‘Techlash’, responsible innovation, and the self-regulatory organization

ABSTRACT

In 2018, major social media companies became the focus of a ‘techlash’ in America. The business practices of Facebook, Google, Amazon, and Twitter came under intensive media and U.S. government scrutiny on a range of troubling issues, including wielding monopoly power, facilitating fake news, violating consumer privacy, and involvement in Russian disinformation campaigns during the 2016 U.S. Presidential election. An alternative private ordering approach to incorporating responsible innovation is proposed in lieu of public regulation: the self-regulating organization (SRO). A recent HarrisX poll found that only 31% of U.S. adults believe that the federal government is capable of regulating large technology companies; this provides an opportunity for the tech industry to develop an effective SRO. Yet, to be successful it will require a high degree of organizational transparency and accountability, and trade-offs made among the competing values of various industry stakeholders, including consumers, government representatives, small tech companies, civil society organizations and advocacy groups.

KEYWORDS:

• Entertainment Software Rating Board
• Financial Industry Regulatory Association
• responsible innovation
• self-regulating organization
• techlash

Introduction

In his January 2018 ‘State of American Business Address’, Thomas Donohue, president and CEO of the U.S. Chamber of Commerce, warned that ‘a backlash against major tech companies is gaining strength – both at home and abroad, and among consumers and governments alike’ (Neidig 2018). Like others in the tech industry, Donahue is concerned that ‘“techlash” doesn't result in broad regulatory overreach that stifles innovation’ that is ‘improving people's everyday lives’ (Neidig 2018). Arguably, 2018 went on to become the year of ‘techlash’ in America and elsewhere. The business practices of Facebook, Google, Amazon, and Twitter have come under intensive media and U.S. government scrutiny on a range of troubling issues, including accusations of wielding monopoly power, facilitating fake news, violating consumer privacy, and their involvement in the Russian disinformation campaigns during the 2016 U.S. Presidential election campaign.

The prospects for U.S. federal regulation of internet and communication technology firms should not be underestimated. The 115th Congress scheduled hearings in late October and early November 2017 with executives of Facebook, Google and Twitter concerning the tech industry's involvement in the 2016 Presidential election. All three companies subsequently announced new policies to improve transparency over who is buying political ads on their social media platforms and what messages they are promoting. Further, in April 2018, Facebook CEO Mark Zuckerberg appeared before Congress over the manipulation of his company's consumer user data by malicious third parties, including by Cambridge Data Analytics during the 2016 U.S. Presidential election cycle.

During the Senate hearing, Zuckerberg indicated that he would support federal regulation of his company, and Senator Amy Klobuchar (D-Minn.) and Senator John Kennedy (R-La.) have taken Zuckerberg up on his support for further regulation, jointly introducing S. 2728, the Social Media Privacy Protection and Consumer Rights Act of 2018. Bill S. 2728 is intended to ‘protect consumers’ online privacy and data by improving transparency, strengthening consumers’ recourse options when a data breach occurs, and ensuring companies are compliant with privacy policies that protect consumers’ (Kennedy 2018; Klobuchar 2018).¹

However, an alternative to public regulation of the tech industry that emerged earlier in 2018 should also be given a hearing, whether as a compliment to, a substitute for, or a hybrid form of public regulation.

The Case for Responsible Innovation

‘The time has come to seriously consider a responsible approach to innovation [in the tech industry]’, says Shelly Palmer, CEO of the Palmer Group, a well-known strategic marketing advisory firm to the technology and media industry (Palmer 2018b). Along with contributors David Sapin, principal U.S. advisory risk and regulatory leader at PwC, and Rob Morrow, principal at PwC Connected Solutions, Palmer presented their formal proposal, ‘The Case for Responsible Innovation’, at the 2018 Consumers Electronics Show in Las Vegas (Palmer 2018b). Noting, ‘the tech industry has come under pressure as concerns mount about potential negative impacts of innovation’, Palmer (2018b) questions the political and practical basis for ‘new government regulation’ as a response to this pressure.

