What is the place and purpose of the data protection law in the changing technological world?
That is the question we tried to answer in the discussion organized by the Lietuvos Respublikos teisingumo ministerija / Ministry of Justice of the Republic of Lithuania as part of the public consultation cycle. These consultations aimed to review the existing national data protection regulations, clarify the problems arising from data protection applications, and refine the possible solutions.
The identified issues and suggestions will be submitted as proposals to the regulatory authorities regarding possible regulatory changes or other measures. Together with business, data protection, and science professionals, we discussed the challenges that data protection rules are facing and the needs of organizations that are obliged to comply with those rules. Here are some key takeaways:
📍 EU General Data Protection Regulation (GDPR) is often enforced by blindly applying requirements without additionally looking at whether any threats to individuals could be caused;
📍 Data protection law is often understood as the part of the human rights framework; however, this approach seems to be a construct by the EU rather than a commonly accepted view in other jurisdictions;
📍 EU GDPR regulatory burden falls heavily on small and medium enterprises that sometimes do not pose heavy risks to data subjects, while big-tech companies have extensive resources to escape such a heavy burden;
📍 Lithuanian businesses encourage the regulatory authorities to put aside a sometimes autocratic enforcement lense and try to cooperate on finding the best balance between business interests and individual protection;
📍 Emerging technologies such as the face, voice, and movement recognition raise additional questions about where we should draw the line of prohibition of data processing.
What do you think about new challenges to data protection law? How should be a balance between business and individuals' interests maintained?
