GDPR Report 2024 - Cover
Miha Creative/Adobe Stock
11
Juni
2024

GDPR in practice – Experiences of data protection authorities

Data protection rules protect privacy and prevent personal information from misuse. When the general data protection regulation (GDPR) came into force in 2018, it strengthened the role of data protection authorities. These supervisory bodies are the key enforcers of the fundamental right of protection of personal data. This report analyses the challenges they face in the GDPR implementation. The findings complement the European Commission's forthcoming evaluation of the GDPR.


Each supervisory authority shall act with complete independence in performing its tasks and exercising its powers in accordance with this Regulation.

Article 52(1) of the GDPR

EU law safeguards DPAs’ complete independence. The latter is enshrined in the EU Charter of Fundamental Rights [11]
 EU, Charter of Fundamental Rights of the European Union (OJ C 326, 26.10.2012, p. 391), Art. 8(3).
and the Treaty on the Functioning of the European Union [12] EU, Consolidated versions of the Treaty on European Union and the Treaty on the Functioning of the European Union (OJ C 326, 26.12.2012, p. 1), Art. 16(2).
as a fundamental guarantee for ensuring enforcement of the right to data protection. The 1995 directive on data protection stated that DPAs ‘shall act with complete independence when exercising the functions entrusted to them’ [13]
 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31), Art. 28(1).
, but it did not define this concept. The GDPR seeks to strengthen this essential requirement and sets out guarantees for the independent of DPAs [14]
 GDPR, Art. 52.
, building on the jurisprudence of the Court of Justice of the European Union (CJEU) [15]
 See CJEU, C-210/16, Wirtschaftsakademie, 5 June 2018; CJEU, C-362/14, Maximillian Schrems v Data Protection Commissioner, 6 October 2015; CJEU, C-288/12, European Commission v Hungary, 8 April 2014; CJEU, C-614/10, European Commission v Republic of Austria, 16 October 2012; CJEU, C-518/07, European Commission v Germany, 9 March 2010. For more information, see FRA, Council of Europe and EDPS, Handbook on European Data Protection Law 2018 edition, Publications Office of the European Union, Luxembourg, 2018.
. According to Articles 52 and 53 of the GDPR, DPAs should be granted [16]
 Art. 52(2), (3), (4), (5) and (6) of the GDPR provide for conditions that are necessary for DPAs’ independence. Art. 53 governs the appointment of DPA members.
:

  • freedom from external influence on their leaders, whether direct or indirect, for example freedom from governments’ or other third parties’ influence;
  • the opportunity to ensure the integrity and impartiality of their leadership,meaning that DPA members should not engage in any actions or occupations that are incompatible with their duties;
  • the financial, human and technical resources, premises and infrastructure necessary for the effective performance of their tasks and exercising of their powers, including in the context of mutual assistance, cooperation and participation in the EDPB;
  • their own staff chosen by and under the sole supervision of the DPA member(s);
  • financial control that doesnot affect their independence;
  • separate annual public budgets, which may be part of Member States’ budgets;
  • transparency in thenomination of DPA members [17]
     For an analysis of Art. 52 of the GDPR, see FRA, Council of Europe and EDPS, Handbook on European Data Protection Law – 2018 edition, Publications Office of the European Union, Luxembourg, 2018, Chapter 5.1.
    .

Member States must ensure that each DPA is endowed with the above elements to enable them to work completely independently. DPAs’ independence has been a central focus of FRA research over the years, as an essential aspect of the enforcement of the fundamental right of protection of personal data [18]
 FRA, Data Protection in the European Union: The role of national data protection authorities – Strengthening the fundamental rights architecture in the EU II, Publications Office of the European Union, Luxembourg, 2010; FRA, Council of Europe and EDPS, Handbook on European Data Protection Law – 2018 edition, Publications Office of the European Union, Luxembourg, 2018, Chapter 5; FRA, Opinion of the European Union Agency for Fundamental Rights on the proposed data protection reform package, Vienna, 2012, Section 4.2.1.
. In 2010, FRA found that normative and practical obstacles hindered DPAs’ capacity to act fully independent of governments, before the adoption of the GDPR [19]
 FRA, Data Protection in the European Union: The role of national data protection authorities – Strengthening the fundamental rights architecture in the EU II, Publications Office of the European Union, Luxembourg, 2010; FRA, Opinion of the European Union Agency for Fundamental Rights on the proposed data protection reform package, Vienna, 2012, Chapter 4.1.1.
. These obstacles included governments’ financial control over DPAs’ budgets, insufficient and inadequate human, technical and financial resources to perform functions, non-transparent member appointment procedures and interference in the performance of certain duties. In 2014, FRA’s research looking into access to data protection remedies found that these findings were still relevant for the large majority of DPAs [20]
 FRA,Access to data protection remedies in EU Member States, 2014, Chapter 4.2.
. Most DPAs covered by the 2014 research stated that they were underfunded and understaffed [21]
 FRA, Access to data protection remedies in EU Member States, 2014, p. 46.
. Their budget did not allow for high-quality specialists to be hired and new, cutting-edge technology to be acquired for the collection and analysis of evidence. The lack of financial and human resources had a negative impact on the quality and quantity of their work and limited their ability to control and sanction data protection violations [22]
 FRA, Access to data protection remedies in EU Member States, 2014, pp. 47–49.
, ultimately affecting their independence.

The independence of the supervisory authority and its members, as well as of staff, from direct or indirect external influences, is fundamental in guaranteeing full objectivity when deciding on data protection matters.

FRA, Council of Europe and EDPS (2018), Handbook on Data Protection Law, pp. 191–194.

This chapter presents the challenges that most interviewees stated regarding the implementation of the GDPR’s guarantees of independence. Section 1.1 focuses on Member States’ requirement to adequately resource DPAs (Article 52(4), GDPR). It examines whether respondents consider that their DPA has sufficient financial and human capacities to perform the tasks set out in Article 57 of the GDPR effectively and fully independent from external influence. Section 1.1.1 looks into adequacy of financial resources, while Section 1.1.2 examines the adequacy of staffing. Section 1.2 discusses the external influence of governments or parliaments, or other external control reported to FRA in this research, including in the allocation of budgets.


