![\"GDPR](\"https:\/\/blog.atinternet.com\/wp-content\/uploads\/2019\/07\/david-clode-3SWJ1eSux8M-unsplash-1024x637.jpg\")
<\/figure>\nThe GDPR\u2019s has just celebrated its one-year anniversary. To mark the occasion, AT Internet has created a comprehensive guide<\/a> on how you can ensure that your digital analytics is 100% compliant with the regulation. To accompany the guide, we are running a blog series and GDPR quiz<\/a> to get you up to speed! <\/p>\n In the first blog, we wade 1. <\/strong>\u274c There was total chaos when the GDPR came in, with 206,326 reported breaches<\/a> in the first few months alone.<\/p>\n \u00a0<\/p>\n \u2705 Although initially there were a large number of reports cases following the GDPR deadline, many were quickly resolved. Of the 200,000 or so breaches in the first nine months of the regulation, around 65,000 were initiated on the basis of a data breach report by a data controller. Of the 95,000 complaints, some 52% of the overall cases had already been closed, with only 1% facing a challenge in national courts.<\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n 2. <\/strong>\u274c For the consumer, the regulation has simply created an endless barrage<\/a> of rapid-fire, pop-up privacy notices that nobody actually reads. This has caused consent fatigue<\/a> and has done little if anything to improve individuals\u2019 comprehension of their data privacy. <\/p>\n \u00a0<\/p>\n \u2705 The implementation of the GDPR has in fact significantly raised the awareness of privacy issues for consumers. Following the Cambridge Analytica scandal, a poll<\/a> in the UK showed that 72% of individuals had already changed their data permissions ahead of May 25th<\/sup>, 2018 and were planning on sharing less data in the future.<\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n 3. <\/strong>\u274c The GDPR offloads too much responsibility on individuals who have a limited understanding of the complexities of the regulation. <\/p>\n \u00a0<\/p>\n \u2705 According to Eurobarometer<\/a> results from March 2019 in an article by the European Data Protection Board (EPDB), the increase in queries and complaints confirms a rise in individuals\u2019 comprehension of data protection rights \u2013 67% of EU citizens polled indicated that they have heard of the GDPR, 36% of them indicated that they are well aware of what the GDPR entails. <\/p>\n \u00a0<\/p>\n \u2705 57% of EU citizens polled indicated that they are aware of the existence of a public authority in their country responsible for protecting their data protection rights. This result shows an increase of 20 percentage points compared to 2015 Eurobarometer results.<\/p>\n \u00a0<\/p>\n This can only increase in the future\u2026<\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n 4. <\/strong>\u274c Businesses have no idea how they can be compliant and what constitutes a data breach \u2013 as reflected in the large number of complaints. According to the IAPP<\/a> more than 56% of respondents subject to the GDPR said they were far from compliance or would never comply and one-fifth said that \u201cfull compliance may be impossible.\u201d Hoping to avoid the costs of incorrect or delayed compliance, many companies are moving forward with a risky \u201cwait-and-see<\/a>\u201d approach as they struggle to understand the best course of action. <\/p>\n \u00a0<\/p>\n \u2705 As a brand-new regulation, the GDPR will take time to become truly effective<\/a> \u2013 confusion during the implementation phase is to be expected. It is also a monumental challenge for regulators as well as for businesses being regulated. Many organisations are still running through a backlog of activity<\/a> required for compliance even so many months after the GDPR entered into law. This can be very slow work and requires an experienced Data Protection Officer (DPO) with both legal and technical expertise. <\/p>\n \u00a0<\/p>\n \u2705 Regulatory bodies spent most of 2018 getting up to speed with their staff levels and internal procedures and finishing the last pre-GDPR investigations.<\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n 5. <\/strong>\u274c There is inadequate support and information available on how companies and individuals can be GDPR compliant. <\/strong>Local Data Protection Authorities (DPAs) are not taking the necessary measures to inform businesses and individuals on the regulation requirements. <\/p>\n \u00a0<\/p>\n \u2705 Following a record number of complaints in France, the CNIL<\/a> has affirmative taken actions to support operators and ensure the successful implementation of the GDPR. These include raising awareness for local authorities with a practical guide, thematic sheets (teleservices, security, Data Protection Officer (DPO) and local authorities, etc.) and a dedicated module in its online training open to everyone. They provide support via the CNIL website and an asset and a developer kit have already been published. CNIL is also in close dialogue with professionals and \u201cnetwork heads\u201d to promote the development of skills in all sectors and support for data protection officers. In practical terms, they have tools available