GDPR Report 2024 - Cover
Miha Creative/Adobe Stock
11
June
2024

GDPR in practice – Experiences of data protection authorities

Data protection rules protect privacy and prevent personal information from misuse. When the general data protection regulation (GDPR) came into force in 2018, it strengthened the role of data protection authorities. These supervisory bodies are the key enforcers of the fundamental right of protection of personal data. This report analyses the challenges they face in the GDPR implementation. The findings complement the European Commission's forthcoming evaluation of the GDPR.


The Board shall ensure the consistent application of this Regulation. To that end, the Board shall, on its own initiative or, where relevant, at the request of the Commission, in particular: … draw up guidelines for supervisory authorities …; issue opinions on draft decisions of supervisory authorities ...; promote the cooperation and the effective bilateral and multilateral exchange of information and best practices between the supervisory authorities; promote common training programmes and facilitate personnel exchanges between the supervisory authorities …; promote the exchange of knowledge and documentation on data protection legislation and practice with data protection supervisory authorities worldwide …; maintain a publicly accessible electronic register of decisions taken by supervisory authorities and courts on issues handled in the consistency mechanism.

Article 70(1)(k), (t), (u), (v), (w) and (y) of the GDPR

The creation of the EDPB as an exchange platform for DPAs to develop guidance and to cooperate is not an innovation of the GPDR: national DPAs have been meeting since the 1995 directive entered into force through the so-called Article 29 Working Party. However, the GDPR gave the EDPB a separate legal personality, as it now operates as an independent body of the EU, and it broadened the tasks and powers allocated to the board and its secretariat.

In its first evaluation of the GDPR, the European Commission emphasised the key role that the EDPB must play in the new EU data protection accountability framework, which has the notions of harmonisation and cooperation at its core [112]
 Commission communication – Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition – Two years of application of the general data protection regulation (COM(2020) 264 final).
. These notions are central to the feedback FRA received when discussing with DPA staff members how they assessed their collaboration and the role of the EDPB. In the ‘Statement on enforcement cooperation’ [113]
 EDPB, Statement on enforcement cooperation, 28 April 2022.
adopted in April 2022, the EDPB demonstrated its commitment to promoting harmonisation to enhance cooperation in the GDPR enforcement framework.

Interviewees agreed that strong cooperation between DPAs ensures swift enforcement and interpretation of the GDPR. Some respondents identified a need for a common methodology to help overcome practical issues related to the procedures to follow when engaging in cooperation with other DPAs. In particular, there is a need for information on best practices and guidance that would help to ensure smooth cooperation between authorities.

The responses received by FRA concerning the EDPB were mostly positive. Several interviewees – notably from smaller Member States – said that the EDPB is playing a positive role in reinforcing the cooperation, exchanges and discussions between them. Specifically, they said that the pilot exchange programme [114]  EDPB, Annual Report 2019, 2020, which includes details of the 2023-2024 work programme; and EDPB plenary minutes. is a good source of expertise from more experienced DPAs. The EDPB’s secondment programme was established in 2019. Paused during the COVID-19 pandemic, it started again in a pilot phase in 2022 and will be deployed throughout 2023 and 2024. The programme aims to facilitate the exchange of staff members, for a short period of time, between authorities.

The EDPB works as a discussion forum, where the national supervisory authorities can share information and discuss topics of interest such as national practices, differences in the national procedural rules, and protocols.

An EU DPA staff member

The second aspect of the EDPB that was praised by interviewees is the number of opinions, guidelines and guidance documents it produces (see Figure 1). Several interviewees underlined how useful the guidance is in supporting their work, highlighting some of them in particular. The usefulness of the EDPB’s guidelines on the enforcement of sanctions and fines was often mentioned, but also its guidelines on the transfer of data to non-EU countries and those on measures to supplement transfer tools to ensure compliance with the EU’s level of protection of personal data. One interviewee also mentioned an example of positive collaboration with the EDPB in a case where they asked for further information on a procedure that lacks detail in the GDPR. Another interviewee highlighted the work conducted within the EDPB subgroup as ‘becoming more and more important for day-to-day enforcement issues’. Some interviewees mentioned that they often use, or refer to, EDPB guidelines to inform data controllers. Finally, some interviewees also highlighted the EDPB initiative to create a pool of experts, allowing DPAs to call on experts with specific professional backgrounds to complement their work.

