Tuesday

19th Mar 2024

New GDPR enforcer says complaints imminent

  • Companies around the world risk massive fines if they violate European data protection rules (Photo: Markus Spiske)

Andrea Jelinek, a former Austrian police chief, will be in charge of coordinating enforcement of the EU's general data protection rules as of Friday (25 May) - in a move that has rattled companies worldwide.

Jelinek chairs a new EU body known as the European data protection board or EDPB which coordinates all the national data protection authorities in a bid to ensure European rights to privacy are uniformly respected throughout member states.

Read and decide

Join EUobserver today

Get the EU news that really matters

Instant access to all articles — and 20 years of archives. 14-day free trial.

... or subscribe as a group

It comes with the power to slap huge fines on companies that refuse or fail to comply with the regulation.

It also follows fresh revelations that social media giant Facebook, whose European headquarters is based in Ireland, has allegedly swept up data of people without their consent or knowledge.

Earlier this week in Brussels, Jelinek told reporters she expects complaints against firms like Facebook to be rolling in on day one but has no plans as of Friday to start launching fines.

"I am sure you won't have to wait for a couple of months. I am sure there will be complaints on Friday," she said. Those complaints will first be fielded by respective national data protection authorities and then sent to the EDPB in cross-border cases.

She also noted the EU's data protection regulation was launched two years ago to give businesses the time to prepare for its enforcement.

Any additional leeway will not be granted, she warned, but noted they will only investigate new violations committed as of Friday. One-off violations committed before Friday will not be probed unless they continue.

With a staff of 13 people, set to expand to 25 late next year, the EDPB will have its work cut out. The board is also supported by European data protection supervisor (EDPS), Giovanni Butterali.

Both are in the same building in Brussels near the European Parliament - with an entrance recently staffed with extra security features.

Broader questions remain on how prepared the respective national data protection authorities are to fulfil their role, given some have yet to be fully staffed and equipped.

Last week, the European commission noted eight EU states had yet to pass the national laws required to ensure the data authorities are ready.

"If we combine the army of all DPAs [data protection authorities] altogether including the EDPS, so 28 plus us, we have no more 2,500 people for the time being, which is less than the lobbyist army in Brussels," Butterali told EUobserver.

Jelinek appeared to brush off these concerns, noting that if necessary, the national authorities could possibly shuffle around staff to plug any gaps and in extreme cases, get the European Commission "to act" against state laggards.

"I know that in some countries there are difficulties regarding the staffing, regarding the money and we are going to stress also on the governments to get them to be staffed enough," she said.

It is also not entirely clear how committed some national authorities will be in pursuing cases given Ireland's past history of complicating Austrian privacy campaigner Max Schrem's case against Facebook.

But Jelinek maintained that all data authorities are committed.

"Max Schrems won't have to run to Ireland again, we are going to negotiate and talk to the future lead supervisor authority - if it regards Facebook, this will be Ireland," she said.

Ireland's data regulator Helen Dixon had also told the Financial Times newspaper she is ready to use "the full toolkit" against non-compliant companies, if needed.

Any disputes among data authorities at EDPB will be overrided by a two-third majority vote and if split, the chair's vote will count.

The targets

Their resolve and determination will be put to the test with immediate affect.

Schrems, who has since launched a European enforcement platform known as noyb, has already filed a first round of GDPR complaints against Google, Facebook, Instagram and WhatsApp over issues related to forced consent.

Those complaints were sent to data authorities in France, Belgium, Germany and Austria and could later involve Irish data protection commissioner, given three of the companies are headquarted in Ireland.

All the companies risks well over a billion euros in fines, if found guilty.

Facebook's chief Mark Zuckerberg earlier this week in Brussels brushed off tough questions by MEPs on shadow profiles, a process were data is collected on people who are not signed up to the network. He also skirted questions on whether Facebook gleans personal data off WhatsApp.

