Promising greater data control to users not controllers

Last March, nearly 90 million users discovered that their personal data had been abused as the Facebook-Cambridge Analytica scandal broke. This happened just two months before Europe’s revamped data protection rules were due to apply. Marking Europe’s Data Protection Day on 28 January, FRA urges users to regain control of their personal data.

The scandal was a wake-up call for users. It revealed how some companies were treating clients’ personal data as their own. They often overlooked their clients’ rights.

This has led to a tech backlash. Many consumers are abandoning online services as they start to reclaim control of their personal data. Take Facebook for example. In Europe alone, it lost four million users between the first and third quarters of 2018.

Consumer trust has also been severely dented as users grow wary of sharing their data with a third party, or not.

Since May 2018, the EU’s new data protection regime, the General Data Protection Regulation (GDPR), has put greater emphasis on the rights of users.

The new rules aim to be forward-looking and efficient, offering robust personal data safeguards, as technological advances expand the frontiers of areas such as surveillance, communication interception and data storage.

Users have the ‘right to be forgotten’, a ‘right of data portability’ and greater access to their data. They can even demand firms to stop using their data. Users can also seek compensation from firms for rights violations.

The rules also advocate a data minimalism approach. In essence, firms should only ask for data they really need rather than what they can get.

Firms doing business in Europe also stand to benefit from the new regime. It provides legal certainty. It also makes it simpler for firms to operate across the EU as rules have been harmonised.

In addition, being GDPR-compliant can help firms regain trust. It signals to users whether a firm is handling personal data carefully.

To help keep pace, FRA, together with the Council of Europe and the European Data Protection Supervisor, have updated their popular handbook on European data protection law.  

It provides useful insights into European data protection law and how it is being applied in practice.

It is a practical tool for legal professionals as well as non-governmental organisations and others who may be confronted with legal questions related to data protection rights violations; this is an issue that is widely anticipated to come to the fore throughout 2019.

In addition, important data protection questions are being discussed. Agreement on data retention is still pending, a new e-Privacy regulation is still in draft and the EU’s proposed Copyright Directive is in its final stages. FRA will continue to feed into the debates, providing evidence and advice as requested.

Nonetheless, the GDPR already provides a strong data protection framework across the EU. It ensures individuals and supervisory authorities have the means to effectively protect their personal data and enforce their fundamental rights. Now users can take back control of their data and ensure their rights are being upheld.