Data Protection Enforcement Research Articles

Personal data protection enforcement under GDPR—the Slovak experience

Personal data protection enforcement under GDPR—the Slovak experience

Is Centralised General Data Protection Regulation Enforcement a Constitutional Necessity?

Protection of personal data as a fundamental right – GDPR’s enforcement dilemma in cross-border cases – “One-stop-shop” model’s inadequacies highlighted – Distinction: regular cross-border enforcement versus cases of common European concern – Proposal: centralised enforcement mechanism for cases of common European concern – Union supervisory authority as a solution – Insufficiencies of the harmonisation proposal of the European Commission – Centralisation’s advantages: uniform enforcement, better coordination, and curbing forum shopping – Implications: fundamental rights protection and EU’s constitutional obligations – Constructive critique of the one-stop-shop model, not a dismissal – European constitutional law mandates effective data protection enforcement.

Varieties of enforcement strategies post-GDPR: a fuzzy-set qualitative comparative analysis (fsQCA) across data protection authorities

ABSTRACT The study explores the divergence in data protection enforcement strategies among national agencies. Whereas the literature on cross-national enforcement practices is scarce, this study develops a scale for data protection enforcement strategies and measures and compares enforcement choices across agencies. Based on survey responses from 18 DPAs, interviews with DPA employees, and secondary sources on GPDR enforcement, the paper clusters DPAs based on enforcement strategies, analyzes cross-national variations, and investigates misalignments between strategy and actions. Using Fuzzy-Set Qualitative Comparative Analysis, the paper tests how bureaucratic and political contexts – organizational capacities, budget sources, and issue saliency – impact enforcement choices. Almost half of the studied DPAs reflect high deterrence by their strategy, but for many of them, lack of resources and expertise inhibits the translation of strategy into practice. This study provides a starting point for understanding the national impacts of Europeanization post-GDPR, adding empirical support for theorizing about enforcement across the EU.

Challenges to the Implementation and Enforcement of Data Protection in Nigeria

The formation of laws that contain the order of social, national and state life is part of the public decision-making process. Public decisions in the form of this law will be binding and apply to all people in a country. Its formation must provide a public space for the wider community to participate in the process of its formation. Pancasila as the root of the legal ideals of the Indonesian nation has the consequence that in the dynamics of the life of the nation and state, as a view of life adopted will provide coherence and direction (direction) to thoughts and actions. Reform of national law is directed at realizing laws based on the will of the people (democratic), then laws which are part of the national legal system in the process of their formation must reflect democratic values which are characterized by actively and comprehensively involving all levels of society in order to participate. inside it. Keywords : Formation of Laws, Renewal of National Laws and the Era of Democracy DOI: 10.7176/JLPG/121-07 Publication date: June 30 th 2022

(Under) Investment in Cyber Skills and Data Protection Enforcement: Evidence from Activity Logs of the UK Information Commissioner's Office

(Under) Investment in Cyber Skills and Data Protection Enforcement: Evidence from Activity Logs of the UK Information Commissioner's Office

Towards Effective Supervisory Oversight? Analysing UK Regulatory Enforcement of Data Protection and Electronic Privacy Rights and the Government’s Statutory Reform Plans

Towards Effective Supervisory Oversight? Analysing UK Regulatory Enforcement of Data Protection and Electronic Privacy Rights and the Government’s Statutory Reform Plans

Data protection and competition law: friends or foes regarding data sharing?

Data plays a prominent role in the digital economy, as being able to use data to develop or improve innovative products or services is a key competitive parameter. Consequently, an increasing call for more data sharing is being made in the EU. However, this might create tensions with the policy objectives of the GDPR, as data sharing will often cover both personal and non-personal data mixed in the same dataset. Unsurprisingly, large data holders have started to use data protection considerations to justify refusals to share data with third parties. This could create some serious competition issues, and some authors thus argue that the GDPR strengthens large data holders’ position by increasing concentration in data markets and by reinforcing barriers to data sharing. This finding seems to rely on the double premise that: i) the GDPR is more lenient towards personal data re-use within the ecosystem of these large data holders than it is towards the sharing of this personal data with third parties; and that ii) the way in which these large data holders re-use personal data within their ecosystem complies with data protection law. In this paper, we show that these two premises can be challenged from a theoretical point of view. Yet, even if these premises are challengeable, large data holders do apply “double standards” in practice. They adopt a very restrictive approach towards data sharing with third parties while massively circulating their users’ data internally. We outline that this is mainly the result of a lack of data protection enforcement, which led, in turn, to a lack of competition enforcement. Therefore, to solve this “double standards” issue, we argue that there is a crucial need for more enforcement of the existing rules by data protection authorities. Data protection, which might presently be somewhat of a foe to competition in light of the “double standers” situation, could become a friend if enforced with more pugnacity against large data holders, as it would not only reinforce the protection of data subjects but would also ensure the existence of a healthier competitive environment.

