Thursday

21st Jan 2021

New GDPR enforcer says complaints imminent

  • Companies around the world risk massive fines if they violate European data protection rules (Photo: Markus Spiske)

Andrea Jelinek, a former Austrian police chief, will be in charge of coordinating enforcement of the EU's general data protection rules as of Friday (25 May) - in a move that has rattled companies worldwide.

Jelinek chairs a new EU body known as the European data protection board or EDPB which coordinates all the national data protection authorities in a bid to ensure European rights to privacy are uniformly respected throughout member states.

Read and decide

Join EUobserver today

Become an expert on Europe

Get instant access to all articles — and 20 years of archives. 14-day free trial.

... or subscribe as a group

It comes with the power to slap huge fines on companies that refuse or fail to comply with the regulation.

It also follows fresh revelations that social media giant Facebook, whose European headquarters is based in Ireland, has allegedly swept up data of people without their consent or knowledge.

Earlier this week in Brussels, Jelinek told reporters she expects complaints against firms like Facebook to be rolling in on day one but has no plans as of Friday to start launching fines.

"I am sure you won't have to wait for a couple of months. I am sure there will be complaints on Friday," she said. Those complaints will first be fielded by respective national data protection authorities and then sent to the EDPB in cross-border cases.

She also noted the EU's data protection regulation was launched two years ago to give businesses the time to prepare for its enforcement.

Any additional leeway will not be granted, she warned, but noted they will only investigate new violations committed as of Friday. One-off violations committed before Friday will not be probed unless they continue.

With a staff of 13 people, set to expand to 25 late next year, the EDPB will have its work cut out. The board is also supported by European data protection supervisor (EDPS), Giovanni Butterali.

Both are in the same building in Brussels near the European Parliament - with an entrance recently staffed with extra security features.

Broader questions remain on how prepared the respective national data protection authorities are to fulfil their role, given some have yet to be fully staffed and equipped.

Last week, the European commission noted eight EU states had yet to pass the national laws required to ensure the data authorities are ready.

"If we combine the army of all DPAs [data protection authorities] altogether including the EDPS, so 28 plus us, we have no more 2,500 people for the time being, which is less than the lobbyist army in Brussels," Butterali told EUobserver.

Jelinek appeared to brush off these concerns, noting that if necessary, the national authorities could possibly shuffle around staff to plug any gaps and in extreme cases, get the European Commission "to act" against state laggards.

"I know that in some countries there are difficulties regarding the staffing, regarding the money and we are going to stress also on the governments to get them to be staffed enough," she said.

It is also not entirely clear how committed some national authorities will be in pursuing cases given Ireland's past history of complicating Austrian privacy campaigner Max Schrem's case against Facebook.

But Jelinek maintained that all data authorities are committed.

"Max Schrems won't have to run to Ireland again, we are going to negotiate and talk to the future lead supervisor authority - if it regards Facebook, this will be Ireland," she said.

Ireland's data regulator Helen Dixon had also told the Financial Times newspaper she is ready to use "the full toolkit" against non-compliant companies, if needed.

Any disputes among data authorities at EDPB will be overrided by a two-third majority vote and if split, the chair's vote will count.

The targets

Their resolve and determination will be put to the test with immediate affect.

Schrems, who has since launched a European enforcement platform known as noyb, has already filed a first round of GDPR complaints against Google, Facebook, Instagram and WhatsApp over issues related to forced consent.

Those complaints were sent to data authorities in France, Belgium, Germany and Austria and could later involve Irish data protection commissioner, given three of the companies are headquarted in Ireland.

All the companies risks well over a billion euros in fines, if found guilty.

Facebook's chief Mark Zuckerberg earlier this week in Brussels brushed off tough questions by MEPs on shadow profiles, a process were data is collected on people who are not signed up to the network. He also skirted questions on whether Facebook gleans personal data off WhatsApp.

Buttarelli, who also sits on the EDPB board, told EUobserver earlier this week that both shadow profiles and WhatsApp data sharing are now are among their priority issues.

"These are the two points which are on our agenda. We need to talk with the other colleagues and see what their perceptions are but they are part of let's say our priorities," he said.

Eight countries to miss EU data protection deadline

The EU starts enforcing its general data protection regulation on 25 May - but Belgium, Bulgaria, Cyprus, Czech Republic, Greece, Hungary, Lithuania and Slovenia won't be ready. The delay will cause legal uncertainty.

Privacy Shield less relevant given GDPR, says data chief

Giovanni Buttarelli, the European data protection supervisor, says the EU-US data sharing pact known as Privacy Shield will play an increasingly minor role given the general data protection regulation.

Analysis

GDPR does not (yet) give right to global oblivion

The 'right to be forgotten' will become enshrined in EU law on Friday, but it is not yet clear to what extent it will apply. Will the EU's law determine how the internet looks globally?

GDPR - a global 'gold standard'?

The new EU privacy rules are touted as a global 'gold standard' - but Mexico's former data commissioner warns some nations are far from ready.

Interview

2013: Snowden was 'wake-up call' for GDPR

The contentious negotiations on the EU's data protection rules (GDPR), very much influenced by intense lobbying from the US, radically changed after whistleblower Edward Snowden revealed in 2013 that US intelligence services were collecting worldwide user-data.

News in Brief

  1. Brexit prompted finance exodus from UK to France
  2. Italian PM Conte wins confidence vote in Senate
  3. Borrell washes hands of EU's Venezuela policy
  4. Russia backs Greece in eastern Mediterranean dispute
  5. 'Ski-holiday' Switzerland reaches new infection high
  6. Germany extends lockdown, others expected to follow
  7. Barnier to be Brexit special adviser to von der Leyen
  8. EU commisioner to visit Bosnia's Lipa migrant camp

Opinion

Rule-of-law deal: major step for Europe of values

At the very moment when an incumbent president across the Atlantic was carrying out staggering attacks on the foundations of democracy, the European Parliament obtained a historic agreement to protect the rule of law in Europe.

Stakeholders' Highlights

  1. UNESDAEU Code of Conduct can showcase PPPs delivering healthier more sustainable society
  2. CESIKlaus Heeger and Romain Wolff re-elected Secretary General and President of independent trade unions in Europe (CESI)
  3. Nordic Council of MinistersWomen benefit in the digitalised labour market
  4. Nordic Council of MinistersReport: The prevalence of men who use internet forums characterised by misogyny
  5. Nordic Council of MinistersJoin the Nordic climate debate on 17 November!
  6. UNESDAMaking healthier diets the easy choice

Latest News

  1. MEPs call to halt Russia pipeline over Navalny arrest
  2. EU targets vaccinating 70% of adults by summer
  3. Portugal pushes to start delayed 'future EU' conference
  4. EU Parliament pressing for inquiry into Frontex
  5. Untapped potential of the single market could boost European recovery
  6. Biden's 'Age of Aquarius'? Mars and Venus will clash over China
  7. The new dimension of 'ever-closer union'
  8. What do new CDU chief's pro-Russia views mean for Europe?

Join EUobserver

Support quality EU news

Join us