It’s been five years since the General Data Protection Regulation (GDPR) took effect in the European Union. This marked a significant step forward in the protection of personal data and privacy rights for people across the EU. However, it wasn’t just the EU that felt the impact of this regulation, as it has had far-reaching consequences around the world, and over time has led to significant changes in data protection laws globally. This article highlights our findings on how the last 5 years have been in the world of data privacy.
Special Content: Download this blogpost!
Starting with Why
The rise of social media and the widespread use of mobile devices has made it easier than ever for companies to collect and use personal data, leading to concerns about how this data is being used and who has access to it. The Cambridge Analytica scandal, where personal data was harvested from millions of Facebook users without their consent, was a wake-up call for many people about the potential dangers of sharing personal information online.
Furthermore, the increasing use of artificial intelligence and machine learning has raised questions about how personal data is being used to train these systems. There is a risk that biased or discriminatory algorithms could be created if the data used to train them is not diverse or representative of the population as a whole.
Overall, the need for GDPR was driven by a growing awareness of the importance of protecting personal data in an increasingly digital world. The regulation aims to give individuals more control over their data and ensure that companies are held accountable for how they collect, use, and store it.
When did GDPR discussions begin?
Our fundamental right to privacy is enshrined in Article 8 of the Charter of Fundamental Rights of the European Union. Article 8 of the EU Charter of Fundamental Rights states: Everyone has the right to the protection of personal data concerning him or her. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law.
The discussions around GDPR began back in 2012, with the European Commission taking the lead in identifying the need for reform of data protection laws.
At the time, the digital landscape was rapidly evolving, and it was becoming increasingly clear that existing data protection laws were no longer fit for purpose. The rise of social media, cloud computing, and big data had created new challenges for data protection, which called for a more robust and comprehensive approach.
As a result, the European Commission launched a wide-ranging consultation process, engaging with stakeholders from across the public and private sectors to gather their views on how data protection laws could be improved.
Over the course of several years, the Commission received thousands of responses from businesses, consumer groups, and other interested parties. These responses helped to shape the development of the General Data Protection Regulation (GDPR)..
The new regulation represented a significant overhaul of the previous data protection directive and signaled Europe’s determination to lead the world on data privacy issues. It introduced a range of new rights for individuals, including the right to be forgotten, the right to data portability, and the right to know when their data has been breached.
Overall, the GDPR has been widely praised for its ambitious and forward-thinking approach to data protection. Although its implementation has not been without its challenges, it is widely seen as a vital tool in protecting the privacy and security of individuals in the digital age.
How long did GDPR take to come into effect?
The GDPR officially took effect on May 25, 2018, after a two-year transition period. The European Union had been working on the GDPR since 2012, and it was finally approved by the European Parliament in April 2016. The two-year grace period was intended to give organizations time to prepare for the new regulations and make any necessary changes to their data protection policies and procedures.
The GDPR was a response to the growing concern over data privacy and security in the digital age. With the rise of social media, cloud computing, and big data, individuals were becoming increasingly vulnerable to data breaches and online identity theft. The GDPR aimed to address these concerns by giving individuals more control over their personal data and holding organizations accountable for protecting that data.
Since its implementation, the GDPR has had a significant impact on data protection regulations around the world. Many countries have adopted similar laws or updated their existing ones to align with the GDPR’s principles.
The GDPR has also led to the creation of new job roles, such as data protection officers, who are responsible for ensuring that organizations comply with the regulations. It has also sparked a renewed interest in data privacy and security among consumers, who are now more aware of their rights and more cautious about sharing their personal information online.
The GDPR took several years to develop and implement, but it has had a significant impact on data protection regulations around the world. It has given individuals more control over their personal data and held organizations accountable for protecting that data. While some organizations have struggled to comply with the new regulations, others have used it as an opportunity to improve their data protection practices and build trust with their customers.
While many companies were able to meet the GDPR requirements before the deadline, there were still a significant number of organizations that were not fully prepared. Some struggled to understand the new regulations, while others simply underestimated the amount of work required to achieve compliance.
One of the biggest challenges for companies was ensuring that their data processing activities were fully compliant with GDPR. This meant reviewing and updating their data protection policies, as well as implementing new procedures for handling data requests and breaches.
Another issue that companies faced was the need to appoint a Data Protection Officer (DPO). The DPO is responsible for ensuring that the company’s data processing activities are compliant with GDPR and acts as the main point of contact for data protection authorities. Finding the right person for this role was not always easy, and some companies struggled to meet this requirement.
