On 25 May 2018, the General Data Protection Regulation (GDPR) became law throughout the European Union. Because it’s a regulation rather than a directive, implementation is not left to the discretion of states; it became part of the legal code of every member of the EU, including the UK at the time. In essence, the GDPR is a set of rules designed to give EU citizens more control over their personal data. The drive behind the regulation was the need to bring the historical patchwork of laws and obligations around personal data, privacy and consent across Europe up to speed and make them fit for purpose in a world dominated by surveillance capitalism. On the face of it, the GDPR looks like a formidable legal instrument.
At any rate, in the run-up to its implementation, the prospect of it seemed to scare the wits out of companies and organisations large and small. It was a gold mine for legal and data-protection consultants. Even amateurs such as me were often approached by small community groups terrified that their email list would get them into trouble because they hadn’t explicitly asked every individual on it for their approval.
The GDPR conferred formidable powers on the data protection authorities (DPAs) of EU states, including the power to impose fines of up to 4% of a company’s global revenues. But so far the number of fines levied has been minuscule compared to the scale of the covert data-broking marketplaces that underpin the revenues of social media and other companies. To date, the biggest fines seem to have been handed out by the UK’s DPA: £183m on British Airways and £99m on the Marriott hotel chain, both for failing to keep customers’ data safe from hackers. But these are exceptions that appear to prove the rule.
So we’re faced with a paradox: on the one hand, there’s massive abuse of personal data by a global data-broking industry; on the other, we have a powerful legal instrument that is not being brought to bear on the abusers. How come? Is it because national DPAs are corrupt? Or indolent? Or just plain incompetent? The answer, it seems, is none of the above. They’re simply overwhelmed by the scale of the task – and lamentably under-resourced for it.
This is what emerges from an investigation by the developers of an innovative browser called Brave, which has led to a formal complaint to the European commission. At the root of the problem is a shortage of critical skillsets. Investigating the shady practices of data-trackers installing cookies on your computer via the websites you visit can be a pretty technical task. DPAs therefore need not just lawyers on their payrolls, but knowledgable, forensically minded techies and such people are in high demand these days and don’t come cheap.
The Brave investigation finds that half of Europe’s DPAs have only five technical experts or fewer (three – Austria, Romania and Latvia – don’t seem to have any at all). Germany, with 29% of all European tech specialists, has the highest percentage, followed by Spain and France with the UK in fourth place (only 3% of the 680 staff at the UK’s Information Commissioner’s Office are tech specialists). But the most worrying deficit of all is in the Irish DPA, which, according to the Brave report, has only 21 tech-enforcement roles. The fact that most of the tech giants have their European HQs in Dublin means that the Irish authority has the heaviest enforcement workload; it’s currently the lead authority for 127 cases and yet its budget is being squeezed by the Irish government.
With the exception of Germany, this seems to be par for the European course. The EU’s governments pay lip service to the importance of citizens’ privacy but they’re evidently unwilling to pay to protect it. So we’re left with a powerful but essentially unenforced regulation, which makes a mockery of the rule of law. Therefore, the big question about the GDPR comes down to this: has it turned out to be just an aspiration or is it a law? And if it’s the latter, shouldn’t we be enforcing it?
What I’ve been reading
Field work
There’s a fascinating article by PD Smith in the TLS about the private and public lives of Albert Einstein. It includes the fact that he spent some time in rural Norfolk, protected by farmers carrying shotguns.
Careless talk
Bertrand Russell’s An Outline of Intellectual Rubbish is a lovely, mischievous essay on the credulity of humankind.
Top tips
68 Bits of Unsolicited Advice is an offering on his blog The Technium by tech writer Kevin Kelly on the occasion of his 68th birthday.