In 2024, the general data protection regulation (GDPR) is in its sixth year of implementation. This regulation, adopted in 2016 as a key part of the EU’s data protection reform, amended the legal framework that had been in place since the 1995 data protection directive entered into force. It has enhanced data subjects’ rights, redefined the scope and application of the fundamental right of data protection and harmonised further national legal frameworks across the European Union. It has strengthened the mandate, tasks and powers of supervisory authorities. Supervisory authorities are referred to in this report as ‘data protection authorities’ (DPAs), as key enforcers of the fundamental right of protection of personal data.
Article 97 of the GDPR provides for regular evaluation reports by the European Commission. The first evaluation report was published in June 2020 and will be superseded by evaluation reports every 4 years. The first report noted, among other things, a significant increase in the amount of work for DPAs, with the number of complaints, notifications of data breaches, investigations and cross-border cases increasing during the reporting period. Discrepancies in terms of DPAs’ resources (human, technical and financial), affecting DPAs’ ability to exercise their role, across Member States were also highlighted. The European Union Agency for Fundamental Rights (FRA) provided specific insights to the European Commission, focusing on the experiences of civil society organisations with applying the GDPR.
The Commission is due to publish its second evaluation report in 2024. The evaluation is taking place in a context where the processing of data is at the core of several EU legal initiatives. The additional requirements stemming from these initiatives and recently adopted legislation have increased or will increase the roles and responsibilities of DPAs. In April 2021, the European Commission presented an artificial intelligence (AI) package, including a proposal for regulating AI. In November 2022, the Digital Services Act and the Digital Markets Act entered into force, which aim to, among other things, reinforce the fundamental rights of users of digital services. In November 2023, the EU Data Act, which provides rules on access to and use of data, for example by users of smart devices, was adopted. Similarly, the Data Governance Act, which entered into force in June 2023, strengthened mechanisms for increasing data availability and overcoming technical obstacles to the reuse of data. In addition, duties contained in the EU’s new pact on migration and asylum will add to DPAs’ responsibilities.
Ahead of the second evaluation, the European Commission requested that FRA collect data on the experiences, challenges and practices identified by DPAs in implementing the GDPR.
In response to this request, between June 2022 and June 2023, FRA undertook 70 qualitative interviews with DPA representatives from all 27 EU Member States. Three staff members were interviewed separately at each DPA, with the exception of five DPAs, where fewer staff members were interviewed. The three staff members were the head of the DPA, an official in charge of international cooperation and an official in charge of processing complaints, investigations and/or sanctions at the DPA. Interviewees were questioned on their experiences in the following areas: DPAs’ independence; the institutional capacity of DPAs; modern technological challenges; raising public awareness; the investigatory powers of DPAs; sanctioning GDPR violations; cooperation between EU DPAs and the GDPR consistency mechanism; cooperation with other national regulators; and the protection of personal data and competing fundamental rights.
This report discusses some of the challenges and promising practices identified and highlighted by DPA staff. It does not provide any comparative legal analysis, nor does it provide an in-depth analysis of DPA work based on qualitative data, such as DPAs’ annual budgets, the number of complaints received or the number of investigations conducted. The aim of the report is to complement such data – available in DPA, European Data Protection Board (EDPB) and European Commission reports – with concrete and detailed examples of practices developed and difficulties faced by DPAs.
From the fieldwork data, FRA identified four key areas related to the challenges faced by DPAs when implementing the GDPR. These are covered by the report as follows. Chapter 1 focuses on independence. Here, FRA analyses what DPAs perceive as challenging in terms of maintaining their independence, looking at both the adequacy of their resources and their freedom from external influence. Chapters 2 and 3 look at the two pillars of the DPAs’ mandate: their supervisory powers and advisory powers, respectively. Finally, Chapter 4 looks into the cooperation established by DPAs with other regulators at the national level and with other DPAs and the EDPB at the EU level.
All these areas are affected, directly or indirectly, by the DPAs’ availability of human, financial and technical resources. While several reports at the national and EU levels have already pointed out that DPAs are lacking resources across the EU, FRA’s research provides a practical understanding of the diverse and multilayered difficulties that DPAs face in the day-to-day management of fulfilling their mandate and in enforcing the right of data protection in the EU. The research also identifies solutions developed to mitigate these challenges. In addition, it gathers details on promising practices that DPAs have developed to mitigate the challenges they face in implementing the GDPR.