Palmer (2018b) propose three basic approaches to regulating technological innovation:

• Government Regulation. The traditional approach is to have government policy makers and regulators step in and implement a regulatory regime that addresses policy concerns of privacy, public safety and national security.

• Self-Regulation. This approach asks individual companies to consider the societal impact of their technologies before those technologies emerge in the marketplace. This approach often falls under the category of ‘corporate social responsibility’, and it can cover anything from environmental protection to addressing sexual harassment in the workplace.

• Self-Regulatory Organization. A self-regulatory organization (SRO) for emerging technologies would consist of the leading organizations in the industry coming together to define responsible innovation principles that all members of the SRO would agree to abide by. The SRO would also oversee and regulate compliance with those principles, levy fines, and refer any violations to a federal regulatory agency, such as the Federal Trade Commission.

Palmer (2018b) are critical of the ‘government regulation’ approach because it moves too slowly to stay abreast of technological innovations; they also caution that policy makers (and their staffs) often lack the technological understanding or efficient procedures to implement regulatory regimes in a timely manner. Likewise, ‘self-regulation’ is reactive in nature, as a company response occurs only after the problem arises and several missteps raises the stakes, bringing unwanted attention to the company. In addition, with this regulatory approach there is an inherent commercial conflict when an individual company agrees to self-regulate, e.g. as a company is in the business of making money for their shareholders, and in many highly competitive industries new technologies must rapidly enter the marketplace to assure long-term financial success for the firm (see also Brand and Blok 2019).

Instead, Palmer (2018b) supports the ‘self-regulatory organization’ (SRO) governance solution to responsible innovation: ‘The collective industry, more so than any think tank, regulatory agency, or policy-making body, has the insight, technical knowledge, and incentive to create workable principles for responsible innovation’. While the authors acknowledge that there will be initial resistance from policy makers to the SRO approach, they believe that they will quickly grasp that ‘this is a far more thoughtful, efficient, and effective approach to ensuring responsible technological innovation’ (Palmer 2018b). The authors also recognize a role for some level of government oversight, which will allow policy makers ‘to influence the policy direction of the new innovation SRO and provide any necessary enforcement’ (Palmer 2018b).

Real world SRO examples

Unlike other concepts that are unlikely to receive a fair hearing in a business context (see Brand and Blok 2019), the concept of a tech industry SRO is a reasonable, market-based departure point to begin a discussion of ‘responsible innovation’ in the governance of the tech industry. In addition, there are arguably real world examples of such SROs operating in other industries. For instance, Palmer (2018b) argue that this regulatory approach has worked in the financial services industry, where the private Financial Industry Regulatory Association (FINRA) regulates trading in equities, corporate bonds, securities futures, and options. All firms dealing in securities and not regulated by another SRO, such as by the Municipal Securities Rulemaking Board, are required to be member firms of FINRA (Johnson 2007). The formation of FINRA resulted from the tech industry consolidation of the regulation, enforcement and arbitration operations of the New York Stock Exchange, Inc., NYSE Regulation, Inc., and the National Association of Security Dealers (NASD) (Johnson 2007).

Wong (2017) suggests that the tech industry emulate the Entertainment Software Rating Board (ESRB). The ESRB, established by the Entertainment Software Association in 1994, is the non-profit SRO that assigns ratings for video games and apps to help parents make informed choices for their children (Entertainment Software Rating Board 2018). Its rating system encompasses guidance about age appropriateness, content, and interactive elements of video games and apps (Entertainment Software Rating Board 2018). The ESRB also enforces industry-adopted advertising guidelines and helps ensure responsible online and mobile privacy practices among companies participating in its Privacy Certified program (Entertainment Software Rating Board 2018). The FTC approved ESRB in 2001 as a ‘safe harbor’ under the Children's Online Privacy Protection Rule (Federal Trade Commission 2001).

