For some authorities, the GDPR did not bring major changes to their supervisory and investigatory powers. However, the sharp increase in administrative fines, coupled with sudden but extensive communication on data protection when the GDPR was adopted, multiplied the number of complaints and related inspections DPAs must conduct. This has created a number of issues, directly and indirectly, as highlighted in Chapters 1 and 3.
While difficulties have been identified in investigating cross-border cases in particular – an issue acknowledged quite early on by DPAs and discussed at several EDPB meetings [65] EDPB, Minutes of the 43rd plenary meeting, 15 December 2020, Section 4.1.3. See also EDPB, ‘EDPB moves ahead with closer cooperation on strategic cases’, press release, 2022; and EDPB, ‘Swift adoption of regulation to streamline cross-border enforcement needed’, press release, 2023. – FRA research identified a number of challenges that can considerably slow down or otherwise affect investigations conducted by DPAs when acting as a supervisory authority.
The EDPB met in Vienna in April 2022 to address issues related specifically to the investigation of cross-border cases. It recognised that DPAs will ‘collectively identify cross-border cases of strategic importance in different Member States on a regular basis, for which cooperation will be prioritised and supported by EDPB’ [66] EDPB, Statement on enforcement cooperation, 28 April 2022. . Several arrangements were made to improve and facilitate cross-border cooperation. As a result, a list of proposals was prepared by the EDPB and sent to the European Commission in October 2022 [67] EDPB,Letter to Commissioner Reynders, 10 October 2022. . In July 2023, the European Commission issued a proposal for a regulation laying down additional procedural rules on the enforcement of GDPR in cross-border cases (hereafter the ‘2023 proposed regulation’) [68] Commission proposal for a regulation laying down additional procedural rules relating to the enforcement of GDPR (COM(2023) 348 final). .
The 2023 proposed regulation aims to address several procedural differences among Member States’ national rules and practices that hinder the effective and quick handling of cross-border cases. These differences include:
To tackle these issues, the 2023 proposed regulation aims to:
In September 2023, the EDPB and the European Data Protection Supervisor (EDPS) issued a Joint Opinion on the 2023 proposed regulation [69] EDPB and EDPS, Joint Opinion 01/2023 on the proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679, 2023. . Both institutions welcomed the proposal, noting that while the proposal will indeed support DPAs in the effective handling of cross-border cases, it will have an impact on DPAs’ resources, and, therefore, these should be adequately increased to appropriately deal with the proposal’s requirements. At the time of drafting this report, the proposal is subject to the ordinary legislative procedure within the European Parliament and the Council of the EU is in the process of examining it in its first reading [70] For more information, see the steps of the ordinary legislative procedure for Procedure 2023/0202/COD on EUR-Lex. .
Most DPAs were interviewed by FRA before the publication of the 2023 proposed regulation. Several of them did highlight that procedural differences make DPA cooperation difficult to implement, for example when deciding to carry out joint operations. Nonetheless, most respondents decided not to refer in detail to these procedural differences, as these are already being addressed by the European Commission’s proposed regulation. In several cases, DPAs emphasised the positive role of the EDPB in accelerating the process of addressing this important challenge.
However, FRA research identified several other challenges that prevent DPAs from conducting supervisory and investigatory tasks effectively, and this chapter deals with these challenges. Respondents highlighted that while investigatory measures listed in the GDPR appear to be adequate, there is still room for improvement (Section 2.1), and that most DPAs are still looking for an efficient way to deal with the high number of complaints (Section 2.2). Finally, they reported that ex officio investigations are not being launched, despite the willingness of DPAs, due to staff shortages (Section 2.3).
Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory: … handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary.
Article 57(1)(f) of the GDPR
Supervision of data controllers and data processors is central to the GDPR architecture: DPAs are obliged to handle every complaint lodged with their authority. Some DPAs emphasised that they consider their role to be primarily a supervisory one, and that providing advice should come second – that is, depending on the human, financial and time resources remaining once supervisory duties have been performed. The ability to conduct thorough investigations is a practical precondition to ensure supervision is conducted exhaustively and rigorously. Investigations can be conducted on the DPA’s own initiative (as per Article 57(1)(h) of the GDPR) or following a complaint (as per Article 57(1)(f) of the GDPR). In all cases, DPA experts must be provided with:
More specifically, investigative powers listed in Article 58 of the GDPR include the power to:
Given that supervision is a major part of the DPA mandate, several interviewees emphasised how most of their resources are used to handle complaints, to the detriment of other tasks, as discussed in Section 1.1 of this report. Here again, several respondents stressed that the lack of resources was having a negative impact not only on the overall work DPAs can perform, but also on the ultimate objective of ensuring safe processing for personal data upstream.
