After 1 Interesting Year of the GDPR The Things We’ve Learned And The Changes For The Future

This Saturday, 25 May marks the one-year anniversary of the European Union’s General Data Protection Regulation (GDPR). In the year since it came into force, the Information Technology and Innovation Foundation (ITIF) and its affiliated Center for Data Innovation have produced a series of reports and analytical commentary examining the impact the GDPR has had on technological innovation and the digital economy. 

What have we learned so far with the GDPR?

In the past year, we’ve seen that stronger privacy regulations do not spur increased Internet use or boost uptake of digital services, which were among key rationale for some GDPR proponents.

Recent enforcement decisions in France and Germany have revealed complexities and contradictions that underscore why the GDPR is fundamentally not a viable model for regulating the digital economy. And the steep penalties show that compliance isn’t enough—companies continue to face uncertainty with regard to the GDPR’s unclear rules.

Effective implementation of the GDPR hinges on cooperation between EU data protection authorities (DPAs) and industry. However, the newly defined roles and obligations of DPAs, the lack of resources to guide companies, and complex procedures make cooperation difficult. Unless EU policymakers clarify and adjust the GDPR, these barriers to cooperation will negatively affect business efficiency and consumer protection.

What is the impact on artificial intelligence?

In particular, the Center for Data Innovation has focused on the impact the GDPR is having on the development and adoption of artificial intelligence (AI) in Europe. A new report released last week shows the GDPR inhibits the development and use of AI in Europe, putting firms in the EU at a competitive disadvantage in the global marketplace.

France’s plan for public interest data—the first clear effort by an EU member state to proactively consider the GDPR in its efforts to bolster AI—demonstrates how to repurpose the use of personal data to serve the public interest, which doesn’t violate the GDPR. However, many important uses of AI—from banking to agriculture—are commercial. Unless the EU reforms the GDPR to enable greater collection, use, and sharing of personal data, any European country’s AI strategy will be constrained by the GDPR’s restrictions.

Where should we go from here?

In a new report commissioned by the incoming Finnish EU Council presidency, ITIF recommended that the Commission conduct a thorough review of the implementation of the GDPR in 2020 to evaluate where it has worked and where it needs improvement. ITIF also recommended amending the GDPR to clarify language around “anonymization” of data, which would help remove regulatory uncertainty for European enterprises.

With regards to AI, the Center for Data Innovation’s new report recommends five targeted steps EU policymakers should take to reform the GDPR for the algorithmic economy: (1) expand authorized uses of AI in the public interest; (2) allow repurposing of data that poses only minimal risk; (3) avoid penalizing automated decision-making; (4) permit basic explanations of automated decisions; and (5) make fines proportional to harm.

Should the United States take its cues from Europe as it starts to craft its own data-protection law? This was the subject of an ITIF debate last fall, and the answer was no. ITIF has released its own privacy proposal that would preempt state laws, improve transparency requirements, strengthen enforcement, and establish a clear set of data privacy rights for Americans based on the sensitivity of the data and the context in which it is collected.

You can read more articles about the GDPR on our site here.

If you would like to have your company featured in the Irish Tech News Business Showcase, get in contact with us at [email protected] or on Twitter: @SimonCocking