US GDPR, to most people, is either a complicated, draconian regulation that limits our capability to trade effectively or as a confirmation that our privacy will be safeguarded. It is none.
The protections are not all that they’re pushed out to be.
We need to ensure that there is effective enforcement of GDPR across Europe if we are to reap the benefits of the privacy protections afforded by the law. While there has been a level of enforcement in many countries, this has been relatively low. In actuality, the headline-grabbing fines of u to 4% of global revenue have not been applied.
Unfortunately, the responsibility of enforcement does not fall evenly on all the Facebook Irish data protection authorities (DPAs). As the Irish government has used tax incentives to entice the majority of the big tech firms to discover the headquarters in Ireland, much of the burden and most complaints have dropped to the Data Protection Commission (DPC).
Irish Data Protection Commission (DPC)
The issue is that the Irish DPC has been extremely inactive. It is reported to have “handled” 99,93% of GDPR complaints without calling any decision on them. And as of May 2021, it was the lead supervisory authority for 164 such cases of pan-European significance, based on the based research by the Irish Council of Civil Liberties (ICCL), but 98% of these cases remained unattended.
Being the growing supervisory for most big tech giants, the Irish DPC gets more cross-border referrals than any other DPA.
Whether the Irish DPC Facebook is underfunded or whether the Irish government is unwilling to permit it to rock the boat and annoy the tech giant that it has attracted is probably less relevant than the impact that its lack of enforcement is having.
Mindful of the risk that such inaction will undermine not only the privacy right of all EU citizens but also the credibility and actions of the other DPAs across the rest of the EU, the European Parliament voted 541 to 1 to adopt a resolution calling on the European Commission to start infringement approaches against Ireland, over its lack of GDPR enforcement.
The DPC avoided taking action by delaying the case with a referral to the EU high court (CJEU) in the case of one exceptionally high profile complaint brought by privacy campaigner Max Schrems of NOYB against Facebook. Even after the CJEU ruled against Facebook, the Facebook Irish data protection commission still sat on its hands, and a complaint was lodged with the Irish High Court, which oversaw that the DPC was obliged to implement the CJEU decision without delay a result, halt EU-US transfers.
The restrictions aren’t all that they’re made out to be either
