In Ireland, where most of the major tech companies have European head offices for tax reasons, 19 statutory investigations have been started — 11 of which focus on Facebook, WhatsApp and Instagram.
The regulation has been cited as inspiration for other data rules globally, including in Japan, Brazil, India and China. And many American lawmakers have cited it as a model on which an American regulation could be based.
But there have also been unintended consequences: The G.D.P.R’s right to access has put reams of information in the hands of the wrong people, for instance, and its right to be forgotten has stopped people from fully exploring the histories of miscreants.
“What’s not so clear yet is whether G.D.P.R. has had an effect on privacy and on corporate data practices,” said Omer Tene, vice president and chief knowledge officer at the International Association of Privacy Professionals. “Has the underlying business model of the internet changed? Is consumer privacy better? I think those questions are very much still open.”
Facebook’s ‘many open questions’
This year, Mr. Zuckerberg has pitched his vision for a private Facebook. In theory, that looks like more sharing in private groups, ephemeral content and encryption by default on messaging.
As I’ve said, one thing is missing from the pitch: a business model. This past week, we got a glimpse into Facebook’s thinking, though, in a letter from its vice president of United States public policy, Kevin Martin, to Senator Josh Hawley, a Republican from Missouri and an outspoken critic of Facebook who raised questions about its privacy push.
Facebook said it planned to collect less data, keep it for less time and hide message content from itself. But there were some telling responses. Would it make inferences about encrypted messages from metadata? There are “many open questions” there. Share metadata around the company? “Outstanding questions.” How about its use of transaction data? “Information about transactions can be used for personalization,” Mr. Martin responded.