Experts take stock of the GDPR

A number of organisations have already commented on the GDPR in advance of the review. "In December 2019, the Council expressed itself surprisingly tame", said Peter Schaar, EAID Chairman and former Federal Data Protection Commissioner. At the beginning he gave an overview of the main demands of the statements, most of which came from Germany.

It calls for more harmonisation and fewer opening clauses, better cooperation between supervisory authorities, and easier documentation and reporting requirements for small companies and associations. The organisations criticised that the DSGVO does not sufficiently address the issue of rampant profiling and that there are no rules on the liability or at least responsibility of hardware and software manufacturers.

"Club treasurers must comply with GDPR, Facebook does not"

Most of the panelists confirmed these demands. Moritz Körner, member of the Liberal Group in the European Parliament, explained the Brussels perspective in his statement. There the evaluation is not yet a topic of discussion. Although the GDPR has a direct effect in contrast to the previous EU Data Protection Directive of 1995, it has not yet been implemented nationally by Greece, Portugal and Slovenia.

France has imposed the highest fines, with Germany in second place. The problem is that the EU Commission has no overview of the fines. The citizens' perspective, on the other hand, is characterised by the "feeling that as club treasurer you have to comply with the GDPR, but not Facebook", said Körner. The FDP politician therefore called for the regulation to become more efficient and less bureaucratic.

GDPR as world law and criticism of the Irish data protection supervisory authority

The Federal Data Protection Commissioner, Professor Ulrich Kelber, stressed that more than 100 countries have already adopted data protection rules, many of them in Africa. The fact that California has oriented itself to the GDPR has attracted particular attention in the IT world. "The GDPR has become world law," concluded Kelber. This is in contrast to the deliberate misinformation in the run-up to May 2018 and the panic at the time, which is fuelling a wave of warnings from law firms. "A more welcoming culture would also be desirable for data protection," he said. Neither Kelber nor the other panelists expected major changes to the legal text after the evaluation. He saw a need for action on profiling and scoring: "Both are legally up to the level of the 1990s and technically up to the level of the 1980s. By the way, they are also given if a person participates in them, for example by signing the law.

Kelber criticised the Irish data protection supervisory authority for its inaction in dealing with IT companies. There was still no draft decision on major cases such as WhatsApp, Facebook and Microsoft. "The pressure on the Irish authority is like that on the Federal Motor Transport Authority in the Dieselgate affair," he said. We must therefore consider whether the one-stop shop principle can remain as it is. According to the GDPR, the lead supervisory authority is the sole point of contact for responsible parties in cross-border data processing. Kelber would like to see more room for manoeuvre for German supervisory authorities.