WEBVTT 00:00:02.520 --> 00:00:06.960 We're gonna start by having the panelists go down and introduce themselves talk a little bit 00:00:06.960 --> 00:00:12.960 about their work and what it has to do with EU US relations. So let's start with Sean. 00:00:12.960 --> 00:00:16.830 Well, good morning. I'm Sean Heather. I'm the Senior Vice President for international 00:00:16.830 --> 00:00:21.930 regulatory affairs at the US Chamber. I also cover antitrust and have been working for the 00:00:21.930 --> 00:00:29.160 last 10 or 15 years on US-EU related matters, going way back to the TEC, if you can remember 00:00:29.160 --> 00:00:34.500 that, which was a Bush - Merkel initiated initiative, and then more recently the T-TIP, 00:00:34.500 --> 00:00:35.640 and now the TTC. 00:00:38.090 --> 00:00:44.330 I'm Jen's Jeppesen, I represent Workday. I'm based in Brussels, Belgium and I look after 00:00:44.330 --> 00:00:50.090 Workday's policy and corporate affairs activities in the European region. It's a 00:00:50.090 --> 00:00:55.640 pleasure to be back in Washington, it's been more than two years, and that's a long time for 00:00:55.640 --> 00:01:02.270 somebody who's been working on transatlantic issues for for many years now. So thanks for the 00:01:02.270 --> 00:01:03.290 invitation. I appreciate it. 00:01:03.000 --> 00:01:08.790 Hello everyone, I'm Alex Greenstein, I'm director of the Privacy Shield program over at 00:01:08.790 --> 00:01:14.460 the Department of Commerce. I got into this through a little bit of a roundabout way. I 00:01:14.460 --> 00:01:21.090 worked for 19 years at the State Department on the, most recently, EU issues, and so ended up 00:01:21.090 --> 00:01:25.530 working on data privacy out in Brussels, and I was director for the European Union over at the 00:01:25.530 --> 00:01:30.570 White House, and then I was working on the National Economic Council doing tech policy, and 00:01:30.570 --> 00:01:35.640 then moved over to Commerce, and have been working on this, and we've been working 00:01:35.640 --> 00:01:41.100 assiduously on our negotiation of an enhanced Privacy Shield framework to restore stability to 00:01:41.100 --> 00:01:43.890 transatlantic data flows. 00:01:43.890 --> 00:01:51.750 And I'm Alina Polyakova, I'm President and CEO of the Center for European Policy Analysis. 00:01:51.750 --> 00:01:55.620 Is there an echo on the mic? Okay, we're good. 00:01:55.620 --> 00:01:59.100 As an institution, we work a lot on transatlantic issues. Obviously, Russia and 00:01:59.100 --> 00:02:03.600 Ukraine has been dominating a lot of our work more recently, but in particular, have been 00:02:03.600 --> 00:02:08.130 working for many years trying to understand how authoritarian states like Russia, China, and 00:02:08.130 --> 00:02:15.690 others, are trying to use basically Western companies to censor the kind of information that 00:02:15.690 --> 00:02:20.670 their populations are able to see, something that we call digital authoritarianism and, as 00:02:20.670 --> 00:02:25.110 part of that, how the transatlantic community should come together and respond. So, a lot of 00:02:25.110 --> 00:02:30.690 issues around the TTC now, obviously, broader questions about some legislative efforts in 00:02:30.690 --> 00:02:36.480 Brussels on the DMA and DSA, and how that hurts or helps transatlantic decision making, unity, 00:02:36.480 --> 00:02:39.630 and tech regulatory policy things. 00:02:39.630 --> 00:02:45.930 Thank you. With that, let's start right at the top with what's going on with Privacy Shield. I 00:02:45.930 --> 00:02:52.500 would love if Alex could give us a briefing of what's going on with negotiations, what we can 00:02:52.500 --> 00:02:56.730 expect to see in the next couple of months, and what some of the main sticking points are right 00:02:56.730 --> 00:02:57.870 now. 00:02:57.870 --> 00:03:02.160 Sure, thanks for having me, and this is definitely a priority for the Biden 00:03:02.160 --> 00:03:11.400 administration. It's something that really cuts to the heart of the transatlantic values and 00:03:11.400 --> 00:03:16.890 the importance of the transatlantic economy, as both the United States and the European Union, 00:03:16.890 --> 00:03:21.180 and the role it plays in the broader transatlantic relationship. So, a little bit of 00:03:21.180 --> 00:03:27.570 history lesson, we're dealing with the fallout from the Schrems II decision which was regarding 00:03:27.570 --> 00:03:32.850 data transfers from Europe to the United States using the standard contractual clauses however, 00:03:32.850 --> 00:03:38.160 and that's one of the EU Data transfer mechanisms that, because the European Union has 00:03:38.160 --> 00:03:43.950 a presumption that data should not be able to transferred overseas unless there is equivalent 00:03:43.950 --> 00:03:48.690 laws in some of the other country that's under the General Data Protection Regulation, their 00:03:48.690 --> 00:03:54.420 data privacy law, and so the United States and Europe have negotiated a series of sort of 00:03:54.420 --> 00:04:02.580 agreements on this issue to enable translate data transfers. However, on previous occasions, 00:04:02.580 --> 00:04:06.660 this has been struck down by the European Court of Justice regarding concerns about US 00:04:06.660 --> 00:04:13.110 government surveillance, and the availability of the limitations on that, but also the 00:04:13.110 --> 00:04:17.760 availability of redress for EU persons who are concerned that their data might have been 00:04:17.760 --> 00:04:21.160 inappropriately accessed. 00:04:21.160 --> 00:04:27.310 We negotiated an agreement a few years ago called the Privacy Shield framework that was 00:04:27.310 --> 00:04:33.310 struck down by the European Court. Now we are in the process of negotiating an enhanced privacy 00:04:33.310 --> 00:04:37.720 shield that would address the concerns raised by the Court of Justice and the Schrems II case. 00:04:39.970 --> 00:04:44.830 It's important to know that what we're negotiating is only about national security 00:04:44.830 --> 00:04:50.380 issues and government access to data. We're not revisiting the commercial elements, the 00:04:50.380 --> 00:04:55.360 framework which the court didn't have any issues with. It's important to note that this is 00:04:55.360 --> 00:05:01.180 something that is -- it needs to be dealt with between governments, because this is essentially 00:05:01.180 --> 00:05:07.300 about national security issues. What we're working to negotiate right now are something 00:05:07.300 --> 00:05:13.510 that threads the needle between what the European Court of Justice requires under 00:05:13.510 --> 00:05:20.590 European Human Rights Law, and fundamental rights, and then also sort of what is possible 00:05:20.590 --> 00:05:29.320 under the US Constitution, and then also what is, I guess I would say, advisable, given the 00:05:29.320 --> 00:05:34.360 national security commitments the United States has, and our need to protect the United States 00:05:34.360 --> 00:05:37.160 and our allies. 00:05:37.160 --> 00:05:44.750 I think, as we've seen recently, it's a dangerous world out there, and that reinforces 00:05:44.750 --> 00:05:55.940 the need for robust national security access to data, with appropriate limitations for 00:05:55.940 --> 00:06:01.160 protection of fundamental rights. That's what we're focused on right now, this has definitely 00:06:01.160 --> 00:06:07.790 been a little bit of a long haul. We definitely recognize that there has been a lot of 00:06:07.790 --> 00:06:13.040 instability in data transfers, and the companies are operating in an environment of uncertainty 00:06:13.040 --> 00:06:20.120 right now, about whether or not it's permissible to transfer data. That's why we and our partners 00:06:20.120 --> 00:06:27.140 in Europe are working to try to conclude this negotiation as quickly as possible, because we 00:06:27.140 --> 00:06:31.850 recognize that's having an impact on both US companies, but also European companies who want 00:06:31.850 --> 00:06:39.050 to be able to use US services, and also, to be honest, do business here and operate their 00:06:39.050 --> 00:06:43.010 operations and factories and things like that here in the United States. 