Statement on 4 Years of GDPR

GDPR did not change a culture of non-compliance. When the GDPR became applicable on 25 May 2018, it was perceived as a watershed moment. Comments were somewhere between the EU getting serious about privacy and the internet breaking down at midnight. The past four years have shown that a law alone does not change business models that are based on the abuse of personal data and a culture within the privacy profession that is often focusing on covering up non-compliance. After a first moment of shock, large part of the data industry has learned to live with GDPR without actually changing practices. This is mainly done by simply ignoring users’ rights and getting away with it. The GDPR culture: open mocking and hostility. This often translates into fundamental rights are belittled. The fundamental right to data protection is not respected and perceived as a result of a long democratic process, but mocked as crazy or “impossible to comply with”. Authorities and non-profits that try to enfor