ABSTRACT
Data protection regulation does not apply in terms of a black-and-white response to a particular set of conducts exercised by data processors and controllers. As stemming from the General Data Protection Regulation’s blueprint, co-regulation characterises most of its main tenets, namely via certification and technical standards. Lack of compliance with the principles of data protection regulation entails punitive and non-punitive mechanisms being triggered against data processors and controllers.
De facto, harms deriving from breaches of data protection regulation do not originate in the refusal to incorporate those principles into the data processors’ and controllers’ activities. Instead, most of them stem from an incorrect or inaccurate reading of the principles underlying the GDPR. Normally, low-intensity compliance entails a breach of data protection regulation. The paper demonstrates and argues that high-intensity compliance may be at least as harmful. To prove its point, the paper presents three recent case studies of instances of compliance where data controllers stretched the mark of data protection regulation too far.
Ribera Martínez, Alba, Ultra Vires Compliance as a GDPR Harm (November 3, 2024).
Leave a Reply