Each Member State shall ensure that each supervisory authority is provided with the human, technical and financial resources, premises and infrastructure necessary for the effective performance of its tasks and exercise of its powers, including those to be carried out in the context of mutual assistance, cooperation and participation in the Board.

Article 52(4) of the GDPR

Article 52 of the GDPR sets out guarantees for the independence of DPAs. Among those guarantees, adequate financial, human and technical resources are critically important for DPAs to be able to perform their tasks effectively and fully independent of external influence. The first European Commission evaluation of the GDPR identified a positive trend in DPAs’ financial and human resources, with ‘an overall increase of 42 % in staff and 49 % in budget for DPAs taken together in the EEA’ [23]
 Commission communication – Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition – Two years of application of the general data protection regulation (COM(2020) 264 final), p. 6.
. Nonetheless, the Commission emphasised that differences between DPAs remained, and that the resource situation was ‘not satisfactory overall’ [24]
 Commission communication – Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition – Two years of application of the general data protection regulation (COM(2020) 264 final), p. 6.
.

Data protection authorities play an essential role in ensuring that the GDPR is enforced at the national level and that the cooperation and consistency mechanisms within the Board function effectively, including, in particular, the one-stop-shop mechanism for cross-border cases. Member States are therefore called upon to provide them with adequate resources as required by the GDPR.

Commission communication – Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition – Two years of application of the general data protection regulation (COM(2020) 264 final)

 

Definition: resources

For the purpose of this report, the term ‘resources’ covers financial resources and technological assets (such as information technology assets) allocated to DPAs, as well as human resources (employees working at DPAs and their expertise).

 

Following the Commission’s first evaluation, the European Parliament issued a resolution calling upon ‘… Member States to comply with their legal obligation under Article 52(4) of the GDPR to allocate sufficient funds to their DPAs to allow them to carry out their work in the best way possible and to ensure a European level playing field for the enforcement of the GDPR’  [25] Commission communication – Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition – Two years of application of the general data protection regulation  (COM(2020) 264 final)
.

The EDPB has gathered data on the availability of resources of DPAs over the years, showing that they are generally inadequate [26]
 EDPB, Overview on resources made available by Member States to the data protection supervisory authorities,2022, p. 5; EDPB, Overview on resources made available by Member States to the data protection authorities and on enforcement actions by the data protection authorities, 2021. See also Commission staff working document accompanying Commission communication – Data protection rules as a pillar of citizens empowerment and EUs approach to digital transition – Two years of application of the general data protection regulation (SWD(2020) 115 final), Chapter 2.4; Council of Europe, Report on the Funding of Data Protection Authorities, Strasbourg, 2021.
. In its contribution to the forthcoming European Commission evaluation of the GDPR, the EDPB showed that, while budgets and numbers of staff have generally increased in percentage terms for almost all DPAs [27]
 According to EDPB data and analysis from 2023 included in the EDPB’s contribution to the European Commission’s report on the application of the GDPR, three DPAs considered that their human, financial and technical resources were sufficient, four DPAs stated that they had sufficient financial and technical resources but insufficient human resources; two DPAs reported that their human and financial resources were adequate; and three DPAs indicated sufficient technical resources. In one Member State, the budget was reduced. See EDPB, Contribution of the EDPB to the report on the application of the GDPR under Article 97,2023, p. 33.
, most DPAs consider that they are ‘insufficient, from a human, technical and financial perspective’ [28]
 EDPB (2023), Contribution of the EDPB to the report on the application of the GDPR under Article 97, 2023, p. 33.
to perform the tasks listed under Article 57 of the GDPR [29]
 EDPB (2023), Contribution of the EDPB to the report on the application of the GDPR under Article 97,2023, Section 4.4.
.

 … the EDPB and supervisory authorities (SAs)are facing a rapidly evolving technological and legal landscape that not only requires the performance of the tasks envisaged in the GDPR, but also of new tasks at national and EU level, more cooperation among the SAs and more involvement of the EDPB. … most of the SAs and the EDPB consider that their resources are insufficient, from a human, technical and financial perspective. In this respect, very specialised technical knowledge is required, in particular with regard to new and emerging technologies, while the financial resources available to SAs and the EDPB cannot compete with those of the private sectors. Therefore, it is of the utmost importance that all SAs are provided with sufficient resources by the Member States to carry out their tasks effectively.

Contribution of the EDPB to the report on the application of the GDPR under Article 97, 15 December 2023

The overwhelming majority of DPA representatives participating in this research confirmed the overall inadequacy of DPAs’ financial, human and technical resources to perform the entirety of the tasks that the GDPR requests of the DPAs. Despite nominal increases, most respondents claimed that funding and staff were insufficient to cope with an increased workload and growing demands in multiple areas of their work. Interviewees referred to three areas that their DPA found particularly challenging to handle within its existing capacity.

 

First, the most frequently cited concern was the substantial increase in workload resulting from managing a significant volume of complaints and data breach notifications, encompassing minor issues, following the implementation of the GDPR. This was previously identified as an issue in FRA’s 2020 and 2021 Fundamental Rights Reports [30]
 FRA, Fundamental Rights Report – 2020,Publications Office of the European Union, Luxembourg, 2020, Chapter 6.3.2; FRA, Fundamental Rights Report – 2021, Publications Office of the European Union, Luxembourg, 2021, Chapter 7.1.
. Some interviewees linked this surge in workload to the GDPR’s requirement that DPAs have to respond to every complaint submitted, even if trivial [31] GDPR, Art. 57(f) tasks DPAs to handle complaints within a reasonable time; Art. 77 guarantees the data subject’s right to lodge a complaint with a DPA and to receive information on the progress and outcome of the claim from the DPA.
. Respondents from a large number of DPAs variously referred to complaint backlogs and long processing times as a consequence of a lack of resources to handle them. In two cases, respondents stated that their DPA was unable to comply with the GDPR’s requirement to address each and every individual complaint within its current capacity [32]
 GDPR, Art. 57(1)(f), establishes that DPAs should handle complaints within a reasonable time; Art. 77 guarantees the data subject’s right to lodge a complaint  a DPA and to receive information on the progress and outcome of the claim from the DPA;  Art. 78(2) prescribes the right to an effective remedy when a DPA does not handle a complaint or does not inform a data subject within 3 months.
. Section 2.2 will examine this aspect in more detail.

