GDPR Report 2024 - Cover
Miha Creative/Adobe Stock
11
June
2024

GDPR in practice – Experiences of data protection authorities

Data protection rules protect privacy and prevent personal information from misuse. When the general data protection regulation (GDPR) came into force in 2018, it strengthened the role of data protection authorities. These supervisory bodies are the key enforcers of the fundamental right of protection of personal data. This report analyses the challenges they face in the GDPR implementation. The findings complement the European Commission's forthcoming evaluation of the GDPR.

Article 97 of the general data protection regulation (GDPR) provides that ‘by 25 May 2020 and every 4 years thereafter, the Commission shall submit a report on the evaluation and review of this Regulation to the European Parliament and to the Council’. In May 2020, the European Commission published its first review [115]
 Commission communication – Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition – Two years of application of the general data protection regulation (COM(2020) 264 final).
(the 2020 report). For the second evaluation of the GDPR, due to be published in 2024, the European Commission invited FRA to conduct qualitative research, collecting the experiences, challenges and best practices identified by data protection authorities (DPAs) in implementing the GDPR.

Data were collected through interviews with DPA representatives and analysed to complement the data collection performed by the European Commission, and the reports prepared by the European Data Protection Board, the European Parliament and the Council of the European Union.

In cooperation with the European Commission, FRA developed a questionnaire building on the tasks of the DPAs as listed in Article 57 of the GDPR.

The questionnaire covered nine areas:

  1. the institutional capacity of DPAs;
  2. modern technological challenges;
  3. the independence of DPAs;
  4. raising public awareness;
  5. the investigatory powers of DPAs;
  6. sanctioning GDPR violations;
  7. cooperation between EU DPAs and the GDPR consistency mechanism;
  8. cooperation with other national regulators;
  9. the protection of personal data and competing fundamental rights.

The questionnaire allowed for semi-structured interviews. It included 16 open questions, where interviewees were invited to describe any challenges they were confronted with directly in their work or have been informed about. Interviewees were also invited to reflect upon the possible causes of these challenges, the potential consequences for data protection and potential mitigation measures. Mitigation measures included both existing practices (referenced through the report) and measures DPA staff believed could be beneficial, but that were not tested yet.

In 2022, the questionnaire was tested by FRA through interviews in four Member States, with the objective of ensuring its relevance and identifying potential shortcomings. The questionnaire was welcomed by DPAs where it was tested, and, on this basis, FRA contracted Franet [116]
 For more information, see the Franet website.
, its network of experts in the Member States, to conduct interviews in 21 Member States. All Franet interviewers received 1 day’s training in December 2022 to harmonise the approach and ensure the highest quality of interview methodology.

By mid-2023, interviews were conducted with DPAs in all 27 Member States. To gather adequate material covering all nine topics, and for FRA to collect sufficient data, three interviews were conducted per Member State. In two Member States only two interviews were conducted, and in three Member States only one interview was conducted, due to workload or availability of staff. Overall, 70 interviews were conducted.

The aim was to interview staff in different positions to ensure a variety of views and experiences and obtain a comprehensive overview. The aim was to conduct interviews with:

Given the differences in the organisational structure and in the experts’ profiles among the DPAs, a certain margin of flexibility was granted to the DPAs and to Franet in the selection of the interviewees for profiles 1 and 2.

In addition, it was not possible to interview these exact profiles at all DPAs. In five Member States, the DPAs could participate in only one or two interviews (out of the three interviews mentioned above). The main reason for this was their workload, which prevented staff members from dedicating more time and resources to this research.

In two Member States, one interview was conducted with all three staff members at the same time. In one Member State, interviews were conducted only with staff members and not the head of the DPA, while in another only the head of the DPA participated in the interview. Given that this affected only a small number of Member States, and that at least one or two interviews could be conducted in all Member States, this did not affect the whole data collection and data analysis conducted by FRA.

All interviews were conducted face to face, either by FRA or by Franet, in the language of the Member State. With the consent of the interviewees, interviews were audio-registered, for the purpose of checking the transcript of the interviews. The audio transcripts were deleted at the end of the research. For further information on the data protection principles applied to this research, you may refer to the data protection notice published on FRA’s website [117]
 FRA, ‘Research project on “GDPR – The experience of data protection authorities”’, data protection notice, 2022.
.

The objective of the interviews was to collect DPAs’ experiences, focusing on the challenges they face in implementing the GDPR and on the promising practices they have identified to respond to these challenges.

Due to overlaps in the responses and in the trends identified by FRA, the report does not follow the structure of the questionnaire. The challenges identified by the respondents are presented based on their relevance to DPAs’ independence, their supervisory powers, their advisory tasks and their cooperation at the national and EU levels. Furthermore, interviewees did not identify any relevant challenges under the ninth area related to the protection of personal data and competing fundamental rights.

FRA analysed the fieldwork data, using Maxqda software to support the identification of trends and common challenges. It also compared the data with previous evidence that FRA has collected on the role, effectiveness and independence of DPAs, described in Box B 1, to identify recurrent issues over the years.

In this report, given that up to three interviews were conducted within each Member State, trends were identified based on the number of Member States mentioning a challenge:

  • when a challenge was mentioned by only one interviewee in less than three Member States, the report refers to ‘a few respondents’;
  • when a challenge was mentioned by several interviewees in less than three Member States, the report refers to ‘some respondents’;
  • when a challenge was mentioned by several interviewees in four to seven Member States, the report refers to ‘several respondents’;
  • when a challenge was mentioned by several interviewees in 7 to 13 Member States, the report refers to ‘many respondents’;
  • when a challenge was mentioned by several interviewees in more than 14 Member States, the report refers to ‘most respondents’ or ‘a majority of respondents’;
  • when a challenge was mentioned by several interviewees in 26 or 27 Member States, the report refers to ‘a very large majority of respondents’.

Interviews were conducted anonymously to obtain the most trustworthy insights into experiences, as this allowed interviewees to speak more freely. Quotes and promising practices were sent out to each interviewee to ensure the anonymity of the former and the accuracy of the latter. Where available and useful, interviewees provided FRA with public sources of information, which were integrated in the report as official references. On a few occasions, the DPA did not, and could not, provide FRA with further references, and the source of the practice was identified as stemming from the interviews FRA conducted with one or several DPAs.