Connect with us


European Union’s General Data Protection Regulations Are Beginning to Bite Tech and Telecom Companies Globally

David Jelke



Illustration by Piqsels used with permission

WASHINGTON, February 5, 2020 – Fines under the European Union’s General Data Protection Regulation follow patterns, some predictable and others less so, according to a presentation by lawyers Dan Cooper and Nicholas Shepherd of Covington and Burling.

The GDPR went into effect summer of 2018, and so far, 190 fines have been levied against European companies for data privacy violations. 150 of those violations occurred this year, with a sizable peak in the fourth quarter.

In fact, about half of the 2019 fines were levied in the last three months of the year. European businesses fear this uptick, but the data from January 2020 seems to be assuaging the fears, Cooper and Shepherd said: So far, only 9 fines have been levied in 2020.

However, the average fine value has been increasing.

Regulators seem to be more drastically punishing companies in larger and wealthier local markets, including France, Germany, and the U.K., which was part of the European Union until January 31, 2020.

Conversely, the greatest number of fines have been levied against companies in Spain and Romania, said Cooper.

Furthermore, the six heftiest fines account for 85 percent of the funds generated from the 190 fines levied in the past year and a half. That means that the data obscure the majority of low-level fines against a diverse spread of countries.

Technology and telecommunications took the prize for the greatest monetary burden for violations at 57 percent; the second greatest offender was transportation at just 12 percent.

Cooper said he was surprised that healthcare and retail, which are in fact huge sectors, only accounted for 6 percent and 7 percent of the monetary burden of fines, respectively.

Still, this data did not account for the two biggest proposed fines in the history of the GDPR: One against British Airways for 200 million Euros and against Marriott for 100 million Euros. These breaches involved the exposure of millions of names, addresses, and credit card numbers. The fines are still pending, meaning that negotiation and settlement between the regulators and the companies may still be taking place.

Cooper and Shepherd also demonstrated how the GDPR takes advantage of powers that go beyond simple fines. They related one example of how regulators forced a Canadian firm to erase mounds of personal data that they had held on to in violation of GDPR principles.

The attorneys also described a ruling where regulators forced a Polish dating app to send 5.7 million emails to clients, apologizing for data leakage. Despite no fine being levied, the total cost required to do this by Polish firm cost more than 8 million Euros, effectively a very major fine.

The lawyers warned participants that regulators will continue to slap progressively larger fines onto companies, especially social media firms, and will become more hawkish as issues such as AdTech, facial recognition, and voter data begins to loom larger in data collection.

Graph of enforcement from the presentation by Covington & Burling.

David Jelke was a Reporter for Broadband Breakfast. He graduated from Dartmouth College with a degree in neuroscience. Growing up in Miami, he learned to speak Spanish during a study abroad semester in Peru. He is now teaching himself French on his iPhone.


National Plan Required For Consumer Privacy, Congresswoman says

Samuel Triginelli



Screenshot of Suzan DelBene from C-Span

April 1, 2021 — A Congresswoman from Washington State, who introduced federal legislation that would be the first national consumer privacy law if adopted, says the federal government is being outpaced by some states that are implementing their own consumer privacy legislation.

“There is a significant problem with consumer privacy in the US,” said Representative Suzan Delbene on Tuesday during a New Democratic Network event. Delbene introduced her Information Transparency, and Personal Data Control Act, a wide ranging federal privacy legislation, on March 10. Delbene is the vice chair of the Ways and Means Committee, and is the chair of the House New Democrat Coalition caucus.

There is no federal data privacy law, which has forced some states to pursue their own consumer data policies. That includes California and, recently, Virginia. Some have said the concern is that there will be a patchwork of different privacy legislation that may end up just confusing Americans.

“We need a uniform set of rights for consumers and businesses standards to follow in the digital world,” DelBene said.

The bill states that companies must provide privacy polies in plain language, must allow users to opt-in for personal information gathering, must disclose who personal information is being shared with, and must submit to privacy audits every two years. The federal law would also give the government the ability to preempt existing state laws.

Simon Rosenberg, president of New Democrat Network, said about the bill that, “together, we have a lot of work to do in the coming years to restore the promise of the Internet. One of the areas of greatest need is creating a single working privacy standard for the United States.