to everyone on their website including:<\/p>\n With 2,044 data breach notifications in France and 89,271 at European level, more than 19,000 data protection officers (natural or legal persons) have been appointed by more than 53,000 organisations. There has been also an influx of requests for information from professionals wanting to apply the GDPR framework and a growing mobilization of professionals and individuals on data protection \u2013 the CNIL website has had more than 8.1 million visits over the last year. <\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n 6. <\/strong>\u274c A vast new Data Protection Officer bureaucracy has been created in organisations and the associated costs are huge.The GDPR makes it a legal requirement for all companies doing business in the EU to appoint a DPO<\/a> if their core business consists of data processing activities. If they process special categories of data (sensitive data, like biometrics, ethnic, health data etc.) they must appoint a one regardless of the scale of processing \u2013 public institutions also have to appoint one. Failure to appoint a DPO can carry fines of up to \u20ac10 million or 2 percent of a company\u2019s global turnover, whichever is higher. This is expected to generate the need for up to 28,000 DPOs in the EU and the US and 75,000<\/a> worldwide. <\/p>\n \u00a0<\/p>\n \u2705 Although initial reports warned that the GDPR would create the need for vast numbers of DPOs, many companies will outsource<\/a> and the likely figure is a considerably lower. Smaller companies are also allowed to share a DPO and they can be in the form of an existing employee as well as a new hire. <\/p>\n \u00a0<\/p>\n \u2705 The GDPR may seem draconian by demanding that each organisation has its own DPO, but data regulation was in drastic need of modernisation<\/a> to bring it in line with a rapidly changing online ecosystem and make the law fit for purpose. <\/p>\n \u00a0<\/p>\n \u2705 By fostering a culture of data protection within an organization, the DPO will save money by avoiding potential fines. <\/p>\n \u00a0<\/p>\n \u2705 Businesses are realising that aside from focusing on the fines they might receive, GDPR compliance can be viewed as an opportunity to engage with customers and build loyalty, as a driver of increased trust<\/a> and overall business growth. This is one of the reasons mobile banking, streaming services, and tech companies, have been extremely agile<\/a> when it came to GDPR compliance. DPOs must be allowed to act independently and cannot receive orders from the management which also creates an atmosphere of confidence in a company\u2019s data privacy practices.<\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n 7. <\/strong>\u274c EU data authorities are not adequately staffed or coordinated to handle the demands. EU regulators claimed they had insufficient resources<\/a> or funding to cope with the new GDPR workload and that they need needed a \u201csubstantial increase in resources and staff\u201d. <\/p>\n \u00a0<\/p>\n \u2705 2018 was a transition year<\/a> and the various agencies needed time to staff up. <\/strong>EU data authorities have stated<\/a> that \u201cwhile the cooperation procedures are robust and efficient, they are time and resource intensive<\/strong> \u2013 SAs need to carry out investigations, observe procedural rules, coordinate and share information with other supervisory authorities.\u201d<\/p>\n \u00a0<\/p>\n \u2705 The Irish DPA \u2018beefed up<\/a>\u2019 it\u2019s 27 staff to more than 130 to cope with the steep rise in complaints and this is expected to rise to more than 200 in the next year.<\/p>\n \u00a0<\/p>\n \u2705 The framework surrounding GDPR fines is still being created. One of the likely reasons for the uneven GDPR fines across countries, as well as the slow associated process, is that those in charge of making legal decisions don\u2019t have legal precedents to guide their actions. <\/p>\n \u00a0<\/p>\n \u2705 In 2019, people should expect regulators to become more concise in their interpretations of the law. <\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n 8. <\/strong>\u274c There is little international coordination \u2013 the DPAs of several EU countries also need to harmonise<\/a> the wide range of fines being handed out.<\/p>\n \u00a0<\/p>\n \u2705 To provide more guidance<\/a> as to how a data protection agency should calculate the amount of a fine, the Dutch data protection agency, the Autoriteit Persoonsgegevens<\/em> has released a framework to determine how severe a penalty will be. The Dutch framework<\/a> (in Dutch) has four categories of violations, and each category has a defined \u201cdefault\u201d fine, along with a range of possible fines depending on the severity of the violation. <\/p>\n \u00a0<\/p>\n \u2705 The UK\u2019s Information Commissioner\u2019s Office (ICO) are coordinating with both the Dutch and Norwegian DPAs<\/a> to create a harmonized framework or matrix \u2018toolkit\u2019 for various watchdogs to give them a foundation for calculating fines in the future.