October 2, 2017

The EDPS, Giovanni Buttarelli, reminds readers that data protection by design will become a legal obligation under the General Data Protection Regulation, which becomes effective in May 2018. Those who process personal data of individuals will have to take data protection into account “both at the time of the determination of the means for processing and at the time of the processing itself”, under Article 25. In other words, data protection principles and safeguards must guide the process from the moment technology and organisational practices are designed and planned, Mr Buttarelli explains.

Mr Buttarelli says that it is time to “stop users being deprived, often unwittingly, of control over their communications and data: time to stop the forcing of consent through “tracking walls”, to stop the promotion of default settings, to stop the use of tracking technologies that escape detection.”

The Commission’s proposal for the new e-Privacy Regulation is “a huge step in the right direction”, Mr Buttarelli says, although it requires some improvements. Mr Buttarelli urges the European Parliament and the Council to finalise the new legislation and create incentives for a sustainable baseline for respecting privacy and data protection. He calls on the EU legislator to “stop the cycle of ever-increasing data collection and the ever-increasing concentration of pools of personal data in the hands of ever fewer more powerful giant tech firms.” In doing so, Mr Buttarelli says, the EU will open opportunities for new business models and for more privacy friendly technologies and business ecosystems. Tracking and advertising are not the same, he says. Advertising flourished before it was connected to ever-closer tracking of user behaviour. Moreover, tracking is increasingly being used beyond commercial advertising, for example, micro-targeted political campaigns.

The limiting factor for effective user control is not the technology, Mr Buttarelli says. “Where the interests of businesses are at stake, we see tremendous efforts and incredible achievements in the development of technologies.” The ingenuity, creativity and engineering excellence demonstrated by the targeted advertising ecosystem are impressive. Therefore, Mr Buttarelli says, we cannot accept that technological limits are given as a reason not to provide users with effective tools for transparency and control to maintain their privacy when they use the internet and electronic communications services.

The current review of the e-Privacy rules is “an opportunity to good to be missed”, in Mr Buttarelli’s view. The e-Privacy review could allow the creation of a new field for competitive and privacy friendly services on the internet and the World Wide Web to give back control to individuals.

Mr Buttarelli says that his office will continue to provide its advice to the legislator to help them find the best solution. At the same time, it will also press ahead with its support for the technological development in privacy engineering. To read the blog post in full, click here.