Saturday

8th May 2021

New GDPR enforcer says complaints imminent

  • Companies around the world risk massive fines if they violate European data protection rules (Photo: Markus Spiske)

Andrea Jelinek, a former Austrian police chief, will be in charge of coordinating enforcement of the EU's general data protection rules as of Friday (25 May) - in a move that has rattled companies worldwide.

Jelinek chairs a new EU body known as the European data protection board or EDPB which coordinates all the national data protection authorities in a bid to ensure European rights to privacy are uniformly respected throughout member states.

Read and decide

Join EUobserver today

Become an expert on Europe

Get instant access to all articles — and 20 years of archives. 14-day free trial.

... or subscribe as a group

It comes with the power to slap huge fines on companies that refuse or fail to comply with the regulation.

It also follows fresh revelations that social media giant Facebook, whose European headquarters is based in Ireland, has allegedly swept up data of people without their consent or knowledge.

Earlier this week in Brussels, Jelinek told reporters she expects complaints against firms like Facebook to be rolling in on day one but has no plans as of Friday to start launching fines.

"I am sure you won't have to wait for a couple of months. I am sure there will be complaints on Friday," she said. Those complaints will first be fielded by respective national data protection authorities and then sent to the EDPB in cross-border cases.

She also noted the EU's data protection regulation was launched two years ago to give businesses the time to prepare for its enforcement.

Any additional leeway will not be granted, she warned, but noted they will only investigate new violations committed as of Friday. One-off violations committed before Friday will not be probed unless they continue.

With a staff of 13 people, set to expand to 25 late next year, the EDPB will have its work cut out. The board is also supported by European data protection supervisor (EDPS), Giovanni Butterali.

Both are in the same building in Brussels near the European Parliament - with an entrance recently staffed with extra security features.

Broader questions remain on how prepared the respective national data protection authorities are to fulfil their role, given some have yet to be fully staffed and equipped.

Last week, the European commission noted eight EU states had yet to pass the national laws required to ensure the data authorities are ready.

"If we combine the army of all DPAs [data protection authorities] altogether including the EDPS, so 28 plus us, we have no more 2,500 people for the time being, which is less than the lobbyist army in Brussels," Butterali told EUobserver.

Jelinek appeared to brush off these concerns, noting that if necessary, the national authorities could possibly shuffle around staff to plug any gaps and in extreme cases, get the European Commission "to act" against state laggards.

"I know that in some countries there are difficulties regarding the staffing, regarding the money and we are going to stress also on the governments to get them to be staffed enough," she said.

It is also not entirely clear how committed some national authorities will be in pursuing cases given Ireland's past history of complicating Austrian privacy campaigner Max Schrem's case against Facebook.

But Jelinek maintained that all data authorities are committed.

"Max Schrems won't have to run to Ireland again, we are going to negotiate and talk to the future lead supervisor authority - if it regards Facebook, this will be Ireland," she said.

Ireland's data regulator Helen Dixon had also told the Financial Times newspaper she is ready to use "the full toolkit" against non-compliant companies, if needed.

Any disputes among data authorities at EDPB will be overrided by a two-third majority vote and if split, the chair's vote will count.

The targets

Their resolve and determination will be put to the test with immediate affect.

Schrems, who has since launched a European enforcement platform known as noyb, has already filed a first round of GDPR complaints against Google, Facebook, Instagram and WhatsApp over issues related to forced consent.

Those complaints were sent to data authorities in France, Belgium, Germany and Austria and could later involve Irish data protection commissioner, given three of the companies are headquarted in Ireland.

All the companies risks well over a billion euros in fines, if found guilty.

Facebook's chief Mark Zuckerberg earlier this week in Brussels brushed off tough questions by MEPs on shadow profiles, a process were data is collected on people who are not signed up to the network. He also skirted questions on whether Facebook gleans personal data off WhatsApp.

Buttarelli, who also sits on the EDPB board, told EUobserver earlier this week that both shadow profiles and WhatsApp data sharing are now are among their priority issues.

"These are the two points which are on our agenda. We need to talk with the other colleagues and see what their perceptions are but they are part of let's say our priorities," he said.

Eight countries to miss EU data protection deadline

The EU starts enforcing its general data protection regulation on 25 May - but Belgium, Bulgaria, Cyprus, Czech Republic, Greece, Hungary, Lithuania and Slovenia won't be ready. The delay will cause legal uncertainty.

Privacy Shield less relevant given GDPR, says data chief

Giovanni Buttarelli, the European data protection supervisor, says the EU-US data sharing pact known as Privacy Shield will play an increasingly minor role given the general data protection regulation.

Analysis

GDPR does not (yet) give right to global oblivion

The 'right to be forgotten' will become enshrined in EU law on Friday, but it is not yet clear to what extent it will apply. Will the EU's law determine how the internet looks globally?

GDPR - a global 'gold standard'?

The new EU privacy rules are touted as a global 'gold standard' - but Mexico's former data commissioner warns some nations are far from ready.

Interview

2013: Snowden was 'wake-up call' for GDPR

The contentious negotiations on the EU's data protection rules (GDPR), very much influenced by intense lobbying from the US, radically changed after whistleblower Edward Snowden revealed in 2013 that US intelligence services were collecting worldwide user-data.

News in Brief

  1. Report: Czech minister plotted to bury evidence on Russian attack
  2. Putin promotes Russia's 'Kalashnikov-like' vaccine
  3. Coronavirus: Indian variant clusters found across England
  4. UN report encourages EU methane cuts
  5. EU court upholds ban on bee-harming pesticides
  6. Israeli tourists welcomed back by EU
  7. EU duped into funding terrorist group, Israel says
  8. Brussels prepares portfolio of potential Covid-19 treatments

Feature

Covid-hit homeless find Xmas relief at Brussels food centre

The Kamiano food distribution centre in Brussels is expecting 20 people every half hour on Christmas Day. For many, Kamiano is also more than that - a support system for those made homeless or impoverished.

Top court finds Hungary and Poland broke EU rules

EU tribunal said Hungary's legislation made it "virtually impossible" to make an asylum application. Restricting access to international protection procedure is a violation of EU rules.

Stakeholders' Highlights

  1. Nordic Council of MinistersNordic Council enters into formal relations with European Parliament
  2. Nordic Council of MinistersWomen more active in violent extremist circles than first assumed
  3. Nordic Council of MinistersDigitalisation can help us pick up the green pace
  4. Nordic Council of MinistersCOVID19 is a wake-up call in the fight against antibiotic resistance
  5. Nordic Council of MinistersThe Nordic Region can and should play a leading role in Europe’s digital development
  6. Nordic Council of MinistersNordic Council to host EU webinars on energy, digitalisation and antibiotic resistance

Latest News

  1. EU ambassadors flock to Red Square for Putin's parade
  2. MEPs win battle for bigger citizens' voice at Conference
  3. Hungary gags EU ministers on China
  4. Poland and Hungary push back on 'gender equality' pre-summit
  5. EU preparing to send soldiers to Mozambique
  6. EU now 'open' to vaccine waiver, after Biden U-turn
  7. EU mulls using new 'peace' fund to help Libyan coast guard
  8. Poland 'breaks EU law' over judges, EU court opinion says

Join EUobserver

Support quality EU news

Join us