3 hours ago
4
Europe is hurtling toward digital vassalage. Under Ursula von der Leyen, the European Commission president, EU laws to tackle tech giants have been either not applied or delayed, for fear of offending Donald Trump. Now leaked documents reveal that the European Commission plans to gut a central part of Europe’s digital rulebook. This will hurt Europe’s innovators and hand the future of Europe’s tech sovereignty to US firms.
Once Europe’s most hyped law, the General Data Protection Regulation (GDPR) is now on the chopping block. Powerful forces within the European Commission, supported by the German government, hope that deregulation will boost Europe’s tech sector, particularly AI. This is a grave mistake.
China’s DeepSeek, which has stunned the AI world over the past year, emerged under a legal regime far stricter than Europe’s. China’s rigorous pre-deployment rules appear to have done its world-beating AI innovation no harm.
Europe’s problem is not that it has too many rules for AI, but that it hypes those rules and then neglects to enforce them. This is why Google, Meta, Microsoft et al dominate Europe’s market. Documents revealed in a US court show a vast free-for-all of data inside Meta: it uses information that people give it for one service, such as social media, to prop up unrelated parts of its business, including its most invasive ad targeting. This allows Meta, and other similar companies, to build cascading monopolies that dominate sector after sector.
Meta’s data free-for-all violates GDPR’s commonsense “purpose limitation principle”: when you hand over data for one purpose, it cannot automatically be used for some other unrelated purpose. Enforcing just this one GDPR principle would effectively break up every giant US tech firm. The GDPR has many other principles that also have the power to upend these firms’ operations. Yet chronic under-enforcement in Europe has allowed them to entrench their domination, leaving no space in the market for European innovators to scale up their offerings.
Instead of correcting this strategic mistake, the commission plans to water down GDPR. One proposed change would allow companies to claim that their AI training data is legal, freed from the GDPR’s more rigorous requirements to prove it. This permissiveness would allow Google, Meta, OpenAI and Microsoft to legitimise years of ill-gotten data gains, and make it utterly impossible for European competitors to catch up. Instead, the US firms should be forced to comply with the law as it is written.
Another proposed change would weaken the protection of people’s most intimate data. Because social media algorithms rely on such “special category” data, but use them improperly, this change would leave children across Europe more exposed to the dangerous algorithms of TikTok, Snapchat and YouTube, which can push self-hate, self-harm and suicide in to their feeds. Again, enforcement rather than deregulation is the answer.
The commission rightly frets that Europeans are plagued by nuisance consent pop-ups. Here too, enforcement is the answer. Proper application of GDPR against online advertising technology firms would do away with the vast data breach at the heart of the industry. Consent pop-ups would become largely obsolete.
The changes are themselves legally fraught. Much of what the commission is planning is contrary to the EU’s charter of fundamental rights and rulings from Europe’s top court. The commission also intends to use an inappropriate procedural manoeuvre, in order to skip the required impact assessments and skirt around the democratic scrutiny that the reforms would receive at the European parliament.
GDPR is Europe’s greatest weapon against digital oligarchy, child harm and foreign political interference. Diluting it now, in the shadow of Donald Trump, would confirm Europe as a digital vassal of the US, a playground where US firms remain unassailably dominant and where US interests overrule European standards and values.
The commission should push key EU member states to enforce GDPR. The most important is Ireland, because the largest US tech firms have their European headquarters there (except for Amazon, which is in Luxembourg). Ireland’s enforcement record is dismal, and it recently appointed an ex-Meta lobbyist as a data protection commissioner. But there is a way to force Ireland – via a vote at the European Data Protection Board – to start applying GDPR to these firms fully and proportionately.
Enforcing Europe’s data rules would not only protect our democracies and children from nasty algorithms, it would also disrupt big tech’s cascading monopolies across Europe. Crucially for Europe’s competitiveness, this is what would create the space for European tech SMEs and startups to scale up everywhere in Europe.
after newsletter promotion
When considering the future of Europe’s privacy laws, the commission would do well to treat big tech’s claims about AI and its requests for deregulation with more scepticism.
This week, 73 scientists wrote to von der Leyen demanding that she retract her budget speech statement that AI would achieve human reasoning by 2026. Prudence demands the commission be more careful about changing its laws for what may be a dangerous speculative bubble. The fact is that large language models remain deeply unprofitable: in the last year they generated an estimated $235bn, but cost an estimated $1.5tn to develop and run.
Policy should not be driven by a dogmatic faith that deregulation will always and inevitably liberate innovation. GDPR enforcement against giant US firms is the solution to the problems identified by the commission. It is easy to sympathise with the commission’s motivations, but they must be pursued by more prudent means. Europe should also do more to protect its democracy from being undermined by US social media algorithms. But its new “democracy shield”, now leaked, has no new measures to do so. In this moment of crisis, Europe should not cripple its best weapon against US tech dominance, but enforce its laws, defend its sovereignty, create the space for innovation, and prove that democracy can tame Silicon Valley.
-
Johnny Ryan is director of Enforce, a unit of the Irish Council for Civil Liberties. Georg Riekeles is the associate director of the European Policy Centre
