Ten years after the EU’s General Data Protection Regulation entered into force on 24 May 2016, the European Commission has highlighted the rights it gives people to control how their personal data is used.
Rules on personal data protection differed widely between EU countries before the GDPR, and people’s rights were often unclear, the Commission said in a statement.
Under the GDPR, people in the EU have the right to know what personal data is collected about them, why it is collected, and who it is shared with.
They can also request access to their data, ask for it to be corrected or deleted, and withdraw consent at any time.
These rights apply whether someone is dealing with a small local business or a multinational company, the Commission said.
It added that companies that failed to comply have faced consequences, including some of the largest fines issued against major firms.
How the GDPR is enforced and linked to newer online rules
The GDPR is enforced by data protection authorities in all 27 EU member states, meaning the same rights apply across the bloc, the Commission said.
The regulation has inspired similar laws outside Europe, turning an EU rulebook into a model used internationally.
The Commission also pointed to other EU laws introduced in the years since the GDPR, including the Digital Services Act, which sets obligations for large online platforms over harmful content, and the Digital Markets Act, which targets certain practices by the biggest tech “gatekeepers”.
It also referenced the AI Act, which sets rules for artificial intelligence systems used in Europe, including requirements linked to rights and safety.
Separately, the Commission cited an EU action plan on cyberbullying and work on a European age verification app as part of its online safety initiatives for children.
