European Data Protection Regulation and Online New Media: Mind the Enforcement Gap
| DOI | http://doi.org/10.1111/jols.12002 |
| Published date | 01 December 2016 |
| Date | 01 December 2016 |
| Author | David Erdos |
JOURNAL OF LAW AND SOCIETY
VOLUME 43, NUMBER 4, DECEMBER 2016
ISSN: 0263-323X, pp. 534±64
European Data Protection Regulation and Online New
Media: Mind the Enforcement Gap
David Erdos*
Data Protection Authorities (DPAs) play a critical role in shaping and
applying the regulation applicable to online media expression within
the European Economic Area. Drawing on seven ubiquitous types of
online new media actors, a comprehensive survey of these authorities
was undertaken. It found that European DPAs generally adopt an
expansive interpretation of data protection and a constrained under-
standing of freedom of expression in this space. In contrast, data
protection enforcement is weak and lacking in harmonization. Except
for street mapping services, each type of online media actor had only
faced relevant enforcement action from a minority of these agencies.
DPA financial resourcing is very limited. Notwithstanding the develop-
ment of DPA `network governance', only DPAs with a particularly
extensive interpretative stance proved likely to have engaged in
extensive enforcement activity. It remains unclear what difference the
General Data Protection Regulation will make to resolving this
enforcement gap and its related problems.
534
*Trinity Hall, University of Cambridge, Trinity Lane, Cambridge CB2 1TJ,
England
doe20@cam.ac.uk
I would like to record my appreciation to the research assistants and others who aided the
research presented, the DPAs who participated in the survey, and the British Academy
whose funding made it possible. I particularly thank Jeff Ausloos, Maja Brkan, and
Brendan Van Alsenoy who provided comments on work in progress, Vaughan Connolly
for checking some of the statistics, and Ann Kristin Glenster for assistance in preparing
the final manuscript. Any errors remain my own.
ß2016 The Author. Journal of Law and Society ß2016 Cardiff University Law School
Although still sometimes unfairly dismissed as `marginal',
1
European data
protection centred on Data Protection Directive 95/46 (herein Directive 95/
46)
2
has emerged as `the central field for the development of privacy law and
policy'.
3
Moreover, whilst it can be seen as heralding a `remarkable expan-
sion in human rights',
4
the substantive framework established by Directive
95/46 sits in strong tension with the freedom to impart information, espe-
cially through new, online media. Google Spain dramatically highlighted this
tension in the area of search-engine indexing.
5
However, it arises similarly
across an ever more variegated and important new or online media
landscape, from blogging to social networking to street mapping. Directive
95/46 additionally `mandated the creation of powerful national independent
regulatory authorities ± data privacy [or data protection] authorities ± that
monitor and enforce these rules'
6
across the European Economic Area
(EEA).
7
As the EU Agency for Fundamental Rights has emphasized, these
agencies are `the main actors protecting data protection rights, [and] play a
crucial role in processing the overwhelming majority of data protection
complaints'.
8
In light of the critical role of the DPAs and the increasing
centrality of online media activity, this article presents research on the
interpretative stance, enforcement efforts, and enforcement capacity of these
535
1 B. Leveson, An Inquiry into the Culture, Practices and Ethics of the Press (2012).
2 Directive 95/46/EC of the European Parliament and of the Council of 24 October
1995 on the protection of individuals with regard to the processing of personal data
and on the free movement of such data.
3 P. Keller, European and International Media Law: Liberal Democracy, Trade, and
the New Media (2011) 331.
4 A. Newman, `Building transnational civil liberties: Transgovernmental entrepreneurs
and the European Data Privacy Directive' (2008) 62 International Organization 103,
at 119.
5Google Spain SL, Google Inc. v. Agencia Espaola de Proteccio
Ân de Datos, Mario
Costeja Gonza
Âlez (C-131/12) EU:C:2014:317.
6 Newman, op. cit., n. 4, p. 104.
7 Under the Agreement on the European Economic Area (EEA), the Directive extends
to Iceland, Liechtenstein, and Norway which, together with the EU, make up the
EEA: see EEA Joint Committee, Decision No. 83/1999 of 25 June 1999 amending
Protocol 37 and Annex XI (Telecommunication Services). The precise relationship
between the legal duties of Iceland, Liechtenstein, and Norway and both related
legal provisions such the protection of data protection within the EU treaties and
interpretations of data protection by the Court of Justice of the European Union
remains a matter of great complexity, the consideration of which is beyond the scope
of this article. Following the results of a referendum on 24 June 2016, the United
Kingdom government is now committed to the United Kingdom (and its intra-EU
overseas territ ory of Gibraltar) l eaving the EU. Its po sition on contin ued
membership of the EEA remains more ambiguous. For now, however, it remains
a full member of the EU, as it was when the data presented in this article was
collated.
8 European Union, Agency for Fundamental Rights, Access to Data Protection
Remedies in EU Member State (2013) 49, at
fra-2014-access-data-protection-remedies_en_0.pdf>.
ß2016 The Author. Journal of Law and Society ß2016 Cardiff University Law School
To continue reading
Request your trial