According to the Irish Council for Civil Liberties (ICCL), in 5 years of implementation, the General Data Protection Regulation (GDPR) is “rarely” enforced against ‘Big Tech’ companies.
In a report published on Monday 15 May, the association scrutinises the cross-border final decisions under the GDPR issued by the European Data Protection Board (EDPB) from 2018 to 2022 across the EU. It found that 64% of these were merely reprimands and only 28 fines were imposed.
In addition, any EU country is the “lead authority” responsible for enforcing the GDPR for companies that have their headquarters in that country. Ireland is home to several major technology companies, including Google, Meta, Apple, TikTok and Microsoft. 87% of the cross-border complaints related to the GDPR and addressed to Ireland concern ‘Big Tech’.
However, the ICCL denounces the fact that 83% of cross-border complaints received by the Irish Data Protection Commission (DPC) only end in “amicable resolution”. However, this type of resolution should not be used for repeated offences or cases involving a large number of people, according to the EDPB guidelines.
In addition, 75% of the DPC’s decisions on GDPR violations in European cases have been overturned by the EDPB, which is demanding stricter enforcement measures, the report adds.
The ICCL stresses that this implementation with variable geometry does not seem to be linked to a lack of resources: EU data protection authorities had a combined budget of more than €320 million in 2022, which has doubled since 2016.
“The EU cannot be a regulatory superpower unless it enforce its own laws”, the association said, calling on the European Commissioner for Justice Didier Reynders to “take serious action”.
The report: https://aeur.eu/f/6xo (Original version in French by Hélène Seynaeve)