The Personal Data Authority (AP) looks back on 2024, where European cooperation began to bear increasing fruit. These included successful interventions at companies such as Meta, Netflix, Booking.com, Clearview, Uber and LinkedIn. This is contained in the AP's just-released 2024 annual report.
Aleid Wolfsen, chairman of the AP: 'As privacy regulators, we are working together increasingly successfully within Europe. Sometimes we have acted together in imposing fines, but we have also used other interventions. For example, the AP was one of the initiators of a joint position on 'pay or consent' models for personalized ads on major online platforms. For those platforms, it is now crystal clear. They cannot limit themselves to offering only 2 choices: pay or consent to share your data. In other words, you don't have to pay for your privacy.'
The AP signals that the democratic rule of law and the model of market regulation adopted by the European Union (EU) are under pressure. The power of large technology companies, for example, poses a serious threat to the privacy and freedom of Europeans. A fist can only be made against this by intensive cooperation within the EU.
Fines imposed by the AP are highly visible. As such, they often determine the image people have of the AP. But the AP does much more. In 2024:
the AP conducted more than 2,000 interviews with organizations to explain the law, promote compliance or mediate a conflict;
the AP drafted legal frameworks, including for facial recognition;
the AP tested 84 bills for privacy concerns;
the AP handled more than 7,500 privacy complaints.
The annual report also reflects on corrections to AP positions. For example, when the EU Court of Justice ruled in 2024 that a commercial interest can indeed constitute a legitimate interest under certain circumstances. European privacy regulators have also published (standards) explanations on the basis of legitimate interest. The AP is a learning organization and takes criticism, such as a judicial correction of a position, to heart.
Despite the fine numbers, in 2024, privacy complaints from people continued to linger longer than desirable, companies had to wait a long time for clarity, the AP was unable to launch enough new investigations, and there was too little capacity to educate companies and supervise AI and algorithms. A serious investment in the AP's capacity is and will continue to be needed.
