HOMO DIGITALIS ΑΣΤΙΚΗ ΜΗ ΚΕΡΔΟΣΚΟΠΙΚΗ ΕΤΑΙΡΕΙΑ

Homo Digitalis: Input For European Commission 2024 Report on the Application of the GDPR HOMO DIGITALIS: INPUT FOR EUROPEAN COMMISSION 2024 REPORT ON THE APPLICATION OF THE GDPR 6 February 2024 This report was drafted by members of Homo Digitalis, as per the official questionnaire of the European Commission available here. Homo Digitalis has answered only questions in which it could provide meaningful input, based on its role and experience. The numbering follows the numbering of the official questionnaire. A FEW WORDS ABOUT HOMO DIGITALIS Homo Digitalis is the first civil society organization in Greece with the goal to protect and promote digital rights. We envisage a fair, open & transparent digital era, in which technology enables people’s prosperity, proactively balancing progress with human rights respect. Our mission is to raise awareness & protect digital rights and freedoms. We…

Ares(2024)887708 - 06/02/2024 Homo Digitalis: Input For European Commission 2024 Report on the Application of the GDPR 1. General comments a. What is your overall assessment (benefits/challenges, increase in trust and awareness, etc.) of the application of the GDPR since May 2018? Are there priority issues to be addressed? Reflecting on the implementation of the General Data Protection Regulation (GDPR) since May 2018, our overall assessment is positive. (i) The GDPR has undeniably served as a cornerstone in establishing strong guidelines for member states, setting a comprehensive framework for elevated data protection standards. (ii) Over the course of its five-year tenure, GDPR has played a pivotal role not only in safeguarding individuals' privacy but also in cultivating a heightened awareness among citizens regarding their data protection rights.

…privacy but also in cultivating a heightened awareness among citizens regarding their data protection rights. Data subjects are more aware of their rights and are increasingly exercising them, as evidenced by the gradual increase in the number of complaints filed with the Hellenic Data Protection Authority (HDPA) in case of violations. (iii) In addition, private companies, acting as data controllers or data processors, have taken legal and technical measures to ensure the compliance with the GDPR and the implementing Greek Law No. 4624/2022;1 and (iv) the number and amount of imposed penalties by HDPA have progressively increased since 2018. However, within the successes, several challenges persist. (i) One of the notable issues revolves around the diverse approaches taken by member states in implementing the GDPR.

(i) One of the notable issues revolves around the diverse approaches taken by member states in implementing the GDPR. While the flexibility 1 There is no data available to show the number of companies that have adopted GDPR compliance measures. Homo Digitalis: Input For European Commission 2024 Report on the Application of the GDPR provided for specialization through national legislations can be beneficial, it simultaneously introduces a level of disparity that may impede the harmonization of data protection practices across the European Union. This calls for a more in-depth exploration to ensure a consistent application of the regulation, fostering a unified data protection landscape. (ii) The effective management of data transfers and the promotion of collaboration among data protection authorities pose significant hurdles.

…of data transfers and the promotion of collaboration among data protection authorities pose significant hurdles. These challenges need careful consideration to facilitate smoother cross- border data flow and enhance cooperation among entities responsible for enforcing the GDPR. (iii) Many companies are still treating GDPR as a “checklist” obligation and have not actively adopted a data protection culture. (iv) There are many challenges related to the delay by data controllers in fulfilling the rights of data subjects. (v) The level of fines imposed by the HDPA is disproportionate to the size of certain companies, and the imposition of fines does not act as a deterrent. As a result, there is uncertainty as to whether the fines actually serve the purpose of preventing the recurrence of unlawful processing in the future.

…as to whether the fines actually serve the purpose of preventing the recurrence of unlawful processing in the future. (vi) Incomplete knowledge and abusive use of GDPR provisions by certain data processors and their employees have been used as a shield to conceal information. For example, representatives of public authorities and private companies have denied lawful access to personal data and even non-personal data (e.g.

…of public authorities and private companies have denied lawful access to personal data and even non-personal data (e.g. documents) because they wrongly perceive the access as unlawful; customer service representatives have refused to introduce themselves because they believe they are allowed to do so by virtue of the GDPR, leading to uncertainty in the customer service Homo Digitalis: Input For European Commission 2024 Report on the Application of the GDPR experience; data controllers have not based the processing of special categories of personal data on Article 6 because they consider the sole application of Article 9 to be sufficient, whereas, correctly interpreted, any processing of special categories of data should be based on the combined application of Articles 6 and 9. (vii) There is a lack of training services for technical compliance with the GDPR.

…of Articles 6 and 9. (vii) There is a lack of training services for technical compliance with the GDPR. The technical and organisational measures are very often poorly implemented, due to a lack of know-how and the absence of institutions that could provide training and practical guidance. (viii) The recent “pay or okay” method used in consideration for the provision of digital services (e.g. for access and use of social media) has confused many data subjects about the extent to which they can control their personal data. (ix) Lastly, an emerging concern revolves around the handling of Inferred Data, an aspect not explicitly addressed in the regulation's text. Inferred data refers to information that is deduced or derived from existing data through analysis, interpretation, or processing.

…refers to information that is deduced or derived from existing data through analysis, interpretation, or processing. It involves drawing conclusions, making assumptions, or predicting additional details based on the available information. This type of data is often generated through advanced analytics, machine learning algorithms, or artificial intelligence systems that can identify patterns and correlations within datasets, enabling the extraction of implicit information. This omission has created a significant gray zone for enterprises, as the lack of specific guidelines regarding inferred data has led to uncertainty in interpreting and implementing compliance measures.

…guidelines regarding inferred data has led to uncertainty in interpreting and implementing compliance measures. This ambiguity poses challenges in establishing clear boundaries for data processing practices, potentially allowing for unintended consequences and ethical concerns related to the Homo Digitalis: Input For European Commission 2024 Report on the Application of the GDPR use of inferred data in the absence of explicit regulatory guidance. As technology continues to evolve, there is a growing need for regulatory frameworks to address these emerging challenges and provide clarity on the responsible use of inferred data within the context of data protection laws. In conclusion, while celebrating the successes of the GDPR, it is essential to address these challenges.

In conclusion, while celebrating the successes of the GDPR, it is essential to address these challenges. To ensure that the GDPR continues to evolve as an effective tool in safeguarding the privacy rights of individuals in the digital age there is need to harmonize national implementation, streamline data transfers, shorten the response time of companies by creating incentives for compliant companies (e.g. getting a tax reduction) and disincentives for non-compliant companies (e.g. automatic calculation of a fee in case no response is proven by the HDPA). There is also need to shorten the response time of data protection authorities to issue a judgment; to impose higher penalties that can act as a deterrent and that are actually proportionate to the annual turnover of companies; to launch guidance tools to prevent misinterpretation and misuse of the GDPR (e.g.

…to the annual turnover of companies; to launch guidance tools to prevent misinterpretation and misuse of the GDPR (e.g. Q&A on the correct use of the GDPR); to support technical compliance; to clarify the picture on the lawful use of data by companies as a means of payment, rather than maintaining the vagueness on the nature of personal data, as the latter can be used against the interests of data subjects; and to provide clarity on Inferred Data.

61 → 12

originalus šaltinis (PDF) ↗