Happy Birthday: The EU General Data Protection Regulation Turns 6

A friend of mine and I decided to take our moms on a tour of Spain and France for the last few weeks of May. So, it was merely a (fun) coincidence that we were able to toast the anniversary of the EU’s General Data Protection Regulation (GDPR) with a glass of cava in Barcelona a few days ago (and I now write this post on my balcony overlooking the city).

It is hard to believe that GDPR has been in effect for 6 years. As far as laws go, GDPR changed the landscape of privacy and normalized discussions about data collection and processing. In fact, a recent poll suggests that close to 70% of EU residents have heard of GDPR and as many as 30% of Americans are also aware of the law.

Many of the terms we now see in U.S. privacy laws, such as data “controller” and “processor” are terms borrowed from GDPR and molded to fit the growing trend amongst U.S. states to regulate privacy under principles of a law that has deep roots in EU culture. For example, prior to GDPR the EU had a similar data privacy regulation, known as the Data Protection Directive (1995), adopted when the internet was in its infancy to protect individuals relating to the processing of their personal data.

A Forbes article from 2020 noted that:

“Europeans have a long history of privacy invasions. During World War II, the Nazi regime used highly sensitive personal data from local population registers to locate and round up Jews, with horrifying results. Later, in communist East Germany, the reach of the combined secret police and intelligence agency Stasi extended into every aspect of civilian life as surveillance and repression of dissent were perfected. It’s not surprising that against this backdrop, Europe has made — and continues to make — great strides in ensuring the privacy of its people.”

After viewing the pockmarks left in the walls of Placa de Sant Felip Neri, a small square in the Gothic quarter of Barcelona (Barri Gotic), where dictator Francisco Franco indiscriminately bombed the city of Barcelona during the Spanish civil war, the cultural and historical significance of Europe’s desire for privacy was front and center. As a privacy professional, I understand that privacy is an important concept in our daily lives, but this viewpoint provided an deeper perspective on exactly why.

As privacy laws become more abundant in all corners of the globe and with my trip to Barcelona as a backdrop for why laws like GDPR exist, I’d like to offer a salud! to privacy around the globe and feliç aniversari to GDPR.