The findings of this report should be interpreted in the context of findings from previous FRA publications on DPAs’ role, effectiveness, functioning and independence. Trends in the data can be seen when comparing the findings of the current research with FRA findings published in 2010 and 2014. In particular, this report shows that, 14 years on, gaps in DPAs’ financial and human resources remain, while the number of tasks that DPAs are responsible for has increased.
The research is intended to complement the evidence gathered by the European Commission, and the studies and reports prepared by the European Parliament, the Council of the European Union and the EDPB. Therefore, to avoid any duplication with the European Commission’s data collection, this report provides input focused on the role and circumstances of DPAs, drawing on their practical experiences, without conducting a comprehensive assessment of GDPR enforcement by DPAs.
With the GDPR’s entry into force, DPAs have been assigned more tasks and their powers have been strengthened. Article 57 of the GDPR lists a number of tasks that DPAs must carry out, such as providing advice to different stakeholders, raising awareness, handling complaints and investigating data protection breaches on their own initiative and when requested.
This research confirms FRA’s findings on the role of DPAs published in 2010 and 2014, and findings published as part of the 2020 and 2021 Fundamental Rights Reports, which emphasised that DPAs face difficulties in fulfilling the entirety of their mandate due to a lack of resources.
This research acknowledges Member States’ efforts to increase DPAs’ overall budgets and staffing when the GDPR entered into force. Nonetheless, an overwhelming majority of interviewees stated that DPAs’ workloads also increased significantly with the introduction of the GDPR. They repeatedly highlighted the mounting workloads that DPAs need to manage with limited staff and inadequate funding.
Concerns expressed by interviewees relate mainly to the extremely large and growing number of individual complaints being submitted, including minor complaints, which DPAs are obliged to handle within a reasonable time under Article 57(1)(f) of the GDPR. This report shows that, because DPAs find themselves underfunded and understaffed, many are obliged to prioritise complaints handling over other regulatory tasks that the GDPR has entrusted to them – such as promoting awareness among public administration bodies and the private sector of their obligations under the GDPR, raising people’s awareness on the right of data protection and providing high-quality advice to public institutions on legislative proposals. Some interviewees pointed out that, due to a lack of resources, their DPA was not able to undertake on its own initiative investigations of data processing operations that could pose risks for data subjects. This limitation would appear to hinder DPAs’ ability to provide independent oversight, including oversight of public institutions and other bodies. Moreover, insufficient resources have been reported to undermine DPAs’ ability to contribute effectively to the EDPB’s increasing volume of activities and to take part in external cooperation mechanisms established under Chapter VII of the GDPR.
In addition, several respondents emphasised that new EU legislation, adopted after the GDPR entered into force, has tasked DPAs with additional duties and responsibilities, extending their workload further, even though the level of resources remains the same. Some interviewees mentioned that EU law requires DPAs to supervise the implementation of new, large-scale EU information technology (IT) systems in the area of migration and border control. These include the Entry/Exit System, which will process the biometric data of hundreds of millions of people at borders coming to the EU for short-term visits as of the end of 2024. Some respondents indicated that new supervisory roles may also arise in the context of the development of AI-driven technologies, with the pending adoption of the Artificial Intelligence Act.
To effectively carry out their duties in evolving and complex technical areas, DPAs need qualified legal and IT professionals with data protection knowledge. However, several interviewees indicated that recruiting professionals with the appropriate legal and technical expertise is a challenge, especially given that DPAs have to compete with the private sector. Some respondents also emphasised that, in their Member State, the recruitment process is conducted through public service competitions, which tend to attract generalists. This has limited DPAs’ autonomy to select and recruit qualified staff, meaning that training on the job has been required, negatively affecting the quality and timeliness of DPAs’ work.
Hence, a large majority of interviewees emphasised that inadequate financial and human resources are a major obstacle to their DPA carrying out the full extent of the tasks required under the GDPR under Article 52 and recital 121 of the GDPR.
Article 52 of the GDPR stipulates elements of DPAs’ independence that Member States should safeguard. These elements include freedom from external influence and enabling them to ensure that their human, financial and technical resources are adequate for performing their mandatory tasks. FRA research published in 2010 and 2014, as well as FRA’s Fundamental Rights Report – 2021 and FRA’s Bulletin 2 on the fundamental rights implications of the COVID-19 pandemic, found that external political pressure was exerted on some DPAs, particularly during the COVID-19 pandemic. This was reported less often during the current fieldwork research. A few interviewees suggested that a DPA’s independence might be at risk if that DPA’s budgetary proposal has to be approved by a ministry that manages a large number of databases that process personal data in various fields. Under-resourcing may also negatively affect DPAs’ perceived independence, by limiting their ability to conduct investigations on their own initiative and to duly oversee governments and public authorities when acting as data controllers.
