GDPR Report 2024 - Cover
Miha Creative/Adobe Stock
11
June
2024

GDPR in practice – Experiences of data protection authorities

Data protection rules protect privacy and prevent personal information from misuse. When the general data protection regulation (GDPR) came into force in 2018, it strengthened the role of data protection authorities. These supervisory bodies are the key enforcers of the fundamental right of protection of personal data. This report analyses the challenges they face in the GDPR implementation. The findings complement the European Commission's forthcoming evaluation of the GDPR.


We have invested in advisory work and guidance because we work preventively as well as reactively. Before, the Data Protection Authority would launch an investigation based on a complaint. Today, this has changed, and we now go into matters in which we have not received complaints. … We believe that by being proactive and working preventively, we can increase the level of data protection. If we only handle complaints, we neglect all those cases that have not been reported. If we don’t work preventively, we only see the tip of the iceberg.

An EU DPA staff member

The GDPR has enhanced DPAs’ advisory role, particularly its role in advising data subjects, data controllers and the public at large. Among the advisory tasks included in Article 57 of the GDPR is that DPAs should raise public awareness and understanding of data protection risks, rules, safeguards and rights associated with data processing [78]
 GDPR, Art. 57(1)(b).
. They should advise national parliaments, governments and other public institutions on the potential implications of draft legislative and administrative measures on data protection [79]
 GDPR, Art. 57(1)(c).
. They should also advise data controllers on high-risk data processing, following a data protection impact assessment [80]
 GDPR, Art. 36(2) and Art. 57(1)(l).
.

The DPAs’ advisory function is of utmost importance, according to a large majority of interviewees. The DPAs’ advisory role is key to effectively enforcing data protection across the EU as, according to many interviewees, advising data subjects and data controllers prevents data protection breaches and complaints.

However, several interviewees mentioned that the DPAs’ advisory function in fact conflicts with their supervisory tasks. Lack of resources (as emphasised in Chapter 1) prevents them from implementing the advisory tasks that the GDPR has entrusted to them. In most DPAs, oversight and supervision absorb most time and staff. Some respondents considered their authority to be primarily a supervision authority, and not a ‘consultant’.

Whether we have sufficient resources is a relative question. We have the resources we have, and we have to make that work. If the ambition is that the DPA should increase its advisory activities, more resources should be allocated. It depends on the ambition.

An EU DPA staff member

One interviewee claimed that their DPA was able to exercise its advisory role only after receiving some additional budget to recruit and assign staff.

Earlier, when the DPA’s resources were more limited, the DPA had to reduce its guidance function to be able to deal with the obligation to process complaints and do oversight. But now that the DPA has more resources, the DPA is allocating them towards guidance again as it is a useful preventative measure.

An EU DPA staff member

Interviewees mentioned two main ways of advising the general public on data protection issues: (1) by publishing guidance and (2) by organising workshops and/or public events with data controllers from the private and public sectors. Here, a difference can be observed between more and less experienced DPAs [81]
 While some Member States established a DPA in the 1970s, others did so only after the adoption of Directive 95/46/EC.
. According to interviewees from more experienced DPAs, providing advice is a regular task of a DPA, whereas for more recently established DPAs, this is generally a secondary task. Less experiences DPAs struggle to find the time, human and financial resources, and technical knowledge to develop guidance and organise awareness-raising activities.

DPAs also deliver targeted advice, either in their responses to formal governmental or parliamentary queries on legislative proposals, or in their responses to data controller queries on future or ongoing data processing. Although time-consuming, several interviewees highlighted the added value of responding to these queries. It could help settle or prevent a misunderstanding in the application of the GDPR or help guide a controller to address data protection risks ex ante. It could also help foster a good relationship between the DPA and data controllers.

[The] personal contact approach is very useful. In writing, a lot gets lost (officials are not able to express themselves in an understandable way and people also interpret writings differently). Thus, it helps a lot when the DPA calls the person and explains the consequences of certain processing. Concerned entities are often not aware of data protection rules; hence, they are very grateful to the DPA when the DPA calls and explains to them and helps them to fix the non-compliance.

An EU DPA staff member

This chapter describes the challenges DPAs face when implementing the advisory tasks entrusted to them by the GDPR, as reported by interviewees. It examines difficulties in providing advice to data subjects and the general public (Section 3.1), to data controllers (Section 3.2), and to public bodies on legislative initiatives (Section 3.4), as the GDPR requires [82]
 GDPR, Art. 57.
. In addition, it reports on some interviewees’ experiences of providing advice to researchers (Section 3.3) and highlights the importance of DPAs’ partnership with data protection officers (DPOs) (Section 3.5). Finally, the last section of this chapter sheds light on the challenges that DPAs face when dealing with new technologies (Section 3.6).

 


Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory … (b) promote public awareness and understanding of the risks, rules, safeguards, and rights in relation to processing. Activities addressed specifically to children shall receive specific attention.

Article 57(1)(b) of the GDPR

FRA’s findings identified similar trends in the public’s understanding of data protection safeguards. On the one hand, DPAs noticed that awareness of data protection increased greatly following the adoption of the GDPR, which resulted in a rapid and substantial increase in complaints. On the other, DPAs found that a large majority of complaints are trivial or unfounded, and that very few complaints are lodged concerning sensitive data processing and misuse of personal data in the digital sphere.