00:06:43.010 --> 00:06:44.930 And can you give us any timelines? 00:06:47.030 --> 00:06:51.320 (sighs) It's a question I always get, and I can't really make any predictions, but we're 00:06:51.320 --> 00:07:01.190 definitely in the homestretch. Hopefully, we'll have good news soon, but I can't make any 00:07:01.190 --> 00:07:03.340 promises. 00:07:03.340 --> 00:07:09.880 Okay, let's move on to Sean for a little bit, and talk about some of the impact on businesses 00:07:09.880 --> 00:07:14.980 this uncertainty has had. What are you hearing from the business community on what it's like to 00:07:14.980 --> 00:07:21.370 wait on a new Privacy Shield, and not be sure if your standard contractual clauses will stand up, 00:07:21.370 --> 00:07:29.470 and how you're sort of feeling in the meantime? More broadly, can you speak to just the EU-US 00:07:29.470 --> 00:07:39.430 relationship, as the EU continues with new bills about data, AI, the DMA and the DSA, and how the 00:07:39.430 --> 00:07:44.740 US and the EU can align, when the EU is being so much more aggressive than the US is? 00:07:44.740 --> 00:07:49.750 Well, there's a lot there. Obviously, this is the State of the Net conference, you all know, 00:07:49.750 --> 00:07:56.530 more so than maybe anybody else I speak to, how important the flow of data across borders is. It 00:07:56.530 --> 00:08:01.930 is the lifeblood of the modern economy, and so it is natural for companies do want to find 00:08:01.930 --> 00:08:07.540 legal certainty and terms of being able to support those data flows. What is important, and 00:08:07.540 --> 00:08:12.310 what Ashley said, is that while a lot of the attention is on Privacy Shield, the court 00:08:12.310 --> 00:08:18.520 decision a year ago last July said that Privacy Shield needed to be struck down, but they put a 00:08:18.520 --> 00:08:23.230 giant question mark next to standard contractual clauses, and standard contractual clauses are 00:08:23.230 --> 00:08:25.300 the workhorse of data flows. 00:08:25.300 --> 00:08:30.280 Privacy Shield is important, its symbolic. lots of small and medium sized enterprises rely upon 00:08:30.280 --> 00:08:34.540 it. but when you look at the bulk of the data flowing between the United States and the EU, it 00:08:34.540 --> 00:08:39.400 flows underneath standard contractual clauses. This giant question mark, I think, has chief 00:08:39.400 --> 00:08:44.230 privacy officers and general counsels of major companies, both in Europe and the United States, 00:08:44.230 --> 00:08:49.660 kind of scratching their heads saying, What does this mean? And, effectively for the last 18 plus 00:08:49.660 --> 00:08:56.260 months, it has not meant that DPAs across Europe have brought judgments. We have not seen 00:08:56.260 --> 00:09:02.710 decisions coming down invalidating standard contractual clauses, but we do see signs that 00:09:02.710 --> 00:09:10.420 there are cases, that are in the system, and that those cases that are in the system are 00:09:10.420 --> 00:09:16.930 increasingly on borrowed time. They are not the kinds of decisions that the DPAs across Europe 00:09:16.930 --> 00:09:20.950 can continue to push off, they're going to be forced, I think, at some point this year to 00:09:20.950 --> 00:09:25.540 begin to make some determinations and decisions, and the question is, if standard contractual 00:09:25.540 --> 00:09:30.970 clauses are an invalid tool to transfer data between the United States and the EU, we have no 00:09:30.970 --> 00:09:33.230 legal mechanism by which to do so. 00:09:33.230 --> 00:09:38.870 So, the pressure is really on Alex, and you and the Biden ministration had made this a priority 00:09:38.870 --> 00:09:44.452 from day one. It was a seamless transition from the last administration to this. This is issue 00:09:44.452 --> 00:09:50.152 number one, as far as the Chamber is concerned, in the US-EU relationship, if we can't solve for 00:09:50.152 --> 00:09:55.792 this, there's no reason to have cooperation in the TTC. The entire TTC agenda, when you look at 00:09:55.792 --> 00:10:01.433 the 10 working groups, all has components about data and the ability to move data at its heart. 00:10:01.433 --> 00:10:03.020 So, this is job number one. 00:10:03.000 --> 00:10:09.420 I am optimistic. There are signs, for those who are watching this closely, that the EU 00:10:09.420 --> 00:10:14.910 understands the importance. I'm also optimistic that, sadly, because of the events of the last 00:10:14.910 --> 00:10:20.250 week or so, that there may be even a greater sense of concern and importance to ensure data 00:10:20.250 --> 00:10:24.420 flows between the United States and Europe. You would never want to say there's a silver lining 00:10:24.420 --> 00:10:29.400 to an invasion, but I do think that this has put a renewed emphasis on the importance of 00:10:29.400 --> 00:10:35.700 transatlantic ties. So, I am optimistic that we might see, and I'm not in the negotiating room, 00:10:35.700 --> 00:10:40.800 I'm not at the table, but I feel like we have a chance to see something maybe mid spring, late 00:10:40.800 --> 00:10:46.470 spring, early summer, that would be the window, which I'm watching right now. 00:10:46.470 --> 00:10:52.050 Switching gears. You said, the state of transatlantic relations? Most people think about 00:10:52.050 --> 00:10:58.080 the US-EU relationship, and they talk about the economic relationship. When you do that, in most 00:10:58.080 --> 00:11:04.200 cases, people think about trade, the US trading partners. But the US-EU relationship is 00:11:04.200 --> 00:11:10.920 different, it's really a relationship based off investment. It's very unique. We have trillions 00:11:10.920 --> 00:11:14.970 of dollars of US investment in Europe, there are trillions of dollars of EU investment in the 00:11:14.970 --> 00:11:19.620 United States. There is no other economic relationship in the world that is built on 00:11:19.620 --> 00:11:23.970 investment first. It's because of that investment we trade with each other. I think 00:11:23.970 --> 00:11:28.620 it's still true today that there is more US investment in Ireland than there is US 00:11:28.620 --> 00:11:33.780 investment in China. That shows you just how significant the relationship is. 00:11:33.780 --> 00:11:39.450 Why do I say that? Well, when we've seen past dialogues between the US and EU, I think there 00:11:39.450 --> 00:11:44.610 has been kind of this sense of hope springing eternal, which I think is today's title for the 00:11:44.610 --> 00:11:50.130 conference, or at least this session of the conference. My view is this, the US and the EU 00:11:50.130 --> 00:11:57.450 have been cohabitating, but never got married. We have this deep relationship that we have 00:11:57.450 --> 00:12:04.020 become comfortable with each other, and when we tried under the T-TIP to formalize that through 00:12:04.020 --> 00:12:10.380 an actual marriage, folks didn't like that too much. So, we're now back, through the TTC, at a 00:12:10.380 --> 00:12:15.720 negotiating table. My concern, about the way in which these negotiations are set up, is almost 00:12:15.720 --> 00:12:21.330 every issue on the TTC agenda, Europe has decidedly put out its markers as to where it 00:12:21.330 --> 00:12:26.010 wants to go on AI, where it wants to go on competition policy, where it wants to go on data 00:12:26.010 --> 00:12:29.940 policy, and there's not much to negotiate. 