It would be effective to deal with preventative work; in that way, awareness would be higher and then there should be fewer complaints coming in. We are dealing with trees, instead of the forest.
An EU DPA staff member
Several interviewees highlighted the importance of sanctions in the new supervisory architecture implemented under the GDPR. They feel that the sharp increase in the number of sanctions has led private companies to ‘take data protection seriously’, despite some respondents stating that litigation should always be considered as a last resort, even in cases where a complaint was submitted to them.
The increased level of sanctions is a big change from the 1995 directive to the regulation. This has escalated to the degree to which data protection is taken seriously. Before, the DPA usually had conversations with lower ranking IT staff members, whereas now the DPA meets with the directors of the companies and lawyers.
When questioned on their experiences and challenges related to the supervisory aspect of their mandate, a large majority of interviewees agreed that the GDPR, on a general basis, provides adequate tools. However, several of them highlighted some critical issues that undermine their overall ability to exercise their investigative powers. Investigating potential data protection breaches remains a complex exercise, and some respondents highlighted that some powers that would help DPAs to conduct their investigations are still missing.
DPAs’ investigative powers are described in Article 58 of the GDPR. When asked about their experiences of using these measures, most interviewees agreed that the compliance model and investigatory tools are adequate and sufficient. However, not all DPAs enjoy access to the techniques necessary for the practical implementation of these powers.
Conducting supervision is particularly challenging without adequate resources. This includes human resources (the capacity of DPAs to recruit IT experts, for example), financial resources (the capacity of DPAs to schedule more on-site investigations, for example) and technical resources (the capacity of DPAs to invest in specific software to support their investigations involving hardware and electronic devices). Some interviewees emphasised that, with a reinforced team, their DPA would be able to diversify and, ultimately, strengthen their investigatory methods.
In addition, several interviewees pointed out that, based on their experience, Article 58 lacks concrete investigative techniques that would be useful in data protection-related contexts. For two interviewees, the main challenge lies at the very beginning of the investigation: the identification of the data controller, notably when it comes to online platforms, applications or social networks. In their view, there are no techniques that would support them in doing this in an effective and timely manner.
Some interviewees regretted that neither the GDPR nor the national legislator has provided their DPA with additional concrete investigatory tools, such as the ability to search under a false name, consult computer sites under a client’s name, or make purchases under a concealed identity. In addition, several respondents flagged the question of the admissibility of evidence in the digital era as an issue where DPAs lack guidance. DPAs are left alone to ‘decide how far they should go to prove a violation, how much information is enough to prove systematic problems’.
Actions and functions set by the GDPR are too general. Those are interpreted in the national regulation. And this is where problems start to arise. It is not about the GDPR competency or scope, but it is about the scope of the national regulation. Often problems are related to the fact that we (at the national level) do not have the right tools. It would be more beneficial if the GDPR would describe more concrete tools that could be used by the DPAs.
Several interviewees highlighted that investigations – both national and cross-border – can be hindered by a too-narrow scope. One explained that their national law does not permit them to extend the scope of the procedure during the investigation.
This issue was raised in the context of handling cross-border cases in particular, with DPAs involved in cases having different rules on extending the scope of the investigation. Despite the mechanisms developed in the GDPR to simplify and harmonise the handling of cross-border cases, difficulties concerning the scope of investigations that have prevented several cases from being resolved in a smooth and timely manner remain. This issue was acknowledged quite early on by DPAs and has been discussed in several EDPB meetings [71] EDPB, Minutes of the 43rd plenary meeting, Section 4.1.3, 15 December 2020. See also EDPB, ‘EDPB moves ahead with closer cooperation on strategic cases’, press release, 2022; and EDPB, ‘Swift adoption of regulation to streamline cross-border enforcement needed’, press release, 2023. . It is one of the key proposals of the European Commission’s 2023 proposed regulation [72] Commission proposal for a regulation laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 (COM(2023) 348 final). .
Several interviewees consider it important to involve data controllers during investigations, including by developing informal contacts with data controllers. Conditions for collaborating with third parties are essential and, therefore, should be better addressed in the GDPR, according to some interviewees.
We are sometimes trying to ease some of these bureaucratic hurdles by having direct exchanges with the controller and with the individual. … There is a large number of cases where, with just one phone call from us, the matter is sorted out. It is not formalistic, but it is effective.
