A report by the lead data watchdog for a large number of tech giants operating in Europe shows a significant increase in privacy complaints and data breach notifications since the region’s updated privacy framework came into force last May.

The Irish Data Protection Commission (DPC)’s annual report, published today, covers the period May 25, aka the day the EU’s General Data Protection Regulation (GDPR) came into force, to December 31 2018 and shows the DPC received more than double the amount of complaints post-GDPR vs the first portion of 2018 prior to the new regime coming in: With 2,864 and 1,249 complaints received respectively.

That makes a total of 4,113 complaints for full year 2018 (vs just 2,642 for 2017). Which is a year on year increase of 36 per cent.

But the increase pre- and post-GDPR is even greater — 56 per cent — suggesting the regulation is working as intended by building momentum and support for individuals to exercise their fundamental rights.

“The phenomenon that is the [GDPR] has demonstrated one thing above all else: people’s interest in and appetite for understanding and controlling use of their personal data is anything but a reflection of apathy and fatalism,” writes Helen Dixon,Ireland’s commissioner for data protection.

She adds that the rise in the number of complaints and queries to DPAs across the EU since May 25 demonstrates “a new level of mobilisation to action on the part of individuals to tackle what they see as misuse or failure to adequately explain what is being done with their data”.

While Europe has had online privacy rules since 1995 a weak regime of enforcement essentially allowed them to be ignored for decades — and Internet companies to grab and exploit web users’ data without full regard and respect for European’s privacy rights.

But regulators hit the reset button last year. And Ireland’s data watchdog is an especially interesting agency to watch if you’re interested in assessing how GDPR is working, given how many tech giants have chosen to place their international data flows under the Irish DPC’s supervision.

More cross-border complaints

“The role places an important duty on the DPC to safeguard the data protection rights of hundreds of millions of individuals across the EU, a duty that the GDPR requires the DPC to fulfil in cooperation with other supervisory authorities,” the DPC writes in the report, discussing its role of supervisory authority for multiple tech multinationals and acknowledging both a “greatly expanded role under the GDPR” and a “significantly increased workload”.

A breakdown of GDPR vs Data Protection Act 1998 complaint types over the report period suggests complaints targeted at multinational entities have leapt up under the new DP regime.

For some complaint types the old rules resulted in just 2 per cent of complaints being targeted at multinationals vs close to a quarter (22 per cent) in the same categories under GDPR.

It’s the most marked difference between the old rules and the new — underlining the DPC’s expanded workload in acting as a hub (and often lead supervisory agency) for cross-border complaints under GDPR’s one-stop shop mechanism.

The category with the largest proportions of complaints under GDPR over the report period was access rights (30%) — with the DPC receiving a full 582 complaints related to people feeling they’re not getting their due data. Access rights was also most complained about under the prior data rules over this period.

Other prominent complaint types continue to be unfair processing of data (285 GDPR complaints vs 178 under the DPA); disclosure (217 vs 138); and electronic direct marketing (111 vs 36).

EU policymakers’ intent with GDPR is to redress the imbalance of weakly enforced rights — including by creating new opportunities for enforcement via a regime of supersized fines. (GDPR allows for penalties as high as up to 4 per cent of annual turnover, and in January the French data watchdog slapped Google with a $57M GDPR penalty related to transparency and consent — albeit still far off that theoretical maximum.)

Importantly, the regulation also introduced a collective redress option which has been adopted by some EU Member States.

This allows for third party organizations such as consumer rights groups to lodge data protection complaints on individuals’ behalf. The provision has led to a number of strategic complaints being filed by organized experts since last May (including in the case of the aforementioned Google fine) — spinning up momentum for collective consumer action to counter rights erosion. Again that’s important in a complex area that remains difficult for consumers to navigate without expert help.

For upheld complaints the GDPR ‘nuclear option’ is not fines though; it’s the ability for data protection agencies to order data controllers to stop processing data.

That remains the most significant tool in the regulatory toolbox. And depending on the outcome of various ongoing strategic GDPR complaints it could prove hugely significant in reshaping what data experts believe are systematic privacy incursions by adtech platform giants.

And while well-resourced tech giants may be able to factor in even very meaty financial penalties, as just a cost of doing a very lucrative business, data-focused business models could be far more precarious if processors can suddenly be slapped with an order to limit or even cease processing data. (As indeed Facebook’s business just has in German

Asia

How a national security threat label has reignited Indonesia’s LGBTQ debate

Indonesia last October classified the “spread of LGBTQ culture” as one of the country’s non-military threats. A series of developments thrust the provision into the public eye this month, sparking a debate.

New: You can now listen to articles.

This audio is generated by an AI tool.

Ericssen

SINGAPORE: For more than eight months, a provision tucked away in an Indonesian presidential regulation on national defence drew little public attention.

In an appendix to Presidential Regulation No. 111/2025 on the General National Defence Policy signed in October last year, the government classified the “spread of LGBTQ culture” as one of the country’s non-military threats.

The clause, referring to lesbian, gay, bisexual, transsexual and queer culture, appeared alongside a range of other threats deemed capable of affecting national resilience. They included illegal trafficking, natural resource theft, terrorism, atheism and radicalism.

A presidential regulation is a legally binding regulation published in the State Gazette, while General National Defence Policy documents are highly technical and usually attract little public attention outside government and defence circles.

But a series of developments thrust the provision into the public eye this month, sparking a debate on the place of LGBTQ issues in state policy and the extent to which social issues should be framed within Indonesia’s defence strategy.

The issue quickly spread beyond social media into mainstream Indonesian media with national outlets including Antara, Kumparan, and Tempo examining the regulation and prompting public responses from senior government officials.

