Time is a serious operational problem for #GDPR enforcement. Today, the Dutch DPA issued a fining report of 58 pages. Last week the Spanish AEPD needed 184 pages! It takes time to draft these reports, as each one is unique. Not counting the time spent on the investigation.
2/ Data Protection Authorities are not in the business of writing books. They are in the business of enforcing the #GDPR. But if GDPR enforcement requires decisions of the volume of books, such enforcement can never be systematic or high-volume (like traffic fines).
3/ Ergo, the DPA-model, which dates back from the ‘70’s/80’s, when data processing operations were limited and easy to oversee/investigate, is not sustainable in our information society. Resources are limited by default, and selective enforcement violates the equality principle.
4/ I fully agree that a decision must be motivated. If 58 or 184 pages are required, so be it. The problem is, that this requires DPA’s to be selective, as resources are scarce. That is why I predict the end of the DPA-model. We need more efficient enforcement models. #GDPR
5/ To start with: the DPO must become a regulated profession, like lawyers, doctors and accountants, including professional training, standards of conduct and disciplinary oversight. This will relieve the pressure at the top of the enforcement pyramid. #GDPR
6/ Second, large-scale rollout of codes of conduct and certification schemes, including audits, complaint mechanisms and oversight bodies. In other words: privatize the complaint handling function of DPA’s, so they can focus on systemic supervision. #GDPR
7/ Third, as data processing is almost never a purpose in and by itself, but typically the byproduct of another activity (taxes, sales, security, etc), sectoral regulators must take the data protection aspects into account in their oversight activities. #GDPR
8/ Fourth, serious forms of misuse or serious negligence must become a crime, as administrative GDPR-fines are likely passed on to investors, consumers and tax payers as a cost. #GDPR
9/ Any other ideas are welcome 😀 #GDPR
• • •
Missing some Tweet in this thread? You can try to
force a refresh
