GDPR enforcement must level up to catch big tech, report warns
A new report by European consumer protection umbrella group Beuc, reflecting on the barriers to effective cross-border enforcement of the EU’s flagship data protection framework, makes awkward reading for the regional lawmakers and regulators as they seek to shape the next decades of digital oversight across the bloc.
Beuc’s members filed a series of complaints against Google’s use of location data in November 2018 — but some two years on from raising privacy concerns there’s been no resolution of the complaints.
Since 2018, legal cases in 🇪🇺, 🇺🇸 &🇦🇺 have been launched against Google in relation to their collection and use of location data. Since then, nothing happened while Google generated $251billion from advertising revenue. pic.twitter.com/tNkUvXrAan
— The Consumer Voice (@beuc) November 26, 2020
The tech giant continues to make billions in ad revenue, including by processing and monetize Internet users’ location data. Its lead data protection supervisor, under GDPR’s one-stop-shop mechanism for dealing with cross-border complaints, Ireland’s Data Protection Commission (DPC), did finally open an investigation in February this year.
But it could still be years before Google faces any regulatory action in Europe related to its location tracking.
This is because Ireland’s DPC has yet to issue any cross-border GDPR decisions, some 2.5 years after the regulation started being applied. (Although, as we reported recently, a case related to a Twitter data breach is inching towards a result in the coming days.)
By contrast, France’s data watchdog, the CNIL, was able to complete a GDPR investigation into the transparency of Google’s data processing in much quicker order last year.
This summer French courts also confirmed the $57M fine it issued, slapping down Google’s appeal.
But the case predated Google coming under the jurisdiction of the DPC. And Ireland’s data regulator has to deal with a disproportionate number of multinational tech companies, given how many have established their EU base in the country.
The DPC has a major backlog of cross-border cases, with more than 20 GDPR probes involving a number of tech companies including Apple, Facebook/WhatsApp and LinkedIn. (Google has also been under investigation in Ireland over its adtech since 2019.)
This week the EU’s internet market commissioner, Thierry Breton, said regional lawmakers are well aware of enforcement “bottlenecks” in the General Data Protection Regulation (GDPR).
He suggested the Commission has learned lessons from this friction — claiming it will ensure similar concerns don’t affect the future working of a regulatory proposal related to data reuse that he was out speaking in public to introduce.
The Commission wants to create standard conditions for rights-respecting reuse of industrial data across the EU, via a new Data Governance Act (DGA), which proposes similar oversight mechanisms as are involved in the EU’s oversight of personal data — including national agencies monitoring compliance and a centralized EU steering body (which they’re planning to call the European Data Innovation Board as a mirror entity to the European Data Protection Board).
The Commission’s ambitious agenda for updating and expanding the EU’s digital rules framework, means criticism of GDPR risks taking the shine off the DGA before the ink has dried on the proposal document — putting pressure on lawmakers to find creative ways to unblock GDPR’s enforcement “bottleneck”. (Creative because national agencies are responsibility for day to day oversight, and Member States are responsible for resourcing DPAs.)
In an initial GDPR review this summer, the Commission praised the regulation as a “modern and horizontal piece of legislation” and a “global reference point” — claiming it’s served as a point of inspiration for California’s CCPA and other emerging digital privacy frameworks around the world.
But they also conceded GDPR enforcement is lacking.
The best answer to this concern “will be a decision from the Irish data protection authority about important cases”, the EU’s justice commissioner, Didier Reynders, said in June.
Five months later European citizens are still waiting.
Beuc’s report — which it’s called The long and winding road: Two years of the GDPR: A cross-border data protection case from a consumer perspective — details the procedural obstacles its member organizations have faced in seeking to obtain a decision related to the original complaints, which were filed with a variety of DPAs around the EU.
This includes concerns of the Irish DPC making unnecessary “information and admissibility checks”; as well as rejecting complaints brought by an interested organization on the grounds they lack a mandate under Irish law, because it does not allow for third party redress (yet the Dutch consumer organization had filed the complaint under Dutch law which does…).
The report also queries why the DPC chose to open an own volition enquiry into Google’s location data activities (rather than a complaint-led enquiry) — which Beuc says risks a further delay to reaching a decision on the complaints themselves.
It further points out that the DPC’s probe of Google only looks at activity since February 2020 not November 2018 when the complaints were made — meaning there’s a missing chunk of Google’s location data processing that’s not even being investigated yet.
It notes that three of its member organizations involved in the Google complaints had considered applying for a judicial review of the DPC’s decision (NB: others have resorted to that route) — but they decided not to proceed in part because of the significant legal costs it would have entailed.
The report also points out the inherent imbalance of GDPR’s one-stop-shop mechanism shifting the administration of complaints to the location of companies under investigation — arguing they therefore benefit from “easier access to justice” (vs the ordinary consumer faced with undertaking legal proceedings in a different country and (likely) language).
“If the lead authority is in a country with tradition in ‘common law’, like Ireland, things can become even more complex and costly,” Beuc’s report further notes.
Another issue it raises is the overarching one of rights complaints having to fight what it dubs ‘a moving target’ — given well-resourced tech companies can leverage regulatory delays to (superficially) tweak practices, greasing continued abuse with misleading PR campaigns. (Something Beuc accuses Google of doing.)
DPAs must “adapt their enforcement approach to intervene more rapidly and directly”, it concludes.
“Over two years have passed since the GDPR became applicable, we have now reached a turning point. The GDPR must finally show its strength and become a catalyst for urgently needed changes in business practices,” Beuc goes on in a summary of its recommendations. “Our members experience and that of other civil society organisations, reveals a series of obstacles that significantly hamper the effective application of the GDPR and the correct functioning of its enforcement system.
“BEUC recommends to the relevant EU and national authorities to make a comprehensive and joint effort to ensure the swift enforcement of the rules and improve the position of data subjects and their representing organisations, particularly in the framework of cross-border enforcement cases.”
We reached out to the Commission and the Irish DPC with questions about the report. But at the time of writing neither had responded. We’ve also asked Google for comment.
Beuc earlier sent a list of eight recommendations for “efficient” GDPR enforcement to the Commission in May.
A new report by European consumer protection umbrella group Beuc, reflecting on the barriers to effective cross-border enforcement of the EU’s flagship data protection framework, makes awkward reading for the regional lawmakers and regulators as they seek to shape the next decades of digital oversight across the bloc. Beuc’s members…
Recent Posts
- Forget Apple’s M4 MacBooks – Lenovo’s Snapdragon X Elite laptops have been spotted and could be the most exciting launch of 2024
- Senate Democrats urge crackdown on autonomous vehicles and driver assist
- Underestimating the dangers within: mitigating the insider cyber threat
- The road to analytics excellence is paved with automation
- Pixel’s new satellite feature could show people where you are on Google Maps
Archives
- April 2024
- March 2024
- February 2024
- January 2024
- December 2023
- November 2023
- October 2023
- September 2023
- August 2023
- July 2023
- June 2023
- May 2023
- April 2023
- March 2023
- February 2023
- January 2023
- December 2022
- November 2022
- October 2022
- September 2022
- August 2022
- July 2022
- June 2022
- May 2022
- April 2022
- March 2022
- February 2022
- January 2022
- December 2021
- November 2021
- October 2021
- September 2021
- August 2021
- July 2021
- June 2021
- May 2021
- April 2021
- March 2021
- February 2021
- January 2021
- December 2020
- November 2020
- October 2020
- September 2020
- August 2020
- July 2020
- June 2020
- May 2020
- April 2020
- March 2020
- February 2020
- January 2020
- December 2019
- November 2019
- December 2011