Most interviewees cited data controllers’ lack of cooperation as their main challenge. For some interviewees, the fact that the DPA cannot perform checks without warning data controllers about its visit is counterproductive, as they may delete or hide relevant information.
What the GDPR says in Article 58 is good; the DPA’s procedure is also good – the problem that the DPA is facing in the field is the lack of interest from the data controller.
Several interviewees highlighted that the GDPR does not provide any leverage in cases where data controllers refuse to cooperate with the DPA. DPAs are mostly affected by this when attempting to access to relevant documents, but one interviewee said that they also encounter this difficulty when they are assessing a data controller’s claim that data cannot be shared for reason of confidentiality. One expert clarified that this absence of leverage generally results in the initiation of additional proceedings for failure to cooperate with the DPA, which significantly extends the time of the proceedings that have been initiated.
This is probably the biggest problem that we face, namely the data controllers – either not providing that information or providing low-quality information. The long delays in the information that you get from the data controller. That is probably one of the main reasons why quality can sometimes be compromised and [why] certain investigations are very stretched out in time.
Some interviewees considered the inclusion of sanctions in national legislation as good practice when data controllers refuse to cooperate. However, one interviewee highlighted that, despite the sanctions included in their national legislation in cases of non-cooperation, some data controllers only allow access to their premises when DPA staff are accompanied by a police officer. Other interviewees underlined that it is good practice to establish a good relationship with the police for this purpose.
Promising practice: increased transparency and visibility for data controllers
In Denmark, at the beginning of each year, the DPA publishes a plan of its future supervisory work. The plan contains only information on the type of supervision, without identifying data controllers’ names, organisations or authorities.
Source: Denmark, Danish Data Protection Agency (Datatilsynet), ‘Special focus areas for the Danish Data Protection Agency’s supervisory activities in 2023’ (‘Særlige fokusområder for Datatilsynets tilsynsaktiviteter i 2023’), 2023.
Promising practice: informing data controllers in advance of the subject of the inspection
In Portugal, before an inspection, preliminary work is conducted to make sure that the issues of concern are properly checked and evidence is collected (e.g. based on the matters raised in the complaint). The inspection team then develops a targeted checklist. The DPA may or may not communicate in advance to the organisation that it will carry out an inspection. This depends on the nature of and the reason for the inspection, in order not to prejudice the action. However, often the data controller or data processor is informed beforehand of the date and time of the inspection, and if specific staff or policies should be available during the inspection. This is to reinforce cooperation and speed up the process, since it is quite important to ensure that the relevant personnel is present and able to provide all the necessary information to the DPA.
Source: Portugal, Article 8 of Law 58/2019.
All in all, investigations are dependent on data controllers sharing relevant information with the DPAs, as emphasised by one interviewee. DPAs that do not have the technological and/or human resources to conduct further audits must rely on the information provided to them by data controllers.
Our biggest challenge lies in the technological retrieval of data – and the police have the know-how for this. This expertise is something we lack. If we were to carry out an unannounced inspection and copy the server to verify what data are stored there, it would require certain technical know-how to be able to crack it and get the necessary security credentials.
Promising practice: amicable settlements and mediation as a faster and more effective way to ensure effective data protection
Some interviewees recommended considering amicable settlements and mediation sessions between parties. In its contribution, the EDPB reported a large disparity between Member States on this matter: half of them had never resolved complaints through amicable settlements. Of the Member States who have done so, half have used this option for fewer than 50 cases, and half (Ireland, Luxembourg, Hungary and Austria) for several hundred cases.
Belgian law establishes the option of reaching amicable agreements through the intervention of the DPA’s front office, clarifying that this would not compromise the supervisory competency of the DPA. In 2022, the DPA received 177 requests for mediation and handled (and closed) 139 mediation cases. Mediation requests related mainly to data protection issues concerning commercial practices, such as direct marketing; image processing and cameras; and data protection in the professional sphere.
This has several benefits, as it shortens the time devoted to the investigation and provides a remedy in a shorter time frame. One interviewee noted that, as the objective of the DPA is to provide the complainant with a legal remedy safeguarding their personal data, facilitating a mediation session leading to a settlement expedites the investigation process and effectively corrects the data protection issue.
Article 5 of the 2023 proposed regulation introduces the option of resolving complaints through amicable settlements. The EDPB and EDPS highlighted in their Joint Opinion that, in its current version, the proposal is not sufficiently comprehensive and clear to effectively support DPAs that wish to settle cross-border cases amicably. This procedure involves a number of challenges, related to differences in national procedural laws, that the proposal does not address.
