Eight months after the entry into force of the General Data Protection Regulation (GDPR) and in view of International Data Protection Day on 28 January, the time has come to take stock. On Friday 25 January, the European Commission unveiled a series of data on the implementation of European rules.
All in all, the institution considers that the positive effects of the new rules are already visible and that citizens are increasingly exercising their right to have their personal data protected.
95,180 complaints from European citizens have been received by European data protection authorities since the entry into force of the Regulation last May. 60,000 complaints had already been registered in November, but it was between December 2018 and January 2019 that a peak was recorded, with an additional 30,000 complaints. Companies also reported a total of 41,502 data violations to their national authorities.
According to the Commission, most complaints concern telemarketing activities, promotional e-mails or video surveillance activities.
By January 2019, 255 investigations had been launched by the European data protection authorities. Several cases are ongoing and could result in fines of up to 4% of the companies' annual worldwide turnover.
So far, only three fines have been imposed: - a fine of €20,000 in Germany to the social network Knuddels for not securing its users' data; - a fine of €5,280 in Austria for a sports betting café for illegal video surveillance; - the record fine of €50 million imposed this week on Google by the French authority for not obtaining valid consent for the personalisation of advertising (see EUROPE 12176).
The Commission also wants to wage war on the misinformation that is circulating about the regulation. In a document, it also points out that violation of the rules does not automatically lead to a fine and that warnings and injunctions are also instruments used by data protection authorities.
As far as implementation by Member States, the Commission considers it to be "well advanced" and requests the remaining five countries - Bulgaria, Greece, Slovenia, Portugal and the Czech Republic - to adapt their legal framework to the new EU rules as soon as possible. (Original version in French by Marion Fontana)