Thursday

6th Aug 2020

EU's landmark GDPR failing to live up to full potential

  • The commission noted data-protection authorities based in Ireland and Luxembourg - European HQss to Google, Facebook, Twitter and Amazon - need a substantial boost in resources (Photo: Descrier)

A two-year review of the EU data protection regulation (GDPR) published by the European Commission on Wednesday (24 June) revealed that its application and enforcement both remain problematic.

"The GDPR is the perfect example of how the European Union, based on a fundamental rights' approach, empowers its citizens and gives businesses opportunities to make the most of the digital revolution," said the EU commissioner for values and transparency, Věra Jourová.

Read and decide

Join EUobserver today

Support quality EU news

Get instant access to all articles — and 20 years of archives. 14-day free trial.

... or subscribe as a group

"But we all must continue the work to make GDPR live up to its full potential," she added.

Since its adoption in 2018, GDPR has largely been considered one of the major successes of the EU for being in the vanguard of online protection of fundamental rights in the bloc and globally.

However, the law has been misused to silence journalists and civil society organisations.

It has also proved to be complicated, as well as time- and cost-consuming for small and medium enterprises, and there is legal uncertainty linked to some of the new technologies.

Additionally, the commission's report also identified fragmentation in national legislation, and a lack of cooperation between different data protection authorities, which have created challenges for cross-border investigations.

Such multi-state investigations require that a lead authority drives the investigation in cooperation with other authorities - this system is based on the so-called "one-stop-shop" mechanism which is supposed to serve both people and companies.

However, the legal services of the European Council have previously criticised the "one-stop-shop" system, back in 2013, for undermining citizens' human rights.

Moreover, only five EU countries - the Czech Republic, Denmark, Hungary, the UK, and Luxembourg (which has yet to resolve any major case) - are considered to have enough resources for such cooperative tasks.

Earlier this year, the Hamburg data protection authority described the system as "cumbersome, time-consuming and ineffective".

Google, Facebook, Twitter and Amazon HQs?

The commission's two-year review also indicates that the authorities based in Ireland and Luxembourg, European headquarters to Google, Facebook, Twitter and Amazon, need a substantial boost in resources.

"Given that the largest big tech multinationals are established in Ireland and Luxembourg, the data protection authorities of these countries act as lead authorities in many important cross-border cases and may need larger resources than their population would otherwise suggest," reads the report.

However, according to a separate report published by NGO Access Now, "the fact that Ireland is currently leading a large number of GDPR complaints is not only an administrative issue but also potentially a political one" since tech giants have arguably gained an unprecedented level of influence in policy debates in Ireland - including data protection enforcement.

The Irish watchdog opened cases against Facebook, the Facebook-owned Instagram and WhatsApp apps, as well as Twitter and Apple - among others.

Meanwhile, a report of the regulatory activities under GDPR of the Irish watchdog indicates that "the workload will continue to increase and the coronavirus crisis is likely to have implications for future funding".

GDPR has increased awareness about the protection of personal data, both within and outside of the EU - about 69 percent of people in the bloc have heard about GDPR, according to a recent survey from the EU Agency of Fundamental Rights.

However, businesses stressed the need for legal certainty on how to implement new technologies in a way that is compatible with the GDPR so that they can continue to invest in innovation.

Members of the EU's expert group on GDPR consider that the exact impact of the GDPR on future innovation is hard to estimate - since this also depends on how EU data protection rules apply to new technologies, such as facial recognition technologies, blockchain or AI.

"The two-year review shines an unflattering light on many of these shortcomings, yet the commission seems determined to double down by layering on even more rules," said Eline Chivot, a policy analyst from Center for Data Innovation, referring to the upcoming regulatory framework for AI and an extension of the right to data portability.

"Make no mistake: that would come at the cost of EU's economic competitiveness in the years ahead," she added.

"Policymakers should fix the GDPR's many shortcomings before creating even more rules. Otherwise, the EU will tie the hands of companies that could help its economy compete in the global economy," she also said.

Podcast

Data and Dystopia

Despite concerns about civil liberties and activities of companies like Clearview AI and Palantir, EU authorities are shaping a new industrial policy around artificial intelligence.

EU data protection rules abused to censor media

This week the EU's data protection rules (known as the GDPR) are two-years old. While the controversial GDPR was intended to offer greater privacy rights, it has also been abused by some authorities to muzzle a free press.

Coronavirus

EU agrees not to use location data in tracing apps

Member states agreed on Thursday that Covid-19 mobile applications used for contact-tracing should not process location data of individuals, amid rising concerns over privacy.

Facebook cries foul on EU request for internal documents

Facebook, a US tech giant known for abusing its users' private data, has filed a complaint at the EU court in Luxembourg, saying the EU Commission's data request was too broad and would affect its employees' medical and financial information.

EU top court bins 'Privacy Shield' in Schrems privacy case

The EU's top court ruled that the EU-US data-transfer pact fails to protect EU citizens' rights to privacy - following a legal challenge from Austrian privacy activist Max Schrems against Facebook. Washington said it was "deeply disappointed" with the ruling.

Column

Four tweets broke Facebook - good news for EU regulators

Facebook PR chief Nick Clegg tried to make us believe that it is comparable to a phone company. Nothing could be further from the truth. His company decides which messages users see. It literally "ranks" content.

Stakeholders' Highlights

  1. UNESDANext generation Europe should be green and circular
  2. Nordic Council of MinistersNEW REPORT: Eight in ten people are concerned about climate change
  3. UNESDAHow reducing sugar and calories in soft drinks makes the healthier choice the easy choice
  4. Nordic Council of MinistersGreen energy to power Nordic start after Covid-19
  5. European Sustainable Energy WeekThis year’s EU Sustainable Energy Week (EUSEW) will be held digitally!
  6. Nordic Council of MinistersNordic states are fighting to protect gender equality during corona crisis

Latest News

  1. Rainbow flag protesters charged by Polish police
  2. An open letter to the EPP on end of Hungary's press freedom
  3. Renew Europe has a plan to combat gender-violence
  4. Why EU beats US on green pandemic recovery
  5. Azerbaijan ambassador to EU shared anti-George Floyd post
  6. Polish party roars back at EU on LGBTI fines
  7. EU: Hong Kong election delay undermines democracy
  8. Why hydrogen is no magic solution for EU Green Deal

Join EUobserver

Support quality EU news

Join us