Brussels sets out to fix the GDPR

New law to solve enforcement flaws of the GDPR could open a Pandora’s box of lobbying and regulators’ infighting.

Brussels sets out to fix the GDPR -0
Source: Shutterstock.com

The European Union is (finally) coming to grips with the dysfunctionalities of its most famous tech law of all: the General Data Protection Regulation.

The European Commission will propose a new law before the summer that’s aimed at improving how EU countries’ privacy regulators enforce the GDPR, a newly published page on its website showed.

Adopted in 2016, the privacy rulebook was a watershed moment in global tech regulation, forcing companies to abide by new standards such as asking for consent to collect people’s data online against threats of hefty fines of up to 4 percent of global annual turnover. The law effectively became European officials’ poster child of powerful legislation coming out of Brussels.


But five years after EU data protection authorities started their job, as GDPR entered into force, activists, experts and some national privacy watchdogs have become frustrated at what they see as an inefficient system to tackle major cases, especially from Big Tech companies.

Most notably, critics have lamented the powerful role that the Irish Data Protection Commission has under the so-called one-stop shop rule, which directs most major investigations to run through the Irish system because tech companies like Meta, Google, Apple and others have set up their European homes there. Under the GDPR, tech companies are overseen by the national regulator in the EU country where they are headquartered.

Ireland and, to a lesser extent, Luxembourg, where Amazon’s EU headquarters is based, have faced mounting criticism in recent years for lax enforcement, which they deny. The Irish data authority in recent months imposed some major multimillion-euro fines to sanction GDPR infringements from Meta, the parent company of Instagram and Facebook.

Now, a new EU regulation that is expected in the second quarter of 2023 wants to set clear procedural rules for national data protection authorities dealing with cross-border investigations and infringements. The law “will harmonize some aspects of the administrative procedure” in cross-border cases and ” support a smooth functioning of the GDPR cooperation and dispute resolution mechanisms,” the Commission wrote.

Europe’s data protection authorities last year pledged to ramp up cooperation to tackle cases of strategic importance. The European Data Protection Board in October sent the Commission a “wishlist” of procedural law changes to improve the enforcement. Among the ideas are setting deadlines for different procedural steps in the handling of a case and harmonizing the rights of different parties involved in investigations across the EU.

“I think there are parts of the GDPR that definitely have to be adjusted to the future reality,” European Data Protection Supervisor Wojciech Wiewiórowski told POLITICO in an interview last June.

The Commission wants to keep the upcoming regulation very targeted and limited — in part because it is bracing for tense discussions with data privacy watchdogs, campaigners and Big Tech lobbyists.

The GDPR is widely considered the most heavily lobbied EU law in the bloc’s history. It led to a massive expansion of Big Tech’s lobbying power in Brussels, where it now tops the ranks of the biggest spenders in influencing EU decision-making.

But it’s not just lobby groups that are expected to pounce on the Commission’s new privacy law proposal. Regulators themselves have clashed over how to interpret and enforce the GDPR, often triggering dispute resolutions and delaying cases.

The GDPR is widely considered the most heavily lobbied EU law in the bloc’s history | Oliver Hoslet/EPA-EFE
“Nobody will be happy with the Commission proposal as usual, because the data protection authorities agree on the problem but they do not agree on the solutions,” said Olivier Micol, the Commission’s head of unit for data protection which is leading the work on the policy. He was speaking at a Brussels event last month.

Non-governmental organizations want to be more involved in the procedures and companies like Google, Apple and Amazon will push back for fear of new fines, Micol said.

“Big Tech companies will not be very much happy with it because it will make the system more efficient to have more enforcement,” he said.

With the European elections looming in spring 2024, the EU executive will also have a short window of time to push its new text through the EU legislative train. The European Parliament and the EU Council, made up of the 27 EU governments, could have just a few months to negotiate their amendments to the Commission’s legislative present.

Parliaments

California nurses applaud new law that provides transparency, improves equity in nursing education
Parliaments

California nurses applaud new law that provides transparency, improves equity in nursing education

California Nurses Association, the largest union of registered nurses in the state, applauds the signing of Senate Bill 1015 by Governor Gavin Newsom. Nurses say the new law, which was authored by Senator Dave Cortese and sponsored by CNA, is an essential step towards ensuring clinical placement opportunities for California’s future nurses, particularly for students attending public institutions like community colleges and state universities.

Seychelles' parliament adopts motion to make sign language official language
Parliaments

Seychelles' parliament adopts motion to make sign language official language

The National Assembly unanimously adopted a motion to designate Seychelles Deaf Language as an official national language, marking a significant milestone for the islands' hearing-impaired populationin. The motion was brought forward by Regina Esparon, the Linyon Demokratik Seselwa (LDS) elected member for Glacis, on behalf of the Women's Parliamentary Caucus, coinciding with the Deaf Week 2024.

Ireland: New law to ban disposable vapes and restrict flavours
Parliaments

Ireland: New law to ban disposable vapes and restrict flavours

Disposable vapes will be banned and vape flavours and colours restricted under new legislation proposed by the government. The Department of Health yesterday published the general scheme of the proposed Nicotine Inhaling Products Bill, which will introduce further restrictions on nicotine inhaling products or vapes.

Brazil calls EU to suspend anti-deforestation law
Parliaments

Brazil calls EU to suspend anti-deforestation law

Brasília urges the European Commission to reconsider its anti-deforestation rules, which could potentially impact Brazil’s exports by almost US$15 billion. The European legislation passed in 2022 includes a ban on the import of products from areas deforested from 2022 onwards, even if deforestation is legal in those areas. 

UK parliament recognizes Bitcoin and digital assets as personal property
Parliaments

UK parliament recognizes Bitcoin and digital assets as personal property

The UK Parliament has introduced the Property (Digital Assets etc.) Bill today to officially and legally recognize Bitcoin $57,732.86, cryptocurrencies, and other digital assets as personal property. This new law will, for the first time, formally protect digital assets such as Bitcoin, cryptocurrency, non-fungible tokens (NFTs), and carbon credits under English law, News.Az reports citing Cointurk news.