00:12:29.940 --> 00:12:35.250 There may be conversations we can have on cooperation vis-a-vis China, on cybersecurity, 00:12:35.250 --> 00:12:40.350 some of the other agenda items, but on the core regulatory issues that are going to govern data 00:12:40.350 --> 00:12:45.120 governance and the digital economy, Europe has decided the path they want to pursue, and I 00:12:45.120 --> 00:12:50.700 don't think it is interested in listening to the United States, or discussing where the United 00:12:50.700 --> 00:12:55.530 States has views, and unless Europe is going to sit down and have conversations like that, I 00:12:55.530 --> 00:12:58.830 think the TTC is gonna have a rocky agenda. 00:12:58.830 --> 00:13:05.490 We're definitely gonna get back to that, but I want to make sure that Jens here could talk 00:13:05.490 --> 00:13:11.460 about what Privacy Shield means to companies like Workday, companies of similar sizes, and 00:13:11.460 --> 00:13:18.390 just the view from Brussels. Why do you think Brussels has such an intention to set these 00:13:18.390 --> 00:13:24.960 rules for the world, and to take a leading role here, and get these bills passed? And what does 00:13:24.960 --> 00:13:30.060 it ultimately mean for relations with the US, and whether they can lead together against 00:13:30.060 --> 00:13:32.850 authoritarian countries? 00:13:32.850 --> 00:13:34.560 How much time do I have? (laughs) 00:13:34.560 --> 00:13:35.130 A couple of minutes. 00:13:35.000 --> 00:13:44.030 A broad question, but beginning with the Privacy Shield and data flows. Workday is a provider of 00:13:44.030 --> 00:13:50.450 software applications for enterprises across a whole range of different industries, from 00:13:50.450 --> 00:13:59.720 banking to automotive, manufacturing, energy, etc, etc, pharmaceuticals, we have something 00:13:59.720 --> 00:14:06.680 like half of the of the Fortune 500 amongst our customers. Many of those companies are European 00:14:06.680 --> 00:14:13.520 headquartered, so we have more than 725 EU headquartered companies that use our services. 00:14:13.520 --> 00:14:20.480 These are world leading companies, and they need, just like American companies do, to manage 00:14:20.480 --> 00:14:28.010 and optimize data flows across borders to run their operations seamlessly across the globe, 00:14:28.010 --> 00:14:39.470 really. Sometimes the issue has been framed as really focused on social media companies and 00:14:39.470 --> 00:14:48.680 their use of data. This is really not the case, this cuts across all industries. It cuts across 00:14:48.680 --> 00:14:54.070 large companies and small companies as well, it's important to note. 00:14:54.070 --> 00:15:02.770 Following the Schrems II decision in July 2020, we had European organizations putting out data 00:15:02.770 --> 00:15:11.170 to demonstrate the impact of Schrems II, and the uncertainty that that has created on European 00:15:11.170 --> 00:15:22.120 businesses. It cuts across all sectors, and it cuts across all sizes of companies. We see small 00:15:22.120 --> 00:15:31.960 companies, in particular, have been extremely reliant on the Privacy Shield. They now have to 00:15:31.960 --> 00:15:39.940 use standard contractual clauses. This is a very difficult process for a small company to manage, 00:15:39.940 --> 00:15:48.580 and they require a lot of legal assistance to be able to make this work. This is really issue 00:15:48.580 --> 00:15:57.130 number one for the EU-US relationship at this point. I think, like Sean, we're super excited 00:15:57.130 --> 00:16:05.710 about the TTC, we think there is an absolute need for Europe and the US to work productively 00:16:05.710 --> 00:16:12.370 across all of these areas. I think this current geopolitical situation, that we have been 00:16:12.370 --> 00:16:20.230 learning with for the past number of months, just emphasizes the importance of that. It is 00:16:20.230 --> 00:16:26.620 really, really essential that Europe and the US try to see eye to eye on as many of these issues 00:16:26.620 --> 00:16:34.780 as possible, understanding that there will be differences in how countries legislate. EU 00:16:34.780 --> 00:16:40.210 countries choose -- have, to some extent, some different values that express themselves in 00:16:40.210 --> 00:16:46.330 different policy choices from the US. That's normal. But, you do have to ensure that there's 00:16:46.330 --> 00:16:51.020 as much cooperation and alignment as at all possible. 00:16:51.020 --> 00:16:58.640 To your question about, why does Europe move ahead so aggressively with legislation and 00:16:58.640 --> 00:17:07.010 policy in this space? Taking European politicians at their own word, they sometimes 00:17:07.010 --> 00:17:14.990 frame it this way, they say, in this global technology industry. that is technology 00:17:14.990 --> 00:17:21.260 services and products that are integrated, not only in the way we work, but in our private 00:17:21.260 --> 00:17:30.290 lives, education, healthcare, etc, etc, that they choose a road where they've taken a 00:17:30.290 --> 00:17:38.750 proactive approach to regulating, rather than seeing a more market led development, where 00:17:38.750 --> 00:17:44.780 technologies evolve and get deployed, and then you try to deal with issues as they come up. 00:17:44.780 --> 00:17:52.280 This is, I would say, a deliberate choice of European politicians, that has advantages and 00:17:52.280 --> 00:17:56.960 disadvantages. But that's, at a very high level, how the situation. 00:17:56.000 --> 00:17:58.580 Thank you. And that brings us to Dr. Polyakova, I'm so happy to have you here today. There seems 00:17:58.580 --> 00:18:04.490 to be a lot of agreement on this panel that having an EU-US relationship over data flows, 00:18:04.490 --> 00:18:16.940 and anything on the Internet, digital, is important for the geopolitical sphere. As we've 00:18:16.940 --> 00:18:21.860 seen the past couple of days, the Internet is very involved in what's going on right now. We 00:18:21.860 --> 00:18:27.980 have both Russia and Ukraine making demands of American Internet companies to either invalidate 00:18:27.980 --> 00:18:35.510 accounts or to de-monetize accounts. Do you, in your view, think it is important for the EU and 00:18:35.510 --> 00:18:41.900 US to be aligned on all these issues, to be able to deal with the greater geopolitical problem? 00:18:41.900 --> 00:18:45.960 Or, is there room for some divergence between the two countries? 00:18:45.960 --> 00:18:50.520 Well, thank you so much for your question, Ashley. I love going last, because I have an 00:18:50.520 --> 00:18:55.590 opportunity to respond to what everyone else has already said. I actually just wanted to pick up 00:18:55.590 --> 00:19:01.890 on where Jens left off, on my we have seen a real divergence in the approach between, 00:19:01.890 --> 00:19:06.660 certainly in Brussels and Washington, when it comes to the tech regulatory agenda more 00:19:06.660 --> 00:19:11.370 broadly. I think, of course, Privacy Shield is very much at the center of it. I couldn't agree 00:19:11.370 --> 00:19:14.970 more that, unless we have agreement on Privacy Shield, then what is the point in the TTC, 00:19:14.970 --> 00:19:19.350 really? Because how are we going to make any forward momentum there, if we don't have the 00:19:19.350 --> 00:19:26.400 basic agreements on data flows. The TTC is set to meet sometime in May, mid May, now in Paris. 00:19:26.400 --> 00:19:30.870 It's been very unclear what the accomplishments have been, and where the agenda is actually 00:19:30.870 --> 00:19:31.350 heading. 