Narrowing Data Protection's Enforcement Gap

The rise of data protection laws is one of the most profound legal changes of this century. Yet, despite their nominal force and widespread adoption, available data indicates that these laws recurrently suffer from an enforcement gap—that is, a wide disparity between the stated protections on the books and the reality of how companies respond to them on the ground. Indeed, Annex I to this Article introduces a novel literature review of twenty-five studies that analyzed the impact on the ground of the GDPR and the CCPA: none found a meaningful improvement in citizen's data privacy. This raises the question: what accounts for this gap and what can be done to improve the performance of these laws? This Article begins by describing three core building blocks of data protection regimes in the United States and Europe—namely, market forces, tort liability and regulatory enforcement—that these jurisdictions combine in different ways to ensure that companies act in accordance consumers’ privacy preferences. It then identifies two key reasons—particularly deep information asymmetries between companies and consumers/regulators, and high levels of market power in many data markets—that enable companies to behave strategically to protect private interests and undermine legal compliance. The conclusion looks at the institutional design of antitrust and anti-fraud laws, two regulatory regimes that face similar challenges in their implementation, to argue that an effective online privacy regulatory system should be built around three key principles. First, the system must multiply monitoring and enforcement resources, and antitrust demonstrates how litigation can fund sophisticated civil-society intermediaries that safeguard consumers. Second, the system must bring violations to light, and anti-fraud policies demonstrate the importance of establishing effective whistleblower programs for data protection. Third, the system must increase governmental accountability, and antitrust provides examples on how to promote public transparency without sacrificing enforcement capacity.

Antitrust Enforcement and Privacy Standards

The current prominence of digital platforms that compete for customers’ attention by offering them free services and generate revenue by monetising the data obtained from customers on different markets, for example on online advertising markets, has brought to the forefront of the antitrust debate the question as to whether privacy standards are a parameter of antitrust enforcement. This paper asks what role, if any, the standard of privacy protection offered by online platforms to consumers plays in antitrust enforcement. In the author’s view, the answer to this question is that privacy standards are relevant to competition analysis as qualitative parameters of competition and can, and should, play a role in the assessment of mergers, agreements and unilateral conduct. When a breach of the data protection rules is either a form of exercise of market power or an element of an exclusionary strategy, competition law can and should intervene. But, as data protection issues become more and more prominent in digital markets, care should be exercised not to blur the line between competition policy and data protection. This would weaken both competition and data protection enforcement, which should instead work in tandem to achieve their common, ultimate objective of maximising societal welfare based on a democratically shared set of values, including a high standard of data protection.

European Data Protection Board: A Nascent EU Agency or an ‘Intergovernmental Club’?

The adoption of the General Data Protection Regulation (GDPR) gave birth to a new EU body - the European Data Protection Board (EDPB), superseding the former advisory Article 29 Working Party (WP29). The institutional reform was one of the key pillars of the EU data protection overhaul carried out in 2012-2016, but also one of the aspects that proved to be the most difficult to agree upon in the interinstitutional negotiations on the GDPR, in particular in the Council of Ministers internal talks. Differently from the original proposals, the EDPB was entrusted with certain legally-binding powers aligning it with some facets of the EU agencies, but the delegation of these powers was cautious and intended to be triggered only as a last resort avenue ‘in individual cases’. In the light of such dynamics, can the EDPB be viewed as a step towards the EU-level data protection agency building, especially, from the political point of view? How distant is the prospect of having there a fully-fledged EU-level data protection regulator, considering that the current ethos of the EU data protection enforcement puts an emphasis on a decentralised mode of governance with significant amount of decision-making competences remaining at the national level?

