Skip to content
Naked Security Naked Security

European Commission “doesn’t plan to comply with GDPR” – well, sort of

Apparently, due to legal weirdness, GDPR doesn't apply to the EC itself. What to do? Shout at the bureaucrats or be cool about it?

Yet another email containing the letters GDPR dropped into our mailbox today.
This one was a bit different – it wasn’t a company explaining how it wanted us to help it comply, nor a company slapping itself on the back for having done what it was expected to do anyway.
This wasn’t even an article about non-compliance that named and shamed someone who hadn’t bothered to get ready in time.
It was about a statutory body that, unlike the rest of us, apparently doesn’t have to comply: the European Commission (EC) itself.


In the curious and orotund way that newspapers sometimes have with words, today’s GDPR email told us that:

The Telegraph can reveal today that Brussels bureaucrats, who pushed for the stricter rules around how companies and governments use data, don’t plan to comply with their own laws.

That seems weird, but you can imagine that there may be all sorts of legal absurdities that might arise by directly applying GDPR to a pan-European executive arm of government.
Which country’s regulator would apply, and how, for example?
Apparently, the EC is planning to subject itself to a regulation that will work like GDPR, even though it hasn’t yet done so.
That makes the Telegraph sound a bit OTT when it remarks that “Brussels bureaucrats […] don’t plan to comply with their own laws,” if indeed their intention is to comply with a regulation that is substantially similar.
As many companies have found, GDPR is more of a digital lifestyle guide, admittedly with teeth in the form of fines, although the EU’s various regulators seem determined not to use GDPR as a revenue mill.
And that got us thinking about a podcast we recorded almost a year ago now with Sophos expert John Shaw.
John’s overview of what GDPR is, and more importantly how we can make it work for us, is calm, measured and blessedly free of the invective that some commentators have allowed to creep in over the past year – during all of which time, of course, GDPR has already been “the law”.
We think it’s well worth another listen.

LISTEN NOW

(Audio player above not working? Download MP3, listen on Soundcloud or access via iTunes.)


5 Comments

the ec is/can be subject to legal oversight via various eu courts (as the executive is separate to the judiciary but not above it, pretty standard setup), so perhaps the author shouldn’t be so quick to judge the telegraphs comments OTT before indulging in some questionable reflections of reality himself? just a thought.

Reply

It is worth bearing in mind that The Telegraph is the most euro-skeptic of the UK broadsheet newspapers, and frequently writes negative stories about EU institutions. I tend to take anything I read in that paper on the subject of Europe with a large pinch of salt, and then look for corroboration in more neutral news source such as the BBC.

Reply

Paul Ducklin: ‘That seems weird, but you can imagine that there may be all sorts of legal absurdities that might arise by directly applying GDPR to a pan-European executive arm of government.
‘Which country’s regulator would apply, and how, for example?’
What actually ‘seems weird’ – and has obviously escaped Paul Ducklin’s notice – is the fact that the EU has a ‘pan-European executive arm’ (a government) that is not directly elected by the people and is, therefore, democratically unaccountable to the people.
No wonder it considers itself above its own laws. Paul Ducklin’s trust in the EU’s ‘intention’ to subject itself to a regulation ‘similar to the GDPR’ begs the obvious question as to how similar and how dissimilar any such a regulation will be, if it ever happens.
And if the peoples of Europe disagree with any such regulation set up by the EU ‘executive arm’, there is still no democratic accountability with said directly unelected EU government/dictatorship, is there?
Food for thought for democrats, if no others, surely?

Reply

What you seem to be saying is that the EU is so unaccountably weird that it is obviously *not* weird. FWIW, I was referring to laws and legalities, where there are many examples of things that seem weird when you hear the what, but turn out to be legalistically cool when you figure out the why.
Here’s an example (it would glide nicely into some of the background banter in an episode of Big Bang Theory, if you ask me – Dr Sheldon Cooper would IMO be quite satisfied at the legal niceties of this one). Her Majesty Queen Elizabeth II of the United Kindgom of Great Britain and Northern Ireland doesn’t have a passport. Doesn’t need one. Yet the UK is a constitutional monarchy, so HM isn’t beyond the law and can’t unilaterally exempt herself from it. Apparently, the legalism is that, because passports are issued in HM’s name, if she had a passport, she would have essentially issued it to herself, which makes it pointlessly redundant.
As for the EU being “a dictatorship” – I think that’s a word like fascist, rape, crucify, decimate or flense: one that ought not to be used loosely or metaphorically. Some words require a precision in ther usage so that they never drift ambiguously into casual speech.

Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!