Impact of GDPR and its future consequences

The European Data Protection Board (EDPB) is an EU body in charge of the application of the General Data Protection Regulation (GDPR).  The European Commission takes part in the meetings of the EDPB without voting rights. The secretariat of the EDPB is provided by the EDPS.

The EDPB will be at the centre of the new data protection landscape in the EU. It will help ensure that the data protection law is applied consistently across the EU and work to ensure effective cooperation amongst DPAs. The Board is not only issue guidelines on the interpretation of core concepts of the GDPR but also be called to rule by binding decisions on disputes regarding cross-border processing, ensuring therefore a uniform application of EU rules to avoid the same case potentially being dealt with differently across various jurisdictions. 

Fall Out

GDPR has come into effect on this Friday. Internet users in the bloc have had to deal with unforeseen consequences, including  blocking access to newspapers of US and many other countries and some companies suspending support for their products.The Los Angeles Times, Chicago Tribune and Orlando Sentinel — all newspapers owned by Tronc media company – displayed messages saying their websites are "currently unavailable in most European countries.

Los Angeles Times wrote on its website  "We are engaged on the issue and committed to looking at options that support our full range of digital offerings to the EU market," . Instapaper, a bookmarking service owned by Pinterest, suspended its service to European clients as it makes "changes in light of GDPR." But that's not the only fallout.

Social media users have criticized companies for sending emails about their privacy policy updates, only to forget to hide the mailing list and effectively end up sharing scores of email addresses.

A Twitter user described it as "doomsday."

Aside from the issues that have plagued GDPR's first day, rights groups have also signaled that companies could be held responsible for poor adherence and questionable practices. Noyb, a digital rights group based in Austria, announced on Friday that it filed four complaints against Google's Android application, Facebook, WhatsApp and Instagram for "forced consent."The group said that instead of making users feel free to make a decision on a service's privacy policy, "the opposite feeling spread on the screens" of users."Tons of 'consent boxes' popped up online or in applications, often combined with a threat that the service cannot … be used if users do not consent."

What are the consequences for India

India is at its own tipping point vis-a-vis privacy norms — not precipitated by the GDPR but instead by national context. Aadhaar, the government’s biometric-enabled identifier, brought almost every Indian resident in contact with technology, but simultaneously made concrete concerns of profiling, surveillance, and exclusion.

The legal challenges to the project led the Supreme Court of India to declare that privacy is a fundamental right guaranteed to every Indian resident by the Constitution. The Court made it clear that the State has a duty to enact laws that will protect users from privacy threats of businesses and the government. On the heels of the Aadhaar case, a Committee has been set up, it is chaired by former Supreme Court judge, Justice B N Srikrishna, and a draft bill is imminent shortly.

A law that applies to both the public and private sector, would also introduce safeguards to government surveillance processes in India, which remain among the least regulated in the world. 

More recently, the Cambridge Analytica  episode spurred a debate about the use of data-driven methods in the Indian electoral campaigns such as targeting and profiling of users to disseminate propaganda. As control over personal data becomes the lifeblood of both commerce and politics, it is no longer tenable to suggest that data protection is a concept foreign to India.

Now the country is  ready to discuss and debate the draft bill that will form India’s first comprehensive data protection law, this context should not be lost. There are of course pragmatic reasons why Indian businesses might actually benefit from a law that meets the European standard The GDPR only allows data transfers to countries that have an ‘adequate’ level of data protection.

But beyond this, developments in India themselves make the case for a strong data protection law. As the Supreme Court’s judgment endorses, we need a law grounded in individual rights, and supported by measures that hold state and private actors accountable for their use of personal data. We can’t rely on the spillover effects of the GDPR.