{"id":5469,"date":"2023-04-19T12:36:21","date_gmt":"2023-04-19T12:36:21","guid":{"rendered":"https:\/\/exciting-panini.13-37-234-21.plesk.page\/?p=5469"},"modified":"2024-07-23T13:59:54","modified_gmt":"2024-07-23T13:59:54","slug":"vers-une-europe-de-la-protection-des-donnees","status":"publish","type":"post","link":"https:\/\/viqtor.eu\/en\/towards-a-europe-of-data-protection\/","title":{"rendered":"Towards a Europe of data protection: the road is long."},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"Towards\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t

Towards a Europe of data protection: the road is long.<\/h1>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\n

Legal Watch No. 36 \u2013 June 2021<\/strong><\/p>\n\n\n\n

Towards a Europe of data protection: the road is long<\/strong>The General Data Protection Regulation raised many hopes in terms of clarity and effectiveness when it came into force.<\/p>\n\n\n\n

While the European Directive it replaced already provided a relatively precise and binding legal framework, the GDPR intended to enable a harmonized implementation of these principles, wherever the companies concerned are located in the European Union.<\/p>\n\n\n\n

The applicable sanctions, revised upwards, also had to be assessed by the supervisory authorities using a coherent analysis grid.<\/p>\n\n\n\n

In fact, there seem to be many pitfalls that still limit this long-awaited harmonization.<\/strong><\/p>\n\n\n\n

German Commissioner Johannes Caspar, who is coming to the end of his term after twelve years at the head of the Hamburg state supervisory authority, persists and signs this June by denouncing the flaws in the implementation of the GDPR.<\/p>\n\n\n\n

The cause is long and complex procedures before a common position can be found by all the authorities meeting within the European Data Protection Board (EDPB).<\/p>\n\n\n\n

The GDPR has established a so-called "one-stop shop" procedure, which provides for the competence of a lead authority, that of the country of the main establishment of the company concerned by the investigation.<\/strong><\/p>\n\n\n\n

This lead authority must nevertheless work with the other national authorities concerned at the various stages of the procedure.<\/p>\n\n\n\n

In practice, there is a centralization of investigations under the Irish authority, which is competent to lead most of the cases against GAFAM established on its territory. Twenty-eight procedures are reportedly underway with the said authority, which is criticized for its slow and lenient procedures regarding big techs such as Facebook and Twitter, which is reportedly giving rise to long and difficult discussions with its counterparts within the EDPS.<\/p>\n\n\n\n

The Commissioner of the Hamburg Authority calls for clear and dissuasive signals to be given by the supervisory authorities in good time so that data controllers comply in a similar manner wherever they are located in the European Union, and without distortion of competition.<\/p>\n\n\n\n

It should be noted that this issue was identified by the Committee itself in its 2020 annual report, and that improving cooperation between authorities is one of its priorities for 2021-2022.<\/p>\n\n\n\n

Let us add that, although it suffers from procedural cumbersomeness, the "one-stop shop" system nevertheless has the advantage for any citizen of the European Union to be able to lodge a complaint with their national supervisory authority, even if the data controller is established in another country, with the competent authorities being responsible for cooperating in handling the complaint.<\/p>\n\n\n\n

If the complainant is not satisfied with the outcome of the investigation, he or she may also seek redress in his or her own country.<\/p>\n\n\n\n

The European Court of Justice also recalled in a judgment of June 15 the room for maneuver of authorities which are not the lead authorities in handling a cross-border complaint.<\/strong><\/p>\n\n\n\n

In the context of a dispute between Facebook (established in Ireland) and the Belgian data protection authority, the Court thus considered that the Belgian authority, although not the lead authority, could bring certain violations of the GDPR by Facebook before the Belgian courts.<\/p>\n\n\n\n

These conditions are nevertheless limited to cases presenting an emergency (Article 66 of the GDPR) or to local cases (Article 56.2 of the GDPR). This ruling therefore does not signal the end of the one-stop shop, but tends to specify the exceptions to its application. The principle of cooperation between authorities thus remains the norm.<\/p>\n\n\n\n

And also<\/strong><\/p>\n\n\n\n

France:<\/strong><\/p>\n\n\n\n

On June 30, the CNIL published the third version of its software designed to facilitate privacy impact analyses.<\/strong><\/p>\n\n\n\n

This new version guides managers in carrying out their impact analysis and enables the development of knowledge bases parallel to those provided by the CNIL.<\/p>\n\n\n\n

<\/p>\n\n\n\n

The CNIL's restricted committee imposed a fine of 500,000 euros on the company <\/strong>Bricopriv\u00e9 for<\/p>\n\n\n\n