GDPR enforcement must level up to catch big tech, report warns

A new report by European consumer protection umbrella group Beuc, reflecting on the barriers to effective cross-border enforcement of the EU’s flagship data protection framework, makes awkward reading for the regional lawmakers and regulators as they seek to shape the next decades of digital oversight across the bloc.

Beuc’s members filed a series of complaints against Google’s use of location data in November 2018 — but some two years on from raising privacy concerns there’s been no resolution of the complaints.

The tech giant continues to make billions in ad revenue, including by processing and monetizing internet users’ location data. Its lead data protection supervisor, under GDPR’s one-stop-shop mechanism for dealing with cross-border complaints, Ireland’s Data Protection Commission (DPC), did finally open an investigation in February this year.

But it could still be years before Google faces any regulatory action in Europe related to its location tracking.

This is because Ireland’s DPC has yet to issue any cross-border GDPR decisions, some 2.5 years after the regulation started being applied. (Although, as we reported recently, a case related to a Twitter data breach is inching toward a result in the coming days.)

By contrast, France’s data watchdog, the CNIL, was able to complete a GDPR investigation into the transparency of Google’s data processing in much quicker order last year.

This summer French courts also confirmed the $57 million fine it issued, slapping down Google’s appeal.

But the case predated Google coming under the jurisdiction of the DPC. And Ireland’s data regulator has to deal with a disproportionate number of multinational tech companies, given how many have established their EU base in the country.

The DPC has a major backlog of cross-border cases, with more than 20 GDPR probes involving a number of tech companies including Apple, Facebook/WhatsApp and LinkedIn. (Google has also been under investigation in Ireland over its adtech since 2019.)

This week the EU’s internet market commissioner, Thierry Breton, said regional lawmakers are well-aware of enforcement “bottlenecks” in the General Data Protection Regulation (GDPR).

He suggested the commission has learned lessons from this friction — claiming it will ensure similar concerns don’t affect the future working of a regulatory proposal related to data reuse that he was out speaking in public to introduce.

The commission wants to create standard conditions for rights-respecting reuse of industrial data across the EU, via a new Data Governance Act (DGA), which proposes similar oversight mechanisms as are involved in the EU’s oversight of personal data — including national agencies monitoring compliance and a centralized EU steering body (which they’re planning to call the European Data Innovation Board as a mirror entity to the European Data Protection Board).

The commission’s ambitious agenda for updating and expanding the EU’s digital rules framework, means criticism of GDPR risks taking the shine off the DGA before the ink has dried on the proposal document — putting pressure on lawmakers to find creative ways to unblock GDPR’s enforcement “bottleneck.” (Creative because national agencies are responsible for day-to-day oversight, and member states are responsible for resourcing DPAs.) 

In an initial GDPR review this summer, the commission praised the regulation as a “modern and horizontal piece of legislation” and a “global reference point” — claiming it’s served as a point of inspiration for California’s CCPA and other emerging digital privacy frameworks around the world.

But they also conceded GDPR enforcement is lacking.

The best answer to this concern “will be a decision from the Irish data protection authority about important cases,” the EU’s justice commissioner, Didier Reynders, said in June.

Five months later European citizens are still waiting.

Beuc’s report — which it’s called “The long and winding road: Two years of the GDPR: A cross-border data protection case from a consumer perspective” — details the procedural obstacles its member organizations have faced in seeking to obtain a decision related to the original complaints, which were filed with a variety of DPAs around the EU.

This includes concerns of the Irish DPC making unnecessary “information and admissibility checks;” as well as rejecting complaints brought by an interested organization on the grounds they lack a mandate under Irish law, because it does not allow for third party redress (yet the Dutch consumer organization had filed the complaint under Dutch law which does …).

The report also queries why the DPC chose to open its own volition inquiry into Google’s location data activities (rather than a complaint-led inquiry) — which Beuc says risks a further delay to reaching a decision on the complaints themselves.