00:19:33.880 --> 00:19:37.870 What I've noticed over the last several years working on these issues is just a very different 00:19:37.870 --> 00:19:45.640 lens for understanding the geopolitics of technology in Brussels and Washington. In the 00:19:45.640 --> 00:19:50.290 European perspective, a lot of that focuses on individual data protection and privacy, in the 00:19:50.290 --> 00:19:55.450 United States the lens is much more about national security. It's very difficult, when I 00:19:55.450 --> 00:20:00.160 go to Brussels or other European countries, to make the point that this is about national 00:20:00.160 --> 00:20:05.980 security, and that we have to prioritize that. What's happening today, certainly, with the 00:20:05.980 --> 00:20:14.800 renewed Russian war in Ukraine, lends just much more credibility to that perspective, that 00:20:14.800 --> 00:20:20.110 number one priority, while data protection individualized is deeply important, but not when 00:20:20.110 --> 00:20:24.940 it goes against our broader transatlantic security. 00:20:27.420 --> 00:20:34.230 It's been very concerning to see what has been a freight train of a regulatory agenda coming from 00:20:34.230 --> 00:20:38.790 Brussels, which, by the way, doesn't fully represent the views of the European member 00:20:38.790 --> 00:20:42.870 states themselves. There's actually quite a bit of divergence, certainly, with some central 00:20:42.870 --> 00:20:47.850 Eastern European countries, the Baltic states, and elsewhere, from what has become a very 00:20:47.850 --> 00:20:53.580 French and German driven agenda on the tech regulatory side. There's a tendency to see 00:20:53.580 --> 00:20:59.400 things like the DMA and the DSA, and the AI act and all these things we see coming out from 00:20:59.400 --> 00:21:04.320 Brussels, as representative of the European perspective, but, in reality, it's not 00:21:04.320 --> 00:21:09.030 necessarily. There are a lot of smaller companies that aren't being classified as 00:21:09.030 --> 00:21:14.700 gatekeepers, medium-sized companies in places like Scandinavia, they have a very active tech 00:21:14.700 --> 00:21:20.580 market, have some concerns, that they don't want to clamp down on US companies just to be 00:21:20.580 --> 00:21:22.710 replaced by French companies. 00:21:22.710 --> 00:21:30.240 There's a lot of divergence on how the European laws that we're going to see enacted in the next 00:21:30.240 --> 00:21:35.970 several weeks here, most likely, are going to affect the European ability to compete. The big 00:21:35.970 --> 00:21:42.480 question for Europe, and this goes back to, again, about why has Europe taking this 00:21:42.480 --> 00:21:47.520 leadership role on the tech regulatory agenda, even though most of the companies really talking 00:21:47.520 --> 00:21:52.020 about are not European companies. I think the reason for that is because there's a real fear 00:21:52.020 --> 00:21:58.050 of being left behind. Obviously, the US still leads on technology innovation, and China is 00:21:58.050 --> 00:22:03.610 actively aggressively competing there, so what is really Europe's role? 00:22:03.610 --> 00:22:09.250 European policymakers have carved out regulation -- sometimes, unfortunately, in the service of 00:22:09.250 --> 00:22:14.770 regulation versus the service of innovation -- as their leadership in the world, part of their 00:22:14.770 --> 00:22:19.870 leadership portfolio. This is where Europe sees its ability to have impact in the world, through 00:22:19.870 --> 00:22:24.910 norms, international standards, etc, but I agree that it's probably a little too early for that, 00:22:24.910 --> 00:22:30.400 because some of this technology is still very nascent. I think now that we look back, look at 00:22:30.400 --> 00:22:34.750 what's been happening in Russia, and China's also part of this dynamic, but to zoom in on 00:22:34.750 --> 00:22:40.750 Russia a little bit, deeply concerning developments about how the the Russian 00:22:40.750 --> 00:22:47.980 government has been using and abusing western tech platforms in the service of digital 00:22:47.980 --> 00:22:51.260 censorship, in the service of digital authoritarianism. 00:22:51.260 --> 00:22:54.740 Just over the last several days, we've really seen a combination, or what has actually has 00:22:54.740 --> 00:22:59.780 been a years long effort by the Kremlin, to force companies to comply with increasingly 00:22:59.780 --> 00:23:06.290 draconian local laws, the so called new landing law, as it's called, that is affecting basically 00:23:06.290 --> 00:23:10.190 all companies, social media, broader tech companies, platforms that are operating in 00:23:10.190 --> 00:23:17.750 Russia, and de facto making them much more vulnerable to things like detaining, arresting 00:23:17.750 --> 00:23:24.020 employees of these firms if they don't comply with these draconian laws. They're demanding the 00:23:24.020 --> 00:23:30.740 takedown of content that is truthful content, which, of course, companies have been resisting 00:23:30.740 --> 00:23:34.760 for a long time, and it's important to know, paying a lot of fines. But you know, at some 00:23:34.760 --> 00:23:40.700 point, I think they come to a question of, do we want YouTube in Russia still, and of course, 00:23:40.700 --> 00:23:45.200 YouTube, for example, has been the only reason why Russian opposition voices or independent 00:23:45.200 --> 00:23:51.560 voices have had any avenue for expression in a deeply state controlled environment, or do these 00:23:51.560 --> 00:23:56.540 companies just pull out, and basically cede this information environment completely to the 00:23:56.540 --> 00:24:01.520 authoritarian state? I think it's a really difficult situation that firms find themselves 00:24:01.520 --> 00:24:09.140 in. It really should be the prerogative of the US government and European leaders to stand up 00:24:09.140 --> 00:24:15.440 for democratic values of free expression, and to support and push back on some of these very 00:24:15.440 --> 00:24:19.880 aggressive authoritarian tactics that we see deployed, but right now, the companies are kind 00:24:19.880 --> 00:24:24.410 of left in the lurch a little bit to figure out for themselves. 00:24:24.410 --> 00:24:31.910 Yeah, absolutely. It sort of brings me back to this idea that abroad, the Biden administration, 00:24:31.910 --> 00:24:36.680 similar to the Trump administration, they're in the position of defending their own tech 00:24:36.680 --> 00:24:42.530 companies to foreign governments that wish to tax them, or put regulations that seem to be 00:24:42.530 --> 00:24:49.040 focused just on the biggest US companies, but at home, they want to regulate them themselves. 00:24:49.040 --> 00:24:55.520 Maybe you could speak a little bit to this tension, that the US government seems to defend 00:24:55.520 --> 00:25:00.740 our companies abroad, but at home there's a pretty robust competition agenda going on, and a 00:25:00.740 --> 00:25:06.200 desire to have more content moderation and more privacy, not saying we've passed many laws, but 00:25:06.200 --> 00:25:10.500 there are many efforts. Can you speak to that tension? 