EU Member States should secure the necessary financial, suitably qualified human and appropriate technical resources for DPAs, in light of obligations contained in Article 52 of the GDPR. As a key element of independence, DPAs should be provided with the means to adequately perform the entirety of their regulatory tasks, as defined in Article 57 of the GDPR. This especially concerns tasks where DPAs can act on their own initiative, which includes the timely provision of advice and opinions on draft legislation and conducting their own investigations of public authorities.
When allocating budgets, Member States should consider that DPAs have been entrusted with additional roles and responsibilities, many of which flow from new requirements under recently adopted EU law. As DPAs’ role expands, so must their resources. An assessment of the adequacy of their resources should be made with reference to all tasks and powers of DPAs.
Member States should consider funding DPAs under a separate and independent budget line from the state budget, to make their budget visible. Where budgets are authorised at the government level, DPAs should be free to determine the allocation and prioritisation of the resources allocated to them, in line with Article 52(6) of the GDPR.
While ensuring core funding for DPAs in the public budget, national budgetary authorities could consider stepping up funding for DPAs in relevant sectoral budgetary lines, in areas where DPAs’ expertise is required, for example asylum, migration, digitalisation of services and internal security.
Member States should support independent and objective reviews of DPAs’ workload to assess whether current budgets and human resources permit them to cope with their mandates and tasks.
The EDPB could consider facilitating exchanges of promising practices of national DPAs, as regards managing available resources to carry out tasks defined in the GDPR.
Member States should ensure that DPAs have the autonomy to recruit competent staff, including IT experts and specialist lawyers, and offer adequate remuneration to prevent frequent staff turnover.
Interviewees highlighted that supervision is their core task. Supervision includes all mandatory tasks aimed at investigating potential GDPR breaches (Article 58 of the GDPR), either on the DPA’s own initiative or following a complaint. A thorough investigation is a precondition for effective supervision. For some DPAs, these investigatory and supervisory tasks should take precedence over any other function (notably in relation to advising), as investigating GDPR breaches is an obligation established in the GDPR. However, several interviewees highlighted various challenges that prevent DPAs from conducting their supervisory and investigatory tasks effectively. Several respondents explained that investigatory measures listed in the GDPR are appropriate but could be complemented with other tools to reinforce their supervisory capacity, such as concrete techniques to identify data controllers of digital services, or investigatory measures allowing for undercover investigations. These should be complemented by more in-depth and technical tools. Interviewees discussed difficulties in launching ex officio investigations, the importance of being able to expand the scope of an investigation based on preliminary findings and the difficulty in assessing electronic evidence collected during investigations. Another recurring challenge mentioned by interviewees relates to the difficulties some may face regarding data controllers’ cooperation with the DPA during the investigation, as such cooperation is not mandatory in many Member States.
In addition, as highlighted above, human resource shortages may force DPAs to concentrate resources on complaints, not leaving enough time for ex officio investigations. Moreover, in most interviews, DPA staff highlighted that they are still adapting to the broadened mandate DPAs were entrusted with by the GDPR, identifying the most efficient way to deal with the high number of complaints.
The European Commission should assess, with the support of the EDPB, which technical and procedural tools – required to fully implement the investigatory tasks and powers prescribed under Article 57(1)(h) and Article 58(1) of the GDPR – DPAs lack. Notably, DPAs should be able, with appropriate safeguards, to collect information under a secret or concealed identity, and extend the scope of the investigation based on their findings, if further potential GDPR violations are discovered during the investigation. Any proposed amendment to the GDPR could also clarify the conditions for the admissibility of electronic evidence.
The European Commission should consider introducing reforms to enhance DPAs’ ability to conduct both ex officio and complaints-related investigations in an adequate, effective and timely manner. Any proposed reform should reinforce the legal framework so that data controllers under investigation have an obligation to cooperate with DPAs.
Most interviewees highlighted that the GDPR requires them to respond to every complaint that has been lodged but that they lack the time and human resources to do so. Complaints concern issues of unequal gravity and some can be petty and repetitive. DPAs have developed a wealth of practices to address complaints more effectively, through prioritisation, grouping, templates, automation or standard replies. However, FRA findings show that there is still no harmonisation and no sufficient exchange of such practices among DPAs to effectively tackle such challenges.