Buttarelli, who also sits on the EDPB board, told EUobserver earlier this week that both shadow profiles and WhatsApp data sharing are now are among their priority issues.

"These are the two points which are on our agenda. We need to talk with the other colleagues and see what their perceptions are but they are part of let's say our priorities," he said.

Eight countries to miss EU data protection deadline

The EU starts enforcing its general data protection regulation on 25 May - but Belgium, Bulgaria, Cyprus, Czech Republic, Greece, Hungary, Lithuania and Slovenia won't be ready. The delay will cause legal uncertainty.

Privacy Shield less relevant given GDPR, says data chief

Giovanni Buttarelli, the European data protection supervisor, says the EU-US data sharing pact known as Privacy Shield will play an increasingly minor role given the general data protection regulation.

Analysis

GDPR does not (yet) give right to global oblivion

The 'right to be forgotten' will become enshrined in EU law on Friday, but it is not yet clear to what extent it will apply. Will the EU's law determine how the internet looks globally?

GDPR - a global 'gold standard'?

The new EU privacy rules are touted as a global 'gold standard' - but Mexico's former data commissioner warns some nations are far from ready.

Interview

2013: Snowden was 'wake-up call' for GDPR

The contentious negotiations on the EU's data protection rules (GDPR), very much influenced by intense lobbying from the US, radically changed after whistleblower Edward Snowden revealed in 2013 that US intelligence services were collecting worldwide user-data.

Opinion

Potential legal avenues to prosecute Navalny's killers

The UN could launch an independent international investigation into Navalny's killing, akin to investigation I conducted on Jamal Khashoggi's assassination, or on Navalny's Novichok poisoning, in my role as special rapporteur on extrajudicial executions, writes the secretary-general of Amnesty International.

Opinion

I'll be honest — Moldova's judicial system isn't fit for EU

To state a plain truth: at present, Moldova does not have a justice system worthy of a EU member state; it is riven with corruption and lax and inconsistent standards, despite previous attempts at reform, writes Moldova's former justice minister.

Latest News

  1. Borrell: 'Israel provoking famine', urges more aid access
  2. Europol: Israel-Gaza galvanising Jihadist recruitment in Europe
  3. EU to agree Israeli-settler blacklist, Borrell says
  4. EU ministers keen to use Russian profits for Ukraine ammo
  5. Call to change EIB defence spending rules hits scepticism
  6. Potential legal avenues to prosecute Navalny's killers
  7. EU summit, Gaza, Ukraine, reforms in focus this WEEK
  8. The present and future dystopia of political micro-targeting ads

Stakeholders' Highlights

  1. Nordic Council of MinistersJoin the Nordic Food Systems Takeover at COP28
  2. Nordic Council of MinistersHow women and men are affected differently by climate policy
  3. Nordic Council of MinistersArtist Jessie Kleemann at Nordic pavilion during UN climate summit COP28
  4. Nordic Council of MinistersCOP28: Gathering Nordic and global experts to put food and health on the agenda
  5. Friedrich Naumann FoundationPoems of Liberty – Call for Submission “Human Rights in Inhume War”: 250€ honorary fee for selected poems
  6. World BankWorld Bank report: How to create a future where the rewards of technology benefit all levels of society?

Stakeholders' Highlights

  1. Georgia Ministry of Foreign AffairsThis autumn Europalia arts festival is all about GEORGIA!
  2. UNOPSFostering health system resilience in fragile and conflict-affected countries
  3. European Citizen's InitiativeThe European Commission launches the ‘ImagineEU’ competition for secondary school students in the EU.
  4. Nordic Council of MinistersThe Nordic Region is stepping up its efforts to reduce food waste
  5. UNOPSUNOPS begins works under EU-funded project to repair schools in Ukraine
  6. Georgia Ministry of Foreign AffairsGeorgia effectively prevents sanctions evasion against Russia – confirm EU, UK, USA

Join EUobserver

EU news that matters

Join us