EU's GDPR: More Control Over Your Data
The EU's GDPR gives people more power over their personal data. It makes companies strictly responsible for how they handle this information, setting global standards.
Topics: technology, politics, individual and values
Example
The EU's General Data Protection Regulation (GDPR) has applied since 25 May 2018. It covers any company, wherever it is based, that handles the personal data of people in the EU, and allows fines of up to EUR 20 million or 4% of global annual turnover, whichever is higher. In January 2019, France's regulator fined Google EUR 50 million for not explaining clearly how it used data for personalised ads and not getting valid consent. In May 2023, Ireland's regulator fined Meta EUR 1.2 billion for transferring Europeans' Facebook data to the US, the largest GDPR fine so far.
Key facts
- The GDPR, applying since 25 May 2018, allows fines of up to EUR 20 million or 4% of global annual turnover, whichever is higher.
- In January 2019 France's CNIL fined Google EUR 50 million for lack of transparency and valid consent for ad personalisation.
- In May 2023 Meta was fined EUR 1.2 billion for transferring EU users' Facebook data to the US, the largest GDPR fine.
Limitations
- Large fines are often appealed and enforcement is slow, especially in Ireland where many tech firms are based, so the size of a fine overstates how quickly behaviour changes.
Evaluations
technology evaluation
Support
Because the GDPR applies to any firm handling EU residents' data, global companies redesigned consent screens and data practices worldwide.
Counterargument
Cookie pop-ups multiplied, and many users click 'accept' without reading, so consent in practice can be a formality.
Rebuttal
Pop-ups are a weak point, but larger cases such as Google's 2019 fine targeted unclear consent, pushing firms towards real choices.
Additional support
Rules on data transfers, enforced in the Meta case, have shaped how cloud services store data in Europe.
politics evaluation
Support
The GDPR is a clear case of the 'Brussels effect': other places, including Brazil and California, wrote laws modelled on it.
Counterargument
Critics say the EU regulates while the US and China build the technology, and heavy rules may hold back European start-ups.
Rebuttal
Large firms can absorb compliance costs more easily than small ones, which is a real concern, but it argues for simpler rules for small firms, not for no rules.
Additional support
Singapore's Personal Data Protection Act, amended in 2020 with higher penalties, shows a smaller state choosing its own balance.
individual and values evaluation
Support
The GDPR treats personal data as something individuals have rights over, including the right to see it and to ask for it to be deleted.
Counterargument
Many people trade data for free services willingly, so rules that assume they value privacy highly may not match their choices.
Rebuttal
People cannot weigh trade-offs they cannot see; transparency rules exist so that the choice is informed.
Additional support
The 'right to be forgotten' lets people ask search engines to remove some outdated results, a value of second chances written into law.
Sources
- EUR-Lex (2016-04-27): Regulation (EU) 2016/679 (General Data Protection Regulation)
- European Data Protection Board (2019-01-21): The CNIL's restricted committee imposes a financial penalty of 50 Million euros against GOOGLE LLC
- European Data Protection Board (2023-05-22): 1.2 billion euro fine for Facebook as a result of EDPB binding decision
More GP guides for this example
Topic guides
- Society and Culture GP Examples
- Politics and Governance GP Examples
- Science and Technology GP Examples