00:25:10.500 --> 00:25:17.190 Sure, there are three things you raised there. One is this competition policy question, which 00:25:17.190 --> 00:25:23.340 is more akin to the DMA, you have a conversation there about federal privacy law, and then you 00:25:23.340 --> 00:25:28.380 have a conversation about content moderation, which, for the most part in the US, is a debate 00:25:28.380 --> 00:25:34.920 about 230. In the competition lane and the pure competition lane, I don't see the Biden 00:25:34.920 --> 00:25:40.200 administration fundamentally having a different position abroad, from what they have at home. 00:25:40.200 --> 00:25:44.400 The administration has made it clear that they do not support the DMA, as drafted, they've made 00:25:44.400 --> 00:25:50.280 it clear to the Europeans that there's a variety of things that need to change. At home, the 00:25:50.280 --> 00:25:57.840 domestic legislation that is most furthest advanced in the Senate, the administration has 00:25:57.840 --> 00:26:04.530 not put out a statement of administrative support for that. In fact, you see large amounts 00:26:04.530 --> 00:26:08.520 of folks on the Democrat side of the aisle who have deep concerns with the way in which that is 00:26:08.520 --> 00:26:11.410 drafted, which is very similar to the DMA. 00:26:11.410 --> 00:26:16.510 Where I think you have tension in the administration is, what should regulation look 00:26:16.510 --> 00:26:20.830 like in this space? There, I don't know that they have an answer, they know what they don't 00:26:20.830 --> 00:26:26.020 like, but I'm not sure they know what they do like. So, when they put their opposition out 00:26:26.020 --> 00:26:30.370 there to Europe on the DMA, when they had withheld their full support for what's happening 00:26:30.370 --> 00:26:35.470 here at home, I think that's entirely consistent. What one should do about platform 00:26:35.470 --> 00:26:41.170 regulation is where I think the administration is still trying to figure out what makes sense, 00:26:41.170 --> 00:26:45.190 what would look like good regulatory practices, how much of this should happen as a matter of 00:26:45.190 --> 00:26:50.500 antitrust law versus regulation? In the United States, we're trying to do it as an amendment to 00:26:50.500 --> 00:26:55.000 our antitrust laws. In Europe, they've decided not to amend their antitrust laws and do it as a 00:26:55.000 --> 00:26:59.740 matter of regulation. These kinds of questions, I think, are very much still unanswered with the 00:26:59.740 --> 00:27:01.020 Biden ministration. 00:27:01.020 --> 00:27:06.150 When you move to the privacy space, obviously, as Alex said, the debate among US- EU is not 00:27:06.150 --> 00:27:10.260 about whether or not we have adequate protections for privacy in the United States 00:27:10.260 --> 00:27:15.540 from a commercial standpoint, the Europeans accept it, but we in the business community 00:27:15.540 --> 00:27:20.820 don't want 50 state-based regulations, we want to see a federal privacy solution, the Chamber 00:27:20.820 --> 00:27:26.070 is very much in favor of that. I think the administration is very much in favor of that. I 00:27:26.070 --> 00:27:32.430 think the details are oftentimes associated with how you construct things like private rights of 00:27:32.430 --> 00:27:38.010 action, and what happens when it comes to to a violation. All of that will take some time to 00:27:38.010 --> 00:27:42.300 sort out, but I think there is a common agenda there. Certainly, I think Europeans would 00:27:42.300 --> 00:27:46.110 welcome a federal privacy law. There's lots of European investment, as I said, in the United 00:27:46.110 --> 00:27:52.170 States, they don't want to have 50 state privacy frameworks by which to address. 00:27:52.170 --> 00:27:58.350 In the third area, which is this content moderation debate. This is the one where I think 00:27:58.350 --> 00:28:04.950 it's the toughest to figure out what is a legislative or regulatory path forward. 00:28:04.950 --> 00:28:11.190 Obviously, you have clear requirements under our constitution for free speech, but we also know 00:28:11.190 --> 00:28:17.130 that you can't yell fire in a crowded theater. What is the online version of that has yet to be 00:28:17.130 --> 00:28:23.130 figured out -- whether that is figured out over time as a matter of common law, or courts, or 00:28:23.130 --> 00:28:28.470 whether that's figured out by the United States Congress. We're a long way from having that 00:28:28.470 --> 00:28:34.950 answer, but the urgency is clear. It's not only being sorted out in Europe through their efforts 00:28:34.950 --> 00:28:39.630 with what they call their DSA, but I see dozens of countries around the world who are putting 00:28:39.630 --> 00:28:44.880 content moderation frameworks in place. Many of those are within authoritarian governments who 00:28:44.880 --> 00:28:50.370 are dictating terms, what is legal content versus illegal content. When you look at these 00:28:50.370 --> 00:28:55.530 regimes, it's very unclear. Companies are left to try to decide for themselves how to interpret 00:28:55.530 --> 00:29:01.740 the law, and then the ways in which they must comply in many cases are completely unreasonable 00:29:01.740 --> 00:29:08.190 and outright crazy. So, that space is the one that, both from a policy standpoint as well as 00:29:08.190 --> 00:29:14.850 from civil society and the business community, is where I think there is the most room to 00:29:14.850 --> 00:29:17.280 figure out what the path forward is. 00:29:17.280 --> 00:29:23.160 Again, on the competition piece, I think the administration is clear on their opposition to 00:29:23.160 --> 00:29:27.960 both approaches, but they're not clear on is what the right approach should be. 00:29:27.960 --> 00:29:29.610 Does anybody else have anything to add? 00:29:29.000 --> 00:29:33.440 Yeah, if I could just chime in there, specifically on the content piece, because I've 00:29:33.440 --> 00:29:38.780 been working on issues around your counter disinformation efforts for too many years, I'd 00:29:38.780 --> 00:29:44.780 like to admit. One of the things that we have to really pay close attention to is the precedent 00:29:44.780 --> 00:29:49.820 setting nature, which I think Sean was just alluding to, some of the legislation that we see 00:29:49.820 --> 00:29:54.710 emerging, talking about online harms and not really defining what that means, talking about 00:29:54.710 --> 00:30:00.410 illegal content. Basically, some of the European proposals have been copied and pasted by 00:30:00.410 --> 00:30:05.090 countries like Russia into their own law, and now the very same language is being used to 00:30:05.090 --> 00:30:11.000 repress and oppress independent voices saying that this extremist content is illegal content, 00:30:11.000 --> 00:30:15.410 that there's online harms in certain content, which is of course, truthful content. So, it's 00:30:15.410 --> 00:30:19.880 being used in the service of censorship and repression, rather than what they're supposed to 00:30:19.880 --> 00:30:21.710 be used as. 00:30:21.000 --> 00:30:21.720 Did you have something to add, Alex? 00:30:21.000 --> 00:31:35.070 Yeah. that is a very good point. Having observed EU-US discussions purely on privacy, but also on 00:30:21.600 --> 00:30:27.643 This is where we also hit this real problem -- we haven't talked about this yet -- around 00:30:27.643 --> 00:30:33.889 concepts like digital sovereignty as well. This is the same concept that the Beijing uses to 00:30:33.889 --> 00:30:40.269 talk about their desire to control the online space. This concept has also become pervasive in 00:30:40.269 --> 00:30:46.648 the European debate. And so, I think my question is, where did the values come in here? If the 00:30:46.648 --> 00:30:52.827 United States and Europe are divided on the tech agenda front, then we'll be divided on the 00:30:52.827 --> 00:30:59.072 values front. I think we need to start really pushing our governments to not leave companies 00:30:59.072 --> 00:31:05.586 just out there fighting the large authoritarian states on their own. It's long overdue. Frankly, 00:31:05.586 --> 00:31:12.033 I think the current situation is just so deeply disturbing .Hopefully, I think there's a silver 00:31:12.033 --> 00:31:18.413 lining, hopefully the unity we're seeing right now between Europe and the United States in the 00:31:18.413 --> 00:31:24.524 response to Russia will be channeled into greater cooperation on this particular agenda as 00:31:24.524 --> 00:31:24.860 well. 00:31:35.070 --> 00:31:40.110 tech policy more broadly, One of the things is that there can be a little bit of an excessive 00:31:40.110 --> 00:31:46.410 focus on, I would say, the instrumentalities of how to implement policy, and the differences 00:31:46.410 --> 00:31:53.130 that we have there. That can sometimes obscure the fundamental sameness of our values. That's 00:31:53.130 --> 00:32:01.140 something that really both sides could stand to work through, is looking more at how we 00:32:01.140 --> 00:32:06.930 implement our policies and practice, and how that reflects our fundamental values. 