Personal data, as we now know, are a mine. Big Tech knows this well. And there is a significant and long-awaited reform step: the
European Commission
has committed to stepping up monitoring of how data protection authorities at the level of EU member states apply the bloc’s flagship data protection rules, committing to regular audits of “large-scale” cases of the General Data Protection Regulation (GDPR). Controls that could help address long-standing criticism that GDPR enforcement is too weak and laborious to put meaningful controls on Big Tech.
Privacy and data processing violations, under the umbrella of the European GDPR legislation, in 2022 showed that two new fronts have opened up. The first is with the United States. After a regulatory vacuum was created in July 2020, after the “Schrems II” ruling of the Court of Justice of the European Union that invalidated the Privacy Shield in force between the United States and the European Union, the Biden administration is trying to create an alternative regulation for the transfer of personal data across the Atlantic. The
European Union
is therefore proceeding on a similar path and a first agreement has been reached, but in the long term, according to the lawyers, it is not clear whether the new operational decisions taken by the United States and the European Union will be sufficient or there will be a risk of a new ruling that nullifies the validity of the agreements.
The EU executive responded to its ombudsman by saying that it will ask all national data protection supervisory authorities to share a report on a bi-monthly basis, presumably every two months instead of twice a month, so six times a year. In short, an overview of large-scale cross-border investigations under the GDPR. In addition, the Commission establishes that these reports will have to include various key details such as the case number, the controller or processor involved, the type of investigation. All together with a summary of the scope of the investigation including the provisions of the GDPR in question.
The European executive has also committed, in its second forthcoming report on the application of the GDPR, to provide an account of the information it receives from data protection authorities. Then the Commission will report on the reporting of the data protection authorities. There is also an old complaint requesting the suspension of
Facebook
data exports. While Apple
all have GDPR cases open awaiting decisions, in some cases years after an investigation has been opened.
Privacy activists and legal experts in the EU have argued for years that, on paper, the GDPR should protect consumers from tracking. Yet they also pointed out that these same rules are being systematically violated by tech giants who think they are big enough to ignore them. The result is that European citizens’ rights are crushed by the market muscle of major tech platforms and their associated operator ecosystems, which critics say extend to the regulatory takeover of “friendly” DPAs. Especially in some Member States such as Ireland where there is a concentration of large technology companies.
A recent Union report on digital advertising and privacy concludes that there is “a need to increase people’s control over how their personal data is used for digital advertising, including how they avoid unwanted targeting.”
Suffice it to say that 2022 was a record year for the privacy guarantors of European states. A year in which the total amount of fines imposed for GDPR violations on the big tech companies and beyond from 28 January to date has been equal to the record figure of 1.64 billion euros, with an increase of 50% compared to the previous year, which brings the GDPR fines made since 25 May 2018 to the total of 2.92 billion euros. In Italy, the total is just over 63 million euros in fines, with the highest single penalty of 27.8 million euros, numbers that put our country in sixth position after Ireland, Luxembourg, France, Spain and Germany.