The risk-based approach under the new EU data protection regulation: a critical perspective

The first broad reform of personal data protection legislation in the European Union entered into force in May 2018 (Regulation (EU) 2016/679, the General Data Protection Regulation). Remarkably, with this reform a risk-based approach has been introduced as the core data protection enforcement model, while data protection authorities see their regulatory role significantly weakened. The risk-based approach is to be implemented by the data controllers (i.e. the operators) via data protection impact assessments (evoking the established environmental impact assessment procedure) and notification of breaches, among other procedures. Hence the scope of both the concepts of risk and risk regulation spread beyond conventional domains, namely the environment, public health or safety, i.e. physical risks, to encompass risks to intangible values, i.e. individual rights and freedoms, presumably harder to assess and manage. Strikingly, the reform has been accompanied by a confident discourse by EU institutions, and their avowed belief in the reform’s ability to safeguard the fundamental right to data protection in the face of evolving data processing techniques, specifically, big data, the Internet of Things, and related algorithmic decision-making. However, one may wonder whether there isn’t cause for concern in view of the way the risk-based approach has been designed in the data protection legislation. In this article, the risk-based approach to data protection is analysed in the light of the reform’s underlying rationality. Comparison with the risk regulatory experience in environmental law, particularly the environmental impact assessment procedure, is drawn upon to assist us in pondering the shortcomings, as well as the opportunities of the novel risk-based approach.

Digital protectionism? Antitrust, data protection, and the EU/US transatlantic rift

EU authorities increasingly take antitrust and data protection enforcement action against US internet companies. While many believe in digital protectionism, this paper looks at the foundations of data protection and antitrust policies across the Atlantic to propose an alternative explanation based on the distinct views over how online markets work and should be regulated. Europeans associate data protection with inalienable rights, Americans treat data as an asset. Europeans use competition policy to advance personal freedom, US antitrust policy focuses on economic efficiency. These singular EU traits encourage the regulation of major internet companies. While the European mistrust of data amassing by private parties supplies political motivation to rein in on digital giants, its competition law framework provides a toolkit capable of overcoming challenges commonly present whenever regulators take antitrust enforcement action against Big Data firms. The US does not share either. This indicates that the EU/US divide over internet regulation will grow - and transatlantic tensions perilously increase. The paper concludes by arguing for an adjusted role for economic reasoning in antitrust enforcement as a way to bridge differences.

Examining data protection enforcement actions through qualitative interviews and data exploration

ABSTRACTAs data breaches continue to increase, data controllers face persistent obstacles in maintaining the security of personal data. The existing literature has focused on the rules creating the legislative architecture, with limited attention on evaluating the means and results of enforcement. In this work, regulatory action of the data protection authorities is evaluated using the legal and regulatory information, particularly with respect to (a) the quantum and type of cases reported to the data protection authority; (b) the types of data breach instances that are chosen to intervene by the regulator; and (c) the threshold of liability that has been established in these types of cases by the courts. This study uses public data provided by the Information Commissioner's Office, the data protection authority in the United Kingdom, with specific focuses on its provision of penalties and enforcement notices. An empirical analysis of penalties is provided, giving novel insight into regulatory outcomes. Furthermore, semi-structured interviews are undertaken with case workers to understand their considerations when investigating. Responses from case workers highlight the complexity in discerning which organizational and technical measures should give rise to liability.

Antitrust Enforcement in Big Data Markets: What is the Role of Privacy and Antitrust Cultures?

EU authorities increasingly take antitrust and data protection enforcement action against US internet companies. While many believe in digital protectionism, this paper looks at the foundations of data protection and antitrust policies across the Atlantic to propose an alternative explanation based on the distinct views over how online markets work and should be regulated. Europeans associate data protection with inalienable rights, Americans treat data as an asset. Europeans use competition policy to advance personal freedom, US antitrust policy focuses on economic efficiency. These singular EU traits encourage the regulation of major internet companies. While the European mistrust of data amassing by private parties supplies political motivation to rein in on digital giants, its competition law framework provides a toolkit capable of overcoming challenges commonly present whenever regulators take antitrust enforcement action against Big Data firms. The US does not share either. This indicates that the EU/US divide over internet regulation will grow - and transatlantic tensions perilously increase. The paper concludes by arguing for an adjusted role for economic reasoning in antitrust enforcement as a way to bridge differences.