Furthermore, some respondents emphasised that, 5 years after the entry into force of the GDPR, DPAs’ decisions in GDPR investigations and lack of timely response to complaints are increasingly challenged in courts at the EU and national levels. Defending themselves against these challenges is costly and resource intensive for DPAs.
The EDPB could consider strengthening the exchange of national practices and experiences, specifically on improving handling large numbers of complaints. Notably, the issues of prioritisation and grouping of complaints would benefit from further guidance from the EDPB, namely guidance on which criteria and safeguards to implement in order to ensure each complaint is properly addressed.
While the majority (69 %) of people in the EU-27 have heard about the GDPR, as FRA’s Fundamental Rights Survey on data protection and privacy showed in 2020, the large number of trivial or unfounded complaints received by DPAs indicates that a proper understanding of what the right to personal data entails is lacking. However, for most DPAs, despite their wish to provide advice and raise awareness among data subjects and the general public, doing so is challenging given their lack of resources.
As reported to FRA, DPAs receive very few requests for prior consultation from data controllers based on Article 36 of the GDPR, which requires data controllers to consult their DPA when the result of a data protection impact assessment (DPIA) shows that the risk to the protection of personal data is high. The limited number of prior consultation requests and of DPIAs gives rise to concerns about the actual understanding of the data protection implications of processing operations among data controllers. The low number of prior consultation requests and the low number of DPIAs suggests, according to interviewees, that, even if data controllers are aware of data protection risks, they do not fully understand what these risks entail or what they should do to identify and prevent them. Interviewees considered the lack of knowledge of data controllers on the application of data protection provisions especially striking when it comes to the development of AI systems.
EU institutions and Member States should further support and promote awareness and understanding of data subjects’ rights and data controllers’ obligations among the general public. This is particularly important for tackling the currently low number of DPIAs, as identified by DPAs.
To increase the understanding of data protection implications in complex fields, notably, but not only, when it comes to the use of new technologies, the EDPB could develop further specific guidance on data processing involving new technologies or related to complex fields.
Most of the respondents interviewed by FRA did not recall any practical experience of providing advice to researchers in the field of scientific research, apart from during the COVID-19 pandemic. Those interviewees who did recall giving advice identified three main challenges that DPAs face when advising researchers. First, some DPAs reported that researchers found Article 89 of the GDPR – which provides for safeguards and derogations when data are processed for research purposes (including statistical, scientific or historical purposes) – to be a complex provision. This is reinforced by the fact that researchers also reported to DPAs that the number of applicable EU and national laws confuses them when attempting to identify the correct legal basis for processing data for scientific and statistical purposes, and DPAs would welcome further field-specific guidance to enable them to properly advise researchers.
Second, some data controllers tend to be unwilling to provide access to data for research-related purposes. Lastly, several interviewees emphasised how the shift to an accountability system (from the pre-GDPR authorisation scheme) has affected their ability to advise researchers. These respondents indicated that they did not appreciate that DPAs are no longer responsible for authorising the processing of sensitive data. While general guidance has been developed by the EDPB and the European Data Protection Supervisor (EDPS), most interviewees emphasised that what they are lacking is field- and technology-specific guidance to enable them to appropriately advise researchers.
The EDPB should consider developing further specific guidance on processing personal data for research purposes, including processing of sensitive data. More guidance, and, where relevant and feasible, more tools, should be provided to clarify the application of derogations prescribed in Article 89 of the GDPR. This guidance should address both researchers and the data controllers that researchers may contact to access specific databases. The guidance should clarify that granting or refusing access to data for research purposes is only based on Article 89 of the GDPR and that the GDPR should not be used as a justification to deny access to data for research purposes. The EDPB could also consider collecting and promoting relevant promising practices identified at the national level.
According to Article 57(1)(c) of the GDPR, DPAs shall provide advice to national institutions and bodies on legislative measures that relate to the protection of personal data. Some interviewees reported specific difficulties concerning advising public bodies acting as data controllers. Interviewees indicated cases where, due to either fear or distrust of the DPA, public bodies did not consult with the authority before launching a data processing operation.