It further points out that the DPC’s probe of Google only looks at activity since February 2020 not November 2018 when the complaints were made — meaning there’s a missing chunk of Google’s location data processing that’s not even being investigated yet.

It notes that three of its member organizations involved in the Google complaints had considered applying for a judicial review of the DPC’s decision (NB: others have resorted to that route) — but they decided not to proceed in part because of the significant legal costs it would have entailed.

The report also points out the inherent imbalance of GDPR’s one-stop-shop mechanism shifting the administration of complaints to the location of companies under investigation — arguing they therefore benefit from “easier access to justice” (versus the ordinary consumer faced with undertaking legal proceedings in a different country and (likely) language).

“If the lead authority is in a country with tradition in ‘common law,’ like Ireland, things can become even more complex and costly,” Beuc’s report further notes.

Another issue it raises is the overarching one of rights complaints having to fight what it dubs “a moving target” — given well-resourced tech companies can leverage regulatory delays to (superficially) tweak practices, greasing continued abuse with misleading PR campaigns. (Something Beuc accuses Google of doing.)

DPAs must “adapt their enforcement approach to intervene more rapidly and directly.” it concludes.

“Over two years have passed since the GDPR became applicable, we have now reached a turning point. The GDPR must finally show its strength and become a catalyst for urgently needed changes in business practices,” Beuc goes on in a summary of its recommendations. “Our members experience and that of other civil society organisations, reveals a series of obstacles that significantly hamper the effective application of the GDPR and the correct functioning of its enforcement system.

“BEUC recommends to the relevant EU and national authorities to make a comprehensive and joint effort to ensure the swift enforcement of the rules and improve the position of data subjects and their representing organisations, particularly in the framework of cross-border enforcement cases.”

We reached out to the Commission and the Irish DPC with questions about the report. But at the time of writing neither had responded. We’ve also asked Google for comment.

Update: The DPC’s deputy commissioner, Graham Doyle, told us the reason it chose to open a “forward-looking” inquiry into Google’s location practices in early 2020 was it wanted to be able to investigate “in real time” rather than try to go back and replicate how things were.

Doyle also said the location-related Google complaints had been lodged with different DPAs at difference times — meaning some complaints had taken considerably longer to reach Ireland than November 2018, raising questions about the efficiency of the current procedures for European DPAs to send complaints to a lead supervisor.

“The complaints in question were lodged with different Supervisory Authorities on different dates from November 2018,” he said. “The DPC received these complaints in July 2019, following which we engaged with Beuc. We then opened an own-volition inquiry in February 2020 in a manner that will enable us to undertake real-time testing in order to evidence our findings.”

Beuc earlier sent a list of eight recommendations for “efficient” GDPR enforcement to the commission in May.

Update II: A commission spokesperson pointed back to its earlier evaluation of the GDPR this summer, flagging follow-up actions it committed to at that point — such as continuing bilateral exchanges with member states on proper implementation of the regulation.

It also said that it would “continue to use all the tools at its disposal to foster compliance by member states with their obligations” — including, potentially, instigating infringement procedures if necessary.

Additional follow-up actions related to “implementing and complementing” the legal framework that it detailed in the report included supporting “further exchanges of views and national practices between member states on topics that are subject to further specification at national level so as to reduce the level of fragmentation of the single market, such as processing of personal data relating to health and research, or which are subject to balancing with other rights such as the freedom of expression;” and to push for “a consistent application of the data protection framework in relation to new technologies to support innovation and technological developments.” 

The commission also said it would use the GDPR Member States Expert Group to “facilitate discussions and sharing of experience between member states and with the commission,” with a view to improving the regulation’s operation.

In the area of GDPR’s governance system, EU lawmakers committed to continue to monitor the effectiveness and independence of national DPAs, and said they would work to encourage cooperation between regulators (“in particular in fields such as competition, electronic communications, security of network and information systems and consumer policy”), while also supporting the EDPB to assess how procedures related to cross-border cases could be improved.