguided European lawmakers, California legislators have introduced a time-sensitive "remove speech or else" law targeting social media sites.

They’ve introduced a bill that would give online platforms such as Facebook and Twitter three days to investigate whether a given account is a bot, to disclose that it’s a bot if it is in fact auto-generated, or to remove the bot outright.

The bill would make it illegal for anyone to use an automated account to mislead the citizens of California or to interact with them without disclosing that they’re dealing with a bot. Once somebody reports an illegally undisclosed bot, the clock would start ticking for the social media platform on which it’s found. The platforms would also be required to submit a bimonthly report to the state’s Attorney General detailing bot activity and what corrective actions were taken.

This is ridiculous for a number of reasons. First, it assumes the purpose of most bots is to mislead, hence the "need" for upfront disclosure. The ridiculousness of this part of the law's many faulty premises is only further underscored by a bot created by the legislator behind the bill, Bob Hertzberg. His bot's bio says [emphasis added]:

I am a bot. Automated accounts like mine are made to misinform & exploit users. But unlike most bots, I’m transparent about being a bot! #SB1001 #BotHertzberg

Hertzberg's bot must have been made to "misinform and exploit users," at least according to its own Twitter bio. And yet, the account's tweets appear to disseminate actual correct info, like subcommittee webcasts and community-oriented info. It's good the bot is transparent. But it's terrible because the transparency immediately follows a line claiming automated accounts are made apparently solely to misinform people.

Plenty of automated accounts never misinform or exploit users. Techdirt's account automatically tweets each newly-published post. So do countless other bots tied into content-management systems. But the bill -- and bill creator's own words -- paint bots as evil, even while deploying a bot in an abortive attempt to make a point.

Going on from there, the bill demands sites create a portal for bot reporting and starts the removal clock when a report is made. User reporting may function better than algorithms when detecting bots spreading misinformation (putting bots in charge of bot removal), but this still puts social media companies in the uncomfortable position of being arbiters of truth. And if they make the "wrong" decision and leave a bot up, the government is free to punish them for noncompliance.

The bill also provides no avenue for those targeted to challenge a bot report or removal. (And no option for sites to challenge the government's determination that they've failed to remove bots.) This is a key omission which will lead to unchecked abuse.

Finally, there's the motivation for the bill. Some of it stems from a desire to punish "fake news," a term no government has ever clearly defined. Some of it comes from evidence of Russian interference in the last presidential election. But much of the bill's impetus is tied to vague notions of "rightness." Hertzberg himself exhumes a long-dead catchphrase to justify his bill's existence.

"We need to know if we are having debates with real people or if we’re being manipulated," said Democratic State Senator Bob Hertzberg, who introduced the bill. "Right now we have no law and it’s just the Wild West."

So, summary executions of bots by social media posse members? Is that the "Wild West" you mean, one historically notorious for its lack of due process and violent overreactions?

Here's the other excuse for bad lawmaking, via an advocate for terrible legislation.

"California feels a bit guilty about how our hometown companies have had a negative impact on society as a whole,” said Shum Preston, the national director of advocacy and communications at Common Sense Media, a major supporter of Hertzberg’s bill. “We are looking to regulate in the absence of the federal government. We don’t think anything is coming from Washington."

So, secondhand guilt justifies the direct regulation of third-party service providers? That's almost worse than no reason at all.

And this isn't the only bad bot bill being considered. Assemblymember Marc Levine wants all bots to tied to verified human beings. The same goes for any online advertising purchases. Levine feels his bill will help fight the bot problem, but his belief is predicated on a profound misunderstanding of human behavior.

By identifying bots, users will be better informed and able to identify whether or not the power of a group’s influence is legitimate. This will mitigate the promulgation of misinformation and influence of unauthentic social media campaigns.

Yes, telling people the stuff they think is legitimate isn't legitimate always results in people ditching "illegitimate" news sources. Especially when that info is coming from a government they don't like presiding over a state many wish would just fall into the ocean. Trying to fight a bot problem largely associated with alt-right groups with legislation from coastal elites is sure to win hearts and minds.

A bot-reporting portal with no recourse provisions -- and a possibile "real name" requirement added into the mix -- will become little more than a handy tool for harassment and hecklers. The cost of these efforts will be borne entirely by social media companies, which also will be held responsible for the mere existence of bots the Californian government feels might be misleading its residents. It's bad lawmaking all around, propelled by misplaced guilt and overstated fears about the democratic process.