<\/p>\n \u00a0<\/p>\n \u2705 Data Protection Authorities across the EU will soon be publishing annual reports<\/a>, which should give us a wider and better picture of the level of compliance one year\u00a0 into the GDPR.<\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n 9. <\/strong>\u274c The threat of huge fines never materialised<\/a>, with the exception of Google\u2019s token slap on the wrist by the French. Only 91 fines<\/a> were imposed in the first eight months of GDPR and (removing the \u20ac50M Google fine) the average GDPR penalty was approximately \u20ac66,000<\/a>. Even Google\u2019s fine was merely a snip of the company\u2019s $136.2 billion 2018 revenue, approximately .04% \u2013 far below the 4% potential.<\/p>\n The fines that were handed out were extremely measured \u00a0<\/p>\n \u2705 The \u2018token\u2019 GDPR fine from French CNIL against Google for \u201clack of transparency, inadequate information and lack of valid consent regarding the ads personalization\u201d can be viewed as a shot across the bows<\/a> for the tech giant. It also demonstrated that DPAs have the will and muscle to implement fines on larger companies and that the major players are not untouchable.<\/p>\n \u00a0<\/p>\n \u2705 The first GDPR fine was for German social media platform Knuddels. Although the data breach was a major one, compromising the email addresses and passwords of 330,000 users, the company\u2019s proactive approach to addressing the breach meant that that the fine was only \u20ac20,000. They not only responded quickly by notifying the German data protection authorities and customers, they also worked rapidly to bring in the recommended security procedures.\u00a0<\/p>\n Stefan Brink, state data protection commissioner for Baden-Wurttemberg, commented<\/a> on its \u00a0<\/p>\n \u2705 In March 2019 when the Polish DPA<\/a> showed a highly measured response by only issuing a \u20ac219,000 fine to a company who failed to inform six million individuals that their personal data were being processed. While the Danish DPA only fined a company \u20ac161,000 for holding on to personal data longer than allowed under GDPR.<\/p>\n \u00a0<\/p>\n \u2705 In June 2019, the CNIL dished out a second fine of \u20ac400,000 fine to the French real estate company Sergic. Although the breach was a serious one, i.e. a lack of due diligence in addressing vulnerability and the fact that the accessible documents revealed very intimate aspects of people\u2019s lives, CNIL took the size of the company and its financial strength into account and imposed a measured fine.\u00a0 <\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n 10. <\/strong>\u274c It is a weak start from the regulation considering that DPAs have already handled around 100,000 self-reported breaches and user complaints. <\/p>\n \u00a0<\/p>\n \u2705 The complaints are still being processed and the impact<\/a> has yet to be felt, in that we haven\u2019t yet seen significant enforcement activity, both in terms of volume and amount.<\/p>\n \u00a0<\/p>\n \u2705 Many cases are also ongoing on an international and national level \u2013 there have been 446 <\/strong>cross-border cases which tend to be far more complex and take longer to resolve. Of the large number of reported to EEA Supervisory Authorities (SAs), over 144,000<\/strong> queries and complaints and over 89,000<\/strong> data breaches have been logged. 63%<\/strong> of these have been closed and 37%<\/strong> are ongoing. <\/p>\n \u00a0<\/p>\n 11. <\/strong>\u274c The GDPR is ineffective against the tech giants as they have interpreted the regulation liberally at best. There is also a major lack of transparency. Facebook has been in the headlines<\/a> for its reintroduction of facial recognition software<\/a> and data sharing with its recently purchased subsidiary WhatsApp. Paul-Olivier Dehaye (a privacy expert who helped uncover Facebook\u2019s Cambridge Analytica scandal) stated that \u201cbig companies like Facebook are 10 steps ahead of everyone else, and 100 steps ahead of regulators \u2013 there are very big questions about what they\u2019re doing.\u201d <\/p>\n \u00a0<\/p>\n \u2705 The EDPB released a report<\/a> stating that out of the 206,326 cases reported under the GDPR across the 31 countries in the European Economic Area (EEA), the national Data Protection Agencies (DPAs) have only resolved only 52 percent of them. As regulators work through this backlog, businesses can expect more fines of greater amounts in the coming months.<\/p>\n \u00a0<\/p>\n \u2705 The CNIL fine against Google was a critical first step, and created an important precedent<\/a> to evaluate the impact and reach of GDPR. More fines are to be expected in 2019 and beyond.<\/a><\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n 12. <\/strong>\u274c Google continues to turn a blind eye in terms of its failure to get consent from users \u201cbefore sharing data among its fast-growing line of networks and products\u2014from YouTube to Google Photos to Gmail and more.