Distinguishing data abuse from the necessity of regulatory reform

The uncovering of a dataset with information on the movements and even domicile of European Commission officials is an important reminder that, as with every other technology or data point, location data can be abused.

Since the news broke out, I have seen several seizing upon it to say that data brokers are inherently illegal or that there should be resistance to any attempt to improve legislation regarding data protection such as the GDPR or ePrivacy in the context of the simplification agenda.

But to me this seems misguided. Abuses are not a counterargument to the fact that the way certain laws are interpreted or applied is raising problems (see some of my articles on ePrivacy and GDPR reform for practical illustrations of some of the issues raised).

It’s a separate discussion: (1) how do we ensure laws are workable and attain their objective (also in the broader context of other rights), and (2) how to ensure enforcement of the laws (obviously, provided that enforcement stays in line with the law).

The reporting suggests very clearly that there is a situation of abuse here, so it is up to regulators to use this to carry out their own investigation.

Politicians have often been fined or reprimanded for abusing personal data gained through their office for separate, election-related purposes. Does that mean no municipality data can be used? Of course not. We shouldn’t let abuse by some dominate the debate about what the law says, how it is applied or how it should apply. Data protection rules are there to ensure that there is protection of personal data *and* to allow the responsible use of personal data, not to make it impossible to use personal data in general.

For instance, some data brokers have a perfectly valid justification also under the current framework for what they do, just like some who use location data do so transparently and with a proper (and lawful) legal ground.

Let’s focus on those two topics separately: good enforcement, and good legislation. The need for enforcement isn’t an excuse to oppose improvements to the law.

Some further reading:
– on how to improve Art. 1, 2, 4(1), 5 & 30 GDPR: https://lnkd.in/ewkfAQSC
– on Art. 5(3) ePrivacy Directive and the consequences of the EDPB’s interpretation: https://lnkd.in/ePDByudx as well as https://lnkd.in/ehdihkSM