Enhanced Privacy Duties for Dominant Technology Companies
47 Rutgers Computer & Tech. L.J. 1 (2021)
103 Pages Posted: 20 Aug 2020 Last revised: 3 Jun 2021
Date Written: February 8, 2020
Abstract
This paper explores two case studies in order to extract the elements of a legislative approach in the United States for stronger privacy regulation for dominant technology companies. The Federal Communication Commission’s now-repealed broadband privacy rules required broadband companies to obtain opt-in consent for data use beyond what was needed for providing broadband service. In an abuse of dominance case, the German Federal Cartel Office required Facebook to get separate affirmative consent from its users for combining third-party and affiliate data with data from its own social network service.
Informed by these two cases, this paper outlines a new privacy law for dominant technology companies in the United States. It would establish enhanced privacy duties for dominant technology companies to ensure that the consumer interest in effective data protection is vindicated in a context where consumers are less able to exercise their general privacy rights. It develops several economic factors to test whether a company is dominant in its line of business and covers companies providing search, social media, online retailing and video exchange services. The paper proposes that such dominant technology companies would need to have a legal basis for their data use and describes consent, contractual necessity and legitimate interest as three possible bases. In addition, dominant technology companies would not be allowed to use unreasonably deceptive, abusive or dangerous designs, as described in Woodward Hartzog’s recent work. Furthermore, they would be required to satisfy enhanced duties of information fiduciaries as outlined in Jack Balkin’s work. The law would also impose restrictions on data sharing with service providers and affiliates and hold open the possibility of banning specific data uses.
The law would put in the hands of an industry-specialist regulatory agency the authority to take into account the specified factors to determine when a technology company was dominant and so subject to enhanced privacy duties. The specialist agency would also be authorized to write and enforce implementing regulations in connection with the requirements specified in the legislation.
Keywords: privacy, data protection, dominant companies, technology, digital platforms
Suggested Citation: Suggested Citation