Enforcing European Privacy Regulations from Below: Transnational Fire Alarms and the General Data Protection Regulation^*

Abstract

The European Union is a global leader in data protection. Nevertheless, its efforts to shape market practice have been criticized as bureaucratic and lacking citizen participation. The adoption of the General Data Protection Regulation (GDPR) has again stoked a heated implementation debate, focusing either on the law's complexity or its new enforcement sanctions. This article draws attention to a less explored provision, Article 80, which allows third parties including non‐governmental organizations to bring complaints for investigation. Empirically, the article demonstrates how NGOs are playing a bottom up role in transforming policy implementation. Theoretically, the article suggests that the legislation offers a novel governance tool – transnational fire alarms – in which third parties enhance accountability in the enforcement phase of the multilevel governance process. The article has implications for the evolution of privacy and data security within Europe as well as the interaction between transnational civil society and pan‐regional democracy.

The civic transformation of data privacy implementation in Europe

“…Other important institutional innovations contained in GDPR, however, are geared to address these issues. Article 80 of the regulation offers third parties like NGOs an explicit role in the process (Jang and Newman 2022). As per the regulations, privacy NGOs and other organizations that deal with privacy issues may bring complaints to DPAs for investigation on behalf of data subjects.…”

“…At the same time, our preliminary results suggest that NGOs have been less active or able to serve as direct service providers for citizens. Finally, the results underscore the growing civic nature of data protection policy implementation in Europe (Jang and Newman 2022). The standard critique of European privacy law as overly top-down and centralized may need to be updated and patterns of civic policy implementation should be considered.…”

“…This is a stark turn for European data protection regulation, which had long been criticized as overly bureaucratic and top-down, lacking on-the-ground oversight (Bamberger and Mulligan 2015). Increasingly though, European data protection rules incorporate a much broader number of actors than just government agencies, including third parties like nongovernmental organizations (NGOs), which have mobilized to turn laws on the books into policy actions (Jang and Newman 2022). In other words, implementation of GDPR now takes a village.…”

Public Comment for FTC's Commercial Surveillance ANPR

“…Based on examples emerging from Europe, civil society actors are essential in bringing strategic market surveillance gaps in front of regulatory agencies. NGOs were found to inject technical expertise, legal knowledge, and organizational capacities to the privacy enforcement process, contributing to the efforts of regulators in creating a culture of compliance across market actors (Borohovich et al, 2022;Jang & Newman, 2022). In addition to reacting to more obvious harms, privacy focused NGOs can perform dedicated research and proactively identify issues and harms that individuals or more traditional consumer rights organizations might miss, including in sectors where descrimination might be prevalent but not widely known.…”

The civic transformation of data privacy implementation in Europe

“…This is a stark turn for European data protection regulation, which had long been criticized as overly bureaucratic and top-down, lacking on-the-ground oversight (Bamberger and Mulligan 2015). Increasingly though, European data protection rules incorporate a much broader number of actors than just government agencies, including third parties like nongovernmental organizations (NGOs), which have mobilized to turn laws on the books into policy actions (Jang and Newman 2022). In other words, implementation of GDPR now takes a village.…”