In my view, it is evident that we lack the necessary financial and human resources. Over the last 2 years, claims have increased by 80 %. This year only, 37 % more complaints were lodged compared to the previous year. Investigations are also getting more complex for the DPA to carry out. The total number of claims will most likely exceed 20 000, which is the highest record ever reached at the DPA.

An EU DPA staff member

Our main problem is the lack of resources, which leads to enormous backlogs. Anyone can file a complaint under the GDPR easily, which is good for the data subjects but complicated for DPAs. We cannot handle hundreds of complaints each year, in a timely and appropriate manner.

An EU DPA staff member

Second, according to several interviewees, the fast growth of online digital platforms and the development of increasingly complex data-processing technologies require DPAs to be well resourced and technically equipped to properly and in a timely manner monitor the risks that such digital and technological advancements might pose to the protection of personal data, as discussed further in Section 3.5. Several respondents stated that this is a highly resource-intensive area, requiring technical expertise and adequate information technology (IT) equipment, which underfunded DPAs are unable to properly ensure within their current capacity. Some DPA staff also emphasised the influence of online digital platforms on their workload. Data subjects or groups of data subjects have been increasingly turning to social media to voice data protection concerns related to public policies or emerging technologies in areas such as health, security and education. Monitoring and responding to such queries takes resources and time away from other tasks, interviewees said.

 … the GDPR places an obligation on Member States to provide their national authorities with sufficient resources to carry out their duties. It’s not only a question of numbers, staff and budget, it is about meeting our ambitions for the regulation of the digital ecosystems. Effective enforcement in the digital world means independent authorities are provided with effective means to achieve this goal. For several years now the CNIL has seen its resources increasing, we are on the right track, but it needs to be amplified given the many challenges ahead. And this is certainly true for all EU DPAs; we count on the European Commission to ensure that all Member States comply with their obligations in this regard.

Marie-Laure Denis, Chair of the National Commission on Informatics and Liberty, The Future of Data Protection – Effective enforcement in the digital world, keynote speech at the European Data Protection Supervisor conference, 17 June 2022

Third, several respondents mentioned that EU or national legislation has tasked DPAs with additional work in several areas, without increasing their budget accordingly. For example, in the area of migration and border control, EU law extended the oversight role of DPAs to new EU IT systems [33]
 For an overview of the IT systems, see FRA, Handbook on European law relating to asylum, borders and immigration, Publications Office of the European Union, Luxembourg, 2020, Chapter 2.
, such as the Entry/Exit System [34]
 Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011 (OJ L 327, 9.12.2017, p. 20).
, which is expected to collect and process the biometric data of millions of people entering the EU for short-term visits from the second half of 2024. In the area of communication and technology, the Digital Services Act regulating online intermediary services [35]
 Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a single market for digital services and amending Directive 2000/31/EC (Digital Services Act) (OJ L 277, 27.10.2022, Article 1).
, including very large online platforms and search engines with more than 45 million users per month in the EU, may create new responsibilities for DPAs in some Member States [36]
 According to Article 49(2) of the Digital Services Act, Member States may assign specific tasks to other competent authorities, in addition to the appointed Digital Service Coordinator, who remains responsible for ensuring the supervision of providers of intermediary services. See Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a single market for digital services and amending Directive 2000/31/EC (Digital Services Act) (OJ L 277, 27.10.2022, p. 1). For example, in Italy the national law explicitly envisages a cooperation between the Digital Service Coordinator (the Authority for Communications) and the DPA; See Article 15 of Law-Decree No. 123/2023 of 16 September 2023 on digital security of children. In the Netherlands and in France, it is proposed that the DPA, together with other authorities, will be the competent authority responsible for the supervision of providers of intermediary services and the enforcement of the DSA. For the Netherlands, see Article 3.1. of Proposal of Law 36531-2, proposed on 2 April 2024. For France, see Article 25 of the project of law number 175 of 17 October 2023.
. Similarly, EU legislation under negotiation at the time of the research is also expected to task DPAs with further roles. Interviewees mostly referred to the proposal for an Artificial Intelligence Act [37] Commission proposal for a regulation laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) and amending certain Union legislative acts (COM(2021) 206 final).
, which may task DPAs with submitting annual reports on the use of real-time remote biometric identification systems used in public spheres for law enforcement purposes [38] Artificial Intelligence Act, Article 5(5).
. In addition, DPAs might also be responsible for the supervision of artificial intelligence (AI) regulatory sandboxes, which will be used to test the use of AI technologies [39] Artificial Intelligence Act, Article 53(2).
. Furthermore, the new pact on migration and asylum contains several pieces of legislation, in relation to which DPAs will have to provide supervision and advice. For example, in light of Article 44 of the Eurodac regulation adopted on 14 May 2024, DPAs will need advice from people with sufficient knowledge of biometric data to be able to perform their supervisory role [40]
 Regulation (EU) 2024/1358 of the European Parliament and of the Council of 14 May 2024 on the establishment of ‘Eurodac’ for the comparison of biometric data in order to effectively apply Regulations (EU) 2024/1351 and (EU) 2024/1350 of the European Parliament and of the Council and Council Directive 2001/55/EC and to identify illegally staying third-country nationals and stateless persons and on requests for the comparison with Eurodac data by Member States’ law enforcement authorities and Europol for law enforcement purposes, amending Regulations (EU) 2018/1240 and (EU) 2019/818 of the European Parliament and of the Council and repealing Regulation (EU) No 603/2013 of the European Parliament and of the Council, (OJ L, 2024/1358, 22.5.2024).
. Under Article 10 of the screening regulation adopted on 14 May 2024, DPAs will also need to support national independent mechanisms, which Member States will have to set up to monitor compliance when screening new arrivals and when examining their asylum requests at borders [41]
 Regulation (EU) 2024/1356 of the European Parliament and of the Council of 14 May 2024 introducing the screening of third-country nationals at the external borders and amending Regulations (EC) No 767/2008, (EU) 2017/2226, (EU) 2018/1240 and (EU) 2019/817, (OJ L, 2024/1356, 22.5.2024).
.

The following sections describe how respondents believe that resource constraints affect DPAs’ ability to perform their regulatory tasks in an effective and independent manner.