In other words, while individuals’ awareness of their rights has increased, an understanding of what the right to data protection entails is still lacking.

A majority of interviewees agreed that providing advice and reinforcing the public’s understanding of what data protection means is an effective use of DPAs’ resources and, ultimately, improves their ability to fulfil their mandate. Here again, lack of resources was said to have a negative impact on the ability of DPAs to provide direct and adequate advice in response to individual requests. For instance, some interviewees mentioned their incapacity to meet with individuals living outside the capital.

The DPA lacks the financial means to organise events or to take part in other events – especially outside the capital. Because the authority doesn’t have regional offices to decentralise the work, it needs to answer demands from opinions from all over the country via email – to mayors, to governmental county-level services (e.g. health insurance, pensions), to data controllers, etc.

An EU DPA staff member

In some Member States, DPAs have set up hotlines for individuals to enable the authority to assess the merits of their grievance before they file an official complaint. Most interviewees pointed out to FRA that a handful of staff must be dealing with high numbers of minor or petty complaints, often similar in content (e.g. related to neighbours installing a CCTV camera, a recurring complaint mentioned by most interviewees). Nonetheless, these hotlines require additional human and financial resources, which many DPAs are lacking.

Systematic complaints handling – as explained in the box Promising practice: a group of DPAs investigated Vinted UAB for GDPR non-compliance – also supports DPAs in finding the appropriate advice for the general public and data controllers in a swift and evidence-based manner.

The idea is that they (junior lawyers) are there to take legal questions, but, in practice, it is more than this, such as questions about the processing of current cases, and, when the public hears our name, many people think that our organisation handles much more than what is in our mandate, with individuals calling in to report how their integrity has been violated, putting our colleagues in a therapist-like role at times.

An EU DPA staff member

Promising practice: providing advice in a regular, structured and systematic manner based on complaint assessments

Some interviewees pointed out that the regular and systematic logging of recurrent complaints received and advice provided on specific issues has helped avoid duplication of effort among DPA staff members. These repositories and databases include different tools, such as a list of standard responses, a catalogue of examples of good decisions, and a regular update of the questions and answers published on the DPA’s website.

Source: Interviews with staff of several EU DPAs.

 


Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory: … (d) promote the awareness of controllers and processors of their obligations under this Regulation.

Article 57(1)(d) of the GDPR

The controller shall consult the supervisory authority before processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk.

Article 36(1) of the GDPR

A majority of respondents highlighted the importance of providing guidance to data controllers, both to ensure correct implementation of the GDPR and to reduce workload when investigating data processing. Interviewees from multiple DPAs said that such requests must be prioritised given the tight deadline to respond established in the GDPR [83]
 GDPR, Art. 36, provides that ‘Where the supervisory authority is of the opinion that the intended processing referred to in paragraph 1 would infringe this Regulation, in particular where the controller has insufficiently identified or mitigated the risk, the supervisory authority shall, within period of up to eight weeks of receipt of the request for consultation, provide written advice to the controller’.
.

Several interviewees referred to the obligation, under Article 35 of the GDPR, to conduct a data protection impact assessment (DPIA) in cases where ‘a type of processing, in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons’. When the data processing would result in a high risk to individuals’ right and freedoms, and in the absence of measures taken by the controller to mitigate the risk, Article 36 of the GPDR requires data controllers to consult with the DPA.

However, some respondents noted that, in practice, data controllers rarely seek the DPA’s advice pursuant to Article 36 of the GDPR. The scarcity of requests and prior DPIAs is a direct consequence of many data controllers’ lack of understanding of the potential risks of inadequate data processing. Interviewees agree that awareness-raising actions targeting specific fields of activities should be conducted to prevent inadequate data processing.

Several interviewees highlighted specific difficulties that further complicate DPAs’ function of advising data controllers in both the public and private sectors. First, in some cases DPAs might not be able to assess the potential risks of a processing operation without carrying out an on-site visit; however, as reported by some interviewees, this can only happen during ex post inspection. Second, some interviewees found that the lines between their advisory and investigatory roles are sometimes blurred. While DPAs wish to provide data controllers with clear guidance on data protection safeguards in data processing, in practice they can give only general advice. Interviewees clarified that this was to avoid DPAs, in the case of investigations, having to supervise the implementation of their own guidance.

If someone wants very detailed advice on their own system, for example, it could easily create a situation where, if the data subject later complains to us, we would have to assess the actions of a controller that we have previously advised on. [Hence,] we can [only] provide general guidance.

An EU DPA staff member

Promising practice: develop targeted and sector-specific guidance

In Sweden, the DPA’s information service can send information letters. These letters explain to parties involved in a complaint what legal obligations the GDPR demands of individuals or organisations with access to and responsibility for personal information. The objective of these letters is to get the responsible actors within different organisations to comply voluntarily with the GDPR.

Source: Interview with staff of the Swedish DPA.

 

Promising practice: development of sandboxes

Some interviewees underlined the importance of dedicating more time and resources to the development of sandboxes. While there is not a common definition of a sandbox, the European Commission’s Better Regulation Toolbox describes regulatory sandboxes as schemes in which stakeholders can test innovations in a controlled environment, under the guidance and oversight of a competent authority.