For some interviewees, the EDPB’s work in this regard is particularly important, as it supports, from a more global perspective, the aim of the GDPR to effectively harmonise data protection across the EU, despite Member States’ procedural differences. One interviewee said that ‘the EDPB guidelines allow [us] to find a common starting point’.

Figure 1 – EDPB documentation published, 2021 to 2023

Number of opinions, general guidance (including guidelines) and binding decisions published by the EDPB, per year.

A graph with green and blue bars

Description automatically generated

Sources: EDPB, ‘Guidelines, recommendations, best practices, 2024; EDPB, ‘Binding decisions, 2024; EDPB, ‘Opinions, 2024.

 

The EDPB does a great job of establishing a uniform approach; however, the lack of an EU-level uniform procedural code is still an obstacle that even the EDPB cannot overcome.

An EU DPA staff member

Several interviewees praised the work of the EDPB while noting that the secretariat is understaffed. One said: ‘The secretariat is generally found to be reliable, neutral and unbiased’. Interviewees said that the secretariat provides DPAs with ‘a very high level of expertise’, and, in short, that ‘the role of the EDPB secretariat is the very heart of the EDPB’.

The EDPB secretariat does a great job. It facilitates national data protection authorities in cooperation with tools. It is understaffed, but the people working there are very competent and dedicated.

An EU DPA staff member

The EDPB secretariat is key and has so far duly responded to its mission despite its own understaffing problems.

An EU DPA staff member

One interviewee also said that, while ‘the system is not perfect and needs some fine-tuning, the EDPB is proactive in seeking feedback, comments and proposals for improvements’.

However, despite interviewees’ generally positive views on the EDPB, several of them also highlighted that they expect the EDPB to reinforce its role in several aspects. The next section outlines recommendations proposed by some of the interviewees.

While the majority of respondents generally praised the numerous guidelines produced by the EDPB as a useful tool to support both their work and their awareness-raising activities, some interviewees suggested that these could be improved by enhancing their quality and developing more practical (less theoretical/broad) guidance. One interviewee mentioned that, in their experience, the guidelines are ‘massive’ and ‘unapproachable for audiences without legal training’.

Practically, the data controller does not know how to implement what the EDPB recommends.

An EU DPA staff member

The guidelines of the EDPB are there, but there might be small details in cases examined at the national level that differentiate a case from the other and can change the entire picture.

An EU DPA staff member

The EDPB has issued opinions that are interesting and useful to some extent, but, when you see their examples, they are rather easy cases and do not reflect what usually happens in practice.

An EU DPA staff member

The issue of resources was also raised by several DPA staff members when discussing the EDPB. While the board is praised for the amount of work it produces, several interviewees voiced concerns about the considerable amount of additional work for DPAs that the EDPB’s related tasks represent, stating that they invest ‘heavily’ in the EDPB’s work. This was raised not only by interviewees from smaller EU Member States; however, interviewees from smaller Member States expressed regret that their current size is preventing them from participating in all EDPB activities as they are expected to.

Due to the lack of resources, the DPA does not get as involved in the cross-border cases and into EDPB work as it could.

An EU DPA staff member

Some interviewees highlighted the inner bureaucracy of the board, which affects the speed of its processes, with one mentioning up to ‘400 meetings’ to discuss similar topics. One interviewee believes that ‘during the elaboration of the EDPB documents too much attention is paid to some petty issues’.

The EDPB could work more to make the processes more effective in their entirety, everything from plenary meetings to more strategic discussions of the large problems facing the EU.

An EU DPA staff member

Some interviewees were more pessimistic about the ability of the EDPB to overcome the inherent complexities of its tasks. One interviewee insisted that the significant differences between DPAs, notably in terms of human resources, cannot be overcome through cooperation within the board.

Some interviewees suggested ways of furthering the positive impact of the board. For several of them, the Internal Market Information System (i.e. the IT platform helping national authorities across the EU to cooperate and exchange information) is not user-friendly enough and should be revised. Some interviewees also emphasised that the case database should be more consistent and could also include statistics/metrics on the DPAs’ work. Finally, one interviewee believed that exchanges within the EDPB could be more transparent.

The current case database available on the EDPB’s website is sporadic and does not necessarily contain all decisions a national DPA may find relevant and important.

An EU DPA staff member