Similarly, several interviewees noted both mistrust and misunderstandings from the executive when it comes to consulting with the DPA, although lawmakers agreed on the importance of providing adequate comments on draft laws to ensure effective implementation of data protection principles, which is prescribed by Article 57(1)(c) of the GDPR. In some instances, DPAs’ opinions were not considered in final draft legislation, while in other instances DPAs were not consulted or were given tight deadlines. Some interviewees also highlighted how staff shortages can negatively impact DPAs’ ability to advise public institutions, as DPAs lack the expert knowledge in-house needed to provide administrative bodies with exhaustive and detailed analysis on questions that are sometimes very technical or sector specific. Several interviewees reported to FRA that mistrust of data protection principles (often perceived as globally hampering the effectiveness of proposed legislation), combined with a misunderstanding of DPAs’ competencies, were the main reasons for not consulting DPAs on draft legislation.
Several interviewees reported difficulties when investigating public administrations because some institutions competent in human rights or national security issues are sometimes granted a general derogation from certain obligations contained in the GDPR under national law, under Article 23 of the GDPR.
Member States should ensure that data protection principles and requirements are mainstreamed in the work and procedures of public bodies and public authorities. They should promote the principle of data protection by default for all data processing, provide public officials with adequate guidance and regular training, and encourage a more systematic consultation of public institutions via their data protection officers (DPOs).
Member States should ensure that any restrictions allowed to public entities under Article 23 of the GDPR are granted on a restrictive basis.
Member States should guarantee that DPAs are equipped with the necessary resources to enable them to provide high-quality and specialist advice to public bodies, in line with Article 57(1)(c) of the GDPR. This includes both technological resources and human expertise, which implies granting DPAs additional resources for recruiting experts and developing in-house training.
Member States should ensure that data protection principles are taken into account when drafting legislative proposals, by consulting with DPAs and seeking their advice in advance. Member States should ensure that sufficient time is given to DPAs to provide detailed, relevant and exhaustive advice.
FRA research shows that, while the majority of interviewees believe that the requirements and tools provided in the GDPR are, in theory, adequate, most interviewees also highlighted that in practice the GDPR remains insufficient to regulate new technologies. Several interviewees said that DPAs are mostly unprepared when it comes to understanding and supervising new technologies (e.g. the implementation of AI-based systems). Some respondents emphasised the importance of dedicating more time and resources to the development of regulatory approaches for testing technologies, such as sandboxes (schemes used to test innovations in a controlled environment). Several interviewees expressed concern over the lack of clarity on the role their authority may have to play in the enforcement of data-related EU acts that have been proposed or adopted since the entry into force of the GDPR, in particular the proposed Artificial Intelligence Act.
The EDPB should consider providing DPAs with further guidance on the application of the GDPR to new technologies. Specifically, the EDPB is invited to collect information from DPAs to identify specific technology-related areas where further explanation is needed to apply the GDPR to data processing. Member States should ensure that DPAs can further engage in research – for example using sandboxes – to identify challenges and have potential solutions ready with respect to new fields where data protection oversight is required. To avoid duplication of work, DPAs are encouraged to foster cooperation with other DPAs and share knowledge and expertise on specific data processing involving new or complex technologies.
The EU legislator should ensure that the competencies of supervisory authorities envisaged in new data-related acts (notably, the draft Artificial Intelligence Act) do not conflict with the competencies of DPAs. Should DPAs be entrusted with any additional tasks and competencies, Member States should ensure that this is accompanied by the provision of relevant additional financial, human, and technological resources.
FRA interviews confirmed that strong cooperation between DPAs will ensure swift enforcement and a harmonised interpretation of the GDPR. According to recital 123 of the GDPR, reinforced and harmonised cooperation between DPAs is a key objective of the GDPR, and the EDPB was provided with a broader mandate than its predecessor to fulfil this objective. The EDPB’s broad mandate described in Article 70 of the GDPR can greatly support DPAs and reduce their workload by ensuring cooperation and consistency and by developing guidance. Interviewees were mostly positive about the EDPB, recognising the quantity of work performed by an institution that many recognise to be understaffed. However, interviewees did identify room for improvement. Some interviewees argued that, although the work of the EDPB is welcome, it has led to significant additional work for DPAs, notably in their participation in working groups and numerous meetings. In this context, several DPAs identified a need to restructure the way in which the EDPB operates and its internal procedures.
EU institutions should provide the EDPB with sufficient human and financial resources to allow it to fully fulfil its mandate and, as appropriate, support the work of EDPB members, including, where relevant, by developing appropriate tools. In turn, the EDPB should consider reflecting on its working procedures to ensure they do not create unnecessary burdens for DPAs.