In 2023, 20 DPAs considered their funding to be insufficient, according to data gathered by the EDPB [42]
 EDPB, Contribution of the EDPB to the report on the application of the GDPR under Article 97, 2023, p. 33.
. Other studies and reports have also documented the inadequacy of DPAs’ financial resources to be able to perform their tasks over the years [43]
 EDPB,Contribution of the EDPB to the report on the application of the GDPR under Article 97, 2023, pp. 15 and 31; EDPB, Overview on resources made available by Member States to the data protection authorities and on enforcement actions by the data protection authorities,2022, p. 5; EDPB, Overview on resources made available by Member States to the data protection supervisory authorities, 2021. See also Commission staff working document accompanying Commission communication – Data protection rules as a pillar of citizens empowerment and EUs approach to digital transition – Two years of application of the general data protection regulation (SWD(2020) 115 final), Chapter 2.4; Council of Europe, Report on the Funding of Data Protection Authorities, Strasbourg, 2021.
.

A large majority of interviewees stated that, overall, DPAs’ budgets were increased after the entry into force of the GDPR. Nonetheless, this increase has not enabled DPAs to expand their institutional capacity sufficiently to carry out all the tasks and exercise all the powers set out in Articles 57 and 58 of the GDPR [44]
 Art. 57 of the GDPR outlines DPAs’ tasks, such as monitoring and enforcing the application of the GDPR, promoting public awareness, providing advice to the national parliament and the government, and dealing with complaints lodged by data subjects. Art. 58 lays down the investigative, supervisory, authorisation and advisory powers of DPAs.
. This was mentioned repeatedly during the interviews, including by interviewees working in DPAs that have received significant increases in budget and staff in the last few years. In two DPAs, respondents had diverging views on this issue: while legal officers stated that they were unable to initiate certain investigations on their own initiative due to lack of resources, their managers considered that resources were sufficient.

Insufficient funding was the main cause of staffing shortages (as Section 1.1.2 further explains) and lack of adequate technical equipment. However, the latter is necessary to conduct investigations and supervise innovative technologies. Some interviewees illustrated this by highlighting that, currently, they cannot step up the digitalisation of complaint forms, overhaul their databases or purchase portable forensics devices to carry out on-site investigations.

Some respondents considered national resource audits a valuable tool to assess whether DPAs are equipped with the resources they need to function according to their tasks and mandate, as the box Promising practice: audits and external evaluations assessing adequacy of resources and needs explains.

Promising practice: audits and external evaluations assessing adequacy of resources and needs

In some Member States, the government has commissioned resource audits to assess whether its DPA has the necessary resources to perform its tasks under the GDPR. In the Netherlands, the Ministry of Justice commissioned three studies, which confirmed the financial challenges that the Dutch DPA was facing. Similarly, in Lithuania, the Ministry of Justice carried out a staff audit in 2021, which revealed that the DPA would need to double its number of personnel to fulfil its mandate and perform the tasks assigned by the GDPR. In Cyprus, several studies have documented the increased work volume of the DPA. This was attributed not only to the GDPR but also to increased awareness of data protection issues among the public, who increasingly contact the DPA.

Sources: Interviews with staff of the Dutch, Lithuanian and Cypriot DPAs. Publicly available source (the Netherlands): KPMG, Research Tasks and Financial Resources at AP (Onderzoek taken en financiële middelen bij AP), 2020.

 

The GDPR requires that DPAs are adequately staffed [45]
 GDPR, Art. 52(4).
and that ‘each Member State shall ensure that each supervisory authority chooses and has its own staff which shall be subject to the exclusive direction of the member or members of the supervisory authority concerned’ (Article 52(5), GDPR) [46]
 GDPR, Art. 52(5).
.The extent to which DPAs are able to exercise and enjoy independence regarding all aspects of their staff is also critical to their ability to carry out their functions effectively and independently. In 2012, in European Commission v Republic of Austria, the European Court of Justice clarified that ‘… the attribution of the necessary equipment and staff to such authorities must not prevent them [DPAs] from acting “with complete independence” in exercising the functions entrusted to them within the meaning of … Directive 95/46’ [47]
 CJEU, C-614/10, European Commission v Republic of Austria, 16 October 2012, paragraph 41.
.

Since 2010 [48]
 FRA, Access to data protection remedies in EU Member States, Publications Office of the European Union, Luxembourg, 2014, p. 9; FRA, Data Protection in the European Union: The role of national data protection authorities – Strengthening the fundamental rights architecture in the EU II,Publications Office of the European Union, Luxembourg, 2010, Chapter 4.1.1.
, FRA has documented inadequate staffing levels at most EU DPAs. The EDPB has also reported over the years that an overwhelming majority of DPAs do not possess the necessary human resources to carry out mandatory activities under the GDPR – with 24 DPAs stating that they were understaffed in 2022 and 23 DPAs stating the same in 2023 [49]
 See EDPB, Contribution of the EDPB to the report on the application of the GDPR under Article 97, 2023, p. 33;EDPB, Overview on resources made available by Member States to the data protection supervisory authorities, 2022, p. 5; EDPB, Overview on resources made available by Member States to the data protection authorities and on enforcement actions by the data protection authorities, 2021.
.

Most respondents stressed the unavailability of sufficiently qualified personnel to perform DPAs’ functions properly. Interviewees from DPAs in only six Member States considered that their DPA had the necessary staffing level to effectively carry out its mandatory functions.

Several challenges related to securing an adequate number of qualified staff were mentioned to FRA. Understaffing was often linked to underfunding by the state. In a couple of Member States, respondents noted with concern that other national agencies and bodies with a supervision mandate were better staffed than the DPA.

Inadequate staffing also results in gaps in technical and legal expertise. This expertise is crucial to addressing challenges stemming from the use of new technologies to perform complex data processing – such as data-intensive online platforms. In almost 10 Member States, interviewees stressed that there were too few information and communications technology (ICT) experts.

Specialised expertise was necessary, for example, when analysing the proposal for transferring public administration data into the cloud. Analysing this governmental ordinance required a thorough understanding of the regulated aspects from a technical perspective.

