The GDPR reforms existing data protection policy by imposing more stringent obligations on not only data controllers but also on data processors relating to obtaining a valid consent,  ensuring transparency of automated decision-making  and security of data processing,  and by providing new rights for data subjects. Data subjects are entitled to withdraw their consent,  request their data to be transferred to another data controller  or to be deleted.  Also, the GDPR includes certain principles aimed at regulating its cross border transfers of the EU citizens’ personal data to ensure a high level of protection outside the EU. 

EU law, GDPR, protection of consumers

Ibid Art.4 (11); Art.7; Art.9

Ibid Art.22

Ibid Art.5;Art.28

IbidArt.7 (3)

Ibid Art.20

Ibid Art.17

Ibid Art. 3; Art.42; Art.44-46

The GDPR (n 4) Art. 6 (a)

Ibid Art.4 (11)

‘GDPR: Consent’(Intersoft Consulting) <https://gdpr-info.eu/issues/consent/#:~:text=GDPR%20Consent,has%20consented%20to%20the%20processing.&text=Consent%20must%20be%20freely%20given,given%20on%20a%20voluntary%20basis.> accessed 15 July 2020

Hoofnagle and Borgesius ( n 1) 79

Frederik J Zuiderveen Borgesius and others ‘Tracking Walls, Take-it-or-Leave-Choices, the GDPR and the E-Privacy Regulation’ European Data Protection Law Review (2017) 3 (3) 3

Ibid 6

The GDPR (n 4) Art. 7 (4)

Borgesius and others (n 19) 8

The GDPR (n 4) recital 43

Ibid recital 42

‘GDPR: noyb.eu filed four complaints over “forced consent” against Google, Instagram, WhatsApp and Facebook’ (Noyb 25 May 2018) < https://noyb.eu/en/gdpr-noybeu-filed-four-complaints-over-forced-consent-against-google-instagram-whatsapp-and> accessed 15 July 2020

Ibid

Deliberation of the Restricted Committee SAN-2019-001 of 21 January 2019 pronouncing a financial sanction against GOOGLE LLC. para.189 <https://www.cnil.fr/sites/default/files/atoms/files/san-2019-001.pdf> accessed 15 July 2020

Ibid para. 157

‘GDPR: Consent’ (n 15)

Article 29 Working Party, Guidelines on Consent under Regulation 2016/679 (10 April 2018) 14

Ibid 12

The GDPR (n4) Art.7 (3)

Ibid Art.20

Ibid Art.17

Ibid Art. 20 (1)

Ibid (2)

‘Right to Data Protability’ (Information Comissioner’s Office ) < https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-data-portability/> accessed 20 July 2020

Ibid

ibid

The GDPR (n4) Art.7 (3)

ibid

ibid

The European Parliament and the Council Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995] OJ L 281/31 Art.12

Case C-131/12 Google Spain SL, Google Inc. v Agencia Espanola de Datos (AEPD), Mario Costeja Gonzalez [2014] ECLI-317

Ibid para. 88

Ibid para.81

The GDPR (n 4) Art.17 (1)

Ibid Art.17 (3)

Eugenia Politou, Efthimios Alepis and Constantinos Patsakis ‘Forgetting personal data and revoking consent under the GDPR: Challenges and Proposed Solutions’ Journal of Cybersecurity (2018) 1 (20)

The GDPR (n4) Art.17 (2)

Case C-507/17 Google v. CNIL [2019] case in Harlan Grant Cohen ‘International Decisions’ The American Journal of International Law (2020) 114 (2)

ibid

ibid

The GDPR (n4) Art. 3 (1)

Ibid Art. 3 (2) (a)

Ibid Art. 3 (2) (b)