\u201d Nicolas Vinocur at Poltico refers to a significant loophole<\/a> being exploited by the tech giants. Chief policy officer at Brave, Johnny Ryan referred<\/a> to Google\u2019s processing of user data in advertising transactions as a \u201cmassive and ongoing data breach\u201d in which it leaks intimate user data to \u201cthousands of companies every day\u201d. According to Brave, Google\u2019s ad exchange broadcasts personal information about users to \u201ctens or hundreds\u201d of potential advertisers every time they visit a website, with no limits placed on how the data is used, making it the \u201cmost massive leakage of personal data recorded so far\u201d. <\/p>\n \u00a0<\/p>\n \u2705 The Irish DPA recently launched a probe of possible violations by Google\u2019s online Ad Exchange<\/a> \u2013 it became the lead authority to watch over Google\u2019s privacy compliance after the Alphabet established its main European base in Ireland in January. <\/p>\n \u00a0<\/p>\n \u2705 The Irish Data Protection Commissioner Helen Dixon said<\/a> that substantial fines were on the way in the \u201ccoming months\u201d. There are currently 18 investigations<\/a> underway by the Irish DPA which has become the lead GDPR regulator for the majority of the major tech companies who are based there.<\/p>\n \u00a0<\/p>\n \u2705 The cases before the DPC in Ireland are some of the most consequential that will be made about the GDPR. As precedents that could \u201credefine business models\u201d, the actions need to be coordinated with other countries and the decision needs to be watertight to withstand court challenges. The progress of the Irish DPO will be fundamental to shoring up the GDPR in the future \u2013 as other U.S. high-profile technology leaders such as Facebook, Twitter, WhatsApp, Airbnb, Microsoft and Oath also have their European headquarters in Ireland to take advantage of the \u201cone-stop shop\u201d mechanism that simplifies cross-border data processing<\/a> for non-EU organizations under the GDPR.<\/p>\n \u00a0<\/p>\n AT Internet\u2019s Analytics Suite<\/em> is 100% compliant with As an Our The GDPR\u2019s has just celebrated its one-year anniversary. To mark the occasion, AT Internet has created a comprehensive guide on how you can ensure that your digital analytics is 100% compliant with the regulation. To accompany the guide, we are running a blog series and GDPR quiz to get you up to speed! In the […]<\/p>\n","protected":false},"author":1,"featured_media":81864,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12033],"tags":[23851,2907,3950,213,20706],"dealstore":[],"offerexpiration":[],"class_list":["post-81861","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analytics","tag-gdpr","tag-months","tag-teething","tag-top","tag-troubles"],"yoast_head":"\n
\nthrough the flood of derisive articles<\/a> on how the
\nregulation has been ineffective so far in addressing data privacy issues. Are
\nthe attacks justified, or is it too early to criticise such a complex and
\nambitious project 12-months in?<\/p>\nHere are the top 12 criticisms<\/strong>\u274cof the GDPR \u2013 and the case in defence<\/strong>\u2705 of the regulation\u2026<\/strong><\/h2>\n
\n\n
\nfor people wishing to exercise their rights or ask a question to an
\norganisation that manages their data, including contact details publicly
\navailable via a dedicated search engine<\/li>\n
\n2019, already attended by more than 35,100 people, including 6,900 who have
\nobtained a certificate of success<\/li>\n
\nmakes it possible to identify all data processing operations and to have an
\noverview of actions relating to personal data<\/li>\n
\nimpact assessment (DIA), which is obligatory for some processing operations<\/li>\n<\/ul>\n
\nand reflect that DPAs are not out to trip companies up and were moving forward
\ndiligently.<\/p>\n
\n\u20ac20,000 fine against Knuddels: \u201cThe LfDI is not interested in entering into
\na competition for the highest possible fines. In the end, it\u2019s about improving
\nprivacy and data security for the users<\/em>.\u201d Although it remains to be seen
\nwhether other DPAs take a similar approach, this case sets a valuable
\nprecedent.<\/p>\nPart two<\/a> looks at what the future holds for data privacy. Tune in to find out where the GDPR goes from here.<\/strong><\/h2>\n
\nMake sure your digital analytics is GDPR-proof!<\/strong><\/h2>\n
\nthe GDPR. Protecting user data and respecting user privacy has been central to
\nour analytics approach for over 20 years.<\/p>\n
\nindependent European provider since day one, we\u2019ve always been strongly aligned
\nwith strict European policies on data protection and privacy. Our solution has
\nbeen developed with privacy-by-design since the very beginning. <\/p>\n
\nlong-standing relationships with the CNIL, France\u2019s data protection authority,
\nand Germany\u2019s T\u00dcV, speak volumes. These trusted authorities recognise the
\nconformity and surety of the Analytics Suite and have awarded us their
\ncertificate of compliance year after year.<\/p>\n Data practice hygiene is growing! Read our latest FREE guide<\/a>: Digital Analytics and the GDPR \u2013 one year on \u2013 making sure you\u2019re compliant<\/em>, to find out more!<\/strong> <\/h2>\n
\n![\"Digital](\"https:\/\/blog.atinternet.com\/wp-content\/uploads\/2019\/07\/Digital-Analytics-and-GDPR-updated-guide.jpg\")
<\/a><\/figure>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"