De Europeeske Oanpak fan Gegevensprivacy Misleart op Grutte Skaal
April 7, 2025 · Frisian News
Europe's GDPR framework, once hailed as a global privacy standard, struggles to protect citizens as tech companies exploit enforcement gaps and regulators lack resources. Six years after implementation, fines remain small relative to corporate profits, and data breaches continue unchecked.
FryskFerline moanne bleatstelde in gegevensleak by in Portugeesk telecombedriuw fjirtich miljoen tillefoannûmers. It bedriuw betelle in boete fan acht miljoen euro, bûsesinten foar in operaasje dy't dy gegevens sûnder tastimming of echte befeiliging sammele. Brusselske regeljouwers diene moannen oer harren aksje. Tsjin dy tiid hienen kriminele netwurken de ynformaasje al kocht en ferkocht. Dit patroan werhellet him elke wike oer it kontinint, en it toant oan dat Europeeske privacyregels allinne op papier wurkje.
De GDPR taheite boargers kontrôle oer harren gegevens te jaan. Ynstee dêrfan skoep se byrokratysk teater. Techbedriuwen witte dat hja de boetes betelje kinne. Apple, Google en Meta behannelje GDPR-sanksjes as bedriuwskosten, krekt as in parkearboete. In miljard-euro boete klinkt grut oant jo betinke dat Meta allinne ferline jier hast fjirtich miljard euro winst makke. Europa beboete Google acht miljard euro foar privacyskeiningen. Google betelle it sûnder ien inkele yngenieur te ûntslaan of ien inkele tafersjochpraktyk yn te perken. De regels feroare neat.
Hânhavering misleart om't Europeeske gegevensbeskermingsautoriteiten gjin macht en jild hawwe. Dútslân hat de sterkste regeljouwer yn Europa, dochs hat it mar fjirtich personielsleden foar in lân fan tachtich miljoen ynwenners. Ierlân, dêr't Meta en oare reuzen harren Europeeske aktiviteiten fêstigje, hat minder privacyynspekteurs as de measte lytse doarpen plysjeagenten hawwe. Dizze ynstânsjes kinne net fluch genôch ûndersykje. As hja klear binne mei in ûndersiik, sirkulearje de gegevens al op kriminele merken. Regeljouwers wurkje yn byrokratysk tempo. Techbedriuwen wurkje mei de snelheid fan koade.
It echte probleem is struktureel. Europa boude in op regels basearre systeem yn de ferûnderstelling dat bedrigingen fan ûnfoarsoarchlike of kweaardige bedriuwen komme. Ynstee dêrfan is de bedriging normale bedriuwspraktyk. Facebook sammelet gegevens om't syn bedriuwsmodel dêrfan ôfhinget. It bedriuw oertrêdt gjin wet troch dit te dwaan, om't de wet hast alles tastiet salang't brûkers op in fakje klikke dat seit dat hja ynstemme. De measte brûkers lêze de betingsten nea. De wet telt dit as tastimming. Dit is gjin bug yn de GDPR. Dit is it ûntwerp.
Europa praat no fan nije regels, stranger boetes, mear finansiering foar regeljouwers. Dizze stappen sille mislearre lykas de earste regels mislearre. It probleem is net dat Europa bettere hânhavering fan privacywetten nedich hat. It probleem is dat Europeeske politisy gjin wil hawwe om it bedriuwsmodel sels te brekken. Dat soe gegevenssamling foar winst ferbieden, of bedriuwen twinge sûnder ynformaasjehannel te konkurrearjen. Gjin Brusselske amtner sil dit foarstel dwaan, om't de yndustry miljoenen oan lobbywerk dertsjinyn brocht. Europa keas regulearring ynstee fan behearsking. No ûntdekke boargers wat dy kar betsjut.
Last month, a single data breach at a Portuguese telecom exposed forty million phone records. The company paid a fine of eight million euros, pocket change for an operation that collected that data without consent or genuine security. Brussels regulators took months to act. By then, criminal networks had already bought and sold the information. This pattern repeats across the continent every week, and it shows that Europe's privacy rules work only on paper.
The GDPR promised to put citizens in control of their data. Instead, it created a bureaucratic theater. Tech companies know they can afford the fines. Apple, Google, and Meta treat GDPR penalties as a business cost, much like a parking ticket. A billion-euro fine sounds large until you remember that Meta alone earned nearly forty billion euros in profit last year. Europe fined Google eight billion euros for privacy violations. Google paid it without cutting a single engineer or limiting a single surveillance practice. The rules did nothing.
Enforcement fails because European data protection authorities lack teeth and money. Germany has the strongest regulator in Europe, yet it manages forty staff members to oversee a country of eighty million people. Ireland, where Meta and other giants base their European operations, employs fewer privacy inspectors than most small towns have police officers. These agencies cannot investigate quickly enough. By the time they finish a probe, the data already circulates on criminal markets. Regulators work at the pace of government bureaucracy. Tech companies work at the speed of code.
The real problem is structural. Europe built a rule-based system assuming that threats come from reckless or malicious companies. Instead, the threat is routine business practice. Facebook collects data because its business model depends on it. The company breaks no law by doing so, because the law allows nearly everything as long as users click a box that says they agree. Most users never read the terms. The law counts this as consent. This is not a bug in the GDPR. It is the design.
Europe now talks of new rules, stricter fines, more funding for regulators. These moves will fail like the first rules failed. The problem is not that Europe needs better enforcement of privacy law. The problem is that Europe's political class lacks the will to break the business model itself. That would require banning data collection for profit, or forcing companies to compete without selling information. No Brussels official will propose this, because the industry spent millions lobbying against it. Europe chose regulation instead of restraint. Now citizens find out what that choice means.
Published April 7, 2025 · Frisian News · Ljouwert, Fryslân