The General Data Protection Regulation (GDPR) celebrates the fifth anniversary of its implementation on Thursday, 25 May. Although considered to be a “landmark legislation”, it continues to face challenges as far as its application is concerned.
Towards better harmonisation?
National data protection authorities, under the aegis of the European Data Protection Board (EDPB), are responsible for implementing the GDPR. Yet, as early as 2020, the European Commission identified a series of shortcomings in its implementation that were notably linked to differences in interpretation and obstacles to cross-border cooperation (see EUROPE 12513/10).
The institution thus intends to present, by the end of June, legislation aiming to harmonise how the GDPR is applied across the European Union (see EUROPE 13130/25). In particular, it will concern “harmonis[ing] certain procedures of cooperation between data protection authorities on cross-border cases—of which there have been more than two thousand since 2018”, explained Commissioner for Justice Didier Reynders and Vice-President for Values and Transparency Věra Jourová in a joint statement.
Insufficient resources?
They also reiterated that national data protection authorities must be equipped with “adequate resources”. This is notably one of the demands made by MEP Birgit Sippel (S&D, German), who is active on digital issues and believes that some of the shortcomings in the GDPR’s implementation are linked to the lack of resources to “monitor compliance”.
Thus, while she conceded that the record fine the Irish authority imposed on Meta was an “important decision”, she stressed that it took 10 years for the process to come to a successful conclusion. Likewise, noyb—an association led by activist Max Schrems—sees it as “an example of enforcement not working” (see EUROPE 13185/4).
It should be noted that, according to the commissioner and the vice-president, over €2.5 billion in fines have been imposed under the GDPR since it came into effect.
The European Commission will present its next report on the implementation of the GDPR in 2024. (Original version in French by Hélène Seynaeve)