That makes a total of 4,113 complaints for full year 2018 (vs just 2,642 for 2017). Which is a year on year increase of 36 per cent.<\/p>\n
But the increase pre- and post-GDPR is even greater \u2014 56 per cent \u2014 suggesting the regulation is working as intended by building momentum and support for individuals to exercise their fundamental rights.<\/p>\n
![\"\"](\"https:\/\/i0.wp.com\/www.wordpressdynamos.com\/timesofnewscdn\/blog\/8d2c5_Screenshot-2019-02-28-at-12.14.29.png?resize=640%2C533&ssl=1\")
<\/p>\n
\u201cThe phenomenon that is the [GDPR] has demonstrated one thing above all else: people\u2019s interest in and appetite for understanding and controlling use of their personal data is anything but a reflection of apathy and fatalism,\u201d writes Helen Dixon, <\/a> Ireland\u2019s commissioner for data protection.<\/p>\n She adds that the rise in the number of complaints and queries to DPAs across the EU since May 25 demonstrates \u201ca new level of mobilisation to action on the part of individuals to tackle what they see as misuse or failure to adequately explain what is being done with their data\u201d.<\/p>\n While Europe has had online privacy rules since 1995 a weak regime of enforcement essentially allowed them to be ignored for decades \u2014 and Internet companies to grab and exploit web users\u2019 data without full regard and respect for European\u2019s privacy rights.<\/p>\n But regulators hit the reset button last year. And Ireland\u2019s data watchdog is an especially interesting agency to watch if you\u2019re interested in assessing how GDPR is working, given how many tech giants have chosen to place their international data flows under the Irish DPC\u2019s supervision.<\/p>\n \u201cThe role places an important duty on the DPC to safeguard the data protection rights of hundreds of millions of individuals across the EU, a duty that the GDPR requires the DPC to fulfil in cooperation with other supervisory authorities,\u201d the DPC writes in the report, discussing its role of supervisory authority for multiple tech multinationals and acknowledging both a \u201cgreatly expanded role under the GDPR\u201d and a \u201csignificantly increased workload\u201d.<\/p>\n A breakdown of GDPR vs Data Protection Act 1998 complaint types over the report period suggests complaints targeted at multinational entities have leapt up under the new DP regime.<\/p>\n For some complaint types the old rules resulted in just 2 per cent of complaints being targeted at multinationals vs close to a quarter (22 per cent) in the same categories under GDPR.<\/p>\n It\u2019s the most marked difference between the old rules and the new \u2014 underlining the DPC\u2019s expanded workload in acting as a hub (and often lead supervisory agency) for cross-border complaints under GDPR\u2019s one-stop shop mechanism.<\/p>\n The category with the largest proportions of complaints under GDPR over the report period was access rights (30%) \u2014 with the DPC receiving a full 582 complaints related to people feeling they\u2019re not getting their due data. Access rights was also most complained about under the prior data rules over this period.<\/p>\n Other prominent complaint types continue to be unfair processing of data (285 GDPR complaints vs 178 under the DPA); disclosure (217 vs 138); and electronic direct marketing (111 vs 36).<\/p>\n EU policymakers\u2019 intent with GDPR is to redress the imbalance of weakly enforced rights \u2014 including by creating new opportunities for enforcement via a regime of supersized fines. (GDPR allows for penalties as high as up to 4 per cent of annual turnover, and in January<\/a> the French data watchdog slapped Google with a $57M GDPR penalty related to transparency and consent \u2014 albeit still far off that theoretical maximum.)<\/p>\n Importantly, the regulation also introduced a collective redress option which has been adopted by some EU Member States.<\/p>\n This allows for third party organizations such as consumer rights groups to lodge data protection complaints on individuals\u2019 behalf. The provision has led to a number of strategic complaints being filed by organized experts since last May (including in the case of the aforementioned Google fine) \u2014 spinning up momentum for collective consumer action to counter rights erosion. Again that\u2019s important in a complex area that remains difficult for consumers to navigate without expert help.<\/p>\n For upheld complaints the GDPR \u2018nuclear option\u2019 is not fines though; it\u2019s the ability for data protection agencies to order data controllers to stop processing data.<\/p>\n That remains the most significant tool in the regulatory toolbox. And depending on the outcome of various ongoing strategic GDPR complaints it could prove hugely significant in reshaping what data experts believe<\/a> are systematic privacy incursions by adtech platform giants.