Insufficient compliance with the legislation on cookies, insufficient information on the processing operations and the recipients of the data and lagging behind, mainly in the public sector, in terms of obligations related to transparency, is the assessment after almost a year of implementation of the General Data Protection Regulation , which provides for fines of tens of millions of euros for violators. And as the President of the Personal Data Protection Authority, Konstantinos Menudakos, notes in an interview with Realnews, the "grace" period that included only recommendations has ended. From now on, fines are coming.
In total, since 25-5-2018, when the Regulation came into force, the Authority has received 1136 complaints about personal data breaches, with private companies. For the processing of these and for the control of the tens of thousands of obligated companies, there are only 16 auditors, when, as Mr. Menuudakos says, at least three times that number is needed.
Except, however, for personnel, in our country, among the last in Europe who have not done it, the implementing law that will specify any «vague» points of the Regulation is also missing. Indeed, the European Commission referred us to this in the European Court.
-Mr. President, 14 months have passed since the implementation of the General Regulation. What percentage have the obligors in our country «complied»?
– We have conducted research on 65 websites of large companies. Public and private. As we found out, no one was perfect. In the first phase, we sent letters of recommendation to them to comply with what they had not done, always reminding them that there may be a second stage of exercising the Authority's control role.
-Where did you find the biggest problem?
-Mainly, there was insufficient compliance with the legislation on cookies, insufficient information on processing operations and recipients of data and a lag, mainly in the public sector, in terms of obligations related to transparency. For example, whether there is a data protection officer and who he is.
-How many complaints have you received?
-From 25-5-18, when the General Regulation came into force, to date, 1136. 912 concern the private sector and 224 the public sector. Most of the complaints in the private sector are about spam, i.e. unwanted electronic communication. There are also many complaints about video cameras, which concerns both the private and public sectors. We also have many cases involving banks. Of course, only a part of them falls under our jurisdiction. And it is the debtor's information about the transmission of his data to either debt management or debt collection companies.
So far, however, we have only progressed to recommendations. From now on, however, fines will begin to be imposed.
-Which are especially «hefty».
-The General Regulation has a list of criteria that are taken into account. The sum of these is that the fine must be such that it acts as a deterrent. Don't do it again. The amount depends on many factors. Such as the type of violation. Another SMS and another leak from Facebook. Also, the financial capabilities of the company being punished. In the past, fines were up to 150,000 euros. It had been observed, therefore, that there was no compliance. In other words, it was more profitable for a large company to continue the violation and each time suffer the fine than to discipline. Now it is a deterrent.
But I want to say this: Sometimes they say “what does the Data Protection Authority do when the French supervisory authority has imposed 50 million euros, the corresponding English one another”. The answer is that there are large companies there, not here. Moreover, we have not yet had a complaint regarding some terrible violation.
-The adaptation of companies is costly. Isn't that a problem?
-There are European programs that fund small and medium-sized enterprises for compliance with the General Regulation. It is a help that Europe can provide as compensation for the strict rules. For large enterprises these expenses are almost painless, and I would say that they can also lead to positive results for their reputation. That is, they prevent violations.
-Compliance with the Regulation and adaptation to it concerns all businesses?
– Theoretically yes, because they all more or less process personal data, at least of staff . However, not everything is mandatory for everyone and this should be made known because there has been a lot of speculation from certain categories of professionals involved in the process. I will tell you a typical example. The president of the Hotel Chamber told me last year that they had convinced a hotelier from a small island that had 6-7 rooms that he should appoint a protection officer. Which is not provided for.
-How many people does the Authority have?
– The scientific staff we have at the moment is 16 people.
-How many should it have?
-Without extravagant requirements, about 100 people including administrative staff. Today we have a total of 40. We therefore want a threefold increase.
-After the implementation of the Regulation, additional difficulties have arisen in the Press as well, to the point that many journalists can no longer do their job.
-The General Regulation makes an exception for informing the public. And it is among the cases that grant authority to the National Legislator to regulate this issue so that there is a balancing between two rights: the right to information –informing and exercising, therefore, the journalistic profession, and the protection of data.
-Which has not been done.
-The law has not been enacted and it has not been enacted poorly. It is expected .. Within this framework some flexibilities granted by the General Regulation will be used and one of them is to set the method of protecting personal data in cases where processing aims at informing the public.
Source: www.dikastiko.gr