Filed Under: automation, bob hertzberg, bots, california, censorship, fake news, marc levine, regulations, social media, speech

How 'Regulating Facebook' Could Make Everyone's Concerns Worse, Not Better

from the it's-a-mess dept

In my last post, I described why it was wrong to focus on claims of Facebook "selling" your data as the "problem" that came out over the weekend concerning Cambridge Analytica and the data it had on 50 million Facebook users. As we described in detail in that post, that's not the problem at all. Instead, much of the problem has to do with Facebook's utter failure to be transparent in a way that matters -- specifically in a way that its users actually understand what's happening (or what may happen) to their data. Facebook would likely respond that it has tried to make that information clear (or, alternatively, it may say that it can't force users to understand what they don't take the time to understand). But I don't think that's a good answer. As we've learned, there's a lot more at stake here than I think even Facebook recognized, and providing much more real transparency (rather than superficial transparency) is what's necessary.

But that's not what most people are suggesting. For example, a bunch of people are calling for "Know Your Customer" type regulations similar to what's found in the financial space. Others seem to just be blindly demanding "oversight" without being able to clearly articulate what that even means. And some are bizarrely advocating "nationalizing Facebook", which would literally mean giving billions in taxpayer dollars to Mark Zuckerberg. But these "solutions" won't solve the actual issues. In that article about "KYC" rules, there's the following, for example:

“They should know who’s paying them,” said Vasant Dhar, a professor of information systems at New York University, “because the consequences are very serious.” In December, Dhar wrote an op-ed calling for social media regulation — specifically, something similar to the “know your customer” laws that apply to banks. “The US government and our regulators need to understand how digital platforms can be weaponized and misused against its citizens, and equally importantly, against democracy itself,” he wrote at the time.

Antonio García-Martinez, Facebook’s first targeted ads manager, thinks so too. “For certain classes of advertising, like politics, a random schmo with a credit card shouldn’t just be able to randomly run ads over the entire Facebook system,” he told me.

Except... that has literally nothing to do with what the Cambridge Analytica controversy is all about. And, anyway, as we've discussed before, the Russians bent over backwards to pretend to be Americans when buying ads, so it's not like KYC rules would really have helped for the ads. And the whole Cambridge Analytica may have involved some ads (and lots of other stuff), but Facebook knew who "the customer" was in that instance. And it knew how an "academic" was slurping up some data for "academic research." Knowing your customer wouldn't have made the slightest difference at all here.

Even Tim Berners-Lee, who recently stirred the pot by suggesting regulations for social media doesn't seem to have much concrete information that would have mattered here.

What’s more, the fact that power is concentrated among so few companies has made it possible to weaponise the web at scale. In recent years, we’ve seen conspiracy theories trend on social media platforms, fake Twitter and Facebook accounts stoke social tensions, external actors interfere in elections, and criminals steal troves of personal data.

We’ve looked to the platforms themselves for answers. Companies are aware of the problems and are making efforts to fix them — with each change they make affecting millions of people. The responsibility — and sometimes burden — of making these decisions falls on companies that have been built to maximise profit more than to maximise social good. A legal or regulatory framework that accounts for social objectives may help ease those tensions.

I don't think Tim is wrong per se in arguing that there are issues in how much power is concentrated between a small group of large companies -- but I'm not sure that "a legal or regulatory framework" actually fixes any of that. Indeed, it seems highly likely to do the reverse.

As Ben Thompson notes in his own post about this mess, most of the regulatory suggestions being proffered will lock in Facebook as an entrenched incumbent. That's because it will (a) create barriers that Facebook can deal with, but startups cannot and (b) focus on "cementing" Facebook's model (with safeguards) rather than letting the next wave of creative destruction take down Facebook.

It seems far more likely that Facebook will be directly regulated than Google; arguably this is already the case in Europe with the GDPR. What is worth noting, though, is that regulations like the GDPR entrench incumbents: protecting users from Facebook will, in all likelihood, lock in Facebook’s competitive position.

This episode is a perfect example: an unintended casualty of this weekend’s firestorm is the idea of data portability: I have argued that social networks like Facebook should make it trivial to export your network; it seems far more likely that most social networks will respond to this Cambridge Analytica scandal by locking down data even further. That may be good for privacy, but it’s not so good for competition. Everything is a trade-off.

Note that last bit? A good way to take away Facebook's dominance is to enable others to compete in the space. The best way to do that? Make it easy for people to switch from Facebook to upstart competitors. The best way to do that? Make it easier for Facebook users to export their data... and use it on another service. But as soon as you do that, you're actually right back into the risky zone. Why is Facebook in so much hot water right now? Because it made it too easy to export user data to third party platforms! And, any kind of GDPR-type solution is just going to lock down that data, rather than enabling them to help seed competition.