<\/p>\n And while well-resourced tech giants may be able to factor in even very meaty financial penalties, as just a cost of doing a very lucrative business<\/a>, data-focused business models could be far more precarious if processors can suddenly be slapped with an order to limit or even cease processing data. (As indeed Facebook\u2019s business just has in Germany, where antitrust regulators have been liaising with privacy watchdogs<\/a>.)<\/p>\n GDPR also shines a major spotlight on security \u2014 requiring privacy by design and default and introducing a universal requirement for swiftly reporting data breaches across the bloc, again with very stiff penalties for non-compliance.<\/p>\n On the data breach front, the Irish DPC says it received a total of 3,687 data breach notifications between May 25 and December 31 last year \u2014 finding just four per cent (145 cases) did not meet the definition of a personal-data breach set out in GDPR. That means it recorded a total of 3,542 valid data protection breaches over the report period \u2014 which it says represents an increase of 27 per cent on 2017 breach report figures.<\/p>\n \u201cAs in other years, the highest category of data breaches notified under the GDPR were classified as Unauthorised Disclosures and accounted for just under 85% of the total data-breach notifications received between 25 May and 31 December 2018,\u201d it notes, adding: \u201cThe majority occurred in the private sector (2,070).\u201d<\/p>\n More than 4,000 data breach notifications were recorded by the watchdog for full year 2018, the report also states.<\/p>\n For the earlier 2018 period, from January 1 to May 24 2018, a DPC spokesman told us it recorded 1198 valid data security breaches \u2014 making the full year total 4740.<\/p>\n The DPC further reveals that it was notified of 38 personal data breaches involving 11 multinational technology companies during the post-GDPR period of 2018. Which means breaches involving tech giants.<\/p>\n \u201cA substantial number of these notifications involved the unauthorised disclosure of, and unauthorised access to, personal data as a result of bugs in software supplied by data processors engaged by the organisations,\u201d it writes, saying it opened several investigations as a result (such as following the Facebook Token breach in September 2018<\/a>).<\/p>\n As of 31 December 2018, the DPC says it had 15 investigations open in relation to multinational tech companies\u2019 compliance with GDPR.<\/p>\n Below is the full list of the DPC\u2019s currently open investigations of multinationals \u2014 including the tech giant under scrutiny; the origin of the inquiry; and the issues being examined:<\/p>\n \u201cThe DPC\u2019s role in supervising the data-processing operations of the numerous large data-rich multinational companies \u2014 including technology internet and social media companies \u2014 with EU headquarters located in Ireland changed immeasurably on 25 May 2018,\u201d the watchdog acknowledges.<\/p>\n \u201cFor many, including Apple, Facebook, Microsoft, Twitter, Dropbox, Airbnb, LinkedIn, <\/a> Oath [disclosure: TechCrunch is owned by Verizon Media Group; aka Oath\/AOL<\/em>], WhatsApp, MTCH Technology and Yelp, the DPC acts as lead supervisory authority under the GDPR OSS [one-stop shop] facility.\u201d<\/p>\n The DPC notes in the report that between May 25 and December 31 2018 it received 136 cross-border processing complaints through the regulation\u2019s OSS mechanism (i.e. which had been lodged by individuals with other EU data protection authorities).<\/p>\n A breakdown of these (likely) tech giant focused GDPR complaints shows a strong focus on consent, right of erasure, right of access and the lawfulness of data processing:<\/p>\n Breakdown of cross-border complaint types received by the DPC under GDPR\u2019s OSS mechanism<\/p>\n While the Irish DPC acts as the lead supervisor for many high profile GDPR complaints which relate to how tech giants are handling people\u2019s data, it\u2019s worth emphasizing that the OSS mechanism does not mean Ireland is sitting in sole judgement on Silicon Valley\u2019s giants\u2019 rights incursions in Europe.<\/p>\n The mechanism allows for other DPAs to be involved in these cross-border complaints.<\/p>\n And the European Data Protection Board<\/a>, the body that works with all the EU Member States\u2019 DPAs to help ensure consistent application of the regulation, can trigger a dispute resolution process if a lead agency considers it cannot implement a concerned agency objection. The aim is to work against forum shopping.