On Day One, GDPR is causing its own little Y2K-like scare.
Services across the web were down for European users on Friday morning, — everything from the Los Angeles Times news website to online shoes retailer Shoes.com and the online clipping service Instapaper.
The suspension of services comes on the very day the European Unions General Data Protection Regulation takes effect. The new privacy rules hold companies liable for using European citizens data without the proper consent or legal basis to do so, and it can trigger fines up to 4 percent of global turnover.
But experts say the suspensions are — in large part — an overreaction to the rules.
Its “the GDPR hysteria,” said Lukasz Olejnik, a data protection researcher. “In many of these limited cases these decisions do not make sense — as with the advisory that led to the recent inbox flooding. This is often simply the result of bad GDPR advice.”
Other tech companies already had announced they were either pulling out of Europe entirely or ceasing their services.
Websites including history.com and others have taken down their services for European visitors. Two U.S. news publishers, Tronc and Lee Enterprises, decided to suspend their websites for European users, too: News websites including the Los Angeles Times, Chicago Tribune and Daily News displayed a notice for European users saying they were figuring out the GDPR impact.
“There sometimes appears to be a bit of confusion on whether companies need to get the consent of individuals to use their personal data,” said Peter Van Dyck, privacy lawyer at Allen & Overy in Brussels. “Under the GDPR, this is certainly not always the case – consent is only one of the legal bases on which companies can rely.”
The European Commission wouldnt comment on whether individual companies or services were right to cease their services in Europe. “We have seen the press reports, but it is not for the Commission to comment on individual companies policies … The EU is and will remain an enormous market of high value,” Commission spokesperson Christian Wigand said.
Over the last few weeks, European Justice Commissioner Vêra Jourová called on companies not to panic, saying that data protection authorities would be reasonable in their assessment of potential violations.
Justice Commissioner Věra Jourová John Thys/AFP via Getty Images
Other tech companies already had announced they were either pulling out of Europe entirely or ceasing their services.
Klout, a once-promising social media analysis firm that wanted to rank anyone with an online presence on a huge, global ladder of prestige, said it “made the decision to sunset the Klout service, effective May 25, 2018.”
Drawbridge, a company that does “people-based marketing,” announced it was pulling out of Europe entirely. Brent Ozar, which does data analytics, decided to do the same. Mobile marketing firm Verve also pulled out of Europe, pointing to the new privacy rules, The Drum earlier reported. Unroll.me, a tool to manage subscriptions, also took down its service for Europeans.
Companies fear challenges from privacy activists, who Friday filed their first complaints based on GDPR privacy rights.
None of Your Business, an NGO launched by Europes flagship privacy activist Max Schrems, filed challenges against Facebook, Google, Instagram and WhatsApp for violations of GDPR rules. The NGO estimates the violations could amount to a €7 billion fine.
The French NGO La Quadrature du Net is holding off on filing 12 collective complaints until Monday as it hopes to gather more people to sign on.