Cory Doctorow, over at EFF, has what I think is the most reasonable idea of all: enable third parties to build tools that help Facebook's (and every other platform's!) users better manager and understand their privacy settings and what's being done with their data. That's an actual solution to the problem we laid out in the previous post: Facebook's failed transparency. Doctorow compares the situation to ad-blockers. Ads became too intrusive, and users were able to make use of 3rd party services to stop the bad stuff. We should be able to do something similar with privacy and data controls. But, thanks to some pretty dumb laws and court rulings (including a key one that Facebook itself caused), that's really not possible:

This week, we made you a tutorial explaining the torturous process by which you can change your Facebook preferences to keep the company’s “partners” from seeing all your friends’ data. But what many folks would really like to do is give you a tool that does it for you: go through the tedious work of figuring out Facebook’s inscrutable privacy dashboard, and roll that expertise up in a self-executing recipe — a piece of computer code that autopiloted your browser to login to Facebook on your behalf and ticked all the right boxes for you, with no need for you to do the fiddly work.

But they can’t. Not without risking serious legal consequences, at least. A series of court decisions — often stemming from the online gaming world, sometimes about Facebook itself — has made fielding code that fights for the user into a legal risk that all too few programmers are willing to take.

That's a serious problem. Programmers can swiftly make tools that allow us to express our moral preferences, allowing us to push back against bad behavior long before any government official can be convinced to take an interest — and if your government never takes an interest, or if you are worried about the government's use of technology to interfere in your life, you can still push back, with the right code.

So if we really, truly, want to deal with the problem, then we need to push for more control by the end users. Let users control and export their data, and let people build tools that allow them to do so, and to control and transparently understand what others do with their data.

If someone comes up with a "regulatory regime" that does that, it would be fantastic. But so far, nearly every suggestion I've seen has gone in the other direction. They will do things like force Facebook to "lock down" its data even more, making it harder for users to extract it, or for third parties to provide users the tools they need to control their own data. They'll put useless, but onerous, Know Your Customer rules that Facebook will be able to throw money at to solve, but every smaller platform will find incredibly costly.

I'm not optimistic about how all of this works out. Even if you absolutely hate Facebook and think the company is evil, doesn't care one wit about your privacy, and is run by the most evil person on the planet, you should be especially worried with the regulatory suggestions that are coming. They're not going to help. They're going to entrench Facebook and lock down your data.

Filed Under: data, elections, know your customer, openness, platforms, regulations, social media, transparency
Companies: cambridge analytica, facebook

AT&T Fails In Bid To Kill FTC Authority Over Broadband Monopolies

from the have-your-cake-and-eat-it-too dept

It can't be overstated that the broadband industry isn't just trying to kill net neutrality, it's trying to gut most meaningful federal and state oversight of entrenched telecom monopolies. While Ajit Pai dismantled consumer protections at the FCC, his "Restoring Internet Freedom" order also ironically attempts to ban states from holding ISPs accountable for privacy, net neutrality, or other anti-competitive behavior. With neither adult regulatory supervision or healthy organic competition in place to keep bad actors in line, the end result will likely be even worse behavior than the kind of Comcast shitshows we've grow used to.

But there's one part of this effort that just faced a notable setback.

Under Ajit Pai's (read: the broadband industry's) proposal, the FCC would take a step back from overseeing ISPs, ceding any remaining authority to the FTC. What Pai and his ISP friends didn't mention is that the FTC's authority over ISPs is severely limited, or that AT&T has spent the last four years in court trying to demolish what authority the FTC does have. That this would leave consumers almost entirely unprotected from monopoly behavior must have simply slipped Ajit Pai's mind during his endless sales pitches for his unpopular repeal.

AT&T's legal gambit began when the FTC sued AT&T back in 2014 for lying to customers about the company's throttling practices. You'll recall that AT&T had been waging a not-so-subtle war on unlimited data users as it tried to drive them to more expensive, metered plans. Amusingly, AT&T lawyers tried to argue in court that the company's "common carrier" status -- the same status it has fought viciously against on the net neutrality front -- exempted it from FTC authority almost entirely under Section 5 of the FTC Act. As we noted at the time, it was a very absurd and Schrodinger-esque tap dance.

At the time, the FTC issued a warning stating that should AT&T lawyers be successful, any company with a common carrier component (from Google to oil conglomerates) could tap dance around FTC oversight. Those without such components could simply buy or merge with a small company with a common carrier component to nab the same benefit. This, the FTC warned, would create a massive accountability and enforcement gap regarding corporate America:

"The panel’s ruling creates an enforcement gap that would leave no federal agency able to protect millions of consumers across the country from unfair or deceptive practices or obtain redress on their behalf. Many companies provide both common-carrier and non-common-carrier services—not just telephone companies like AT&T, but also cable companies like Comcast, technology companies like Google, and energy companies like ExxonMobil (which operate common carrier oil pipelines). Companies that are not common carriers today may gain that status by offering new services or through corporate acquisitions. For example, AOL and Yahoo, which are not common carriers, are (or soon will be) owned by Verizon. The panel’s ruling calls into question the FTC’s ability to protect consumers from unlawful practices by such companies in any of their lines of business."

