The COVID-19 pandemic has affected both EU data protection authorities and the organizations they oversee, finding themselves in uncharted territory. DPAs have been left to choose how they'll go about handling their enforcement work in an unparalleled time of hardship and technological uptake for companies — all while the pressure's on for critics who say DPA's enforcement of the EU General Data Protection Regulation has been weak to date.
Where DPAs stand on enforcement
DPAs from France, Germany, Ireland and the U.K. recently detailed, through webinar or exclusive comments to The Privacy Advisor, where they stood on enforcement as the pandemic rages on. The resounding message from the four is that they plan to uphold their enforcement actions and hold organizations accountable when GDPR standards are not met, regardless of the COVID-19 crisis.
"I don’t think we’ve taken a particular stance across the board on any type of softening of approach," Irish Data Protection Commissioner Helen Dixon said during Bloomberg Law's Leadership Forum. "It very much is case by case. … Particularly with the bigger tech companies we regulate, they have the resources and capabilities, just as we do as the data protection authority, to implement systems, work from home and remain productive. We’ll consider any reasonable request for some kind of extension or a derogation that needs to be applied, but it’s not our starting point."
Following suit with Ireland, France's data protection authority, the Commission nationale de l'informatique et des libertés, has no plans of changing its tune in the face of COVID-19.
"The object remains broadly the same: to have the right balance between support and control," CNIL Head of Enforcement Mathias Moulin told The Privacy Advisor. "Similarly, the priorities of our enforcement policy remain broadly unchanged: data security, respect for the rights of individuals through the investigation of complaints and the development and effectiveness of European cooperation."
Early on, as the pandemic began to take shape, U.K. Information Commissioner Elizabeth Denham initially announced there would be considerable rollbacks on her office's enforcement work. That stance was somewhat altered more recently as Denham said during a webinar with Global Counsel that the ICO moved to "back away or postpone certain cases that affect front line workers" but otherwise was staying the course.
"We have only paused 10% of our work," Denham said. "We’ve evaluated that again in the last few weeks as more and more organizations are coming back to basics and online."
France and Germany both revealed to The Privacy Advisor that any slowdown in enforcement was mostly due to government lockdown restrictions, which limited or halted such activities as on-site investigations.
Germany faces a unique challenge with a national DPA overseeing state DPAs, which enforce at their own discretion. German Federal Commissioner for Data Protection and Freedom of Information Ulrich Kelber indicated state DPAs have mostly maintained their independence during the pandemic.
"Of course, we tried to harmonize our strategy with our colleagues on national and international levels. But there are also differences with regards to the various laws that deal with pandemic outbreaks," Kelber said. "As a federal state, we know that local authorities are better qualified to deal with the specific problems of their region. So far this approach seems successful."
Kelber was clear that Germany will not back off of the stringent scheme on GDPR fines it had settled upon before the pandemic came to be. However, Kelber added that fines aren't always the answer.
"A fine is something of a last resort for me. The DPAs have a lot of enforcement tools that they may use prior to a fine," Kelber said. "Still, there are some grave violations of the GDPR that may call for a fine regardless of how cooperative a company may have been. It is very important to me that we use our enforcement tools proportionally."
Strong fines aren't as certain in France, where Moulin said the CNIL's restricted committee has always considered legitimate hardships a violator has endured. This could come into play with the financial burdens COVID-19 has placed on some companies.
"Economic elements are systematically taken into account in the calculation of sanctions," Moulin said. "If the organization demonstrates that the crisis has affected its ability to comply with the demands regarding compliance actions and associated deadlines, this will be analyzed and taken into account, if appropriate."
'Strong' enforcement a matter of interpretation
As DPAs suggest they'll remain firm with enforcement strategies, it's fair to ask if those approaches were strong in the first place.
Dixon has been consistently adamant that DPAs are doing their jobs under the GDPR and will continue to do so.
"I don’t think there’s any credibility to the argument that the GDPR is broken," Dixon said. "I also don’t think we ever suggested it was perfect. Even as regulators, we see there are issues with some provisions and it doesn’t solve all problems, but already it’s delivered a lot."
Dixon added that quick investigations and delivery of enforcement — she's been criticized on both — were "never going to be the reality” and stemmed from "false expectation." She cited data protection officer appointments across the bloc, improved accountability within privacy programs and data subjects' increased ability to exercise their rights as positives the GDPR has produced.
On the other hand, there's been a public perception that DPAs simply haven't shown the GDPR's teeth to this point.
"My thought was the first year would be about getting it right and then the next would be where enforcement kicks in," Mozilla Head of EU Public Policy Raegan MacDonald said. "We still haven’t really seen that for different reasons. I think it comes down to the data protection authorities and to whether and what extent they are independent or adequately resourced."
Access Now also questioned the power of enforcement in its two-year report on the GDPR. Within it, the advocacy group discussed the potential repercussions of DPAs failing to strengthen enforcement during the pandemic, saying strong enforcement "will be crucial to ensure that this public health crisis does not turn into a human rights crisis."
Access Now U.S. Policy Manager Eric Null and his EU colleagues continue to suggest that anything short of strong enforcement won't produce results.
"Data collection and use have increased during the pandemic, as we can see by the number of new apps and services that are designed to help address COVID-19-related problems," Null said. "To abandon or weaken enforcement of GDPR during this time would be a huge mistake, as good data governance is just as important now as it was before."
Finding the way forward
What's clear about the regulators' enforcement strategies is that they each intend to keep pushing data protection forward, knowing its general importance is only growing as the effects of COVID-19 continue to take shape.
"We are going to be tested in the data protection world more than we ever have," Denham said. "What we need is a new relationship with the companies and organizations that we oversee because more resources are going to need to go into advice, especially in the coming months and years."
Along the same lines as Kelber's inclination to avoid fines as often as possible, MacDonald suggested DPAs may want to be more amendable to how they bring about long-standing, meaningful change through their enforcement.
"We’ve actually needed the DPAs to be more scrutinous than normal because of the things being proposed, which have been mostly technological solutionism," MacDonald said. "You need to be tactful and strategic to get the end result that you need. That could be through enforcement or working with (essential entities) to get them the resources they need to be compliant, but you can’t just give a free pass and have other companies see and remember that."
Christian D'Cunha, former head of the private office of the European Data Protection Supervisor, spent more than six years advising on EU legal and policy developments and strategy, including the GDPR. D'Cunha, now working for the European Commission on cybersecurity and digital privacy, recalled that GDPR was brought into force "to update the laws for the digital age." It's a notion he believes DPAs should look back on as they look to be firm and evoke change.
"Strong should mean that the thought of enforcement causes companies to change the way they behave and look to be above reproach in everything they do," D’Cunha said. "I get the impression sometimes that it’s more of an adaption of privacy policies to justify practices when they really should be revising the way they do business and show the changes they’ve made."
Photo by Calvin Hanson on Unsplash
