Data protection and appropriate measures: too many uncertainties in the judicial applications?

Abstract

The present paper analyses, from a comparative perspective, the accountability rules outlined in the GDPR and their practical application by the courts of Member States. The first part of the article highlights the influence of the GDPR on Third Countries, with specific attention to Chinese legislation regarding data protection. The second part is mainly focused on the obligations relating to accountability and the notion of appropriateness of measures to be adopted by Data Controllers, as well as its connection with liability rules stated in Article 82 of the GDPR. The analysis considers the application of these rules, emphasising the different interpretations made by Data Protection Authorities, national courts, and more recently, by the Court of Justice of the European Union.