Some observers and activists say the clause could heighten discrimination against LGBTQ individuals in society, even as Indonesian ministers have defended the regulation while saying the government has no intention of curtailing the fundamental rights of citizens.

“As Indonesian citizens, LGBTQ people are entitled to education, employment, healthcare and other public services without restrictions, segregation or discrimination,” Indonesia’s Human Rights Minister Natalius Pigai told CNA in a phone interview.

CNA Games

Guess Word

Crack the word, one row at a time

Buzzword

Create words using the given letters

Mini Sudoku

Tiny puzzle, mighty brain teaser

Mini Crossword

Small grid, big challenge

Word Search

Spot as many words as you can

Show Less

Indonesia’s Human Rights Minister Natalius Pigai. (Photo courtesy of Human Rights Ministry)

But he added that Indonesian society is not ready to accept the LGBTQ community, even as the state remains obliged to respect, protect and fulfil every citizen’s rights to education, employment, healthcare and public services.

“The time has not yet come to formally recognise them as an official group because society is not yet ready to accept them,” he said.

HOW THE CLAUSE CAME TO PUBLIC ATTENTION

While it remains unclear what first drew widespread attention to the provision, it resurfaced amid a series of developments involving LGBTQ issues. One was a Pride Month-themed social media post in mid-June by Suara Mahasiswa, a student publication at the University of Indonesia.

The post had led to a heated online debate, with critics arguing it was inconsistent with Indonesia’s religious and social norms. They questioned why it invoked the Pancasila national ideology to defend the LGBTQ community. Pancasila comprises five principles: Belief in one God, civilised humanity, national unity, democracy and social justice.

The backlash prompted the university to publicly distance itself from the post and launch an internal review.

Then in late June, the Indonesian Ulema Council (MUI) said it was preparing an academic paper and a draft bill to criminalise LGBTQ-related conduct for Parliament’s National Legislation Programme.

MUI deputy chairman Muhammad Cholil Nafis argued that moral appeals alone were no longer sufficient to curb what he described as the growing activities and campaign surrounding LGBTQ culture.

“If there are no legal penalties at all, it eventually becomes normal. We should not normalise it. Punishment helps people understand that it is not normal,” he said.

“Deviant activities, such as same-sex parties, are now increasingly being displayed openly in public without any sense of shame,” he added.

Scrutiny then shifted to the new regulation that had previously gone largely unnoticed.

The belated attention came as no surprise to Agus Wahyudi, head of the Inter-Religious Studies Programme at Gadjah Mada University (UGM) in Yogyakarta.

Documents such as the General National Defence Policy typically circulate within government bureaucracy and rarely become the subject of public debate, he said.

But a provision can take on political significance when a series of events – in this case, the Pride Month-themed social media post and the MUI’s planned bill – draws the public’s notice, said Agus.

“What changed was not necessarily the policy itself, but the public attention it attracted,” Agus said.

WHY WAS IT PLACED IN A NATIONAL DEFENCE DOCUMENT?

Asked whether the presidential regulation represented the first national policy to explicitly mention LGBTQ, human rights lawyer Asfinawati said Indonesia’s 2008 Pornography Law referred to “lesbian” and “homosexual” acts in its explanatory notes to a provision banning the production, distribution and sale of pornographic material.

It defined what the law described as “deviant sexual intercourse” for the purposes of pornography offences, rather than creating a standalone offence based on sexual orientation or gender identity.

Presidential Regulation No. 111/2025 goes further by classifying the “spread of LGBTQ culture” itself as a non-military threat, argued Asfinawati, the former chair of the Indonesian Legal Aid Foundation.

“This regulation no longer links it to sexual conduct. Simply having a particular sexual orientation or gender identity is placed within a threat framework,” she said.

Experts have questioned whether a national defence framework was an appropriate instrument for addressing issues such as sexual orientation and gender identity.

In principle, national defence should focus on military threats, said Tangguh Chairil, a lecturer in security studies at the Department of International Relations at Binus University, Jakarta.

Indonesia, however, classifies threats into three categories: Military, non-military and hybrid. As a result, issues beyond the traditional defence sphere are increasingly viewed as national security issues.

“Because the definition is so broad, almost anything can be treated as a national security threat,” Tangguh told CNA.

Classifying LGBTQ culture as a non-military threat under a defence framework means the issue may be treated as a security concern requiring state attention and resources, he added.

“Issues that have been successfully securitised tend to receive greater attention than others,” he said.

Yusril Ihza Mahendra, Coordinating Minister for Legal Affairs, Human Rights, Immigration, and Corrections, told news outlet Tempo on Jul 9 that “non-military threat” was used to categorise risks against national resilience.

In the socio-cultural context, “resilience” refers to values, ethics, character of the younger generation, families, digital space, and social cohesion, he said.

“What the government perceives as a threat is the campaign, propaganda, and dissemination of LGBT behaviour aimed at altering the values that align with the nation’s culture and morality,” he added.

Indonesia’s Chief Minister for Law and Human Rights, Yusril Ihza Mahendra, speaks as Australia’s Minister for Home Affairs, Tony Burke, listens during a press conference following their meeting in Jakarta, Indonesia, December 3, 2024. (REUTERS/Willy Kurniawan)

Asfinawati said the regulation cannot serve as the legal basis for introducing new criminal provisions or for regional governments to impose criminal sanctions unless authorised by law.

Under Indonesian law, a person’s sexual orientation as well as consensual same-sex relations between adults are not, by themselves, criminal offences. The exception is Aceh province, which implements Islamic crimina

Privacy complaints received by tech giants’ favorite EU watchdog up more than 2x since GDPR

More cross-border complaints