Digitale Gesellschaft e.V.

European Commission Didier Reynders Commissioner for Justice Berlin, 29 April 2020 Improving the GDPR to protect our rights and freedoms: Recommendations from German digital rights group Digitale Gesellschaft and the German Federation of German Consumer Organisations (vzbv) Dear Commissioner Didier Reynders, the GDPR has raised awareness for the issue of data protection, led organizations to clean up their data processing practices and, last but not least, helped establishing and improving institutions for enforcing data protection. Yet, the GDPR is far from perfect. However, a number of shortcomings can and should be addressed via implementation or complementing legislation. With the following intervention, we want to highlight a number of aspects we deem of special relevance. Enforcement is still falling short.

…we want to highlight a number of aspects we deem of special relevance. Enforcement is still falling short. International manufacturers and providers that run our digital infrastructures continue violating our fundamental rights and freedoms. Among others, news media, health websites and even some children's websites put our rights at risk by broadcasting personal data to hundreds of tracking companies. This is followed up by them generating individual profiles about each and every one of us. The increasing impact of algorithmic decision-making, especially based on so-called “artificial intelligence”, remains out of control for individuals and society as a whole, despite the efforts of the GDPR. Following related guidance from data protection authorities, academics and others, we suggest the following eight recommendations for the evaluation of the GDPR from a civil society perspective:

…others, we suggest the following eight recommendations for the evaluation of the GDPR from a civil society perspective: 1. Delivering on Privacy Icons 2. Closing the Loopholes regarding automated individual decision-making 3. Specifying the Rules for Profiling 4. Establishing Rules against User Tracking 5. Regulating Data Brokers 6. Holding Manufacturers accountable 7. Automating Data Protection 8. Beyond GDPR

Tracking 5. Regulating Data Brokers 6. Holding Manufacturers accountable 7. Automating Data Protection 8. Beyond GDPR 1. Delivering on Privacy Icons The GDPR provides for the possibility to create more transparency on data collection and processing by means of privacy icons (Article 12(8) and recital 166). The Commission should urgently make use of the opportunity to strengthen the position of citizens in the data economy by means of EU-wide harmonized data protection pictograms. In doing so, it should continue the risk-based approach of the GDPR by introducing not only simplified visualisations for different types of data and processing purposes, but also for the specific risks to the rights and freedoms of natural persons. 2.

…of data and processing purposes, but also for the specific risks to the rights and freedoms of natural persons. 2. Closing the Loopholes regarding automated individual Decision-making Article 22 of the GDPR establishes a general prohibition on decisions based solely on automated processing as long as these decisions “produce legal effects or similarly Ref. Ares(2020)2299432 - 29/04/2020 significantly affect” the data subject. However, the provisions of Article 22 are prone to be loop holed for narrowing its scope. At the same time, the application of automated decision-making becomes more and more relevant. We recommend that the European Data Protection Board addresses the most pressing issues of Article 22 by issuing further guidance on automated decision-making pursuant to Article 70(1) lit. d.

…issues of Article 22 by issuing further guidance on automated decision-making pursuant to Article 70(1) lit. d. There is ample need to clarify, first, that the word “solely” in paragraph 1 cannot be interpreted in a way that a mere formal human intervention hinders the application of Article 22. Second, the word “similarly” in paragraph 2 presents another potential loophole. It should be clarified that important uses cases of automated decision-making are covered. Relevant examples are automated content regulation and targeted advertising since they similarly affect citizens' rights and freedoms. Third, the blanket exemption for cases where automated decision-making is “necessary for entering into, or performance of, a contract” in paragraph 3 allows discriminatory practices that exclude people from, e.g., services of the information society or other essential products and services.

…practices that exclude people from, e.g., services of the information society or other essential products and services. The European Data Protection Board should recommend legitimate use cases for automated decision-making in the context of contracts. All other use cases should be subject to a data protection impact assessment according to Article 35(4) and prior consultation pursuant to Article 36 of the GDPR.

…data protection impact assessment according to Article 35(4) and prior consultation pursuant to Article 36 of the GDPR. 3. Specifying the Rules for Profiling Profiling addresses a broad number of different cases. From simple customer data bases containing names and home addresses to systems processing detailed user interaction histories down to the second. When it comes to profiling, a more nuanced approach and a more general discussion on its limits are needed. As a start, controllers must be held accountable for building up profiles even if they do not lead to automated decision-making, especially if the profiles are rich in data. The European Data Protection Board should issue an opinion that classifies different legitimate uses cases of profiling according to their risks for the rights and freedoms of data subjects, along with recommendations for appropriate technical and…

…rights and freedoms of data subjects, along with recommendations for appropriate technical and organisational measures. 4. Establishing Rules against User Tracking Every time European citizens use the web they are reminded that GDPR does not work as intended. Most people cannot control the data that is collected about their online behaviour. While everyone knows that Google and Facebook are big in targeted advertising, data about people’s online behaviour is also collected and shared by dozens and hundreds of other companies most people never heard of. This leads to chilling effects on freedom of speech and information, since people always have to wonder where the information about their online behaviour and reading habits is going to end up. To resolve this issue, the EU needs to adopt a strong E-Privacy Regulation to accompany the GDPR as it was intended in the first place.

…issue, the EU needs to adopt a strong E-Privacy Regulation to accompany the GDPR as it was intended in the first place. Communication and data about online behaviour is so sensitive that it needs the strongest protection possible. The technical standard called “Do Not Track” still poses an interesting approach. Yet, “Do Not Track” must be accompanied by a legally binding instrument. In particular, real-time bidding in online advertising needs to be tackled. Users must have the chance to understand and disable the streams of information about their online behaviour that is triggered every time an online advertisement is shown in their browser. Website providers must be held accountable as joint controllers when enabling third parties to collect data on their site. If both is not possible, real-time bidding must be banned in general.

…third parties to collect data on their site. If both is not possible, real-time bidding must be banned in general. 5. Regulating Data Brokers Absent public scrutiny, a billion-dollar data brokering business has emerged in recent years. Specialised companies collect data about people from all kinds of sources – from browser data to shopping behaviour – and combine this data in individual profiles to be marketed to other companies. Neither individuals nor data protection authorities have sufficient insight into data brokering. The GDPR does not explicitly address this issue. For the GDPR, trading personal data is a processing operation like any other. In addition, the Directive 2019/770 on certain aspects concerning contracts for the supply of digital content and digital services fails to address data brokerage. We recommend that the General Data Protection Regulation be supplemented by…

…in personal data. In principle, personal data should not be traded, except in specified cases acceptable to society. 6. Holding Manufacturers accountable Data protection-enhancing technologies are still largely missing on the European market. Manufacturers must be obliged to implement data protection by design and by default mechanisms (Article 25) as well as security mechanisms (Article 32) into ICT systems to enable end-users to protect their fundamental rights and freedoms, and help controllers and processors to comply with their data protection obligations. Without ICT manufacturers being held accountable, security and data protection mechanisms cannot be built into the systems themselves. In addition, it is often the ICT manufacturers determining the purposes and means of the processing of personal data. Thus, they can be held accountable according to the GDPR. We recommend that…

14 → 12

originalus šaltinis (PDF) ↗