Despite these challenges, many companies were able to achieve GDPR compliance within the deadline. This was due in part to the help of external consultants and legal advisors, who were able to provide guidance and support throughout the compliance process.
However, compliance with GDPR is an ongoing process, and companies must continue to monitor and review their data processing activities to ensure they remain compliant. Failure to do so could result in significant fines and damage to the company’s reputation.
Overall, while there were certainly challenges in achieving GDPR compliance, the introduction of the new regulations has led to greater levels of data protection and privacy for individuals across the EU and beyond.
Big Fine News on the Eve of GDPR’s 5th Birthday
Facebook’s parent company, Meta, has been fined €1.2 billion by Ireland’s Data Protection Commission (DPC) for mishandling user data during its transfer between Europe and the United States. This fine is the largest ever imposed under the EU’s General Data Protection Regulation (GDPR) privacy law. The issue revolves around the use of standard contractual clauses (SCCs) to move European user data to the US, with concerns raised about the weaker privacy laws in the US and potential access by US intelligence agencies.
Meta plans to appeal the ruling, considering it unjustified. The decision does not affect Facebook in the UK. Privacy groups see the ruling as significant and hope it will encourage EU companies to demand that US partners store data within Europe or seek domestic alternatives. The fine follows a decade-long legal battle initiated by Austrian privacy campaigner Max Schrems, highlighting the challenges of transferring EU data to the US. Despite the substantial fine, experts believe Meta’s privacy practices may not significantly change.
GDPR fines, let’s get serious
One of the most significant changes that the General Data Protection Regulation (GDPR) brought about was the introduction of hefty fines for companies that violated the rules around data privacy. The GDPR was implemented on May 25, 2018, and since then, there have been numerous high-profile cases of data breaches and violations of the regulation.
The GDPR fines are designed to be a deterrent to companies that do not take data privacy seriously. The fines can be up to €20 million or 4% of a company’s global annual turnover, whichever is higher. This means that companies can face significant financial penalties for violating the GDPR.
Statistics: Highest individual fines (Top 10)
The following statistics shows the highest individual fines imposed to date per data controller.
(only top 10 fines)
Source: https://www.enforcementtracker.com/?insights
GDPR fines over time
This graph shows how GDPR fine sizes / severity (€) slowly increased over time from inception of the GDPR. It demonstrates a slow start with some small increases over the first couple of years after GDPR inception, with a significant increase in mid-2021 and subsequent upsurges periodically since.
Source: https://www.enforcementtracker.com/?insights
However, examining the frequency of fines, it is clear that the trend of overall number of fines (cumulative) rose steadily over time.
Source: https://www.enforcementtracker.com/?insights
From May 2018 to May 2023, data protection authorities in the EU issued regulatory fines totaling €3.987 billion for infringements of the GDPR regulations. This is a significant increase from the fines issued in the first year of GDPR, which totaled €56 million.
Large fines like that of Google in January 2019, issued by The French data protection authority, CNIL, were issued because Google did not provide users with enough information about how their data was being used, and did not obtain proper consent for personalized ads.
Another significant GDPR fine was issued to Marriott. The UK Information Commissioner’s Office (ICO) fined Marriott £99 million for a data breach that exposed the personal data of millions of customers. The breach occurred in 2014, but Marriott did not discover it until 2018.
These fines show that data protection authorities are taking the GDPR seriously and are willing to use their powers to enforce the regulation. Companies that do not comply with the GDPR regulations can face significant financial penalties, as well as damage to their reputation and loss of customer trust.
It is essential for companies to take data privacy seriously and ensure that they are complying with the GDPR regulations. This means implementing appropriate data protection measures, obtaining proper consent from users, and providing users with clear information about how their data is being used.
However, despite the positive impact of GDPR, there are still concerns about data privacy in today’s digital age. Cyber-attacks and data breaches are becoming increasingly common, and the consequences of such incidents can be severe for both individuals and organizations.
What countries are issuing fines of highest value?
When we cross reference the number of fines with their total sum it is fascinating to see. Ireland, with €2,510,340,900 across over just 25 fines is in direct contrast to Italy, with a whopping 646 fines but just €59,560,050 in total amount.
Source: https://www.enforcementtracker.com/?insights
Source: https://www.enforcementtracker.com/?insights
One of the challenges facing organizations is the sheer volume of data they collect and store. With the rise of big data, it can be difficult to ensure that all personal information is being properly protected. In addition, the complexity of modern IT systems means that there are often multiple points of vulnerability that can be exploited by hackers.