<\/p>\n In a section on \u201cEU cooperation\u201d, the DPC further writes:<\/p>\n Our fellow EU regulators, alongside whom we sit on the European Data Protection Board (EDPB), follow the activities and results of the Irish DPC closely, given that a significant number of people in every EU member state are potentially impacted by processing activities of the internet companies located in Ireland. EDPB activity is intense, with monthly plenary meetings and a new system of online data sharing in relation to cross-border processing cases rolled out between the authorities. The DPC has led on the development of EDPB guidance on arrangements for Codes of Conduct under the GDPR and these should be approved and published by the EDPB in Q1 of 2019. The DPC looks forward to industry embracing Codes of Conduct and raising the bar in individual sectors in terms of standards of data protection and transparency. Codes of Conduct are important because they will more comprehensively reflect the context and reality of data-processing activities in a given sector and provide clarity to those who sign up to the standards that need to be attained in addition to external monitoring by an independent body. It is clarity of standards that will drive real results.<\/p>\n<\/blockquote>\n Over the reported period the watchdog also reveals that it issued 23 formal requests seeking detailed information on compliance with various aspects of the GDPR from tech giants, noting too that since May 25 it has engaged with platforms on \u201ca broad range of issues\u201d \u2014 citing the following examples to give a flavor of these concerns:<\/span><\/p>\n \u201cSupervision engagement with these companies on the matters outlined is ongoing,\u201d the DPC adds of these issues.<\/p>\n Talking of ongoing action, a GDPR complaint related to the security of personal data that\u2019s systematically processed to power behavioral advertising is another open complaint on the DPC\u2019s desk.<\/p>\n The strategic complaint was filed by a number of individuals in multiple EU countries (including Ireland) last fall. Since then the individuals behind the complaints have continued to submit and publish evidence<\/a> they argue bolsters their case<\/a> against the behavioral ad targeting industry (principally Google and the IAB which set the spec involved in the real-time bidding (RTB) system).<\/p>\n The Irish DPC makes reference to this RTB complaint in the annual report, giving the adtech industry what amounts to a written warning that while the advertising ecosystem is \u201ccomplex\u201d, with multiple parties involved in \u201chigh-speed, voluminous transactions\u201d related to bidding for ad space and serving ad content \u201cthe protection of personal data is a prerequisite to the processing of any personal data within this ecosystem and ultimately the sector must comply with the standards set down by the GDPR\u201d.<\/p>\n The watchdog also reports that it has engaged with \u201cseveral stakeholders, including publishers and data brokers on one side, and privacy advocates and affected individuals on the other\u201d, vis-a-vis the RTB complaint, and says it will continue prioritizing its scrutiny of the sector in 2019 \u2014 \u201cin cooperation with its counterparts at EU level so as to ensure a consistent approach across all EU member states\u201d.<\/p>\n It goes on to say that some of its 15 open investigations into tech giants will both conclude this year and \u201ccontribute to answering some of the questions relating to this complex area\u201d. So, tl;dr, watch this space.<\/p>\n Responding to the DPC\u2019s comments on the RTB complaint, Dr Johnny Ryan, chief policy and industrial relations officer of private browser Brave \u2014 and also one of the complainants\u00a0\u2014 told us they expect the DPC to act \u201curgently\u201d.<\/p>\n \u201cWe have brought our complaint before the DPC and other European regulators because there is a dire need to fix adtech so that it\u2019s works safely,\u201d he told TechCrunch. \u201cThe DPC itself recognizes that online advertising is a priority. The IAB and Google online \u2018ad auction\u2019 system enables companies to broadcast what every single person online reads, watches, and listens to online to countless parties. There is no control over what happens to these data. The evidence that we have submitted to the DPC shows that this occurs hundreds of billions of times a day.\u201d<\/p>\n \u201cIn view of the upcoming European elections, it is particularly troubling that the IAB and Google\u2019s systems permit voters to be profiled in this way,\u201d he added. \u201cClearly, this infringes the security and integrity principles of the GDPR, and we expect the DPC to act urgently.