The views expressed in this article do not necessarily represent those of Ars Technica.
Previously, I explored some weaknesses of Europe’s leading data privacy law, the General Data Protection Regulation (GDPR). Expanding on that analysis, I now propose ideas for crafting a strong privacy protection framework in the US.
Addressing the GDPR’s shortcomings can be challenging. Some readers may doubt criticisms of the GDPR, believing it is too early to judge its effectiveness. Others might suspect that critics are aligned with Big Tech’s interests against GDPR. I want to clarify that I have no affiliations with any Big Tech agendas.
In this discussion, I will first illustrate the consequences of overlooking GDPR mandates. I will then detail several acknowledged conceptual flaws of the GDPR, as pointed out by one of its main designers. Following that, I will suggest essential features and design principles that the US should consider in crafting its own privacy laws. Finally, I will explain why this issue should matter to everyone.
The Steep Cost of Dismissing the GDPR
It’s a misconception to view the GDPR merely as a bureaucratic nuisance. Consider these enforcement actions across various countries:
- In May 2023, Irish regulators fined Meta $1.3 billion for illegally transferring personal data from the EU to the US.
- On July 16, 2021, Luxembourg’s National Commission for Data Protection imposed a 746 million euros ($888 million) fine on Amazon. The fine stemmed from a 2018 complaint by 10,000 individuals facilitated by a French privacy advocacy group.
- On September 5, 2022, Ireland’s Data Protection Commission levied a 405 million-euro fine on Meta Ireland for GDPR violations concerning the handling of children’s data.
These examples show that GDPR is far from just a paperwork exercise; ignoring it can lead to significant financial penalties. Overlooking GDPR compliance is a grave mistake.
9 Conceptual Flaws of the GDPR Identified by a Key Architect
Axel Voss, a crucial figure in the creation of the GDPR and a member of the European Parliament, drafted the 2011 initiative report that spurred the GDPR’s development. After seeing the regulation in action, Voss pinpointed several deficiencies in a position paper. Here are nine flaws he noted:
Firstly, the GDPR, while theoretically sound and a step towards better data protection standards, is overly bureaucratic and predominantly crafted by EU officials from a top-down perspective.
Secondly, GDPR is premised on the belief that data protection is an inherent right for EU citizens, leading to provisions that are absolute and narrowly focused on safeguarding individuals’ rights, thereby reshaping the dynamics between states, citizens, and businesses into a rigid framework.
Thirdly, the regulation aims to empower individuals by legalizing specific rights, including the rights to be informed, access, rectification, erasure, data portability, restrict processing, object to data processing, oppose automated decision-making, and withdraw consent. However, this list may not cover all necessary rights, potentially limiting the GDPR’s effectiveness in safeguarding privacy.
Fourthly, the GDPR adopts a restrictive approach to data handling, which excludes potential scientific discoveries by enforcing strict purpose limitations. This stance fails to accommodate new technological realities like machine learning and AI.
Fifthly, the GDPR views all personal data processing as inherently risky, demanding legal justification for each action, which might inhibit data-sharing in a data-driven economy.
Sixthly, the regulation does not differentiate between low-risk and high-risk data processing, generally imposing the same obligations across different scenarios except in certain high-risk cases.
Seventhly, the GDPR does not offer exemptions for low-risk scenarios or when SMEs, startups, non-profits, or private individuals are data controllers, nor does it balance the rights of data controllers or third parties who may have legitimate business or confidentiality interests.
Eighthly, the regulation lacks mechanisms that allow smaller enterprises to outsource compliance responsibilities to third parties who manage data processing.
Ninthly, the GDPR relies excessively on a bureaucratic system for monitoring and managing compliance, necessitating a large-scale administrative apparatus.
While these issues highlight enforcement challenges and negative impacts on Europe’s digital economy, this article focuses solely on the nine flaws listed. These are critical considerations that US policymakers should avoid replicating in their own privacy regulations.
Fortunately, it’s possible to address many of these issues effectively.
I am Sofia, a tech-savvy journalist and passionate member of the “Jason Deegan” team. Growing up, I was always fascinated by the latest technological advancements and loved sharing my knowledge with others.