Sources: For further information, see EDPB, Contribution of the EDPB to the report on the application of the GDPR under Article 97, 2023; and Belgium, Data Protection Authority (L'Autorité de protection des données), Service de Première Ligne, and Médiation et traitement des plaintes, from the 2022 annual report.
Promising practice: cooperation with the judiciary
One interviewee highlighted that establishing close cooperation with the judiciary has positive benefits for the conduct of investigations. Their DPA received guidance from the prosecution service when producing internal guidelines on how to obtain relevant information in accordance with the law.
Source: Interviews with staff of an EU DPA.
Another interviewee regretted that, in many Member States, obligation to cooperate in an investigation is limited to data controllers and data processors, when it could greatly benefit the investigation to extend the duty to collaborate to every person or institution of interest.
Finally, some interviewees pointed out the difficulty of dealing with data processing by individuals. Unlike legal entities, individuals generally process personal data at home rather than in a public office. In such cases, the power of the DPA to access premises can conflict with individuals’ right to inviolability of the home. If the person does not grant access voluntarily, the only way for the DPA to exercise its powers is to obtain permission from the court, which is a lengthy process, and may give individuals time to destroy evidence. For one interviewee, such situations leave an impression of impunity, undermining the effectiveness of the sanctions, which are either delayed by more than a year or not imposed at all.
The GDPR is built as a legal act limiting big data controllers. But we need to apply it to trivial cases. The majority of cases are about settling disputes between two natural persons... Application of a legal act aimed at something big to small cases is complicated.
Most interviewees highlighted how their capacity to supervise the enforcement of the GDPR was jeopardised by the large number of complaints they continue to receive on a regular basis. For several interviewees, lack of resources remains the main issue challenging their ability to comply fully with their supervisory obligations. In some cases, DPAs have to request the support of colleagues from other departments/specialities in supervision tasks related to the handling of complaints, to compensate for its lack of human and/or technical resources. Furthermore, some investigatory techniques that could help process complaints in a swifter manner are not being used due to the lack of appropriate experts in-house.
In two cases, interviewees stated that a lack of human and financial resources also prevents them from conducting inspections across the whole country. To overcome this, one interviewee said that they ask notaries to conduct on-site investigations for them, but that they do not consider this good practice, as notaries and their colleagues may not have the expertise and technology that the DPA needs to efficiently conduct the inspection. The interviewee highlighted the fact that ‘in many cases, the notary’s on-site inspection is useless; therefore, we end up having to go there to conduct the investigation’.
Promising practice: lack of resources can be mitigated by grouping similar complaints
Several DPAs indicated grouping complaints on similar issues as good practice. When a DPA notices that a high number of complaints about a specific issue (e.g. data related to debts) are being lodged, it identifies these as a ‘hot topic’ or priority. Once grouped, the DPA first updates their materials and guidelines and then investigates the complaints together.
Source: Interviews with staff of several EU DPAs.
Several respondents stressed that, when it comes to the obligation of DPAs to respond to data subjects, a less stringent set of rules and more efficient criteria should be provided, as DPAs differ in size, level of resources and degree of governmental support.
In this regard, there is a notable tension between Article 77 of the GDPR, which states that all complaints must be processed, and Article 57(1)(f) of the GDPR, which indicates that complaints must be processed to the extent necessary. Does every individual complaint need to undergo the litigation process, or is there a prioritisation to be made? This type of discourse is touchy, but in any case, a structured approach to complaints must be organised in a reasonable and rational manner by each national legislator.
Promising practice: data-driven approach – mining data from previous complaints to respond more efficiently to future complaints
One interviewee described how the DPA uses data generated from its supervisory activities to target its activities. To do this, the DPA registers all case-related information in a uniform way in its database. Reports on breaches of data security are equally useful to help decide where to conduct investigations. The interviewee said: ‘One could get the idea that organisations where multiple data breaches have been reported constitute suitable targets for supervision, but it might reflect that the particular organisation knows when to report a breach and when to not report a breach. What might be more interesting would be to supervise those who we never hear from.’ The DPA also uses these data to identify specific sectors that its supervisory activities could target.
Source: Denmark, Danish Data Protection Agency (Datatilsynet), Supervision with Effect – The Danish Data Protection Authority’s strategy for a data- and risk-based effort, 2020–2023 (Tilsyn med effekt Datatilsynets strategi for en data- og risikobaseret indsats, 2020-2023), 2020.
