Navigating the fine line between the General Data Protection Regulation (GDPR) and the Digital Services Act (DSA) has been a daunting task for platforms in recent times. However, the European Data Protection Board (EDPB) has now stepped in to provide much-needed guidance on this matter. In their latest set of guidelines, the EDPB has recommended legitimate interests as a lawful basis for proactive platform investigations, while also emphasizing the importance of adding transparency, accuracy, and Data Protection Impact Assessment (DPIA) duties to the process.
The EDPB’s guidelines come at a crucial time when platforms are facing increasing scrutiny over their data practices. With the GDPR and the DSA setting out clear requirements for data protection and platform accountability, companies have been struggling to find the right balance between compliance and innovation. By recommending legitimate interests as a lawful basis for proactive platform investigations, the EDPB is offering platforms a way to conduct necessary investigations while still upholding the rights of their users.
Legitimate interests, as defined by the GDPR, allow companies to process personal data without explicit consent if they have a legitimate reason for doing so, and if the interests of the data subjects do not override those legitimate reasons. In the context of platform investigations, this means that companies can gather and analyze data to improve their services, prevent fraud, and enhance user experience, as long as they can demonstrate that these activities are necessary and proportionate.
Moreover, the EDPB’s emphasis on transparency, accuracy, and DPIA duties adds an extra layer of protection for data subjects. Transparency requires platforms to inform users about the data they collect and how it will be used, giving users the opportunity to make informed choices about their data. Accuracy ensures that the data collected is kept up to date and corrected if necessary, reducing the risk of decisions being made based on incorrect information. DPIA duties, on the other hand, require platforms to assess the impact of their data processing activities on user privacy and take steps to mitigate any risks.
By following the EDPB’s guidelines, platforms can not only navigate the tension between the GDPR and the DSA more effectively but also build trust with their users. By using legitimate interests as a lawful basis for proactive investigations and incorporating transparency, accuracy, and DPIA duties into their processes, platforms can show that they are committed to upholding data protection standards while also driving innovation.
In conclusion, the EDPB’s latest guidelines provide a clear path forward for platforms looking to comply with the GDPR and the DSA while still harnessing the power of data for business growth. By following these recommendations, platforms can strike the right balance between data protection and innovation, ultimately building a more secure and trustworthy online environment for all.
data protection, GDPR, DSA, EDPB, platform investigations
