GDPR – the experience of data protection authorities

The project will provide evidence-based advice on the experiences of data protection authorities (DPAs). It will support the European Commission’s evaluation report on the implentation of the General Data Protection Regulation (GDPR).
Project Status
Ongoing
Project start date
1
January
2022

What?

The project will provide evidence-based advice on the experiences of data protection authorities (DPAs). It will support the European Commission’s evaluation report on the implementation of the General Data Protection Regulation (GDPR). FRA will collect information by conducting qualitative fieldwork research, based on interviews with staff members and officials of national DPAs.

Why?

The European Commission invited FRA to support the second evaluation of the GDPR by providing qualitative data on the experiences and challenges of national data protection authorities when implementing their tasks and mandate as defined in the GDPR. The GDPR prescribes that the Commission regularly evaluates and reviews the application of the GDPR. The first report was published in 2020, and the next evaluation report is due by mid-2024, starting with a first report after two years of application and every four years thereafter. FRA’s findings will feed into this process. It will provide qualitative data complementing DPAs written submissions to the European Commission.

How?

The research covers all 27 EU Member States. Data will be collected by FRA experts and the Agency’s multidisciplinary research network, FRANET, through a combination of desk and fieldwork research. The findings will also build on FRA’s past work relating to the protection of personal and private life (Articles 7 and 8 of the Charter of Fundamental Rights), including the 2010 report on the role of data protection authorities. Fieldwork will take place in 2023 and FRA will publish its findings in 2024.

See also