A few interviewees mentioned that national legislation prevents them from using the full spectrum of levies in cases involving public administrations. In one case, the interviewee criticised the fact that their powers for supervising public bodies in charge of security or human rights-related matters, such as ombudspersons, have been greatly reduced. Similarly, two interviewees from the same Member State highlighted the opt-out of the public sphere from administrative punishment altogether as ‘a major loophole’ in the GDPR. Some interviewees regretted that public authorities cannot be fined.
There are now certain limitations here that did not exist before. There has been a considerable reduction in the control of the DPA over (public bodies), which I do not think is appropriate. In general, it is not okay for anybody to be exempt from the DPA’s oversight. What the GDPR has stipulated, that DPAs are not competent for the courts when they are adjudicating in court cases, is fine. However, it is not fine that a body remains outside the scope of the DPA.
In a recent judgment, the CJEU clarified that a parliamentary committee of inquiry set up to supervise the executive power must respect the GDPR – as long as the purpose of their inquiry is not to safeguard national security [73] CJEU, ‘A parliamentary committee of inquiry must in principle comply with the general data protection regulation’, press release, Luxembourg, 2024. . Public bodies that operate in fields related to national security are not de facto exempted from the GDPR. Each data processing activity must be assessed individually, and the public body is only exempt from GDPR provisions in cases where data processing activities are intended to safeguard national security.
Article 62 of the GDPR allows DPAs to conduct joint operations involving two or more EU DPAs, either joint investigations or joint enforcement measures. For a joint operation to take place, certain conditions need to be fulfilled. Five joint operations were initiated between 2018 and 2023, according to the EDPB’s annual reports [74] EDPB, Annual Report 2021, 2022, p. 66; EDPB, Annual Report 2020, 2021, pp. 55 and 68; and EPDB, Annual Report 2019, 2020, pp. 29 and 31. and its contribution to the report on the application of the GDPR under Article 97 [75] EDPB, Contribution of the EDPB to the report on the application of the GDPR under Article 97, 2023. .
Joint operations could be a useful tool for DPAs to strengthen mutual learning and understanding of the application of the GDPR, according to some interviewees. A couple of respondents argued that since joint operations are not an established practice, DPAs might not be inclined to resort to them.
Several respondents challenged the practical applicability of joint operations and pointed out five reasons why they are significantly underused.
Even among comparably similar national legal systems, these [joint operations] can be problematic.
Speaking about joint investigations, the problem of lack of resources is relevant again. The DPA is a bit reluctant to initiate a joint investigation or participate therein, because such investigations will normally be needed for big cases, and they require a lot of resources. If the DPA joins one joint investigation, it might need to put on hold some national cases. This is something that can benefit more the large DPAs – with more resources.
If seven people work on investigations in the whole of the country and that is not enough to meet all [national] needs, then it is difficult or impossible to conduct joint investigations outside the country.
It is possible to prepare and coordinate a document in English, but then it has to be translated into a national language and presented as a decision from one Member State’s authority. So something as simple as that can influence the decision to cooperate.
From the perspective of a smaller data protection supervisory authority and a smaller EU Member State, I understand that for the supervisory authorities of Member States that have a much larger role, are bigger, have 10 times as many employees – joint investigations are probably not their priority when they have their own investigations in which they issue fines of hundreds of millions of euros. To put it in simple terms, these (joint investigations) are not high on their priority list. Perhaps they could assign a few employees to handle such cases as part of their activities, in order to enable smaller supervisory bodies, in terms of population and number of employees, to participate more promptly and adequately.
In addition to these practical difficulties, several interviewees argued that formal ways of cooperating under the GDPR do not lead to swift cooperation schemes, particularly in the framework of joint operations. Formal requirements combined with different interpretations of the GDPR risk prolonging the decision-making process in cross-border cases requiring an urgent response. Some interviewees considered that informal ways of cooperating can deliver better and more timely results. A few cooperation models have been tested in practice, as described in the boxes below.
Joint investigations are difficult in any case as every country is different, it has different companies, etc., so these investigations would never end if DPAs would do it jointly. In small groups it is doable; for example, the Baltic countries have a more similar culture and procedural rules.
Promising practice: Baltic state DPAs – joint preventive supervision of specific sectors
In addition to joint investigations mentioned in the GDPR, some DPAs have resorted to informal ways of cooperating with other DPAs to lessen the administrative burden for each authority. The DPAs of the Baltic states (Estonia, Latvia and Lithuania) launched a preventive joint supervision on the compliance of personal data processing in the field of short-term vehicle rental (e.g. electric scooters). The joint supervision aims to issue recommendations to strengthen the protection of personal data in this specific sector and contribute to more consistent supervision across the Baltic states.