An EU DPA staff member

In at least eight Member States, interviewees reported that it is difficult to hire qualified professionals with adequate data protection knowledge and ICT expertise, particularly if recruitment is carried out through general public administration competitions, which several DPAs have to rely on when selecting new staff. Insufficient legal expertise affects DPAs’ ability to deliver on their advisory function, to the point that, in one Member State, the DPA referred data controllers to EDPB guidelines when providing advice on new technological developments in almost every case.  Chapter 3 of this report further explores the impact of inadequate staffing levels on DPAs’ advisory role, while Chapter 4 looks in more detail at DPAs’ capacity to effectively contribute to EDPB activities.

These data protection topics are very specific and are not widely known. It is not like hiring professionals in the area of accounting or human resources; there is not a broad availability.

An EU DPA staff member

Recruitment and retention of qualified staff was found to be a major challenge which was repeated by multiple interviewees.  Low remuneration and less advantageous working conditions were often cited as the main reasons. In some cases, DPAs are limited by national recruitment rules from offering competitive remuneration. In at least eight DPAs, interviewees stressed that ICT specialists with high salary expectations would move to the private sector after being trained at the DPA. Attracting and retaining competent staff in this field was highlighted as a key issue in Member States with an overall shortage of ICT experts. One interviewee lamented the fact that specialist staff working at the DPA were not allowed to receive higher wages, as staff working for some other public agencies did.

The main issue we have faced is the low pay of staff over the last 4–5 years. We experienced high personnel turnover in the complaints and investigations unit. Only two colleagues have been in the DPA for more than 6 years. In the past 2 years, we have seen a 30 % increase in staff, but some colleagues have left within a year of employment. The main reason, that they share informally, relates solely to remuneration, which is too low for the expected expertise and workload.

An EU DPA staff member

The DPA makes great effort to attract skilled workers. The DPA competes for experts with the private sector – during both recruitment and retaining processes. The DPA’s experts are highly valued employees for private companies. The DPA has two IT experts, which is insufficient.

An EU DPA staff member

The DPA often hires personnel without previous experience. They receive training, and they are in demand in the private sector within 3–4 years and often leave, especially lawyers.

An EU DPA staff member

In a few Member States, it was observed that staff recruited from the public administration pool seek to move to other public institutions shortly after their recruitment. They often move to services that better match their education and professional backgrounds. In general, the extreme workload affects staff performance and mental well-being in some Member States, it was reported to FRA. Legal experts often struggle to handle the high number of complaints and carry out investigations in complex areas of law. Often, backup systems to cover absences are not in place; as a consequence, many professionals leave.

To address insufficient human resources, staff are obliged to optimise performance and invest more time beyond regular working hours. This, however, is not necessarily a good practice.

An EU DPA staff member

Several staff members from the DPA fell sick with burnout, which peaked last year, leading to long-term absences. The colleagues, who remained in service, experienced stress-related consequences (such as weight gain).

An EU DPA staff member

Constant changes in personnel hinders DPAs’ ability to develop a consistent approach to exercising their mandate. Staff turnover may also affect their overall autonomy, objectivity and coherence when exercising their powers. For example, several interviewees mentioned that regular participation in EDPB activities was disrupted by frequent staff changes. Others said that this issue limits their ability to supervise evolving technological developments. Finally, the regular transfer of DPA employees to other public services or the private sector may also affect DPAs’ perceived independence.

It is hard to find a data protection specialist without any links with some stakeholders in the field and who would not be in a conflict of interest.

An EU DPA staff member

Adequacy of human resources is the major shortcoming. The recruitment system publishes the posts and recruits the staff, and a few months later, after investing in his/her training, the officer moves to another post in the civil service. The only solution is to republish the vacancy and reinvest in a new officer. The DPA’s performance is not negatively impacted, but, with more permanent, experienced officers, the authority could have a greater role in the EDPB subgroups.

An EU DPA staff member

Several DPAs were forced to prioritise certain tasks over others and were not able to fulfil their entire mandate as a result of resource constraints. Complaints handling is usually prioritised, according to many interviewees [50]
 For further details on complaints handling under the GDPR, see Art. 57(1)(f), Art. 77 and Art. 78(2).
. Interviewees said that a lack of resources meant that it was difficult to perform certain tasks, such as carrying out rights-awareness campaigns; providing advice on GDPR compliance to legislators; and providing information to data subjects about their rights and to private bodies about their obligations. Chapter 3 of the report examines this in more detail. Interviewees in several Member States also highlighted that limited time and reduced capacity adversely affected the number of ex officio investigations that their DPA could undertake into the proper application of the GDPR, putting at risk their oversight function, as Section 2.3 further explains.

There is a fundamental problem with the tasks entrusted to the DPA by the GDPR. To be able to fulfil all the responsibilities listed under Article 57 of the GDPR, considerably more personnel would be required. Therefore, mandatory tasks are prioritised while secondary tasks are handled with remaining resources. Complaints handling is a high-priority task … .

An EU DPA staff member

 What the DPA would really like to do is to provide unsolicited advice, but, due to capacity problems, we don’t manage to do so.

An EU DPA staff member

A shortage of resources also jeopardises DPAs’ capacity to effectively cooperate with their counterparts in cross-border cases, as discussed in Section 4.2. Interviewees from at least five DPAs said cross-border cases were too complex and resource intensive. In addition, several DPAs were precluded from actively participating in EDPB working groups and activities because of a lack of resources – either a lack of financial resources to cover the cost of travel, or a lack of qualified staff. Section 4.2 examines DPAs’ involvement in the EDPB in more detail.

The DPA received additional staff after the GDPR, but it would need many more to properly fulfil its mandate. We must persistently remind the budget ministry about the GDPR’s requirement to cooperate with other DPAs in cross-border cases or in the EDPB, for example. The EU Digital Package will involve similar cooperation. Enhancing resources is imperative when entrusting competencies to DPAs. Otherwise, they will be overwhelmed and unable to properly enforce those duties.

An EU DPA staff member

Promising practice: balancing in-person and virtual EDPB meetings

The COVID-19 pandemic enabled DPAs to explore the effectiveness of virtual meetings, and EDPB group meetings in particular. Online meetings helped reduce DPAs’ travel and personnel costs. Interviewees, who expressed concerns about the cost of attending face-to-face meetings, were keen to continue the practice of remote participation, while stressing the importance of in-person meetings for discussing the most critical issues and for networking.

