GDPR, four months later: How are businesses and consumers adapting?

We’re approaching 4 months under the EU’s General Data Protection Regulation (GDPR) and we wondered how things are going for businesses. Do users have more control? Were companies fined out of business? Did all of Europe ask to be forgotten? Let’s find out.

The news is mix of good, bad, and be patient. No businesses have been fined yet, but it does take time for these types of cases to be reviewed, so that’s not really a surprise. Facebook was only recently assessed the maximum pre-GDPR fine of £500,000 for the Cambridge Analytica mess. That process started well before GDPR took effect and for reference, the equivalent maximum fine under GDPR would have been closer to £1.4 billion.[1]

Though there were no fines, there was a case in Germany where webcams that showed tourist faces were found to violate their privacy. The promotion of tourism was not found to be a legitimate reason for showing identifiable people and tourism could still be promoted by relocating the webcams. The providers chose to take the cameras down instead of repositioning them.[2]

Google and Facebook were sued on day 1 by a privacy group claiming their one size fits all privacy checkbox for a myriad of services is inadequate under GDPR.[3] Given Google’s recent issues with Android tracking privacy this might present a problem for them.[4]

A TrustArc survey in July showed that only 20% of businesses believed ...