Another issue is the lack of standardization across different countries and regions. While GDPR has set a high standard for data protection, not all countries have implemented similar legislation. This can lead to confusion for organizations that operate across multiple jurisdictions, and can make it difficult for individuals to understand their rights and how they can enforce them.
Despite these challenges, there are steps that organizations can take to improve data privacy. One approach is to adopt a “privacy by design” approach, which involves building data protection into all aspects of an organization’s operations. This can include everything from employee training to the design of IT systems.
Another key factor is transparency. Organizations that are open and honest about their data practices are more likely to earn the trust of their customers and stakeholders. This can involve providing clear and concise privacy policies, as well as being responsive to individuals’ requests for information about how their data is being used.
Download this blogpost!
What countries are issuing the most fines?
Way out in front is Spain, with more than double the amount of fines to second place Italy. Interestingly, Ireland, who has issued the largest fines sum total, does not even feature inside the top 10 countries relating to the number of fines issued.
By total number of fines:
Source: https://www.enforcementtracker.com/?insights
Source: https://www.enforcementtracker.com/?insights
While GDPR has certainly had a positive impact on data privacy, there is still work to be done to ensure that personal information is properly protected in today’s digital age. By adopting a proactive approach and prioritizing transparency, organizations can help to build trust with their customers and stakeholders, and demonstrate their commitment to data privacy.
What Types of GDPR Violations are we seeing time and time again?
Fines by type of violation
The following statistics show how many fines and what sum of fines have been imposed per type of GDPR violation to date.
By total sum of fines:
Source: https://www.enforcementtracker.com/?insights
Way out in front it is clear that non-compliance with general data processing principles & Insufficient legal basis for data processing are costing the most in GDPR fines.
By total number of fines:
Source: https://www.enforcementtracker.com/?insights
Insufficient legal basis for data processing features again for not only a large sum but is also the most commonly fined violation.
What industries are being fined the most?
Fines by sector
By total sum of fines:
Source: https://www.enforcementtracker.com/?insights
By total number of fines:
Source: https://www.enforcementtracker.com/?insights
GDPR was just the start, not the end
GDPR was an essential step in privacy and data protection regulation. It established a robust data protection framework that encouraged companies to take responsibility for protecting users’ data. However, it is just the beginning of a new era of data protection laws.
In addition to the CCPA, other states in the US are also considering enacting similar laws. For example, New York is currently reviewing the New York Privacy Act, which would grant New York residents the right to know what personal information companies have collected about them and request that it be deleted.
Furthermore, the European Union is already working on a new data protection law that would replace GDPR. The proposed law, called the Digital Services Act, aims to address the challenges posed by new technologies and the digital transformation of society.
Outside of the US and EU, other countries are also taking steps towards stronger data protection laws. The prevalence of similar regulations worldwide forces businesses to adapt to the laws’ varying requirements, ensuring data protection is a priority globally. Companies must be proactive in implementing data protection measures and ensuring compliance with these laws to avoid hefty fines and reputational damage.
Moreover, data protection laws are not the only regulations that businesses need to be aware of. The rise of artificial intelligence and machine learning has led to the development of ethical guidelines and principles. For example, the European Commission published guidelines on AI ethics, and the US National Institute of Standards and Technology (NIST) released a framework for managing AI risks.
While GDPR was a significant step towards data protection, it was just the beginning. The global trend towards stronger data protection laws and ethical guidelines means that businesses must continue to adapt and prioritize data protection to avoid legal and reputational risks.
The GDPR’s Contribution to Digital Privacy Rights
The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy for all individuals within the European Union (EU) and the European Economic Area (EEA). GDPR has helped to lay the groundwork for improved digital privacy rights, not just in the EU but also globally. The regulation sets out strict rules for how personal data must be collected, processed, and stored by businesses, organizations, and governments. GDPR has been a game-changer in the world of digital privacy, and its impact has been felt across the globe.
The GDPR has given individuals greater control over their personal data. It has introduced new rights, such as the right to be forgotten, which allows individuals to request that their personal data be erased. It has also strengthened existing rights, such as the right to access and correct personal data. These changes have put individuals back in control of their personal data and given them the power to decide who can access it and for what purpose.
Public debate around GDPR was already pushing the technology industry to adopt more user-centric products, particularly in the area of digital consent. The regulation requires businesses to obtain explicit consent from individuals before collecting, processing, or storing their personal data. This has led to a greater focus on user experience and design, with businesses looking for ways to make the process of obtaining consent more transparent and user-friendly.