\u201d<\/p>\n The IAB has previously<\/a> rejected the complaints as \u201cfalse\u201d, arguing any security risk is \u201ctheoretical\u201d; while Google has said it has policies in place to prohibit advertisers from targeting sensitive categories of data. But the RTB complaint itself pivots on GDPR\u2019s security requirements which demand that personal data be processed in a manner that \u201censures appropriate security\u201d, including \u201cprotection against unauthorised or unlawful processing and against accidental loss\u201d.<\/p>\n So the security of the RTB system is the core issue which the Irish DPC, along with agencies in the UK and Poland, will have to grapple with as a priority this year.<\/p>\n The complainants have also said they intend to file additional complaints in more markets across Europe, so more DPAs are likely to join the scrutiny of RTB, as concerned supervisory agencies, which could increase pressure on the Irish DPC to act.<\/p>\n The watchdog\u2019s report also includes an update on long-running litigation<\/a> filed by European privacy campaigner Max Schrems concerning a data transfer mechanism known as standard contractual clauses (SCCs) \u2014 and originally only targeted at Facebook\u2019s use of the mechanism.<\/p>\n The DPC decided to refer Schrems\u2019 original challenge to the Irish courts<\/a> \u2014 which have since widened the action by referring a series of legal questions up to the EU\u2019s top court with (now) potential implications for the legality of the EU\u2019s \u2018flagship\u2019 Privacy Shield data transfer mechanism.<\/p>\n That was negotiated following the demise of its predecessor Safe Harbor, in 2015<\/a>, also via a Schrems legal challenge, going on to launch in August 2016 \u2014 despite ongoing concerns from data experts. Privacy Shield is now used by close to 4,500 companies to authorize transfers of EU users\u2019 personal data to the US.<\/p>\n So while Schrems\u2019 complaint about SCCs (sometimes also called \u201cmodel contract clauses\u201d) was targeted at Facebook\u2019s use of them the litigation could end up having major implications for very many more companies if Privacy Shield itself comes unstuck.<\/p>\n More recently Facebook has sought to block the Irish judges\u2019 referral<\/a> of legal questions to the Court of Justice of the EU (CJEU) \u2014 winning leave to appeal last summer<\/a> (though judges did not stay<\/a> the referral in the meanwhile).<\/p>\n In its report the DPC notes that the substantive hearing of Facebook\u2019s appeal took place over January 21, 22 and 23 before a five judge Supreme Court panel.<\/p>\n \u201cOral arguments were made on behalf of Facebook, the DPC, the U.S. Government and Mr Schrems,\u201d it writes. \u201cSome of the central questions arising from the appeal include the following: can the Supreme Court revisit the facts found by the High Court relating to US law? (This arises from allegations by Facebook and the US Government that the High Court judgment, which underpins the reference made to the CJEU, contains various factual errors concerning US law).<\/p>\n \u201cIf the Supreme Court considers that it may do so, further questions will then arise for the Court as to whether there are in fact errors in the judgment and if so, whether and how these should be addressed.\u201d<\/p>\n \u201cAt the time of going to print there is no indication as to when the Supreme Court judgment will be delivered,\u201d it adds. \u201cIn the meantime, the High Court\u2019s reference to the CJEU remains valid and is pending before the CJEU.\u201d<\/p>\n Article source: http:\/\/feedproxy.google.com\/~r\/techcrunch\/social\/~3\/Z-FU3UAza3Y\/<\/p>","protected":false},"excerpt":{"rendered":" A report by the lead data watchdog for a large number of tech giants operating in Europe shows a significant increase in privacy complaints and data breach notifications since the <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[3],"tags":[10,7,14,15,6,12,11],"class_list":["post-14361","post","type-post","status-publish","format-standard","hentry","category-latest-update","tag-computer-news","tag-downloads","tag-microsoft-download-news","tag-networking-updates","tag-technology-update","tag-wordpress-plugin-download","tag-wordpress-theme-download"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tMore cross-border complaints<\/strong><\/h2>\n
![\"\"](\"https:\/\/i0.wp.com\/www.wordpressdynamos.com\/timesofnewscdn\/blog\/a4153_Screenshot-2019-02-28-at-17.27.41.png?resize=623%2C680&ssl=1\")
<\/p>\nData breach notifications also up<\/h2>\n
Open probes of tech giants<\/h2>\n
\n
![\"\"](\"https:\/\/i0.wp.com\/www.wordpressdynamos.com\/timesofnewscdn\/blog\/ea83b_Screenshot-2019-02-28-at-16.03.33.png?resize=640%2C482&ssl=1\")
<\/p>\n\n
\n
Adtech sector \u201cmust comply\u201d with GDPR\u00a0<\/strong><\/h2>\n
Schrems II vs Facebook\u00a0<\/strong><\/h2>\n