The FINRA example departs from Palmer's conception of an SRO, however. Burton (2017) notes that FINRA is governed by a 23-member board, which consists of 12 public governors, ten board members who are financial service industry governors, and the organization's CEO. Given that by definition an SRO regulates itself, the fact that FINRA has only 10 of 23 governors who are industry representatives means that the financial services industry does not control FINRA, and is not an SRO (unlike the ESRB), but a quasi-private regulatory organization with minority (43%) industry representation.

Prospects for a tech industry SRO

The development of an effective SRO will be a challenge for the tech industry, but if the threat of intrusive public regulation in the U.S. and elsewhere emerges as a valid concern, it is more likely to evolve as a viable alternative. The ESRB, for example, was a response to the Video Games Rating Act of 1994 to avoid federal regulations imposed on the industry (Wong 2017). However, at the time there was a strong public consensus that the video gaming industry needed further regulation of its product content. In contrast, the results of recent surveys of American consumers on their impressions of social media companies offers a slightly declining but overall generally positive image of the industry (Springboard 2018).

For example, a Pew Research Center (2018) poll from a January 2018 survey of online U.S. adults finds that 88% of respondents believe that the internet has ‘mostly been a good thing’ personally, while 70% find the internet has been ‘mostly a good thing’ for society. Likewise, a HarrisX (2018) poll of U.S. adults, released in April 2018, finds that 70% of U.S. adults believe that tech companies have a positive impact on their daily lives, while 68% believe they have a positive impact on society. An April 2018 Wall Street Journal/NBC News poll (Hook 2018) of U.S. adults finds that 51% of respondents believe that social media platforms are either regulated sufficiently (37%) or are regulated too much (14%) – with 37% believing they are regulated too little (Wall Street Journal 2018). While these survey results appear to indicate strong for the tech industry, there are specific issues that do concern U.S. consumers.

Thus, in the HarrisX (2018) poll 64% of respondents believe that technology companies should be legally responsible for the content they carry on their system, while 83% believe there should be tougher regulations and penalties for breaches of data privacy. Importantly, while 53% believe the federal government should regulate large technology companies as they do big banks, only 31% believe that the federal government is capable of regulating them. Lastly, 62% of survey respondents thought the federal government would take steps to regulate the tech industry this year or within the next few years.

Yet tech companies will not have to wait for additional U.S. government regulation. California Governor Jerry Brown signed the California Consumer Privacy Act of 2018 into law on 28 June 2018. In addition, on a much greater scale, the European Union enacted the General Data Protection Regulation (GDPR), effective as of 25 May 2018 (Palmer 2018a). Companies who collect and manage this data are responsible for protecting it from misuse and exploitation, and respect the rights of data owners or face financial penalties for violations. The GDPR applies to any organization operating within the EU, as well as any organizations outside of the EU that offer goods or services to customers or businesses in the EU. U.S. tech companies now face a new public regulatory environment, as the GDPR becomes a de facto global regulation for these firms.

Whether as a complement to, or a substitute for, new U.S. regulation of the tech industry that could be enacted over the next few years, the establishment of an SRO would require developing an industry-wide consensus on acceptable RI principles and compliance mechanisms. Given the American public's doubts of the federal government's capability of providing effective regulation, the tech industry has an opportunity to develop a convincing SRO proposal. At the same time, given the growing debate over the Trump administration's active push for deregulation, the likelihood of significant regulation of the tech industry in the short term is highly uncertain – thus possibly affording the tech industry time to develop an effective SRO that could demonstrate responsiveness to consumer and regulator concerns. Two important conditions concerning SRO effectiveness arise from the very different contexts of the market, on the one hand, and civil society, on the other.

One important consideration is a thesis argued by Macey and Novogrod (2012): the success of industry self-regulation critically depends on the market power of the firms in the SRO. Thus, if the firms (making up the SRO) have market power, and as long as the industry generates profits for members, self-regulation can work. Nevertheless, if either profitability or market power decline, self-regulation can be an effective governance mechanism. Clearly, Google and Facebook remain viable in this respect, having captured 91% of online search market share, with Amazon having some 70% of the e-book sales (Verbruggen 2017). As long as the major players (such as Google, Facebook, and Amazon) remain profitable, maintain market power (without violating antitrust statutes pertaining to anti-competitive practices,) and are active members of a proposed tech industry SRO, Macey and Novogrod’s (2012) thesis for an effective SRO is met.