“In her bill, the approach Representative DelBene takes to protecting Americans’ privacy is smart, measured, and will undoubtedly be highly influential in shaping the approach Congress takes in the days ahead. It is a very welcome addition to the vital debate underway about our digital future,” Rosenberg added.

The purpose of this bill is to ensure that privacy policies are transparent and clear. “Many consumers are given lots of information with lots of legal terms, that leads them to click the accept button without knowing what they have signed up for,” DelBene said.

“There is an urgent need for consumers to understand what data is being shared,” she added. “We want to make sure there is enforcement. The law says that this will be the responsibility of the Federal Trade Commission, so the FTC must have the resources to do this.

“I think my bill is focused on privacy specifically because I think it is foundational. We build on important things, such as AI, facial recognition, and all the other issues we need to address. If we don’t start addressing the issues of data privacy, it will be hard to imagine how it will the expansion of laws to address a broader set of issues that need to get ahead of.”

Congresswoman DelBene believes the bill can be bipartisan, but she wants to make sure Congress understands its importance. “I’m not sure Congress understands these issues, so it takes a collective effort to push it forward.”

DelBene says she’s confident that Congress will follow the bill, despite many congresspeople who she said are hesitant to take that first step.

Continue Reading


Attach Strings To Data Collection To Combat Surveillance Capitalism, Experts Suggest

Samuel Triginelli



Photo of Marietje Schaake from the European Parliament

March 29, 2021 – Laws addressing how much data can be collected should be among new regulations that must ensure data collection from big technology companies doesn’t harm Americans, according to a March 17 panel of academics at the South by Southwest conference.

The era of corporate self-regulation is now up, said Marietje Schaake of the Standford University Cyber Policy Center and panelist at SXSW conference discussing the “techno-democratic” approach to Big Tech, including what to do about surveillance capitalism.

Surveillance capitalism is an economic system centered on commodifying personal data with the core purpose of profit-making.

“We have heard many pledges, many promises, and good intention offers for solutions for self-regulatory initiatives. And the time is out for those,” she said.

Schaake said it is time the government attach consequences to data collection to the detriment of the public and to set clear limits on collection practices.

“We have tried for too long, and it has led to several distractions and lost time to make sure that the rule of law is leading and that there are enforceable accountable, transparent expectations placed on these companies,” she said.

Joan Donovan, a social scientist at the Harvard Kennedy School, said what’s critical is how much data tech companies should be allowed to collect and under what conditions should they sell it to ensure rights aren’t violated.

“The tech sector as it is built now, relies on harvesting so much data about an individual that their products and the entire economy they are built on could not exist” if there were robust rights and privacy protections in place, Donovan said.

She said the discussion about regulating these businesses should include moving from a focus on protecting enterprise to protecting human rights.

Continue Reading


House Energy and Commerce Chairman Frank Pallone Calls for Update to Children’s Privacy Legislation

Derek Shumway



March 11, 2021 – House Energy and Commerce Committee Chairman Frank Pallone, D-N.J., on Thursday called for an update to the Children’s Online Privacy Protection Act at subcommittee hearing on “Kids Online During COVID: Child Safety in an Increasingly Digital Age.”

“The challenges children face online existed before the pandemic, but it’s only gotten worse,” he said.

Visiting in person with extended family and friends have so far become a thing of the past as the COVID-19 pandemic continues. Many other in-person activities have been replaced with video games, social media, and other video services.

Kids’ screen time has doubled during the pandemic, said Pallone. The effects of too much screen time can increase instances of anxiety, sleep deprivation, obesity, and cyber bullying, he said.

The increased screen time due to the pandemic has turned consumers into victims of what he called harassment and dark pattern manipulation led by advertisers. Children cannot defend themselves like adults in managing these predatory practices, he said.

“Despite laws to protect children’s privacy, data collection and tracking of children is disturbingly prevalent.” He went on to criticize many apps targeting children on mobile devices are notorious for collecting personal information, which is then bought and sold, resulting in advertising meant to manipulate children.

He said that digital ad spending specifically targeting children was expected to reach $1.7 billion this year. COPPA, which hasn’t been updated since 2013, needs to be updated because, he said, internet companies have since continued to target children.

Continue Reading


Signup for Broadband Breakfast

Get twice-weekly Breakfast Media news alerts.
* = required field