Down Arrow Button Icon

The European Union already has the world’s toughest data privacy laws, and has proven unafraid to hammer U.S. tech giants over their anti-competitive ways. But it seems that’s not enough.

The bloc’s incoming tech czar, Margrethe Vestager, said in a Friday speech that the EU may need “broader rules to make sure that the way companies collect and use data doesn’t harm the fundamental values of our society.”

What’s she driving at? Think disinformation and the Cambridge Analytica scandal.

The EU’s General Data Protection Regulation (GDPR) may protect people from companies misusing their personal data, she told a gathering of lawyers in Copenhagen, but the privacy law’s rules “don’t help me, if the problems come from the way that [companies] use other people’s data, to draw conclusions about me or to undermine democracy.”

“When platforms manipulate the way we see the world, in ways that we often don’t even notice, that affects our ability to understand the world around us. It can be hard for us to make good decisions, if we’re not confident of the facts. And that can stop our markets, and even our democracies, from working well,” Vestager warned.

Vestager has for the last five years been the EU’s competition commissioner, and is about to enter an unprecedented second term when Ursula von der Leyen’s new Commission begins work at the start of November. But the Dane will also become one of the Commission’s three executive vice presidents, with responsibility for making Europe “fit for the digital age.”

The melding of these two roles made it clear that von der Leyen wanted the EU to become more assertive in the digital realm. And now we can start to get an idea of what new rules will be involved.

Vestager’s speech likely referred to a new, not-yet-proposed law called the Digital Services Act, which von der Leyen referenced in her mission letter to Vestager. “I want you to coordinate the work on upgrading our liability and safety rules for digital platforms, services and products as part of a new Digital Services Act,” the Commission’s president-elect wrote.

Though details remain scarce, a Commission discussion document about this new legislation leaked a couple months ago. The intention seems to be for the new law to replace the EU’s 19-year-old eCommerce Directive, which broadly protects online platforms such as Facebook or YouTube from liability for the actions of their users.

That leaked document suggested that the new law could create new, EU-wide rules for forcing platforms to remove hate speech, and for further regulating political advertising. “Cross-border micro-targeted disinformation campaigns are easy to set up, but difficult to detect,” it read.

This appears to be a response to scandals such as that around Cambridge Analytica, where Facebook users’ data ended up in the hands of an organization that wanted to influence people’s behavior and political views with acutely targeted messaging. While Cambridge Analytica’s claims about what it could achieve were somewhat overblown, the potential impact of such tactics is very serious.

The U.K.’s privacy watchdog fined Cambridge Analytica last year over the privacy implications of its data-slurping, but warned at the time that there were “still bigger questions to be asked and broader conversations to be had about how technology and democracy interact and whether the legal, ethical and regulatory frameworks we have in place are adequate to protect the principles on which our society is based.”

It now seems that Vestager and the European Commission are gearing up to force that conversation.