The first month of GDPR has seen a sharp increase in the number of complaints to regulators across Europe, showing strong public interest in the new rules.
The UK’s Information Commissioner’s Office (ICO) told the Guardian it has seen a rise in breach notifications from organisations, as well as more data protection complaints following the activation of the law.
The French data protection regulator, CNIL, reported a 50% increase in the number of complaints since the legislation came into effect on 25 May, compared with the same period last year, according to Politico Europe. A further 29 cases are under investigation at the European level, the site reports.
Across Europe, the regulation has also sparked greater transparency from firms that have suffered a data breach, with notifications spiking over the same period. GDPR increases maximum fines for malpractice to €20m (£17.6m) or 4% of a company’s global turnover – whichever is higher – and companies are more likely to face higher fines if they delay reporting breaches.
In Austria, more than 100 complaints have been filed in the last month, along with 59 breach notifications – the same number that would typically be received in eight months.
An ICO spokesperson said: “It’s early days and we will collate, analyse and publish official statistics in due course. But generally, as anticipated, we have seen a rise in personal data breach reports from organisations. Complaints relating to data protection issues are also up and, as more people become aware of their individual rights, we are expecting the number of complaints to the ICO to increase too.”
Isabelle Falque-Pierrotin, the head of CNIL, told Politico: “The general public is interested about all the transparency obligations, consent and all the new rights.”
The bulk of the response to the legislation has been a substantial number of complaints against high-profile companies, such as those against Facebook and Google filed by privacy campaigners at the consumer rights organisation Noyb. Those complaints accuse the two companies of forcing consumers into providing “consent” for data processing in a “take it or leave it” deal, which Noyb argues is against the principles of the law.
“Considering the powerful position these companies have and the consequent pressure the data subject is put under, to agree to irrelevant processing/advertising purposes, we believe that any such consent obtained should be considered invalid,” a Noyb spokesman told the Guardian.
Fearing such complaints, other companies exited European operations entirely in May, and still hav enot worked out a way to re-establish themselves on the continent. Operations at the LA Times, Chicago Tribune and other papers owned by the Tronc media group are blocked to EU readers; the Pinterest-owned reading app Instapaper has been down for maintenance for a month; and USA Today has taken to offering those in Europe a slimmed-down, ad-free experience, hoping that will leave their title compliant with the law.
