GDPR: A global mentality shift towards personal data


by Efi Thoma, Lawyer LL.M.
Data is incontestably the new gold! In the new digital era, personal data of individuals is being collected, processed, and transferred around the globe from companies and organizations involved in this process, without the individuals’ prior knowledge and explicit consent. The companies and organizations that collect and use such data, have a competitive advantage and strengthen their market position by analyzing this data. Data may be even sold to third parties worldwide, without neither the prior knowledge of the individuals concerned, nor their “unambiguous” consent. The new General Data Protection Regulation (GDPR) constitutes a huge breakthrough in privacy laws, leading to a drastic transformation of the privacy landscape on a global scale. It is not just the GDPR large fines in cases of breaches or serious non-compliance that make the difference, it is the new culture of awareness that is being established regarding personal, and namely sensitive data, as well as the notion of the protection of privacy and integrity of individuals in order for them to start feeling less comfortable with providing easily personal information, by just assuming that this is acceptable.
Pursuant to GDPR, once individuals consent to have their personal data processed by an organization, they automatically become “data subjects”. Their privacy has been essentially strengthened by the right to be informed, to access their data, to rectification, to erasure, to restrict processing, to data portability, to object and to restrict automated decisions and profiling, and the right to know when their data has been hacked. Thus, European residents enjoy the guaranteed rights to determine whether, when, how and to whom their personal information is revealed and how it can be used. Notwithstanding the comprehensive data protection framework provided by GDPR, enterprises’ successful compliance with the latter, and the key role of Data Protection Authorities (DPAs) in interpreting and enforcing GDPR’s provisions, as well as their effective collaboration, the key factor that shall determine the accomplishment of GDPR’s aim lies within individuals’ informed approach towards their personal data. It is imperative that European residents engage proactively and collaborate with DPAs towards GDPR’s de facto application. For example, it is important to know that they may file a complaint with the Data Protection Authority and to seek a judicial remedy, in case their above rights are being compromised or denied.
GDPR’s primary objective is to ensure the growth of the digital economy while keeping personal data of EU citizens secure and protected. It particularly aims at the enforcement of personal data safeguards and has a direct impact not only on the EU countries, but also globally with regard to enterprises engaged in economic activity associated with the collection and/or processing of personal data of individuals located inside the EU. US companies which may have adhered to the EU-US Privacy Shield which provides a lawful basis for transfers of personal data from the EU to US organizations, in order to be GDPR compliant, must meet much stricter requirements. The Privacy Shield reflects the requirements set out by the Court of Justice of the EU in its ruling of October 2015 (“Schrems”), which declared the old “Safe Harbour” framework invalid. A sustainable GDPR compliance is undeniably a challenging task for enterprises worldwide and entails an indisputable shift in mentality regarding the perception of personal data. EU should share its values on privacy and personal data protection in the international domain and build strategic partnerships with likeminded countries. An ambitious step for EU is a UN-Treaty ensuring a minimum standard of data protection.
Previous initiatives launched by the European Commission, such as “Citizens First” seeking to promote EU citizens’ rights by providing practical guidance, succeeded in raising awareness and exchanging best practices between EU countries. Ultimately a change in mentality, notably in the importance of valuing personal data,  is required in order to transform this robust legislative framework into reality. Regardless of the mandatory nature of GDPR and its direct application throughout the EU, if individuals do not feel empowered to effectively exercise the rights stemming from it, it shall remain a hollow statement. Rights are guaranteed not by the existence of laws but by their enforcement. It is a unique opportunity to take control of our personal data and uphold our fundamental privacy rights. (efi.thoma@gmail.com)

Comments

Post a Comment

Editorial

Editorial
George Kazoleas, Lawyer

Top Stories

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld her find
Read more

ECHR President: Covid-19 pandemic has raised a number of important human rights issues

Image
Increased polarisation and challenges to Europe’s fundamental principles, together with the global COVID-19 pandemic, are likely to create the most difficult period we have seen in many years, according to the President of the European Court of Human Rights (ECHR). Speaking at the court’s annual press conference in Strasbourg, ECHR President Robert Spano said that democracy, the independence of the judiciary and the rule of law are increasingly being called into question at both the European and global levels. He added that the on-going pandemic has already raised a number of important human rights issues, including the proportionality of measures taken by Council of Europe member states, the legal basis of those measures and the use of domestic procedures to sanction actions or inaction. President Spano underlined that the ECHR has been able to continue its work despite the pandemic, deciding on over 39,190 applications in 2020 and holding online public hearings for the first time.
Read more