Source:  Interviews with staff of several EU DPAs.

 

Lack of sufficient funding means that DPAs are not sufficiently technically equipped to be able to supervise and advise on the growing developments in AI-based technologies and the internet of things, according to interviewees in two Member States. Funding is also essential to ensure DPAs’ activities are able to cover a wide geographical area. DPAs were restricted to conducting investigations in the capital city in two Member States due to high travel costs.

Promising practice: improving efficiency in the use of resources

The Danish DPA has optimised its efficiency, especially in the handling of complaints and general information queries, by introducing the Lean management practices on process effectiveness working method (the Lean principles). This involves mapping out internal working processes and identifying potential inefficiencies to create more effective work processes. As a result, case processing time decreased from 2–4 years in 2015 to less than 1 year in 2022. Increased efficiency in complaints- handling enabled the DPA to step up ‘preventive’ activities, such as advisory work and promoting public awareness of GDPR compliance.

Source: Denmark, Danish Data Protection Authority (Datatilsynet), ‘Processing times’ (‘Sagsbehandlingstider’).

 

Promising practice: exploring opportunities to secure additional funding

In some Member States, DPAs are able to secure additional funding through fees, donations or the recovery of financial penalties. In addition, DPAs might have the opportunity to secure additional funding through the EU or other external sources, subject to applicable national law.

Sources: Council of Europe, Report on the Funding of Data Protection Authorities, Strasbourg, 2021. For more information, see ‘EU funding supporting the implementation of the General Data Protection Regulation (GDPR)’.

 

Having well-resourced DPAs is essential for the enforcement of the fundamental right of data protection, as set out in the Charter of Fundamental Rights, EU law and CJEU jurisprudence, and acknowledged in FRA’s previous reports on DPAs’ role in the EU [51]
 FRA,Data Protection in the European Union: The role of national data protection authorities – Strengthening the fundamental rights architecture in the EU II, Publications Office of the European Union, Luxembourg, 2010;FRA, Opinion of the European Union Agency for Fundamental Rights on the proposed data protection reform package, 2012.
. Adequate financial, human and technical resources are necessary to ensure that DPAs run efficiently and effectively as independent supervisory authorities [52]
 FRA, Data Protection in the European Union: The role of national data protection authorities – Strengthening the fundamental rights architecture in the EU II, Publications Office of the European Union, Luxembourg, 2010, p. 42.
. FRA has also emphasised that adequate resources are a precondition for the ability of DPAs to perform their advisory, supervisory and awareness-raising tasks and exercise their powers fully independent of any external influence [53]
 FRA, Data Protection in the European Union: The role of national data protection authorities, FRA opinion on GDPR, Vienna, 2010, p. 42.
. Sufficient resources are also key to ensuring the right to good administration and independence, which, as a general principle of EU law, binds all EU Member States. This statement applies equally to other human rights players, such as national human rights institutions and oversight bodies of intelligence services, as described in previous FRA reports [54]
 FRA, Strong and Effective National Human Rights Institutions – Challenges, promising practices and opportunities, Publications Office of the European Union, Luxembourg, 2020; FRA, National human rights institutions in the EU Member States – Strengthening the fundamental rights architecture in the EU I, Publications Office of the European Union, Luxembourg, 2010; FRA, Surveillance by Intelligence Services – Volume I: Member States’ legal frameworks, Publications Office of the European Union, Luxembourg, 2015; FRA, Surveillance by Intelligence Services: Fundamental rights safeguards and remedies in the EU – Volume II: Field perspectives and legal update, Publications Office of the European Union, Luxembourg, 2017; FRA, Surveillance by Intelligence Services: Fundamental rights safeguards and remedies in the EU – 2023 update, Publications Office of the European Union, Luxembourg, 2023.
.

DPAs have developed a set of practices to mitigate inadequate human and financial resources, using them in the most effective way despite constraints, as described in the boxes in this section.

Promising practice: automated procedures to support human resources 

To expedite certain processes and reduce workloads, some DPAs have digitised specific procedures. For example, interviewees from Spain and Portugal reported that complaints can be submitted online only by filling in a compulsory form. The complainer must use a digital ID when submitting the form. These online forms were found to be useful in avoiding multiple, time-consuming communications with the data subject about the information and evidence necessary for their complaints to be further processed. In Spain, new automated procedures have been used to help DPAs differentiate between the different levels of severity of complaints received.

In addition, in cases of less serious allegations, the DPA might consider issuing a warning to the data controller concerned instead of initiating a sanctioning procedure. This practice has helped spare resources for more complex and time-sensitive complaints.

Sources: Interviews with the staff of Portuguese, Spanish and Romanian DPAs.

 

Promising practice: optimising human resources for enhanced efficiency

Many DPAs reorganised their available human resources following the entry into force of the GDPR. To increase efficiency, some DPAs have found it useful to periodically review how their human resources deliver on the tasks assigned to them by the GDPR. As a result, some DPAs have streamlined certain areas of expertise across their main activities. For example, in Finland, the DPA does not allocate staff to advisory and enforcement tasks.  Instead, legal experts provide guidance and advice in their respective fields of specialisation.

Source:  Interviews with staff of several EU DPAs.

 

Promising practice: efforts to motivate DPA staff when recruited through the public administration

In Lithuania, efforts have been made to motivate civil servants working for the DPA by providing them with good working conditions and matching their skills with the area of work that interests them the most. Specific measures include providing motivational bonuses, offering training and guidance for professional development and allowing staff to participate in EDPB working groups according to their interests. In addition, staff have been given the opportunity to gain more expertise through secondments to other EU or international organisations. This has helped improve motivation and excellence among DPA employees and promote participation in external cooperation activities.

Source: Interviews with staff of the Lithuanian DPA.

 

Promising practice: outsourcing to external contractors

Interviewees from seven DPAs found outsourcing certain tasks to external contractors a useful practice. For example, in France, the DPA is considering outsourcing the handling of certain complaints to a properly trained external service provider. This provider would process recurring and/or simple complaints, such as requests for access to personal data. While helping to handle complaints more quickly, this practice would enable internal resources and expertise to be directed towards more complex cases. In Malta, the DPA uses outsourcing for cases requiring intense forensics analysis. In Ireland, a framework contract with an external company has helped to fill gaps in the ICT skillset of the DPA, while the support of legal firms is sought for certain tasks (not for investigation purposes). However, some interviewees indicated that this is only a temporary measure as it cannot be sustained without adequate funding.