While much work is still needed, GDPR has provided a significant impetus for change. It has forced businesses to take a closer look at their data handling practices and make changes where necessary.
GDPR has also had a ripple effect on other countries and regions around the world. Many countries have introduced their own data protection laws, modeled on GDPR, in an effort to provide greater protection for their citizens’ personal data. This has led to a more harmonized approach to data protection globally, with businesses having to comply with multiple regulations in different jurisdictions.
In conclusion, GDPR has had a significant impact on digital privacy rights. It has given individuals greater control over their personal data and forced businesses to take a closer look at their data handling practices. While much work is still needed, GDPR has provided a solid foundation for further improvements in digital privacy rights, both in the EU and around the world.
Understanding the GDPR After Five Years
The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy. The GDPR was designed to give EU citizens greater control over their personal data and to harmonize data privacy laws across Europe.
Since its implementation, the GDPR has been a game-changer in the world of data protection. It has not only helped to strengthen the protection of personal data but has also brought about much-needed changes in a world where data breaches had become all too common. The regulation has also had a significant impact on businesses that handle personal data, forcing them to take data protection seriously and comply with the regulations.
One of the most significant changes brought about by the GDPR is the increased rights it gives to individuals when it comes to their personal data. These include the right to access their data, the right to have their data erased, and the right to object to the processing of their data. The regulation also requires businesses to obtain explicit consent from individuals before collecting their data.
Another important aspect of the GDPR is the increased accountability it places on businesses that handle personal data. The regulation requires businesses to implement appropriate technical and organizational measures to ensure the protection of personal data and to report any data breaches to the relevant authorities within 72 hours.
While the GDPR has been in effect for five years, there is still work to be done to ensure that organizations continue to comply with the regulations and that the public’s privacy rights are upheld. The GDPR has set a high bar for data protection, and it is essential that businesses continue to strive to meet these standards.
GDPR has made significant strides in protecting personal data and privacy rights. It has been a positive step in enhancing the protection of personal data worldwide. With continued efforts to comply with the regulations and uphold privacy rights, we can expect to see a more secure and privacy-focused future for all.
What do the next 5 years have in store for the GDPR?
Gartner has estimated that in 2023, 75% of the world’s population will have its personal data covered under modern privacy regulations. The International Association of Privacy Professionals (IAPP) in cooperation with Westin Research Center have produced an interactive map identifying those countries with data protection laws.
IAPP Global Comprehensive Privacy Law Mapping Chart
Source: https://iapp.org/media/pdf/resource_center/global_comprehensive_privacy_law_mapping.pdf
What about the USA, is Europe far ahead?
Here is a visual depiction of the timeline for upcoming effective dates for state privacy laws.
It’s eye opening in a few ways:
- If you look at the “you are here” icon, we’ve barely begun. A lot of effective dates won’t really matter for large companies but, still, there’s a lot to go.
- There will be more. The chart doesn’t factor in the forthcoming additional CCPA regulations or any laws that may pass in the remainder of the 2023 legislative session.
- The My Health My Data staggered effective date issue is a problem.
- Look at that Texas effective date. The bill still needs to officially pass the legislature, which we expect will happen. It then will have a short timeline for implementation.
- Indiana may have been state number 7 but it won’t go into effect for a long time. Colorado and Connecticut will both go into effect – and their rights to cure will expire – a full year before Indiana goes into effect.
Source: David Stauss
CIPP/US/E, CIPT, FIP, PLS, Partner at Husch Blackwell
In Conclusion
The General Data Protection Regulation (GDPR) has made significant strides in advancing digital privacy rights and data protection. Implemented in 2018, it has influenced global data protection laws, holding companies accountable for data collection and usage while giving individuals more control over their personal information. Despite challenges such as cybersecurity vulnerabilities and the need for consistent enforcement, GDPR has set the foundation for a new era of data protection and privacy, emphasizing transparency, compliance, and the integration of privacy measures into all operations.
However, the journey towards effective data privacy is ongoing. The GDPR’s impact extends beyond the European Union, with similar regulations emerging worldwide. To navigate the evolving landscape, organizations must prioritize data protection globally, adapt to varying requirements, and prioritize transparency to avoid fines and reputational damage. By embracing a “privacy by design” approach and continually enhancing data protection practices, businesses can safeguard personal information and maintain the trust of their customers in the digital age.
