Poltical Economy of European Integration M.A.
Refine
Has Fulltext
- yes (1)
Year of publication
- 2021 (1)
Document Type
- Master's Thesis (1)
Language
- English (1)
Is part of the Bibliography
- yes (1)
Keywords
- Accountability, Data Protection Authority, European Union, Fines, General Data Protection Regulation, Multi-level governance. (1) (remove)
Institute
I. Abstract
It has been three years now since the EU General Data Protection Regulation (GDPR) became enforceable, which highlighted the end of an era with lack of enforcement in the field of data protection provisions (Albrecht, 2016, p. 287). The EU General Data Protection Regulation, which was effective from 25 of May 2018, has replaced the outdated European Data Protection Directive (95/46/EC). This new regime has brought new legal rights to data subjects, while extending the scope of the responsibilities for controllers and processors. As personal data progressively embodies an important new class of economic asset for organisations, GDPR has significantly expanded the enforcement powers of the Data Protection Authorities. Consequently, it has also enhanced the regulators enforcement rights to impose fines, which may go up to €20 million or, if higher, 4% of an organisation’s annual global turnover (DLA Piper, 2018, p. 5). GDPR has actually replaced a regime under which fines for a data breach were limited and enforcement actions were uncommon. Through this new regime the regulatory environment across European Member States has undoubtedly shifted and regulators have greater powers of enforcement (DLA Piper, 2018, p.3). The fact that the important role of the strict application of the accountability principle was assigned to the national Data Protection Authorities (Albrecht, 2016, p. 288) and the function to exercise corrective powers in case of violation of the Regulation’s provisions has made the topic of fines and other sanctions an issue that has had the attention of all the companies, not only in Europe but worldwide.
Having this context and the importance of the topic in mind, the main focus of the thesis is related to how DPAs’ work on the EU multilevel governance system contribute on the accurate and consistent application of the GDPR. Also, analysing fines as one of the enforcement instruments in the system ruled from the EU principle of accountability is the other central point of the research. Additionally, it is known that we live in times when technology has been frequently developing and where digitalization is progressing in a high scale. This is translated into the flow of personal data (but not only) inside, across borders and IT systems of the EU. Such data flows so easily through IT systems and can as easily be misused from the subject that is processing those data. In order to guarantee, empower the individuals and give them control over their personal data the EU legislator has also detailed the penalties that occur when data that is processed is not in accordance with GDPR. In order to avoid such situation and to correct the cases where violations toward EU data protection law are present, special attention is given to the fines (Article 83-84 GDPR), as a key sanction tool. Therefore, the thesis is concentrated on administrative fines for data protection violations and their issues as well as on the limitations of such a sanction in the system of accountability in Europe. It’s aim is analysing the fines problematic and situations that Member States have faced so far in practice.
Keywords:
Accountability, Data Protection Authority, European Union, Fines, General Data Protection Regulation, Multi-level governance.