00:32:06.000 --> 00:32:11.580 The example I'm thinking of here is in terms of privacy, certainly we have different approaches 00:32:11.580 --> 00:32:20.970 to it, but from the United States standpoint, we argue that it's not a decision between privacy 00:32:20.970 --> 00:32:25.890 and security, you can have both of those things, but you just need to have the right policies and 00:32:25.890 --> 00:32:29.580 approaches in place. We're trying to dig into that. 00:32:29.000 --> 00:32:35.300 One of the things is -- it's gets less attention than Privacy Shield, but -- there are 00:32:35.300 --> 00:32:40.400 discussions now at the Organization for Economic Cooperation and Development about what are the 00:32:40.400 --> 00:32:45.560 appropriate safeguards and limitations on government access to data? Really, this is 00:32:45.560 --> 00:32:49.970 bringing together practitioners from the national security communities in Europe and the 00:32:49.970 --> 00:32:54.470 United States, along with people who are responsible for fundamental rights, and looking 00:32:54.470 --> 00:32:59.180 really deeply into what are the best practices around sort of government surveillance, and 00:32:59.180 --> 00:33:03.770 we're finding there's a lot of commonalities there. Certainly, we have different legal 00:33:03.770 --> 00:33:08.750 systems in Europe and the United States, but when it comes down to it, the values that 00:33:08.750 --> 00:33:15.440 underpin them are quite similar, and you find a lot of best practices. That does give me some 00:33:15.440 --> 00:33:21.770 hope for this moving forward, that we have sort of more in common than we have different, and 00:33:21.770 --> 00:33:29.210 then also the current crisisdoes focus minds on that a little bit. That's my two cents. 00:33:29.190 --> 00:33:38.002 Yeah, thanks Alex, that makes a lot of sense. I recall, Ambassador Bill Kennard saying in 00:33:38.002 --> 00:33:46.912 meetings that, with the EU and the US, it was the narcissism of small differences. I think 00:33:46.912 --> 00:33:55.823 it's a pretty apt observation, given that the policy issues that are being debated and the 00:33:55.823 --> 00:34:04.733 values that underpin them are so similar, whilst the institutional setup and the political 00:34:04.733 --> 00:34:13.447 dynamics are different. You mentioned the Franco-German locomotive is back on track, the 00:34:13.447 --> 00:34:21.378 French-German locomotive of European integration. After Brexit there's a big UK 00:34:21.378 --> 00:34:29.995 shaped hole in the Union, where there was a push or pull towards open trade, restrained 00:34:29.995 --> 00:34:36.360 intervention in markets and so on, and so we really see that now. 00:34:36.360 --> 00:34:46.020 The digital sovereignty concept that you mentioned, President Macron likes to talk about 00:34:46.020 --> 00:34:53.100 strategic autonomy. We currently have the French presidency of the of the Union, and this has 00:34:53.100 --> 00:35:01.800 been an incredibly strong narrative that runs across all kinds of policy areas. Just one quick 00:35:01.800 --> 00:35:14.130 example, there are cybersecurity standards being developed for the entire EU. That's entirely 00:35:14.130 --> 00:35:22.320 sensible to have that cybersecurity framework for a cloud services across the EU to replace 00:35:22.320 --> 00:35:29.460 national standards. Brilliant idea. But what the French have tried to do is to introduce what 00:35:29.460 --> 00:35:37.920 they called sovereignty requirements, so that certain parts of the cloud services market can 00:35:37.920 --> 00:35:44.850 only be serviced by European companies, with maximum percentage of foreign ownership, with no 00:35:44.850 --> 00:35:54.330 involvement of non-EU staff, with strict data localization requirements in place. So, we're 00:35:54.330 --> 00:36:03.780 seeing this political narrative now really being reflected in different policies across across 00:36:03.780 --> 00:36:09.690 the sphere, and in a way that is probably actually actively harmful to what the 00:36:09.690 --> 00:36:17.640 cybersecurity framework seeks to put in place, because what you do not want is to have it such 00:36:17.640 --> 00:36:22.890 that European organizations, public sector organizations, or companies, cannot use the best 00:36:22.890 --> 00:36:29.160 possible cybersecurity technologies in the market. So, there's a lot of work for us to do 00:36:29.160 --> 00:36:29.760 on this. 00:36:32.070 --> 00:36:37.200 If you look at the way things are going, it seems though data sovereignty and this 00:36:37.200 --> 00:36:43.920 balkanization of the Internet is happening all over the world in Russia, China, India, US, 00:36:43.920 --> 00:36:50.040 Europe, how do we sort of come together and have a free and open Internet again, where every 00:36:50.040 --> 00:36:53.520 country doesn't have different rules, and the Internet doesn't look a little different 00:36:53.520 --> 00:36:58.200 depending on where you are? Is there a coming back to that? Or have we gone too far? 00:37:01.360 --> 00:37:07.630 I can start us off there, if you don't mind Ashley. We don't have free and open Internet on 00:37:07.630 --> 00:37:12.280 a global level anymore, and we just don't live in that reality. I mean, go to China, go to 00:37:12.280 --> 00:37:18.760 Russia, go to Myanmar, obviously. At this point, we are in a position, unfortunately, having to 00:37:18.760 --> 00:37:26.410 defend the free and open democratic online space. This is exactly where the squabbles over 00:37:26.410 --> 00:37:33.880 details are deeply unproductive, and go against the broader strategic agenda of making sure 00:37:33.880 --> 00:37:40.000 we're all on the same place. Because we have to defend that space, we have to defend the ability 00:37:40.000 --> 00:37:46.960 of people to have access to truthful information, a variety of sources. Companies big 00:37:46.960 --> 00:37:52.600 and small play a deep and huge role in that. My concern about things like sovereignty, and 00:37:52.600 --> 00:37:57.940 conversations, especially on cloud services and other issues, are deeply concerning, because 00:37:57.940 --> 00:38:05.590 it's just reinforcing the splinternet model in a different sector. We have to really shift 00:38:05.590 --> 00:38:10.300 lenses, because if we keep moving in this direction, we're just going to reinforce the 00:38:10.300 --> 00:38:15.940 authoritarian vision of the online world, and it's not the vision, I think, that many of us 00:38:15.940 --> 00:38:22.870 here share, or that many individuals would like to be a part of, frankly. That's the big issue 00:38:22.870 --> 00:38:29.980 today, whether we can move away from -- the EU wants to lead on regulation, and we can put 00:38:29.980 --> 00:38:35.740 innovation on the backbench there, where we are on competition policy, etc, etc, -- we do align 00:38:35.740 --> 00:38:41.770 on the bigger, broader principles. We have to come back and compromise, and a lot of that 00:38:41.770 --> 00:38:47.200 compromise has to happen in Brussels, because they have been so much further along on setting 00:38:47.200 --> 00:38:52.690 out their demands and their agenda, and the US has been lagging behind there, and hasn't been 00:38:52.690 --> 00:38:56.890 as engaged in some of these issues until the current administration. So, there's a lot of 00:38:56.890 --> 00:38:58.210 work we have to do. 00:38:58.210 --> 00:39:03.580 I don't want to, you know, raise the alarm bells too much, but we're in a really bad place right 00:39:03.580 --> 00:39:10.600 now. We have to move really, really quickly to ensure that what we still have, that we're going 00:39:10.600 --> 00:39:11.920 to have for future generations. 