Unfortunately for AT&T, things didn't work out that way. This week the US Court of Appeals for the 9th Circuit ruled (pdf) AT&T's dream scenario wouldn't be coming to fruition, and that the lawsuit against AT&T for lying to its customers would be moving forward:

"We affirm the district court’s denial of AT&T’s motion to dismiss. Looking to the FTC Act’s text, the meaning of “common carrier” according to the courts around the time the statute was passed in 1914, decades of judicial interpretation, the expertise of the FTC and Federal Communications Commission (“FCC”), and legislative history, we conclude that the exemption is activity-based. The phrase “common carriers subject to the Acts to regulate commerce” thus provides immunity from FTC regulation only to the extent that a common carrier is engaging in common-carrier services.

While an important win for FTC authority, it's important to note that on the broadband front this only retains the status quo: that is, the FTC's existing, flimsy oversight of broadband ISPs. And that oversight doesn't extend very far. Unlike the FCC, the FTC can't create new guidelines when needed, and can only act against broadband ISPs after the fact -- if it can be clearly illustrated that an ISP engaged in "unfair or deceptive" behavior. In the telecom sector, where anti-competitive behavior is often hidden behind claims of network security, that's often difficult.

That said, FCC boss Ajit Pai was quick to issue a statement (pdf) declaring that this was a win for consumers (correct, sort of), and that the FCC would be working closely with the FTC to protect net neutrality better than before (not correct, and extremely unlikely):

"The Ninth Circuit’s decision is a significant win for American consumers. Among other things, it reaffirms that the Federal Trade Commission will once again be able to police Internet service providers after the Restoring Internet Freedom Order takes effect,” said FCC Chairman Pai. “In the months and years ahead, we look forward to working closely with the FTC to ensure the protection of a free and open Internet."

Again, the FTC's authority over ISPs is extremely limited, and with no actual net neutrality rules to enforce it's comical to think this will be the equivalent of keeping real net neutrality rules (and FCC authority) intact. The throttling lawsuit aside, the FTC pretty rarely actually takes action against ISPs for oceans of bad behavior despite ample opportunity (most notably on the false advertising front). That's in part because the FTC's already under-funded and under-manned, and is tasked with overseeing everything from washer and dryer manufacturers to accuracy in bleach labeling.

So while this ruling is important in terms of ensuring the FTC can police bad actors generally, for the broadband industry specifically it simply means what little authority it has over ISPs remains intact. The shorter version: while uncompetitive broadband monopolies have been successfully gutting most federal and state oversight of their regional monopolistic fiefdoms, their attempt to eliminate all oversight won't be occurring just yet.

Filed Under: authority, fcc, ftc, net neutrality, oversight, regulations
Companies: at&t

Top EU Court Says Uber Is A Transport Service That Can Be Regulated Like Traditional Taxis

from the if-it-looks-like-a-duck,-swims-like-a-duck,-and-quacks-like-a-duck,-then-it-prob dept

Uber is a company that provokes strong emotions, as numerous stories on Techdirt indicate. Uber has been involved in some pretty bad situations, including inappropriate behavior, special apps to hide from regulators, and massive leaks of customer information. Despite this, it is undeniable that millions of people around the world love the convenience and competitive pricing of its service.

Equally, traditional taxi services dislike it for the way Uber flouts transports regulations that they obey, which is fair enough, and hate it for the way Uber challenges their often lazy monopolies, which is not. This has led to some appalling violence in some countries, as well as numerous legal actions. One of those, instituted by a professional taxi drivers' association in Spain, has resulted in a case before the EU's highest court (pdf), the Court of Justice of the European Union (CJEU), which has just ruled as follows:

the Court declares that an intermediation service such as that at issue in the main proceedings, the purpose of which is to connect, by means of a smartphone application and for remuneration, non-professional drivers using their own vehicle with persons who wish to make urban journeys, must be regarded as being inherently linked to a transport service and, accordingly, must be classified as 'a service in the field of transport' within the meaning of EU law.

The CJEU's reasoning was that Uber is more than a simple intermediation service. Its smartphone app is "indispensable" for the process of agreeing to deals between the driver and the customer, and Uber exercises "decisive influence over the conditions under which the drivers provide their service." As a result, the CJEU ruled that Uber is not "an information society service", but a "service in the field of transport", and may therefore be regulated just like traditional taxi services.

In practice, this means that Uber will be able to operate in the EU, but will be unable to continue with its swashbuckling approach that has seen it ignore many traditional requirements for taxi services. That result will be important for its knock-on effect on other services offered as part of the so-called "sharing economy". In fact, these are better described as new kinds of rental services, and like Uber they have often skirted around existing laws that cover their field of operation. The CJEU ruling, which can't be appealed, is likely to mean that other companies using online technology to provide such services will also need to obey relevant EU laws.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: cjeu, eu, regulations, ride sharing, taxi
Companies: uber