An interviewee said:

the sandbox method is a very successful way of working as it allows us to give better guidance on new technology while we learn an enormous amount about the technology itself. For example, we gained knowledge of AI technology federated learning, discovering things we would never have known otherwise. We sat with data scientists involved in the project and looked in detail at how the algorithm was built, learning what it means and what consequences the technology has for data protection.

Source: European Commission, Better Regulation Toolbox, 2023.

 

Third, some respondents highlighted difficulties that apply specifically to advising public authorities and bodies when they are acting in their capacity as data controllers, that is, when the DPA provides advice to them on specific data processing, and not within the procedure of advising on draft laws or legal initiatives. In some Member States, DPAs are not allowed to issue fines to public entities, only recommendations. Hence, as one interviewee explained, DPAs’ advisory role is not sufficiently acknowledged by public authorities, as recommendations are not enforceable. Some interviewees also claimed that public bodies distrust, and sometimes fear, DPAs when it comes to asking them for opinions on data processing, as highlighted in Section 2.2.2. For instance, one respondent witnessed a case where a public sector body developed a data processing operation without contacting the DPA in advance because of a fear of a ‘no’ from the DPA’s side. Thus, ‘public authorities rather develop and deal with consequences later … ’, as one interviewee put it.

To support research and innovation, the GDPR includes a ‘special regime for scientific research’ in Article 89, as explained in the EDPS’s preliminary opinion on data protection and scientific research [84]
 EDPS, A preliminary opinion on data protection and scientific research, 2020, p. 16. See also European Parliamentary Research Service,How the general data protection regulation changes the rules for scientific research, PE 634.447, 2019.
, which applies to the processing of personal data for ‘archiving in the public interest, scientific or historical or statistical research purposes’ [85]
 GDPR, Art. 89 and Art. 5(1)(b).
. In this context, Article 89 of the GDPR allows for certain exceptions to the data protection guarantees under certain conditions (e.g. the existence of technical and organisational measures).

During the COVID-19 pandemic, several DPAs were confronted with increasing requests to provide advice on the use of sensitive medical data of COVID-19 patients for research purposes. The box Promising practice: develop targeted and sector-specific guidance describes an example.

Promising practice: DPA advice on scientific research during the COVID-19 pandemic

In the Netherlands, the House of Representatives asked the DPA for an opinion on the use of vaccination data for research on the high mortality rates during the COVID-19 pandemic. The DPA recommended that Statistics Netherlands could use the data from the National Institute for Public Health and the Environment for the intended purposes. The DPA stated that this research was permitted under the GDPR, but called on the Ministry of Health, Welfare and Sport to consider legislation clarifying the use of health data for scientific research.

Source: The Netherlands, Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Request for advice on research into excess mortality (Advise AP onderzoek oversterfte), 2023.

 

Most respondents, however, could not recall any practical experience of providing advice to researchers in the field of scientific research, apart from the advice delivered during the COVID-19 pandemic. Among those who could recall some examples, only a few stated that the GDPR has allowed for a certain consistency and awareness the of safeguards that should be put in place when processing personal data for research-related purposes.

There is an incentive among researchers to carry out a lot of anonymisation, pseudonymisation and encryption, decentralised data storage and early deletion, because this gives them the freedom to use data for their own purposes.

An EU DPA staff member

For several interviewees, however, the implementation of Article 89 of the GPDR has been challenging [86] GDPR, Article 89, provides for safeguards and derogations in relation to processing data for archiving purposes in the public interest, for scientific or historical research purposes or statistical purposes.
. In 2019, national differences in the implementation of Article 89 were identified in a study commissioned by the EDPB [87]
 EDBP, Study on the appropriate safeguards under Article 89(1) GDPR for the processing of personal data for scientific research, 2019.
. In this report, FRA research identifies the following two challenges.

First, the complexity of the applicable legal framework and uncertainty about the legal basis of data processing were repeatedly mentioned as an issue of concern in this context. In addition to the GDPR, specific legislation may apply to the processing of personal data in a certain field; for example, sectorial laws regulating medical research [88]
 Directive 2004/23/ECof the European Parliament and of the Council of 31 March 2004 on setting standards of quality and safety for the donation, procurement, testing, processing, preservation, storage and distribution of human tissues and cells (OJ L 102, 7.4.2004, p. 48).
, clinical drug trials [89]
 Regulation (EU) No 536/2014 of the European Parliament and of the Council of 16 April 2014 on clinical trials on medicinal products for human use (OJ L 158, 27.5.2014, p. 1); European Commission, ‘Question and answers on the interplay between the clinical trials regulation and the general data protection regulation, 2014; EDPB, Opinion 3/2019 concerning the questions and answers on the interplay between the clinical trials regulation (CTR) and the general data protection regulation (GDPR), 2019.
and statistics [90]
 Several pieces of EU legislation govern statistics depending on the subject area. See ‘EU legislation on statistics’.
, at both the EU and national levels [91]
 For an overview of sectorial legislation adopted at the national level to regulate the use and collection of personal data for research purposes and its interplay with the GDPR, see Milieu, Study on the appropriate safeguards under Article 89(1) GDPR for the processing of personal data for scientific research, 2021. The study was commissioned by the EDPB.
. The plethora of applicable EU and national legislation has made it difficult for researchers – and data controllers – to identify a legal basis for a processing operation, according to many interviewees. Many interviewees mentioned that EDPB guidance in the area of clinical trials is useful in this respect [92]
 EDPB, Opinion 3/2019 concerning the questions and answers on the interplay between the clinical trials regulation (CTR) and the general data protection regulation (GDPR), 2019.
. The data subjects concerned may also be affected by the lack of legal clarity, ultimately discouraging them from exercising their rights [93]
 See also European Commission, Directorate-General for Health and Food Safety, Assessment of the EU Member States’ rules on health data in the light of GDPR, Publications Office of the European Union, Luxembourg, 2021.
. Both researchers and the general public would therefore benefit from further guidance on correctly applying the GDPR for the purpose of research, to avoid legal uncertainty hindering innovation. The importance of providing further guidance, especially on sharing sensitive data with researchers and monitoring discrimination caused by bias in algorithms, was underlined in FRA’s previous work [94]
 FRA, Bias in Algorithms – Artificial intelligence and discrimination, Publications Office of the European Union, Luxembourg, 2020, p. 15.
.

