Civil society call and recommendations for concrete solutions to GDPR enforcement shortcomings

With the General Data Protection Regulation (GDPR), the European Union (EU) has successfully increased data protection standards, bolstered awareness and created a ripple effect beyond the EU. Thanks to the efforts of policy-makers and civil society, the GDPR is reshaping the way companies and governments handle people’s information and gives individuals more control over the use of their own personal data. The GDPR holds a genuine potential to put an end to data-exploitative business models and to shift the balance of power in favour of data subjects, responsible companies and governments. EDRi members call on the European Data Protection Board (EDPB), the European Commission, and all national data protection authorities (DPAs) to urgently address the structural and procedural enforcement issues that prevent the GDPR from fully reaching its potential.

Almost four years after the entry into force of the GDPR, we celebrate the collective achievements of the law and take stock of the persisting shortcomings in its enforcement. While new record high fines were handed out in 2021 and an increasing number of decisions have been issued, we observe several barriers to the effective exercise of people’s rights, including their access to remedy and a lack of harmonisation in the enforcement mechanism.

For the rights and requirements of the GDPR to be delivered and realised, DPAs and the EDPB must have the necessary resources to act and national procedures for enforcement must be harmonised. Based on our experience with GDPR implementation and enforcement, we believe that our recommendations would go a long way to improve its enforcement.EDRi recommendations for better GDPR enforcement.