FRA publishes “GDPR in practice – Experiences of data protection authorities”

The European Union Agency for Fundamental Rights (FRA) published a report analyzing the experiences and challenges faced by data protection authorities (DPAs) in the implementation of the General Data Protection Regulation (GDPR). This report aims to complement the forthcoming evaluation by the European Commission, providing practical insights from DPA representatives across the EU. The research is based on 70 qualitative interviews conducted between June 2022 and June 2023 with DPA staff from all 27 EU Member States.

Key Findings and FRA Opinions

Inadequate Resources: The report identifies that inadequate resources, both financial and human, are a significant obstacle for DPAs. Despite an overall increase in budgets and staff, most DPAs report insufficient resources to handle their growing workloads. This inadequacy affects their ability to perform tasks such as complaint handling, awareness raising, and independent investigations.

High Volume of Complaints: DPAs face challenges managing large volumes of complaints, including many trivial and repetitive ones. This issue forces DPAs to prioritize complaints over other regulatory tasks, which compromises their ability to conduct proactive investigations and provide comprehensive advisory services.

Public Awareness and Understanding: There is a gap between public awareness of data protection laws and actual understanding. While many individuals are aware of the GDPR, the specifics of their rights and the obligations of data controllers remain unclear to them. This contributes to the high volume of complaints and highlights the need for better public education on data protection matters.

Technological Challenges: New technologies, particularly AI and complex data-processing systems, pose significant challenges for DPAs. The report suggests that the GDPR alone is insufficient to address these challenges effectively. DPAs require additional technical expertise and resources to oversee the implementation of these technologies properly.

Cooperation and Tools: The report emphasizes the importance of stronger cooperation between DPAs and the need for additional tools to enhance their supervisory capacities. The European Data Protection Board (EDPB) plays a crucial role in facilitating this cooperation, but it also needs adequate resources to support its activities and assist national DPAs effectively.

Recommendations

The FRA provides several recommendations to address these challenges:

• Increased Resources: Member States should ensure that DPAs have sufficient financial, human, and technical resources to fulfill their mandates.
• Enhanced Tools: The European Commission and EDPB should consider introducing new tools and procedures to support DPAs in their investigatory and supervisory tasks.
• Public Education: Efforts should be intensified to improve public understanding of data protection laws and the specific rights and obligations under the GDPR.
• Technology-Specific Guidance: The EDPB should develop further guidance on the application of the GDPR to new and emerging technologies to help DPAs manage these complex areas effectively.

The report concludes by acknowledging the efforts of Member States to increase DPA budgets and staff but highlights the ongoing need for significant improvements to ensure the effective implementation of the GDPR across the EU.

👉 Read the report here.