Second, respondents noted that in some Member States public authorities have been reluctant to grant access to personal data for research purposes and that, in a couple of Member States, the GDPR has often been used as justification for refusing such access. One respondent explained that the GDPR states only under what circumstances information might be provided, but does not address under which circumstances it must be provided, hence creating uncertainty. Therefore, granting access to data for research purposes by public authorities is another field that requires further clarification, potentially through the development of specific EDPB tools or guidance.

In addition, some interviewees mentioned that the GDPR should not be used to justify refusing access to data, but as a legal framework governing this access.

We have provided guidance to researchers in several cases, and we often had to open doors to researchers where the added value of the research warranted this, and the data controller was being extra, and unnecessarily, cautious. The role of the DPA is to open doors by suggesting anonymisation and proposing different methodologies, encouraging researchers to exercise proportionality, because often researchers ask for significantly more information than what is needed to extract their conclusions.

An EU DPA staff member

Against this background, interviewees from a few Member States questioned whether the GDPR provides sufficient legal clarity to enable them to consistently transpose the derogations and safeguards provided for in Article 89 across the EU. One respondent suggested that the provision should require Member States to adopt national legislation on the applicable derogations under the GDPR when data are processed for scientific research purposes. Such legislation is prescribed in Article 85 of the GDPR, which states that the applicable derogations for processing data for journalistic purposes should be prescribed in national law [95] GDPR, Article 85(2), provides for exemptions and derogations from some GDPR chapters, when processing of personal data is conducted for journalistic purposes or the purpose of academic artistic or literary expression. Article 85(3) obliges Member States to adopt laws based on Article 85(2).
.

As a final point, some respondents brought to FRA’s attention that in most EU Member States DPAs are no longer providing prior authorisation for the use of personal data for scientific research purposes. This was a requirement under Directive 95/46/EC [96]
 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).
, repealed by the GDPR. In one Member State, the DPA still provides ‘permission’ for certain personal data processing for research purposes, but it does not authorise the processing of sensitive data, which falls under the competency of the national ethics committee. Some respondents found that the authorisation system was useful for keeping DPAs informed, updated and aware of potential data protection risks in data processing in the field of research.

DPAs have developed several practices and initiatives to address these concerns and raise awareness among researchers and data controllers of the applicable data protection safeguards when processing data for research purposes. Some of these practices are highlighted in the following boxes.

Promising practice: research plans that justify the need to obtain personal data

In Hungary, the DPA systematically requires researchers to provide a research plan justifying the need for obtaining personal data. This is submitted to the public institution along with the request for access to the data. This was confirmed in a DPA decision, which clarified that while archived material containing personal data should not be consulted by researchers, this prohibition may be lifted if the researcher complies with additional requirements, including providing a detailed research plan and attaching to his/her application a supporting statement from the public body conducting the research.

Sources: Interviews with staff of the Hungarian DPA; Hungary, National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság), Decision NAIH/2016/2504/27/H, 2017.

 

Promising practice: privacy research days

Since 2022, the French Data Protection Authority, the National Commission on Informatics and Liberty (CNIL), has organised a ‘Privacy Research Day’ to build bridges between researchers and data protection regulators. The event gathers legal experts, computer scientists, designers and researchers in social science.

Source: France, National Commission on Informatics and Liberty (Commission Nationale de l’Informatique et des Libertés), ‘Privacy research day: Discover the program of the first CNIL’s international conference, 2022.

 

Promising practice: online guidance on scientific research and data protection

The Finnish DPA has published online a ‘data protection roadmap for scientific research’, which provides guidance to controllers when considering data protection in different phases of research and the lifespan of data. The roadmap consists of 10 steps that researchers should follow. They include defining the basis of the processing, ensuring data protection subjects’ rights, and documenting the implementation of data protection principles and other procedures specified in the GDPR during the lifespan of the research project. The roadmap is also available in English.

Source: Finland, Data Protection Authority, ‘Scientific research and data protection.

 

Promising practice: developing dialogue and exchanges with research and statistics institutes

Several DPAs have developed channels for exchange with research and statistics institutes. For instance, the Italian DPA developed a regular exchange with a network of DPOs working with research-related bodies. In addition, it is cooperating closely with the Italian National Institute of Statistics (ISTAT). Following the advice of the authority, ISTAT succeeded in pseudonymising a large number of personal data.

Source: Interview with staff of the Italian DPA.

