Interesų grupė
Response to the roadmap of the European Commission’s report on the General Data Protection Regulation (GDPR) 29 April 2020 Contents 0. SUMMARY......................................................................................................................................1 1. WHO WE ARE.................................................................................................................................1 2. ABOUT THIS SUBMISSION..........................................................................................................2 3. OUR EXPERIENCE WITH THE COOPERATION MECHANISM..............................................2
OUR EXPERIENCE WITH THE COOPERATION MECHANISM..............................................2 4. OUR FEEDBACK............................................................................................................................2 4.1 Passive approach by Supervisory Authorities............................................................................2 4.2 Divergent and conflicting standards over the admissibility of complaints................................3 4.3 Lack of information concerning the progress of the complaints to complainants.....................3 4.4 Long duration of the proceedings..............................................................................................4 5. CONCLUSION................................................................................................................................5
.......................................................................................................................5 6. APPENDIX: SURVEY METHODOLOGY AND RAW DATA......................................................6 Ref. Ares(2020)2297963 - 29/04/2020 0. SUMMARY We first present the Civil Society Organisations which are submitting this input and the complaints we lodged, which allowed us to observe the functioning of the cooperation mechanisms provided by chapter VII of the GDPR. We then provide a detailed feedback of the issues we encountered, alongside some policy recommendations which we believe could address such shortcomings. Finally, we explain the methodology we used to survey the complainants and organisations involved, and whose feedback has informed our submission.
…we used to survey the complainants and organisations involved, and whose feedback has informed our submission. In particular, our experience highlighted: • A substantially passive attitude of the Supervisory Authorities in the handling of complaints; • Divergent and conflicting standards over the admissibility of complaints; • Lack of information concerning the progress of complaints to the complainants; and • Long duration of the proceedings. In short, cross border complaints are not effectively tracked or resolved at present: the root cause is to be found in the way the One-Stop-Shop mechanisms was implemented, as Supervisory Authorities lack the means and encouragement to take an active stance in the resolution and enforcement of complaints.
…lack the means and encouragement to take an active stance in the resolution and enforcement of complaints. We believe such shortcomings can be tackled without resorting to legislative changes, but rather by implementing appropriate guidelines and procedures which can allow Supervisory Authorities to effectively work together in all stages of the complaint. We also find Supervisory Authorities to be ill-equipped to meet their new tasks, and assert enforcement decisions against well-resourced technology companies: we therefore call on Member States to provide proper financial means to their national Supervisory Authorities, and on the European Commission to ensure that Member States meet their obligations under Article 52(4) of the GDPR. 1.
…and on the European Commission to ensure that Member States meet their obligations under Article 52(4) of the GDPR. 1. WHO WE ARE Open Rights Group (ORG) is a UK-based digital campaigning organisation working to protect fundamental rights to privacy and free speech online. With over 3,000 active supporters, we are a grassroots organisation with local groups across the UK. We have worked on GDPR and other issues such as data retention, and were a party in the Watson case at the CJEU. Our current focus includes the free expression impacts of content moderation and ‘online harms’ regulatory proposals, alongside surveillance and encryption policy, the use of personal data in the COVID-19 pandemic, data protection enforcement, online advertising and the use of personal data by political parties. We are a member of European Digital Rights (EDRi).
…advertising and the use of personal data by political parties. We are a member of European Digital Rights (EDRi). Panoptykon Foundation is a Polish watchdog NGO with the mission to protect fundamental rights in the context of growing surveillance and fast-changing information technologies. We believe in „watching the watchers” and consider data a source of power. Therefore we keep an eye on entities that collect and use personal data in order to influence people (public authorities, intelligence agencies, business corporations). On the legal front we keep track of new legislation, develop alternative regulatory solutions and intervene to protect human rights. In our advocacy we address both policymakers and business lobbies. Through our research and investigations we expose risks related to commercial and public surveillance in order to raise public awareness.
…and investigations we expose risks related to commercial and public surveillance in order to raise public awareness. We visualize 1 collected data and engage in artistic collaborations in order to reach broader audience. Since 2010 we have been active member of European Digital Rights (EDRi). The Civil Liberties Union for Europe (Liberties) is a non-governmental organisation promoting the civil liberties of everyone in the European Union (EU). We are headquartered in Berlin and have a presence in Brussels. Liberties is built on a network of national civil liberties NGOs from across the EU. Currently, we have member organisations in Belgium, Bulgaria, the Czech Republic, Croatia, Estonia, France, Hungary, Ireland, Italy, Lithuania, Poland, Romania, Spain, Slovenia, the Netherlands and associated partners in Germany and Sweden.
Italy, Lithuania, Poland, Romania, Spain, Slovenia, the Netherlands and associated partners in Germany and Sweden. We intend to keep expanding our membership to include NGOs from all 27 EU countries. 2. ABOUT THIS SUBMISSION We are glad to see the Commission reaffirming the objective to strengthen individuals’ rights to data protection with the Communication “Data protection rules as a trust-enabler in the EU and beyond – taking stock”, both as means to promote the adoption of sound data management practices by business and organisations, and to drive public trust within an increasingly data driven economy. With this regard, Open Rights Group, Panoptykon Foundation and Liberties worked together for the last years to address online advertising data processing practices, raising a number of complaints to different National Supervisory Authorities. Within this context, we observed some…
VII of the GDPR, and we welcome the opportunity to contribute to the Commission report on the application of the GDPR. 3. OUR EXPERIENCE WITH THE COOPERATION MECHANISM On September 12, 2018, we filed two complaints to the Supervisory Authorities of Ireland and the UK, seeking action against Google and the Interactive Advertising Bureau breaches of the data protection regime, as well as the initiation of a wider investigation of adtech data protection practices. Additional complaint were filed in 2019 to the Supervisory Authorities of Poland, The Netherlands, Spain, Luxembourg, Belgium, Germany, Hungary, Italy, Bulgaria, Romania, Estonia, Slovenia, France and Czech Republic, for a total of 21 Supervisory Authorities being involved in the action.
Estonia, Slovenia, France and Czech Republic, for a total of 21 Supervisory Authorities being involved in the action. These complaints were all supported by compelling evidence, validated by a number of reports and press statements released by the Supervisory Authorities. In our experience, however, Supervisory Authorities have failed to address these findings with appropriate regulatory action, resulting in the absence of any significant change of behaviour by the industry and, ultimately, in the continuation of a systemic breach of the data protection rights of the complainants and EU citizens at large. In particular, we encountered a passive approach by Supervisory Authorities, diverging and conflicting standards over the admissibility of complaints, lack of information concerning the progress of the complaints, and long duration of the proceedings.
…of complaints, lack of information concerning the progress of the complaints, and long duration of the proceedings. All these aspects are further substantiated in the following paragraphs. 4. OUR FEEDBACK 4.1 Passive approach by Supervisory Authorities In our experience, Supervisory Authorities have shown a substantially passive attitude in the handling of the proceedings: fifteen Supervisory Authorities merely assigned a Registration Number to the complaint being issued or referred their claim to a Lead Supervisory Authority, without any further communication to the complainant. Another SA expressly instructed the complainant to 2 contact the Lead Supervisory Authority to obtain updates about the complaint, which the complainant did with no avail. Finally, three Supervisory Authorities did not reply at all. Recommendations: We believe that Concerned Supervisory Authorities should be…
40 → 12