Source: Interviews with staff of several EU DPAs.

 

Promising practice: boost the capacity of DPOs in public administration

The Italian DPA has promoted several initiatives to strengthen the role of data protection officers (DPOs) in public administration. The aim was to increase the data protection capabilities of competent ministries and reduce requests for advice submitted to the DPA by public authorities (*). For instance, the Italian DPA drafted specific documentation to support the designation of DPOs and improve understanding of their role and tasks in the public sector (**). The DPA organised specific events, workshops and meetings with DPOs.

The Italian DPA also participated, with four other DPAs, in the T4DATA (‘Training For Data’) project, which included a series of transnational training activities for trainers (carried out in 2018) and, at the national level, numerous free training initiatives dedicated to DPOs operating in public entities. These included a series of seminars in various cities in Italy, a handbook and a large number of webinars held by the DPA examining numerous topics related to the GDPR and the national legal framework on the protection of personal data (***).

The role of DPOs is analysed in Section 3.5. of this report.

Sources:

(*) Interviews with staff of several EU DPAs.

(**) Italy, National Data Protection Authority for Data Protection (Garante per la protezione dei dati personali), Guideline on DPOs’ appointment, responsibility and tasks in the public administration [document 9589104], 2021.

(***) Italy, National Data Protection Authority for Data Protection (Garante per la protezione dei dati personali), Training For Data (T4DATA) project, 2018-2019.

 


The member or members of each supervisory authority shall, in the performance of their tasks and exercise of their powers […], remain free from external influence, whether direct or indirect, and shall neither seek nor take instructions from anybody.

Article 52(2) of the GDPR

Each Member State shall ensure that each supervisory authority is subject to financial control which does not affect its independence and that it has separate, public annual budgets, which may be part of the overall state or national budget.

Article 52(6) of the GDPR

Under Article 52 of the GDPR, DPAs must act completely independently, which involves performing tasks and exercising their powers free from any direct or indirect external influence [55]
 GDPR, Art. 52; GDPR, recitals 117, 118 and 121.
. DPAs should act objectively, impartially and free from any instructions relating to the performance of their duties from the state and private actors, as clarified by the CJEU [56]
 FRA, Council of Europe and EDPS, Handbook on European Data Protection Law 2018 edition, Publications Office of the European Union, Luxembourg, 2018, Chapter 5.1; CJEU, C-518/07, European Commission v Federal Republic of Germany (Grand Chamber), 9 March 2010, para. 27; CJEU, C-614/10, European Commission v Republic of Austria (Grand Chamber), 16 October 2012, paras 59 and 63.
. Moreover, Member States should not exercise any form of control over DPAs through national budgetary procedures and should ensure their financial autonomy, according to the GDPR [57]
 GDPR, Art. 52(6).
.

Interviewees were asked about their views on, and any experiences of, influence from governments and/or other public institutions when carrying out their tasks and exercising their powers. This also included their financial autonomy when establishing their budgetary needs. FRA also asked about staff appointment procedures and whether these ensure independence. The following sections summarise the main findings.

The financial control that each DPA is subject to under national law must not affect its independence, according to the GDPR [58]
 GDPR, Art. 69.
. National budgetary procedures can significantly affect DPAs’ ability to work independently, as pointed out by FRA in previous reports [59]
 FRA, Data Protection in the European Union: The role of national data protection authorities – Strengthening the fundamental rights architecture in the EU II,Publications Office of the European Union, Luxembourg, 2010.
.

In most Member States, DPAs must submit their budgetary requests to the Ministry of Justice or other ministries for approval. Although responsible ministries may not decide on the breakdown of expenditure, they might have the power to scale down the DPAs’ overall budget size. A few interviewees reported an underlying risk of underfunding, preventing DPAs from carrying out their duties with full autonomy. This may be the case particularly when the DPA’s budget is attached to a ministry that is also the data controller of large national databases, processing sensitive personal data, as was reported in one Member State. It could create an impression of conflict of interest, whether valid or not, in cases where DPAs are not undertaking investigations of their budgetary authorities on their own initiative, a few interviewees said.

In addition, government delays in delivering budgets may also adversely affect DPAs’ ability to conduct planned activities. It took approximately 2 years for DPAs in two Member States to receive their annual budget allocations, according to respondents.

Insufficient political support for DPAs’ role and functions generally, often resulting in lower budgetary allocations, was noted in certain Member States. This is due to the following.

  • There are misconceptions about DPAs’ independent supervision of data processing, mostly among ministries of finance. For example, the GDPR can be seen as a hindrance to innovation, and there is a misconception that data protection does not generate revenue for the state and/or is not a primary need of the general population.
  • There is a lack of understanding of the role and responsibilities of DPAs. In four Member States, budgetary authorities declined to increase DPAs’ budgetary resources on the basis that the DPAs’ functions had remained unaltered over time, unlike those of other public agencies. In two Member States, DPAs received fewer resources than other national regulators and agencies with a narrower mandate (e.g. cybercrime, corruption).
  • Public awareness of the GDPR remains low in certain Member States.

In certain Member States, intense advocacy efforts by the DPA, targeting the public and national and EU institutions, have resulted in budgetary increases.

Another cause of the lack of resources is the perception of privacy as a luxury and not as a primary need. Nonetheless, when reading the proposal for an AI regulation discussed at the EU level, one can identify a list of potential risks related to data protection, confirming the need to have strong – and properly staffed – oversight mechanisms, such as DPAs.

An n EU DPA staff member

Promising practice: autonomy of DPAs when drafting their budgetary needs

The Spanish DPA has a certain autonomy when drafting its annual budgetary proposal, which is negotiated with the competent public budgetary authority (the tax ministry). The proposal is sent to the government so that it can be integrated, independently, into the state budget.

Source: Interviews with staff of the Spanish DPA; Spanish Data Protection Agency (Agencia Española de Protección de Datos), ‘Budget management’ (‘Gestión presupuestaria), 2024.