 

Promising practice: developing cooperation with ethics boards

In Lithuania, the DPA cooperates closely with the Academic Research Ethics Board. The two institutions have worked together to develop guidelines on how to conduct research and how to reconcile this with data protection. Similarly, they cooperated in drafting the Health Data Re-Use Act, which regulates the use of health data for research purposes. In Latvia, DPA representatives take part in the Commission on Ethics in Research at the University of Latvia, where researchers present their plans and the DPA can provide its assessment on data protection, if necessary. In Malta, the Data Protection Act requires researchers to obtain prior authorisation from the DPA before processing genetic, biometric, health or social care data. To comply, the DPA collaborates with the University of Malta’s Research Ethics Committee, which issues an initial assessment of each research proposal, including data protection compliance. The DPA then decides whether to authorise the research or not. This collaboration ensures compliance with the law.

Source: Interviews with staff of several EU DPAs.

 


Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory: … (c) advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to processing.

Article 57(c) of the GDPR

Member States shall consult the supervisory authority during the preparation of a proposal for a legislative measure to be adopted by a national parliament, or of a regulatory measure based on such a legislative measure, which relates to processing.

Article 36(4) of the GDPR

Providing advice and legal opinions to governmental or public bodies is not a new responsibility of DPAs. Some respondents highlighted that, prior to the GDPR, domestic legal frameworks entrusted DPAs with advisory responsibilities, that is, providing detailed opinions on legislative draft proposals or other administrative measures affecting the individual rights to data protection. In some cases, however, respondents emphasised that the GDPR did make clear the obligation of state authorities to consult the DPA. Some interviewees did acknowledge increased interest from the government in the DPA’s opinions.

Several interviewees indicated that providing advice on draft laws is a crucial task, if not a priority, as it may prevent future complaints and data protection risks by ensuring the inclusion early on of data protection safeguards in the law. The sense of making it a priority is strongly reinforced when they see the direct impact of their recommendations in the amendments, or even sometimes in the withdrawal, of draft legislative texts, according to some interviewees.

The DPA is a kind of preventive supervisor of legislation. It is actually quite nice that the DPA has this function of advisory body. The DPA recently issued its opinion on a new bill … In this opinion the legislator was told that this bill cannot become law because it is in violation of the EU Charter. … Because the DPA is a supervisory body with investigatory and sanctioning powers, its opinions and recommendations carry more weight. These are not really opinions but legality assessments.

An EU DPA staff member

DPAs should be able to provide advice on their own initiative, by commenting on any legislative initiative, as long as there are data protection implications, according to some interviewees. They should not only respond to official requests prior to the enactment of legislation. In practice, however, lack of resources prevents DPAs from providing unsolicited recommendations, despite their will to do so.

What the DPA would really like to do is provide unsolicited advice, but, due to capacity problems, we don’t get around to doing that.

An EU DPA staff member

Only a few respondents acknowledged increased interest from the government in their opinions following the entry into force of the GDPR. Most respondents pointed out some deficiencies undermining the delivery of independent advice, as Section 1.2.1of this report outlines.

  • Several respondents underlined that DPA recommendations, being non-binding, are not always considered by the legislator. The same goes for policymakers, who are not obliged to incorporate DPAs’ advice into negotiated legislation. However, interviewees insisted on the importance of acting proactively during legislative processes.
  • Some respondents noticed differences between DPAs and other comparable public bodies (e.g. ombudspersons) in the provision of legal advice and recommendations on draft laws. In one case, an interviewee expressed concern over the fact that a recent amendment now prohibits the DPA from providing fundamental comments, that is, comments that should be considered by the authority in charge of the legal proposal. In another Member State, the DPA is not allowed to request a constitutional review unless an inspection procedure is launched – while other public bodies may do so.
  • Several interviewees lamented the fact that their government does not always consult the DPA prior to the enactment of legislation that affects the protection of personal data. Several reasons were indicated. In some cases, the failure to request the DPA’s opinion was attributed to a lack of understanding of the potential data protection implications of a draft law. In one case, the interviewee mentioned some hostility from the government, which perceives the DPA as a barrier to innovation – but clarified that such hostility ceases after the DPA provided clarification.

And then there are still issues that the government and parliament still forget on matters of data protection. For example, when changes to the … Law were under discussion, the DPA was not heard.

An EU DPA staff member

We are not seen in a good light by certain quarters because, for them, data protection is there to stop innovation, to stop processes, to pose restrictions, to put safeguards which might stifle innovation. So, this is a general perception.

An EU DPA staff member

  • Fourth, the absence of government consultation, or the very short deadline provided to the DPA to respond to a request for legal opinion – as described in Section 1.2.1 – were noted to not only hinder DPAs’ capacity to provide advice during legislative processes, but also contribute to the large volume of complaints received by DPAs, as the quotes below describe.

The COVID-19 pandemic was a difficult experience for the DPA, which would have preferred that the government contacted the DPA when drafting the measures, but did not – there would have been much less anger among the people and the DPA would have received far fewer complaints.

An EU DPA staff member

For example, the DPA received a hundred complaints, virtually identical, as a result of one processing of personal data, until the DPA announced, through the media, that it was already dealing with the matter and that no further reports were necessary. The DPA would have had far fewer problems if the government had consulted the DPA. On many occasions, the DPA learned of the content of a draft law through journalists.