Another important aspect of developing an effective SRO is to include civil society organizations, advocacy groups, and public citizens, representing additional stakeholders affected by tech companies’ products and services.² This tracks a responsible innovation concept that ‘denotes an orientation towards anticipation, inclusiveness, responsiveness, and reflexivity concerning science and technology and innovation processes more broadly’ and encourages ‘a democratic governance of innovation’ (van Oudheusden 2014, 68). The independent voice of such ‘extended peer review’ – which goes beyond a ‘pallid consensus’ of industry insiders that encourages echo chambers, filter bubbles, blind spots, and market failures – will arguably improve the long-term sustainability of the tech industry and the broader American society.³ As Sarewitz (2011, 7) notes: ‘a vigorous disagreement between experts would provide decision-makers with well-reasoned alternatives that inform and enrich discussions as a controversy evolves, keeping ideas in play and options open’.

The tech industry SRO concept proposed by Palmer et al., in spite of FINRA's inclusion of non-industry members as governance partners, may indeed have the ‘insight, technical knowledge, and incentive to create workable principles for responsible innovation’ (Palmer 2018b). Yet, whether a proposed tech industry SRO will continue to operate in the so-called ‘public interest’, rather than the interests of the established tech industry, will require an intense level of organizational transparency and accountability – specifically, as it pertains to the broader inclusion of the civil society. Furthermore, this process involves tradeoffs among competing values (and costs and benefits) for a variety of industry stakeholders, including consumers, government representatives, and small tech companies, to ensure its effectiveness as both a substitute for, and complement to, new legislation (whether domestically or internationally) and ensuing public regulation.

Disclosure statement

No potential conflict of interest was reported by the author.

Notes on contributor

Thomas A. Hemphill, a professor of strategy, innovation and public policy, School of Management, University of Michigan-Flint, received his Ph.D. in Business Administration with a primary field in Strategic Management and Public Policy and secondary field in Technology and Innovation Policy from The George Washington University. His technology and innovation management publications can be found in the Bulletin of Science, Technology & Society; Innovation: Management, Policy & Practice; International Journal of Innovation Management; International Journal of Innovation and Technology Management, Journal of Responsible Innovation, Knowledge, Technology & Policy; Research-Technology Management; Science and Public Policy; Technology Analysis & Strategic Management; and Technology In Society.

Notes

1 There is reportedly a strong movement by both Democrat and Republican Congressional leadership to pursue privacy legislation in the 116th Congress (Kerry 2019). Furthermore, a broad representation of stakeholder interests – including organizations like Access Now, the Business Roundtable, BSA/The Software Alliance, the Electronic Privacy Information Center, Google, the Internet Association, the Information Technology Industry Council, and the U.S. Chamber of Commerce – have issued recent white papers or statements concerning proposed privacy principles or frameworks on what proposed legislation should address (Kerry 2019).

2 Vogel (2010, 69) describes voluntary civil regulations, an integral part of an effective SRO, as follows:

A defining feature of civil regulations is that their legitimacy, governance and implementation is not rooted in public authority. Typically operating beside or around the state rather than through it, civil regulations are based on ‘soft law’ [emphasis added] or private law rather than legally enforceable standards.

Soft law mechanisms can include private standards, guidelines, codes of conduct and principles (Marchant and Allenby 2017), but also certain non-legislative regulatory agency activities that include interpretive rules, guidance documents, and general statements of policy (Franklin 2010). Abbott (2013, 6) notes that soft law governance approaches, such as ‘information disclosures, codes of conduct, and certification mechanisms’ have the innate advantage of being ‘adopted and revised much more rapidly than formal regulations’.

3 The author wishes to thank the anonymous referee for the insightful comments and suggestions provided to improve the quality of the overall article.