00:39:16.220 --> 00:39:22.430 I'll just build off of what you were talking about. I think the one area where we risk 00:39:22.430 --> 00:39:31.310 atomization or fragmentation is artificial intelligence. The EU has moved forward with 00:39:31.310 --> 00:39:42.560 legislation last year, a very broad and ambitious piece of legislation, it's early 00:39:42.560 --> 00:39:51.890 stages yet, yet it has a number of very sensible components that I think will find a receptive 00:39:51.890 --> 00:40:01.610 audience on the US side. However, it is not clear that it will hit the right balance between 00:40:01.610 --> 00:40:08.990 the dual objectives, which are to create an ecosystem of excellence and innovation, as well 00:40:08.990 --> 00:40:15.500 as an ecosystem of trust, and a vibrant market for trustworthy AI applications. 00:40:18.660 --> 00:40:25.890 Talking about -- back to the TTC, we would very much encourage the US government to be as 00:40:25.890 --> 00:40:33.780 engaged as possible, and as forward leaning as possible, in terms of dialogue with EU 00:40:33.780 --> 00:40:42.900 policymakers in this space. The regulation is going to set out technical standards for 00:40:42.900 --> 00:40:48.870 compliance, the worst outcome would be if we have a set of standards coming out of Europe 00:40:48.870 --> 00:40:54.660 that are then not compatible with what NIST, for example, has been working on here, something 00:40:54.660 --> 00:41:03.000 that Workday has really supported. So, if we can use the TTC to facilitate alignment and 00:41:03.000 --> 00:41:09.630 interoperability, and these two pieces docking together nicely, I think that would would be the 00:41:09.630 --> 00:41:11.280 best outcome for all of us. 00:41:11.280 --> 00:41:16.020 Yeah, I think you really put your finger on it, in terms of the word that I always focus on, 00:41:16.020 --> 00:41:23.850 interoperability. We don't have to have all the same laws and approaches on the Internet, but we 00:41:23.850 --> 00:41:28.860 do need to ensure that they work nicely together, and that there are ways to build 00:41:28.860 --> 00:41:34.350 bridges. That's essentially what Privacy Shield was about, you had an EU law that functioned 00:41:34.350 --> 00:41:39.300 differently than US laws, but you had enough US law in that space that you could make an 00:41:39.300 --> 00:41:43.980 argument that, if you add some things to it, it is essentially equivalent. That's kind of the 00:41:43.980 --> 00:41:49.740 spirit that we're looking at, is finding ways to work together, and that also gets to the issue 00:41:49.740 --> 00:41:54.840 of trust, and trusting that, yes, other systems may look somewhat different but, since we 00:41:54.840 --> 00:42:00.750 operate on the same values, that we can accept that that will probably get you to the right 00:42:00.750 --> 00:42:02.020 place. 00:42:02.020 --> 00:42:08.230 If the question was, where are we headed? I think the answer is, we are not. We are in a 00:42:08.230 --> 00:42:12.880 state of fragmentation, the question is how much more fragmented we become. If you listen to part 00:42:12.880 --> 00:42:18.730 of the last session with Congressman McCaul, he talked about essentially decoupling with China 00:42:18.730 --> 00:42:23.050 when it comes to technology, the importance of export controls, the importance of not allowing 00:42:23.050 --> 00:42:28.930 tech transfer for national security concerns. If Europe decides to take a maximalist approach in 00:42:28.930 --> 00:42:35.590 terms of divergence with the United States, on DMA, on DSA, on AI, on the cloud -- we haven't 00:42:35.590 --> 00:42:40.840 even talked about the Data Act, which just was put out last week, which is entirely an effort 00:42:40.840 --> 00:42:45.400 to say, look, we're going to redefine what the definition of data ownership means, what it 00:42:45.400 --> 00:42:50.470 means for B2B business relationships for data, we're going to compel the sharing of data, which 00:42:50.470 --> 00:42:55.780 is a property right, fundamentally. If Europe decides to go down completely divergent paths 00:42:55.780 --> 00:43:00.280 from the United States, we are talking about a decoupling between the United States and the EU 00:43:00.280 --> 00:43:02.950 on digital economy policy. 00:43:02.950 --> 00:43:07.000 When I heard you lay out the cloud stuff, I said to myself, are we talking about France and 00:43:07.000 --> 00:43:10.750 Europe, or are we talking about China? The idea that you're only going to have a certain amount 00:43:10.750 --> 00:43:15.490 of local content, you're going to only allow certain amount of foreign direct ownership into 00:43:15.490 --> 00:43:21.160 a space, these are the tools China has used, that have caused the challenges we have today in 00:43:21.160 --> 00:43:25.810 the US-China trade relationship. And so, to the degree to which Europe is headed down that same 00:43:25.810 --> 00:43:31.270 path, we will end up in a position of decoupling. That's going to be very difficult 00:43:31.270 --> 00:43:36.580 when you look at, again, where I started, our relationship has been built on investment, we 00:43:36.580 --> 00:43:42.100 have invested deeply in each other's markets. That investment is something that American 00:43:42.100 --> 00:43:46.690 businesses are interested to continue to make additional investments in, and European 00:43:46.690 --> 00:43:51.610 businesses are interested in making additional investments here in the United States. So, we 00:43:51.610 --> 00:43:58.060 need to figure out how to get around the table at the TTC and work on these issues, but we do 00:43:58.060 --> 00:44:03.520 have some serious challenges, given where Europe has decided to set out its agenda, and where we 00:44:03.520 --> 00:44:06.340 stand today in these conversations in the United States. 00:44:08.620 --> 00:44:13.540 Since we have Dr. Polyakova here, and there's so much going on with the Russian invasion of 00:44:13.540 --> 00:44:18.580 Ukraine, I just want to ask you, what has been sort of the most striking thing to you, in the 00:44:18.580 --> 00:44:25.450 past week or so, that you've seen online having to do with the social media companies, Russia, 00:44:25.450 --> 00:44:32.620 Ukraine, and the attempts at censorship and even just a lot of the misinformation we're seeing? 00:44:32.620 --> 00:44:36.230 Has anything been particularly shocking to you or different? 00:44:36.230 --> 00:44:42.410 Well, it depends what the relative starting point is for shock, right? I think we're in a 00:44:42.410 --> 00:44:47.810 much better place than we were, for example, in 2014 when Russia invaded Crimea and eastern 00:44:47.810 --> 00:44:53.780 Ukraine, which is when I started working in disinformation issues, where the Russian 00:44:53.780 --> 00:44:57.860 narratives were really propagating into Western media, and they were being spread very widely on 00:44:57.860 --> 00:45:02.840 social media. Then we saw her own ability to really grasp the importance of that, then, of 00:45:02.840 --> 00:45:07.500 course, came to us here in the United States in 2016, and then elsewhere. 