An EU DPA staff member

Promising practice: regularly exchanging with authorities and acting proactively

Some interviewees highlighted the importance of acting proactively to reinforce DPAs’ advisory role during the legislative process, both by contacting ministries and requesting to be kept up to date on potential future legislative initiatives, and by providing unrequested recommendations on draft laws. In general, respondents who mentioned acting proactively also told FRA that processes and exchanges are generally going smoothly with governmental bodies.

One interviewee also mentioned that a collaboration with the ministry of justice proved to be very successful: ‘When the project finally reaches the Ministry of Justice, it either introduces the DPA as an advisor or asks for the authority’s opinion if the initiator has omitted this aspect’.

Source: Interviews with staff of several EU DPAs.

 

  • Fifth, interviewees insisted that neutrality and prudence are key when approached by ministries with questions related to future draft laws. DPAs may give advice during the drafting of a text but they must clarify that this is not a formal assessment on their part and it is not a guarantee that the draft proposal is data protection compliant.

We are expected to say in such a case that one solution is legal and another is not. We cannot say that. We can only do that when there is an inspection, when some personal data processing is actually under way, and only then can we make an assessment … We give basic instructions, we point out some past cases, what was the solution, what they didn’t pay attention to, etc. We certainly give some guidelines. The problem with this is that you don’t get all the relevant information. It is human nature to give information that leads to the conclusion that a certain solution is appropriate. They don’t tell you the downside, either deliberately or not, because they are not aware of (the downsides), because that’s why they come to us for our opinion.

An EU DPA staff member

Promising practice: create guidelines specifically tailored to ministries developing legal initiatives

In some Member States, DPAs have developed guidelines specifically aimed at ministries in the process of developing new laws, to guide them and ensure that data protection is taken into account. Another interviewee mentioned that training is being organised for lawyers working in ministries. However, for now, it remains difficult to assess the real impact of these measures.

Source: Interviews with staff of several EU DPAs.

 

  • Sixth, and contrary to the trend identified by some DPAs, several interviewees highlighted that they receive a high number of official requests to comment on draft laws, even when these have no data protection implications. Interviewees expressed different views on this. It was perceived by some as a positive trend where the legislator is taking the protection of personal data seriously. However, some respondents were concerned that such a large number of requests from governmental bodies is hampering DPAs’ activities and may ultimately prevent them from developing in-depth analyses. Two interviewees said they believe this to be intentional.
  • Seventh, in some Member States, DPAs have noted that their government still lacks an understanding of the potential risks to data protection. This is particularly the case in the area of legislation on the digitalisation of public processes.

This lack of understanding translates into concrete challenges, delaying the provision of legal opinions, according to some interviewees. On the one hand, it has resulted in a lack of clarity about certain data processing operations. On the other hand, DPIAs are rarely conducted before consulting the DPA.

Promising practice: enhanced cooperation with DPOs in ministries

In one Member State, the DPA reported good cooperation with the DPO’s office within one of the ministries. After the office was established, the DPA noticed a real improvement in the understanding of data protection implications of draft laws.

Source: Interviews with staff of an EU DPA.

 

The requirement included in Article 37 of the GPDR to establish a DPO was not a new requirement of the GPDR. However, the regulation did broaden the obligation to data controllers and data processors that might not have been required to contract a DPO under the 1995 directive. The task of the DPO is to inform, advise, and act as a contact person between the controller/processor and the DPA.

A large number of DPOs were recruited in a short period of time following the entry into force of the GDPR. In 2019, a study by the International Association of Privacy Professionals [97]
 IAPP is a large association that brings together professionals and experts on privacy and data protection. It is a non-profit organisation working to develop and foster understanding related to privacy and data protection.
(IAPP) estimated that 500 000 organisations had registered a DPO across Europe [98]
 IAPP, ‘Study: An estimated 500K organizations have registered DPOs across Europe’,16 May 2019.
.

Several interviewees discussed the impact of this on DPAs. Some respondents connected it with their recruitment difficulties, associating the large-scale DPO recruitment by private and public entities with a data protection experts’ ‘brain drain’. Interviewees also flagged the salary imbalance that can exist between private and public sector employment as an additional difficulty for DPAs when competing with the private sector to recruit high-level experts in such a niche field, as Section 1.1.2 discussed in more detail. This difficulty is shared by public authorities in general. In three Member States, the DPA evidenced the absence of a DPO either in public bodies or in both private and public bodies and requested these bodies to hire a DPO, it was reported to FRA.

The majority of municipalities either no longer have the data protection officers (they are required to have one, but as they are exempted from fines, they usually opt for saving the money and are no longer paying for DPOs), or outsource the issue to someone who does not function properly.

An EU DPA staff member

Some interviewees highlighted how DPOs have been playing a crucial role in their work, by preventing potential violations of the GPDR, thanks to their understanding of the legal frameworks, and by developing a meaningful and useful communication channel between the DPA and data controllers.

Promising practice: communication and training material tailored to DPOs

Several interviewees mentioned the development of information materials specifically targeted to DPOs as a good practice to reinforce their knowledge. These tools take different forms, such as the organisation of workshops, training or conferences, the publication of guidance, the setting up of a DPOs’ network, the regular sending of information bulletins, etc.

Source: Interviews with staff of several EU DPAs.

