by Alice Valeria Zucchetti*
From those who always click "I agree" on all website pop-ups to those who tape their computer's camera; multiple are the attitudes towards the protection of our data and our privacy. However, it is undeniable that these issues have become the focus of our daily lives.
Recently, the General Data Protection Regulation, also known as the GDPR, turned three years old. The GDPR is currently the main European legislation on the protection of personal data. Although it entered into force on the 24th of May 2016, it was implemented after two years the 25th of May 2018.
The origin
Europe addressed privacy as an issue even before the GDPR. The lawyer Lapo Curini Galletti, an expert on the topic, recalls: "privacy in Europe was born in the mid-nineties with Directive 95/46/EC of the European Parliament and Council. As a result, over the years, all privacy institutions have been born and evolved, both within the Member States and at Community level". In summary: each Member State has enacted privacy laws and set up its own supervisory body, while the EU has carried out interpretations of EU legislation and has issued other directives to regulate specific areas. However, the need for simplification and uniformity at Community level combined with the very rapid development of technologies demanded an increase in the level of vigilance and security. In response to these needs, the GDPR was conceived, which, as the Lawyer states, is not "a revolution in the world of privacy but an important reorganization of its whole past".
The changes
Three are the significant innovations introduced by the GDPR.
The first is the introduction of a wider territorial scope. This implies that the legislation applies both if the person processing the data and the person to whom the data refers to are in the European territory. Consequently, "if a company established outside the Union processes data of a European entity (or in any case located on European territory) it will be obliged to comply with the GDPR", affirms lawyer Lapo Curini Galletti.
The second: "the growth of the amounts of sanctions requires more attention to privacy and compliance with the rules to all players in the market, regardless of the size" reveals the Lawyer.
The third: the GDPR introduced the notion of accountability. From May 25, 2018, with the introduction of accountability, the assessments on the risks of processing and on the appropriate measures to eliminate them pass entirely into the hands of the person who handles the data. This is the only person responsible for data processing recognised by the GDPR. Speaking of Accountability, lawyer Lapo Curini Galletti clarifies that "those who process data - even before starting - will have to design their own privacy system for each activity and then only process personal data to the extent necessary and sufficient for the intended purposes and the period strictly necessary for those purposes".
Differences between countries and effects of Brexit
The GDPR is a regulation and, as such, it is implemented in the same way in these states with no room for flexibility in its adaptation. However, the Lawyer specifies "the European privacy legislation, thanks to the GDPR, has reached a higher level of homogeneity than in the past but still not perfect uniformity. In fact, as a consequence of the parts for which the GDPR expressly provides for the possibility of derogation and because of the extreme vagueness of some of its provisions, some differences in interpretation and/or approach remain".
As for the United Kingdom, which has recently actually left the European Union, "in reality, everything is still in progress, but we should have a clearer idea of the final scenario soon," affirms lawyer Lapo Curini Galletti. However, it is certain that "companies based in the United Kingdom, from 1 January 2021, are subject to the English legislation which provides - in the context of data processing - the updating of all privacy documentation which must explicitly refer to the Information Commissioner's Office, the UK Data Protection Reference Authority". For now, the Lawyer continues, "if a person based within the EU must carry out any data transfer in the UK for a client company or supplier, the processing must refer to the European GDPR until 30 June 2021".
The big companies OTT
The big companies that provide only through internet services or content, also called OTT (over-the-top companies), such as Facebook, Netflix, Amazon and Google, "will no longer be able to circumvent the legislation since it no longer matters in any way whether or not the seat is within the Community, nor ignore any sanctions as these may reach even 4% of the annual worldwide turnover of the company", explains the Lawyer.
As a result, after the implementation of the GDPR, the relationship between users and these companies has changed, as lawyer Lapo Curini Galletti claims "on the one hand companies are much more attentive to a perfect compliance with the legislation, on the other users, also as a result of the media clamour created around the GDPR, prove much more aware and demanding."
Users
Returning to us users, if in most cases the concern is unjustified, the Lawyer however sustains that "many new technologies, social platforms, tools are born and explode so quickly that, even if we wanted to, it would not be humanly possible to predict the scope and effects concerning data protection". As a result, he advises " to never be the first to disclose personal data without a real need." He suggests using without fear the resources guaranteed by the GDPR to assert their rights and concludes: "So I advise, if necessary, to use these tools without fear and not to waste time and protect their rights".
*18-year-old Italian high school student. I have been selected for a special programme of journalistic training within the news agency Adnkronos International.
