LONDON (AP) – Facebook CEO Mark Zuckerberg is promising to do a better job protecting user data following reports that a political consultant misused the personal information of millions of the company's subscribers. The fact is, European regulators are already forcing him to do so. A similar data breach in the future could make Facebook liable for fines of more than $1.6 billion under the European Union's new General Data Protection Regulation (GDPR), which will be enforced from May 25. The rules, approved two years ago, also make it easier for consumers to give and withdraw consent for the use of their data and apply to any company that uses the data of EU residents, no matter where it is based. The law is the latest attempt by EU regulators to rein in mostly American tech giants who they blame for avoiding tax, stifling competition and encroaching on privacy rights. European analysts say GDPR is the most important change in data privacy regulation in a generation as they try to catch up with all the technological advances since 1995, when the last comprehensive European rules were put in place. The impact is likely to be felt across the Atlantic as well. "For those of us who hold out no hope that our government will stand up for our rights, we are grateful to Europe," said Siva Vaidhyanathan, a professor at the University of Virginia who studies technology and intellectual property. "I have great hopes that GDPR will serve as a model for ensuring that citizens have dignity and autonomy in the digital economy. I wish we had the forethought to stand up for the citizen's rights in 1998 (the start of Google), but I'll settle for 2018." The US has generally taken a light touch approach to regulating internet companies, with concerns about stifling the technology-fed economic boom derailing President Barack Obama's 2012 proposal for a privacy bill of rights. But Europe has been more aggressive.EU authorities have in recent years taken aim at Google's dominance among internet search engines and demanded back taxes from Apple and Amazon. The European Court of Justice in 2014 recognised "the right to be forgotten," allowing people to demand search engines remove information about them if they can prove there's no compelling reason for it to remain. Now, data protection is in the crosshairs of the 28-nation bloc, where history has made the right to privacy a fundamental guarantee. Nazi Germany's use of personal information to target Jews hasn't been forgotten, and the new Eastern European members have even fresher memories of spying and eavesdropping by their former communist governments. In today's world, digital commerce companies collect information on every website users visit and every video they like. This data is the lifeblood of social media sites that give users free access to their services in exchange for the right to use that intelligence to attract advertisers. But the Facebook scandal shows it can also be used for other purposes. A whistleblower this month alleged that Cambridge Analytica improperly harvested information from over 50 million Facebook accounts to help Donald Trump win the 2016 presidential election. News reports have focused on the relationship between Cambridge Analytica CEO Alexander Nix, former Trump strategist Steve Bannon and billionaire computer scientist Robert Mercer, who bankrolled the operation. Cambridge Analytica says none of the Facebook data was used in the Trump campaign. Facebook is investigating. "The regulation is trying to balance the power between ourselves as individuals and organisations that use that data for a whole variety of services," said David Reed, knowledge and strategy director at DataIQ, a London-based firm that provides research on data issues.