The name Pablo Escobar may not be registered as an EU trade mark

Image
According to the Judgment of the General Court in Case T-255/23 (Escobar v EUIPO) the name Pablo Escobar may not be registered as an EU trade mark. The public would associate that name with drug trafficking and narco-terrorism.  On 30 September 2021, Escobar Inc., established in Puerto Rico (United States), filed an application with the European Union Intellectual Property Office (EUIPO) for registration of the word sign Pablo Escobar as an EU trade mark for a wide range of goods and services.  The Colombian national named Pablo Escobar, who was born on 1 December 1949 and died on 2 December 1993, is presumed to be a drug lord and a narco-terrorist who founded and was the sole leader of the Medellín cartel (Colombia).  EUIPO rejected the application for registration on the ground that the mark was contrary to public policy and to accepted principles of morality. It relied on the perception of the Spanish public, as it is the most familiar with Pablo Escobar due to the links between Spa
Read more

A national court is not required to apply a decision of its constitutional court that infringes EU law (ECJ)

Image
In its Judgment of 26.9.2024 in Case C-792/22 (Energotehnica) the Court of Justice ruled as regards the right to an effective remedy that a national court is not required to apply a decision of its constitutional court that infringes EU law. In such a case, the national court may not be penalised.  Following the death of an electrician by electrocution during a maintenance operation, an administrative procedure was initiated against his employer. At the same time, criminal proceedings for negligence and manslaughter were initiated against the supervisor. The victim’s next of kin also became civil parties to the criminal proceedings.  The administrative court hearing the dispute concluded that the present case did not involve an ‘accident at work’. It annulled the administrative penalties imposed on the employer. According to national legislation, as interpreted by the Romanian Constitutional Court, that administrative decision prevents the criminal court from reconsidering whether the
Read more

Imposition of fines and order to comply following a leak of expats’ personal data file by Greek Data Protection Authority

Image
The Greek Supervisory Authority for Data Protection imposed on the Greek Ministry of the Interior,  an administrative fine totalling EUR 400,000 and on a Member of European Parliament an administrative fine totalling EUR 40,000 for infringements of GDPR. The Hellenic Data Protection Authority received a large number of complaints regarding unsolicited political communication via e-mail sent on 1/3/2024 and entitled "100 days before the European elections", by Member of European Parliament Anna-Michelle Asimakopoulou. Following this, the Authority investigated the case ex officio, exercising immediately its powers of investigation and auditing the bodies involved. Following a series of on-the-spot audits and the receipt of evidence and data in the context of the audit, it was found that a file containing personal data of all registered Greek expatriate voters for the June 2023 elections, for which the Hellenic Ministry of the Interior is the controller, and for which the leg
Read more

Fair trial: Minors subject to criminal proceedings must have the practical and effective opportunity to be assisted by a lawyer (ECJ)

Image
According to ECJ's Judgment in Case C-603/22 (M.S. and Others), minors subject to criminal proceedings must have the practical and effective opportunity to be assisted by a lawyer. Such assistance must be offered at the latest by the time they are first questioned by the police. Criminal proceedings against three minors were brought before a Polish court. They were charged with having broken into the buildings of a disused former holiday centre. During those proceedings, it was found that the suspects had been questioned by the police in the absence of a lawyer. Before they were first questioned, neither they nor their parents had been informed of their rights or the conduct of the proceedings. The court-appointed lawyers therefore requested that previous statements made by the suspects be removed from the file as evidence.  The national court, questioning the effectiveness of the procedural guarantees in place for minors during the pretrial phase, made a reference to the Court of
Read more

Legal Officer's position in the International Labour Organization

Image
ILO - International Labour Organization, based in Geneva, Switzerland seeks to recruit a Legal Officer. The Off ice of the Legal Adviser/Office of Legal Services (JUR) provides a wide range of legal services to the International Labour Organization and its various organs (in particular the Office, the International Labour Conference and the Governing Body of the ILO).   The work is carried out by a small, dedicated team at ILO headquarters. The unit reports directly to the Director-General.  It is responsible for furthering and defending the legal interests of the Organization. The Development Cooperation position of Legal Officer will report to the Legal Adviser.  This position will provide the Office of the Legal Adviser with the necessary capacity to provide legal support for the increasing development cooperation demand from headquarters and field units of the ILO. The position will better enable JUR to respond in a sound and timely manner to the demands placed upon it. Educati
Read more