Source: Estonia, Data Protection Inspectorate, ‘Supervisory authorities of the Baltic states launch of coordinated inspection of the compliance of personal data processing in the field of short-term vehicle rental’, 2022.
Promising practice: a group of DPAs investigated Vinted UAB for GDPR non-compliance
The Dutch, French, Lithuanian and Polish DPAs have joined forces to investigate the GDPR compliance of the online clothing sales website vinted.com, operated by the Lithuanian company Vinted UAB. After a significant number of complaints about the website were received in those countries, the DPAs set up a working group – facilitated by the EDPB secretariat – to coordinate action and support the lead authority, the Lithuanian DPA, in issuing an enforcement decision. The cooperation provided the Lithuanian DPA with considerable human resource support. The EDPB has agreed to use this form of cooperation in the future.
Source: EDPB, ‘Vinted investigation signals closer and stronger cooperation between personal data protection supervisory authorities’, 2022.
Several interviewees referred to the DPAs’ commitment to fostering joint operations in cross-border cases, as expressed in the ‘Statement on enforcement cooperation’ in April 2022 [76] EDPB, Statement on enforcement cooperation, 28 April 2022. . Some suggested that the following could be further explored in the short term, with EDPB support:
Most interviewees supported reform of the GDPR to set out a uniform procedure, binding at the EU level, that harmonises procedures and rules. A few interviewees underlined that ‘binding’ procedural mechanisms may be constitutionally challenging if, for instance, the supervisory authority from one Member State was able to conduct investigations in another Member State without the approval of its authorities.
Promising practice: informal collaboration between EU DPAs on specific topics
One interviewee mentioned that there are some examples of promising practices in terms of collaborations or conversations between national DPAs. These were described as very useful, even though they do not count as joint operations. The interviewee referred to actions developed when Italy made a decision to ban ChatGPT due to lack of compliance with the GDPR, and other DPAs considered doing so. The interviewee’s DPA established a European task force so that the different DPAs could follow a similar approach, and all of them initiated ex officio preliminary investigation actions against the US company OpenAI, owner of ChatGPT.
Source: Interview with staff of an EU DPA.
An ex officio investigation takes place when a DPA initiates an investigation without prior notification of a data breach or a complaint filed by a data subject. While a significant number of own-initiative investigations have been launched [77] EDPB, Contribution of the EDPB to the report on the application of the GDPR under Article 97, 2023, p. 47. , interviewees identified a number of limitations that DPAs face when conducting ex officio investigations, notably the large number of complaints (Section 2.2.1), and the lack of sufficient time and resources (Section 1.1).
There are three main obstacles preventing DPAs from launching more ex officio investigations:
Most interviewees raised concerns about resources being taken away from ex officio investigations because of the obligation to process every individual complaint received (in very large numbers, as highlighted in Section 2.2). This is quite problematic given that, as interviewees highlighted, ex officio investigations are arguably more important for the wider public than individual cases. They can include cases that the public may not be aware of, and therefore cannot make a complaint about.
In the past, when there were not so many complaints, we could do more inspections, probe the ground ourselves and find out that there was a need for additional action in a certain area. The large number of complaints dictates the pace, and the ex officio inspections cannot be done as much. Our position is that these ex officio inspections help in advance to ensure that infringements do not occur in the most pressing areas. I would have liked to see more ex officio inspections in the health sector, in telecommunications; it seems to me that we could prevent a lot of infringements in this way.
Given the time necessary to respond to each complaint within a certain deadline and the time-consuming nature of ex officio investigations, most interviewees raised lack of resources as an obstacle to carrying out ex officio investigations.
Nevertheless, individual complaints can help identify key areas and thus allow DPAs to prioritise self-initiated investigations in these areas, as highlighted by one interviewee.
We have no choice but to process each complaint. A large part of the effort is focused on processing complaints and notifications, leaving less room to use ex officio investigative powers. The resources are the decisive factor here, as the major part of them have been concentrated on processing complaints and notifications.
The majority of interviewees emphasised that they would like to have more resources and time to conduct ex officio investigations. In fact, ex officio investigations can support the effective implementation of data protection, as they increase DPAs’ ability to identify breaches that data subjects or data controllers are not aware of.
What we would also like to do more is ex officio investigations, because a lot of the digital world people don’t see themselves. And we do see. People can’t complain about that because they don’t know at all.
