11
June
2024
GDPR in practice – Experiences of data protection authorities
Data protection rules protect privacy and prevent personal information from misuse. When the general data protection regulation (GDPR) came into force in 2018, it strengthened the role of data protection authorities. These supervisory bodies are the key enforcers of the fundamental right of protection of personal data. This report analyses the challenges they face in the GDPR implementation. The findings complement the European Commission's forthcoming evaluation of the GDPR.
Search inside this publication
-
Key findings and FRA opinions
- Inadequate resources risk undermining the implementation of data protection authorities’ mandate and their independence
- Supervision is key, but would be more effective if supported by additional tools
- Large numbers of complaints are a major challenge and should be addressed by data protection authorities as a priority
- Awareness among the general public of the existence of data protection laws does not necessarily mean that they actually understand these laws
- Providing scientific researchers with advice is a challenge for some data protection authorities
- Advising and supervising public bodies acting as data controllers remains a challenge due to mistrust and misunderstanding of data protection authorities’ competencies
- The general data protection regulation is perceived as insufficient when it comes to concretely addressing the challenges posed by new technologies
- Strengthening cooperation between data protection authorities may require strengthening the European Data Protection Board
- Introduction
- 1. Data protection authorities’ complete independence as a fundamental guarantee
- 2. Data protection authorities as supervisory authorities
-
3. Data protection authorities as advisory authorities
- 3.1. Advising the general public
- 3.2. Advising data controllers
- 3.3. Focus – advising researchers is challenging
- 3.4. Advising on legislative initiatives
- 3.5. Data protection officers: privileged partners for data protection authorities
- 3.6. Lack of expertise to for responding to challenges related to new technologies
- 4. Data protection authorities as cooperating authorities
- Annex: Methodology
- Abbreviations
- About this publication
- AI – artificial intelligence
- CJEU – Court of Justice of the European Union
- DPA – data protection authority
- DPIA – data protection impact assessment
- DPO – data protection officer
- EDPB – European Data Protection Board
- EDPS – European Data Protection Supervisor
- FRA – European Union Agency for Fundamental Rights
- GDPR – general data protection regulation
- IAPP – International Association of Privacy Professionals
- ICT – information and communications technology
- IT – information technology
Related