00:45:07.500 --> 00:45:12.570 I've seen how companies have actually learned a huge deal over the last eight years, and have 00:45:12.570 --> 00:45:18.990 been quite active in removing content, fact checking content, and this has really been a 00:45:18.990 --> 00:45:22.860 thorn in the Kremlin side. One of the big conflicts that we've seen emerge in the last 00:45:22.860 --> 00:45:28.560 week was our fact checking, and Meta's policy effect of fact checking content, labeling 00:45:28.560 --> 00:45:32.130 content, and the Russian government demanded they stop doing this, or they're going to 00:45:32.130 --> 00:45:36.630 basically start limiting access to their platforms in Russia. They have been doing that, 00:45:36.630 --> 00:45:41.310 and then only partially complying with this. Again, I think companies have been trying to 00:45:41.310 --> 00:45:47.160 push back. One interesting development has also been the European Union now banning Russian 00:45:47.160 --> 00:45:52.170 state sponsored media outlets, like RT, Sputnik, and others. My understanding is that the 00:45:52.170 --> 00:45:58.230 companies are following the EU now, I guess, proposed law on this, and that's been a really 00:45:58.230 --> 00:46:00.800 positive development. 00:46:00.800 --> 00:46:06.110 The big question is, there are companies like TikTok, where are they going to go? Platforms 00:46:06.110 --> 00:46:12.680 that are operating in these authoritarian states, but are not necessarily as concerned 00:46:12.680 --> 00:46:17.420 about issues around false misleading information? I think we have to ask ourselves, 00:46:17.420 --> 00:46:24.290 do we want our children to be using Facebook or Instagram or TikTok, when we're talking about 00:46:24.290 --> 00:46:30.290 control of false information? It's been a much better situation, I think governments have, 00:46:30.290 --> 00:46:34.400 especially the US government has, been very effective on the broader information messaging 00:46:34.400 --> 00:46:40.700 side. Certainly Ukrainian, certainly people in Central Eastern Europe, are much, much more 00:46:40.700 --> 00:46:49.700 aware of disinformation, and have a much more critical lens on it. To be fair, or to be honest 00:46:49.700 --> 00:46:57.320 I should say, it's been really depressing to watch, as well, how deeply penetrating the 00:46:57.320 --> 00:47:02.900 Russian state propaganda has been in Russian society, which, again, is why go back to the 00:47:02.900 --> 00:47:08.120 point of, we have to fight to maintain freedom of access of information in these authoritarian 00:47:08.120 --> 00:47:13.910 states while we can, because that window is closing. The majority of Russians, despite the 00:47:13.910 --> 00:47:17.780 very brave and courageous Russians who have been protesting the war, and getting arrested and 00:47:17.780 --> 00:47:22.160 thrown in, and beat up and all these things last, last several days, that's still a 00:47:22.160 --> 00:47:29.240 minority. The reason for that is because most people are buying the state narrative, and why? 00:47:29.240 --> 00:47:33.410 Because they don't have access to other information, they're watching state sponsored 00:47:33.410 --> 00:47:39.110 media, because that is the mainstream media, and that is the dominant information source for many 00:47:39.110 --> 00:47:43.430 Russians. We see what that leads to. 00:47:43.430 --> 00:47:47.750 It's a better situation that companies have learned. Unfortunately, I don't think 00:47:47.750 --> 00:47:52.520 governments have learned as much, because we still don't have just a basic regulatory 00:47:52.520 --> 00:47:57.560 framework that will give companies some guidance on what they should or should not be doing. I'm 00:47:57.560 --> 00:48:03.890 not talking about things that we were talking about earlier, but just some basic guidance. Now 00:48:03.890 --> 00:48:08.870 we have companies doing all kinds of different things, as they have been for many, many years, 00:48:08.870 --> 00:48:14.390 and it's also creating a lot of loopholes. Twitter may be able to remove something, but 00:48:14.390 --> 00:48:20.180 Facebook is not, and etc, it goes on like that. That is really limiting our ability to counter 00:48:20.180 --> 00:48:25.850 disinformation and false narrative on the online space, but I do think things are better than 00:48:25.850 --> 00:48:26.600 they used to be. 00:48:26.600 --> 00:48:32.300 Yeah, just last night, Meta announced that they took down a coordinated and authentic activity 00:48:32.300 --> 00:48:39.200 attempt, but it reached far fewer people than it -- maybe even, whatever, a couple years ago -- 00:48:39.200 --> 00:48:45.890 nothing like what we saw in 2016 with the US election, it was a much smaller impact. A lot of 00:48:45.890 --> 00:48:50.030 what me and my colleagues have been seeing in the past couple of days is, it's not so much the 00:48:50.030 --> 00:48:55.400 sophisticated online disinformation campaigns, it's just regular people going online and 00:48:55.400 --> 00:49:01.280 retweeting something that isn't from the current conflict, or was a picture taken out of context, 00:49:01.280 --> 00:49:06.140 or just something that was totally unrelated, but you got a bunch of people rallying in 00:49:06.140 --> 00:49:11.690 support of Ukraine to retweet it. We see a lot of confusion there, too. So, the companies are 00:49:11.690 --> 00:49:17.060 in a tough position, you'd like to see the support for Ukraine, and all of the retweets and 00:49:17.060 --> 00:49:23.090 the interactions we're seeing, but even some of this positive content or pro-democracy content 00:49:23.090 --> 00:49:29.450 is not accurate. So, there's a lot to unpack there. I just want to make sure before we wrap 00:49:29.450 --> 00:49:36.380 up, if anybody had anything else to add broadly about Privacy Shield, anything we missed. And 00:49:36.380 --> 00:49:38.630 you said in a week, right? 00:49:38.630 --> 00:49:40.550 Next week, it's done. Yeah. 00:49:40.550 --> 00:49:40.580 (laughs) 00:49:40.580 --> 00:49:41.030 Totally. 00:49:43.850 --> 00:49:45.500 Did you want to add anything? 00:49:45.500 --> 00:49:52.580 Well, I think it's just worth pointing out that this is a very concrete concern, the Privacy 00:49:52.580 --> 00:49:59.840 Shield, but behind that sits this whole other dimension of EU-US issues in the technology 00:49:59.840 --> 00:50:06.740 space, and looking at the geopolitical situation that we're in right now, this ought to focus the 00:50:06.740 --> 00:50:16.430 mind in terms of forging, really productive cooperation, on this in the very short term, and 00:50:16.430 --> 00:50:21.650 on the other issues going forward. That should be something to strive for. 00:50:21.650 --> 00:50:27.290 I know that's definitely our hope. I can say that, in these negotiations, we have really 00:50:27.290 --> 00:50:32.360 strong partners in the European Commission. We have worked with them on these issues for a long 00:50:32.360 --> 00:50:38.750 time, and I can say definitely, over the years, we have developed a shared language, and they've 00:50:38.750 --> 00:50:44.330 developed a deeper understanding of our approaches on surveillance policy, and there's 00:50:44.330 --> 00:50:50.240 definitely a mutual understanding and a lot of goodwill there. I think that's only growing, and 00:50:50.240 --> 00:50:53.550 so that makes me optimistic. 00:50:53.550 --> 00:50:59.040 Well, on that optimistic note, we will wrap up today's panel, and thank you guys very much for 00:50:59.040 --> 00:50:59.640 joining us.