The Fundamental Rights Survey provides, for the first time, a comprehensive set of comparable data on people’s experiences and opinions concerning their fundamental rights. The survey focuses on everyday situations in areas including data protection, equal treatment, access to justice, consumer rights, crime victimisation, good administration and the importance of protecting rights.
The document covers selected results related to data protection and technology. FRA will publish results on other areas in other reports and products.
This document focuses on two main aspects: the way and willingness of people to share data about themselves, and their awareness about the EU data protection legal framework. Each section includes a short overview of relevant GDPR provisions, followed by the survey results.
In the tabs in this section you can find graphs showing results from the survey on:
For more information about the survey methodology please see the the Fundamental Rights Survey project page.
Lawfulness - Public administration and private companies must rely on legal grounds to collect personal data. The GDPR provides for six possible legal grounds for processing personal data. One of these legal grounds is consent. Individuals must indicate their willingness to share their personal data (Article 6 of the GDPR). Where special categories of data are processed – such as political views, religious beliefs, sexual orientation or biometric data for the purpose of uniquely identifying a natural person – additional conditions apply for the processing of such data (Article 9 of the GDPR).
The Fundamental Rights Survey asked respondents about their willingness to share personal data with public administration and with private companies. The data covered in the survey include the respondent’s home address, citizenship, date of birth, sexual orientation, religion or belief, political views, fingerprints and facial images.
Question: “Which of the following types of personal information would you be willing to provide to use a service offered by a (1) private company or (2) public administration?” Multiple responses allowed: 1 Your home address, 2 Your citizenship, 3 Your date of birth, 4 Whether you’re straight, gay, lesbian or bisexual, 5 Your religion or belief, 6 Your political views, 7 A scan of your fingerprints for identity purposes, 8 Your facial image for identity purposes, 9 I would not be willing to provide any of the above.
Results: In the EU-27, more than one in five respondents (23 %) do not want to share any of these data with public administration, and 41 % do not want to share these data with private companies.
More than half of respondents would be willing to share basic personal data with public administration, including their home address (63 %), date of birth (62 %) and citizenship (58 %). This is considerably lower for private companies, where only slightly more than one third would be willing to share such data (date of birth 38 %, citizenship 37 % and home address 36 %). People are much less willing to share other data. People are least willing to share their political views (7 %) with public administation. Only about one in 20 is willing to share their facial images (6 % - see graph below), political views (5 %) or fingerprint scan (4 %) with private companies.
The results vary strongly across countries. The graph below shows the percentages of people willing to share their facial images across the EU-27 countries, the United Kingdom and North Macedonia.
Transparency – awareness of what is being done with personal data enables individuals to exercise their rights. Information about the intended processing should therefore be provided in a “concise, transparent, intelligible and easily accessible form” (Article 12 of the GDPR).
Right to be informed – not only the purposes and the legal basis for the processing should be communicated to individuals, but also a large range of information allowing them to fully understand the processing at stake and implement their rights. This includes being told about: the identity and contacts of the entity collecting their data; how long their data will be kept; the recipients or categories of recipients of the personal data; and whether the personal data will be transferred to a non-EU country or international organisation (Articles 13 and 14 of the GDPR).
Consent - Consent must be freely given, specific, informed and provide an unambiguous indication of an individual’s wishes signifying agreement to the processing of their personal data. Individuals have the right to change their mind and withdraw their consent, at any time. The GDPR clarifies that the request for consent shall be presented in “an intelligible and easily accessible form, using clear and plain language” (Article 7 of the GDPR).
Data Protection by design and by default: technical and organisational measures should be implemented to ensure data protection by design and by default. Notably, by default settings should ensure that personal data are not made accessible without the individual’s intervention to an indefinite number of persons (Article 25 of the GDPR).
Question: [Only those respondents who have a smart phone that allows them to access the internet or social media]: Do you know how to check the privacy settings when using different apps on your smartphone? (1) Yes, on all apps, (2) Yes, on some apps, (3) No, (4) I don’t know what privacy settings are.
Question: [Only those respondents who have a smart phone that allows them to access the internet or social media]: Do you know how to turn off the location settings on your smartphone? (1) Yes, (2) No, (3) I don’t know what location settings are.
Results:The majority of people in the EU-27 (72 %) know about the privacy settings on their smartphones. However, less than half of the respondents (41 %) know the privacy settings on all their apps and 31 % only for some apps. Slightly more people know where to turn off the location settings (77 %).
There is a gender gap in the knowledge about the use of privacy and location settings. 21 % of men do not know how to check privacy settings, compared to 27 % of women. 23 % of women do not know how to turn off location settings, compared to 16 % of men.
Awareness – each Member State must provide for one or more independent public authorities responsible for monitoring the GDPR’s application, and for promoting “public awareness and understanding of the risks, rules, safeguards and rights in relation to processing” (Article 57 of the GDPR).
Right of access – the rights of individuals depend on their capacity to know which data are being collected, who collects the data, how the data will be processed, and for how long. Public administration and private entities are required to communicate this information to any individuals requesting it (Article 15 of the GDPR).
Question: Have you heard of the General Data Protection Regulation – GDPR? (1) Yes, (2) No
Results:Overall, 69 % of people in the EU-27 have heard about the General Data Protection Regulation (GDPR). Men are slightly more aware of the GDPR (71 %), compared to women (67 %).
Question: Have you ever heard of any of the following? Please respond with the first thing that comes into your head. [NAME OF NATIONAL SUPERVISORY AUTHORITY FOR DATA PROTECTION – BASED ON ART. 51 OF REGULATION (EU) 2016/679]. In the survey, the name of the respective authority was used in each country
Results:71 % of people in the EU-27 have heard about their national supervisory authority for data protection (DPA). Most often respondents in the Czech Republic have heard about their DPA (90 %). In Belgium, few people have heard about the respective DPA (44 %) and even fewer in the United Kingdom (35 %).
