Data privacy progress, enforcement and Brexit

Abstract

This paper discusses how, in the second year of the General Data Protection Regulation (GDPR), there has been outstanding progress in public awareness regarding data privacy, an increase in corporate accountability and awareness at all levels of organisations, a cultural shift in businesses regarding the use of data and international influence of the Regulation. It stipulates how there has also been progress in GDPR enforcement as Data Protection Authorities (DPAs) have been more active, imposing warnings, administrative fines and processing limitations but it has been inconsistent, as decisions have varied in terms of rigour and quality across the EU (European Union). This has been particularly so due to its conflicting interpretations, the lack of cooperation between DPAs, the extent of the efficiency of the one-stop shop mechanism, among other motives. The paper discusses the lack of clarity on enforcement rules and trends has left businesses in a vulnerable position. Also, Brexit and the Schrems II judgment have left individuals and businesses in a vulnerable position. First, individuals might have to exercise their rights in multiple jurisdictions, and businesses might face double fines for the same violations. Secondly, regarding data transfers between the EU and the UK, if an adequate decision is not reached, businesses will have to rely on other safeguard mechanisms for data transfer, such as the standard contractual clauses (SCCs). The reliance on SCCs, however, is now questionable and uncertain in light of the Schrems II decision. The paper analyses how the use of SCCs will imply additional burdens for data controllers and their valid implementation will depend on the approaches that DPAs and other EU authorities take.