 

The role of the DPO is regarded as an essential preventive measure for effective enforcement of the GDPR, and, for several interviewees, DPOs are considered to be partners.


Rapid technological developments and globalisation have brought new challenges for the protection of personal data. The scale of the collection and sharing of personal data has increased significantly. Technology allows both private companies and public authorities to make use of personal data on an unprecedented scale in order to pursue their activities. … Those developments require a strong and more coherent data protection framework in the Union, backed by strong enforcement, given the importance of creating the trust that will allow the digital economy to develop across the internal market.

Recitals 6 and 7 of the GDPR

Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory: … monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular, the development of information and communication technologies and commercial practices.

Article 57(1)(i) of the GDPR

Respondents were asked about the capacity of their authority to respond to challenges stemming from new technologies, such as AI and machine learning, and encompassing blockchain and crypto assets, the internet of things, facial recognition and connected vehicles, for example.

A majority of respondents believe that the tools provided in the GDPR are, in theory, sufficient. However, most of them also mentioned several issues that can have an impact on their effectiveness in addressing issues stemming from the use of new technologies.

  • First, several respondents indicated they are mostly unprepared when it comes to understanding and assessing new technologies.
  • Second, a number of interviews were ambivalent about the adequacy of the GDPR, believing that it is adequate but insufficient. Most interviewees referred to the generic and technological neutrality of the GDPR as both a positive and negative. With regard to AI, it leaves too much room for interpretation, and DPAs believe that guidance is greatly needed. For instance, one interviewee explained that when it comes to AI the GDPR is reaching its limits, as AI is creating a conflict with the data minimisation principle.
  • Third, several interviewees expressed concerns about the clarity of their role in the constellation of multiple data-related acts. Because other EU laws on new technologies (such as the Digital Services Act and the proposed Artificial Intelligence Act) also directly touch upon data protection issues that are covered in the GPDR, how to coordinate and deal with potential overlaps of mandates of supervisory authorities remains unclear [99] Council of the European Union, Council position and findings on the application of the GDPR – Consultation of Member States, Brussels, 8 November 2023, para. 18.
    .

The GDPR is technology neutral. But it is difficult to pigeonhole some new technologies. An example concerns blockchain: who is the controller and who is the processor?

An EU DPA staff member

The technological neutrality of the legislation in this matter leaves the task of constructing an understanding of new technologies, and their relation to the GDPR and other regulatory instruments, on the shoulders of the judicial system. Often these interpretative matters are not limited only to constructing what is personal data, but more broadly what is technology.

An EU DPA staff member

Most respondents indicated that their authority has had almost no practical experience or concrete cases involving new technologies. For those who have had some experience, the cases related mainly to video surveillance, the use of biometrics, the use of AI and machine learning, and large-scale leaks of personal data. According to these respondents, the main challenges when dealing with AI and new technologies lie in:

  • the access given by the data controller to the DPA inspector, which depends on the level of trust the data controller has in the inspector, given the related trade secrets and sensitivity attached to such technologies;
  • the access to information/premises by non-EU data controllers, and, notably, these being based in non-EU countries (e.g. the United States or China);
  • the feasibility of assessing the proportionality of the use of personal data;
  • the feasibility of assessing the explainability and transparency of the use of such technologies.

Despite the relative absence of concrete cases, the majority of respondents underlined that they mostly feel unprepared when it comes to new technologies. Interviewees identified (1) the lack of time to conduct research, test cases, etc. on specific technologies and (2) a shortage of IT experts among DPA staff with knowledge and experience of new technologies.

Respondents highlighted this as an issue that is preventing them from (1) conducting appropriate research on the tensions between new technologies and data protection, and (2) providing data controllers with appropriate guidance. For instance, two respondents referred to blockchain as an example of a technology that may not be compliant with some provisions of the GDPR. Given that blockchain works with an unchangeable chain of blocks it may not be compliant with the principle of accuracy [100] GDPR, Art. 5(1)(d).
or the right to rectification [101] GDPR, Art. 16.
or erasure [102] GDPR, Art. 17.
. Another respondent emphasised that anonymity is a real issue when dealing with cases involving new technology, as more advanced technologies cannot rely on fully anonymised data. In addition, anonymisation becomes more difficult, as modern techniques allow for tracking anonymised data back to data subjects. At the same time, the GDPR requires data used for the development of these technologies to be anonymous.

A few respondents also noticed unpreparedness on the side of the data controllers regarding new technology, further reinforced by the fact that data controllers do not use tools such as prior consultations and DPAIs.

Several respondents once again made a link to human resource shortages, notably IT specialists, as indicated in Section 1.1.2. Several interviewees believe that the only way to overcome these difficulties is to increase cooperation with the EDPB and with other DPAs from EU Member States and European Economic Area countries. Some respondents highlighted the potential for the EDPB pool of experts to provide DPAs with technological expert knowledge they may lack.

We as an institution would like to deal with new technologies and their impact. Because, in my opinion, it is the aim of the GDPR – to follow the new technologies and to ensure that those do not violate human rights and that we maintain the balance ... However, unfortunately, due to minor disputes between private persons (that represent a large part of complaints received), we are unable as a supervisory authority to examine those cases which really impact the aim of the GDPR.