The “Riskification” of European Data Protection Law through a two-fold Shift

The importance of the concept of risk and risk management in the data protection field has grown explosively with the adoption of the General Data Protection Regulation (2016/679). The article explores the concept and the role of risk, as well as associated risk regulation mechanisms in EU data protection law. It shows that with the adoption of the General Data Protection Regulation there is evidence of a two-fold shift: first on a practical level, a shift towards risk-based data protection enforcement and compliance, and second a shift towards risk regulation on the broader regulatory level. The article analyses these shifts to enhance the understanding of the changing relationship between risk and EU data protection law. The article also discusses associated potential challenges when trying to manage multiple and heterogeneous risks to the rights and freedoms of individuals resulting from the processing of personal data.

The EU data protection reform and the challenges of big data: remaining uncertainties and ways forward

ABSTRACTAs the first broad reform of the EU data protection legislation is being achieved, and notwithstanding EU institutions’ confident discourse, scepticism remains about the reform’s ability to safeguard the fundamental right to data protection in the face of evolving data processing techniques underlying so-called big data. Yet, one might wonder whether the cause for this difficulty should be ascribed mainly to technological progresses that the law finds it hard to deal with or rather to the policy choices embedded in the legal reform itself. Indeed, a new data protection enforcement model is being adopted, which relies heavily on risk assessment and management by the data controllers themselves. Likewise, data protection authorities see their supervisory role significantly weakened. These developments and the underlying rationality are discussed. Given the limitations of the risk-based approach as currently devised, we suggest that it be reappraised in consideration of risk regulatory experiences in other domains.

European Data Protection Regulation and Online New Media: Mind the Enforcement Gap

Data Protection Authorities (DPAs) play a critical role in shaping and applying the regulation applicable to online media expression within the European Economic Area. Drawing on seven ubiquitous types of online new media actors, a comprehensive survey of these authorities was undertaken. It found that European DPAs generally adopt an expansive interpretation of data protection and a constrained understanding of freedom of expression in this space. In contrast, data protection enforcement is weak and lacking in harmonization. Except for street mapping services, each type of online media actor had only faced relevant enforcement action from a minority of these agencies. DPA financial resourcing is very limited. Notwithstanding the development of DPA ‘network governance’, only DPAs with a particularly extensive interpretative stance proved likely to have engaged in extensive enforcement activity. It remains unclear what difference the General Data Protection Regulation will make to resolving this enforcement gap and its related problems.

Online dispute resolution: Settling data protection disputes in a digital world of customers

In this article online dispute resolution (ODR) and alternative dispute resolution (ADR) are assessed in relation to the protection of personal data. ODR and ADR schemes are mechanisms to settle low-cost e-commerce disputes out-of-court. The purpose of this analysis is to examine the suitability of online dispute resolution as an additional means to the existing mechanisms for data protection enforcement. In this discussion particular attention is given to services offered to users as ‘free’, but which instead process personal data as a condition on access (e.g. social networking sites). The second section examines data protection in the digital age, highlighting the key principles of data protection and the challenges associated with the existing enforcement mechanisms. The third section questions the suitability of online dispute resolution as a solution for data protection enforcement in the European Union. In order to avail of the EU regulated ODR mechanism to resolve data protection issues, data protection disputes must fall under the scope of the Alternative Dispute Resolution Directive and the Online Dispute Resolution Regulation. Following an analysis of the applicability of the framework in this context, the final part of this article focuses on the challenges associated with the application of ODR schemes to the enforcement of online data protection disputes.

Potestades sancionatorias en el proyecto de reforma a la Ley No. 19.628 de protección de datos personales. Una crítica

This paper analyzes the sanctioning powers vested upon the competent authorities in the Amendment Project for Act Number 19.628 on personal data protection. For such purpose, the Spanish sanctioning model for data protection enforcement is analyzed, thus providing elements to criticize and review the institutional configuration chosen in our Amendment Project, which, as we will show, is inadequate for an effective protection of the fundamental right to informational self-determination.