Most respondents agreed that DPAs operate independently from their government, parliament and any other public bodies. A majority of respondents also agreed that national accountability procedures – such as annual reporting to parliament or the European Court of Auditors’ audits and evaluations – do not challenge DPAs’ independence. Rather, they are used to verify the sound spending of budgets and identify deficiencies in DPAs’ administration.

A few DPAs were also subject to national ombudspersons’ inquiries on the handling of cases. In one Member State, it was reported that, while the DPA at first found it difficult to accept the opinion of another independent authority, it took on board the authority’s critical assessment of how the DPA handled complaints, and it valued the review by an independent authority to firmly ground their request for a budgetary increase.

In some Member States, FRA research revealed DPA difficulties in performing certain mandatory tasks, primarily due to forms of ‘indirect’ influence by either the executive or the legislative body. This was further exacerbated by inadequate human and financial resources. Issues reported to FRA included:

  • legislators being resistant to taking advice on incorporating data protection safeguards into the development and use of technologies; this was raised when tracking technology was set up to fight the spread of COVID-19 (as FRA has previously reported [60]
     FRA, Coronavirus Pandemic in the EU – Fundamental rights implications: With a focus on contact-tracing apps, Bulletin 2, Publications Office of the European Union, Luxembourg, 2020.
    and with respect to the use of technological equipment for security purposes;
  • the government refusing to implement some suggestions made by the DPA with respect to its reorganisation and the distribution of its competencies, which the DPA considered important for enabling it to fully exercise its powers;
  • the head of the DPA not being entitled to publicly answer to matters related to the DPA’s work in parliament, since this is the responsibility of the ministry the DPA is attached to.

Interviewees raised specific concerns about some governments’ practices, saying that they adversely affected their DPA’s advisory function (Chapter 3 of this report looks into DPAs’ advisory role in more detail). Several interviewees observed that governments set tight deadlines when requesting legal opinions on proposed legislation and/or addressed multiple, simultaneous requests to DPAs, which hindered their ability to deliver legal advice of sufficient quality. For instance, in one Member State, the DPA had 1 or 2 days to provide an official reply to a governmental request. Understaffed DPAs found this particularly problematic, and occasionally it resulted in the refusal to comply with the request. Furthermore, around five DPAs reported situations where legislators did not consult them, or consulted them only at a very late stage, on key files. Examples reported to FRA are described below.

  • Interviewees from two Member States highlighted that during the legislative process the responsible parliamentary commissions do not systematically consult the DPA on policy and legislative initiatives involving the processing of a large number of personal data. This was particularly the case during the COVID-19 pandemic. In the opinion of one respondent, in most cases the government endorses the DPA’s suggestions only to prevent public outcry, as it is only when the media picks up the DPA’s concerns that these are considered by the legislator. In one Member State, a respondent stressed that regular exchanges with a dedicated parliamentary commission for data protection issues have ceased to exist.
  • One interviewee stated that on many occasions the DPA found out about draft legislation through the media, as it had not published on the official portal as required.
  • Several employees from one DPA affirmed that the government is generally reluctant to consult the DPA and only does so when it is compulsory.
  • One interviewee observed that very few public bodies seek the DPA’s advice (no more than two to three consultations per year), as they fear the outcome of the DPA’s assessment.

Promising practice: providing advice at an early stage of the legislative process

Some DPAs are actively involved as experts in law-making working groups of the government or parliament. To ensure that the DPAs’ advisory role is not compromised, DPA representatives do not hold voting rights in some countries.

Furthermore, in some Member States DPAs make sure that their expert advice is properly noted in meeting records to avoid situations where the legislator claims to have consulted them when adopting provisions that might give rise to issues concerning the right of data protection.

Source: Interviews with staff of two EU DPAs.

 

We can determine the compliance of an action with data protection law only during an inspection. When we are asked for advice, we can only give basic instructions and guidelines – we point out some past cases, what was the solution, what they didn’t pay attention to, etc. We cannot carry out a thorough assessment.

An EU DPA staff member

Promising practice: ensuring good administration within the DPA through a code of ethics

The Spanish DPA has adopted a social responsibility plan and a code of ethics that permits any person to submit claims related to the internal procedures followed by the DPA.

Source: Spain, Spanish Data Protection Agency (Agencia Española de Protección de Datos), ‘Ethics and public integrity’ (‘Ética e integridad pública’), press release, 2022.

 


Member States shall provide for each member of their supervisory authorities to be appointed by means of a transparent procedure by their parliament, their government, their head of State, or an independent body entrusted with the appointment under Member State law.

Article 53 of the GDPR

Ensuring that DPAs’ leadership is free from any external influence or incompatible occupation is an essential guarantee of DPAs’ independence, according to the GDPR [61] GDPR, Art. 52(2).
. In addition, DPA members should refrain from any action incompatible with their duties and perform their tasks free of any conflict of interest [62]
 GDPR, Art. 52(3).
. They should be selected through a ‘transparent procedure’ [63]
 GDPR, Art. 53(1).
.

FRA has stressed the importance of DPAs’ leadership being appointed in a transparent manner as an effective guarantee of independence from the political branches of government [64]
 FRA, Data Protection in the European Union: The role of national data protection authorities – Strengthening the fundamental rights architecture in the EU II,Publications Office of the European Union, Luxembourg, 2010, Chapter 4.1.1.
.

Interviewees did not report deficiencies in the transparency of DPA leadership nominations as a common problem across Member States. However, some interviewees highlighted ongoing challenges in ensuring the independence of DPAs’ leadership. In one Member State in particular, interviewees stressed that the selection of the DPA’s leadership is highly ‘politicised’.

Some interviewees pointed out that conflicts of interest might occur when DPAs are institutionally attached to one ministry and are led by one director without a collegial body. In many EU Member States, the ministry of justice can potentially exercise some form of control over the DPA’s activities by deciding on the overall size of its budget, as highlighted in Section 1.2.1. of this report. Interviewees from one DPA observed that this risk might be exacerbated when the ministry of justice has to approve the director’s leave, promotions, business trips, etc. Theoretically, the ministry can always exercise some form of influence on the director’s activities, putting DPAs’ independence at risk. One interviewee suggested that the ministry could refuse a director’s trip to the EDPB sessions because the DPA has issued a decision of data breach against the Ministry of Justice (imaginary example).