An EU DPA staff member

Promising practice: Establish a research team dedicated to new technologies within the DPA

The Polish DPA has established a new department – the Department of New Technologies – which is among other things responsible for:

  • preparing opinions on new technological solutions in terms of their impact on the security of personal data processing;
  • analysing and participating in the drafting of opinions and documents on technological developments and their impact on personal data protection within international working groups;
  • drawing up opinions and providing consultations to other DPA departments, within the framework of the matters they deal with, on the processing of personal data in IT systems;
  • drawing up opinions on issues relating to the processing of personal data in IT systems;
  • monitoring new technological developments with regard to data processing and providing information about them to the other departments of the DPA.

 

The Department of New Technologies has its own staff but regularly coordinates with employees from other departments, such as the IT department, which supports the new department with its expert knowledge.

Sources: Poland, Statutes of the Personal Data Protection Office; Poland, Polish DPA Annual Report 2021 (Sprawozdanie z działalności prezesa urzędu ochrony danych osobowych w roku 2021), 2021, pp. 17 and 24.

 

Interviewees were ambivalent about the adequacy of the GDPR to answer such challenges. For most of them, the technological neutrality of the EU data protection legislation is a positive thing. However, a majority of respondents indicated that the GDPR is not sufficient for addressing data protection concerns related to the use of new technologies. One respondent observed, for example, that ‘what is complicated is how to judge whether a new technology fits within the GDPR’. Giving the example of AI, the respondent said that it is difficult to assess whether algorithms that have used personal data for training purposes but do not process personal data once launched would be covered by the scope of the GDPR.

The challenge of applying data protection law to new technologies, such as AI and algorithms, was also highlighted in FRA’s 2020 report on AI and fundamental rights [103]
 FRA, Getting the Future Right – Artificial intelligence and fundamental rights, Publications Office of the European Union, Luxembourg, 2020.
.

So, there is always a rather large gap between the important questions that come up in the context of new technological development and the guidance EDPB can give; I think this gap will always be a large one.

An EU DPA staff member

Several DPAs expressed some uncertainty about what to expect regarding their role in the European Commission’s numerous recently adopted and proposed acts related to data, including the Artificial Intelligence Act [104]
 Commission proposal for a regulation laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) and amending certain Union legislative acts (COM(2021) 206 final).
, the Digital Services Act [105]
 Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a single market for digital services and amending Directive 2000/31/EC (Digital Services Act) (OJ L 277, 27.10.2022, p. 1).
, the Digital Markets Act [106]
 Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act) (OJ L 265, 14.9.2022, p. 1).
, the Data Act [107]
 Commission proposal for a regulation on harmonised rules on fair access to and use of data (Data Act) (COM(2022) 68 final). See also European Parliament, ‘Parliament backs plans for better access to, and use of, data, press release, 2023; European Council, ‘Data Act: Council adopts new law on fair access to and use of data’, press release, 2023.
, the Data Governance Act [108] Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724 (Data Governance Act) (OJ L 152, 3.6.2022, p. 1).
, the interoperability acts [109]
 See European Commission, ‘Interoperability’, for a list of acts related to interoperability, namely Regulation (EU) 2019/818, Regulation (EU) 2019/817, Delegated Regulation (EU) 2021/2103, Implementing Regulation (EU) 2021/2224 and Delegated Regulation (EU) 2021/2222.
and the Single Digital Gateway Act [110]
 Regulation (EU) 2018/1724 of the European Parliament and of the Council of 2 October 2018 establishing a single digital gateway to provide access to information, to procedures and to assistance and problem-solving services and amending Regulation (EU) No 1024/2012 (OJ L 295, 21.11.2018, p. 1), as amended on 24 September 2023.
. Several interviewees also expressed concern that the relevant legal frameworks may be fragmented, potentially resulting in contradictory legal requirements and conflicts with other national regulatory authorities.

In July 2022, the EDPB and EDPS expressed similar concerns about the Commission’s proposal for a regulation on the European Health Data Space: ‘Regarding the governance model created by the proposal, the tasks and competencies of the new public bodies need to be carefully tailored, particularly taking into account the tasks and competencies of national supervision authorities, the EDPB and the EDPS in the field of processing personal (health) data. Overlap of competencies should be avoided and fields of and requirements for cooperation should be specified’ [111]
 EDPB and EDPS, Joint Opinion 03/2022 on the proposal for a regulation on the European Health Data Space, 2022, p. 4.
.

It also becomes more and more complex with the upcoming new legal instruments, for example with the new legal acts (the Artificial Intelligence Act, the Data Governance Act, the Data Act, etc.) for which the DPA will certainly play a role even though such role is not yet exactly clear yet. Our challenge is: how can the DPA give proper supervision on this?

An EU DPA staff member

Promising practice: DPAs coordinating the supervision of AI with other national regulators

The Dutch DPA has had a coordinating role in the supervision of algorithms since 2023. This role involves coordinating the work of various agencies with competencies in supervising algorithms and AI. Coordinating duties include identifying and analysing cross-sector risks, promoting a joint interpretation of standards in supervisory practice and establishing a public register for AI algorithms in the Netherlands. It will also foster a better understanding of data protection legislation and may prevent misinterpretations of new developments, such as algorithms, by other regulators.

Source: The Netherlands, Dutch Data Protection Authority (Autoriteit Persoonsgegevens), ‘Algorithm Supervisor Establishment Note’ (‘Inrichtingsnota algoritmetoezichthouder’), 2022.