Four years on: What have we learned from GDPR?
Several studies have found that many companies are not compliant with key requirements either of the US or EU data privacy regulations. A recent data privacy research report by CYTRIO uncovered the fact that 90% of companies are not fully compliant with US data privacy regulations, including CCPA and CPRA Data Subject Access Request (DSAR) requirements. Alarmingly, a further 95% of companies are using error-prone and time-consuming manual processes for GDPR DSAR requirements.
If it is only responsible companies that are even attempting to comply with privacy regulations, then this becomes a cost or tax on them and represents a competitive advantage for irresponsible ones that don’t abide by the rules at all.
At the outset, all the headlines about GDPR were about the proposed fines. And indeed there have been numerous fines amounting to a great deal of money. According toDLA Piper, nearly €1.1bn in fines were handed out last year. These related to a total of 356 breach notifications a day – a sevenfold increase on last year’s total.
Given the continued and widespread lack of compliance, unfortunately the fines appear not to be working as a deterrent but instead tend to be an additional cost for those unfortunate enough to have suffered a data incident. Many of those fined had taken reasonable measures but had either suffered from unforeseen mistakes or been the victims of attacks and had then been fined once the ICO had been notified.
Meanwhile, it is unknown how many companies that, having been less responsible and then covering up their mistakes and choosing not to submit breach notifications, have gone on to avoid fines entirely.
Nowhere has non-compliance appeared more obvious, evident and controversial than when it comes to BigTech. Arguably some of the largest data abusers have been the tech giants whose business model relies on data exploitation. Following the ‘Schrems II’ ruling against Facebook in the European Court of Justice that overturned Privacy Shield, it was expected that the Irish regulator would take immediate action against the social media giant. However, the Irish regulator initially dragged its heels, appearing not to want to upset the tech giants that had chosen to base their European headquarters within its jurisdiction. Even after it was sanctioned by a vote in the European parliament of 541 to 1 for its inaction, it chose to collaborate with Facebook on a workaround that risked undermining GDPR, rather than actually enforce the regulation.
Leaked internal documents show that Facebook (AKA Meta) designed its ad system in a totally unsiloed way. Without completely re-engineering it from top to bottom, the firm simply cannot hope to comply with GDPR’s requirement for a legal basis for each use of personal data. Aware of this, senior management chose to invest in lobbying and legal appeals, rather than invest in any such fundamental technical reform. Regulatory fines along with lobby and legal costs were seen as a lower-cost tactic than reform and compliance would have been. And with the Irish DPC seemingly unwilling to act, the chances of the Schrems ruling being enforced and them having to cease business in the EU remains low.
As a seasoned campaigner on such issues, my personal mantra has always been to seek to strike the right balance between meaningful protection (digital ethics, privacy and cybersecurity) and the maximisation of economic and social value (cloud, digital transformation and innovation).
At present we have the worst of both worlds – there is little in the way of meaningful protection, given the lack of enforcement.
