The EU's General Data Protection Regulation is meeting most of its objectives, with the creation of a strong culture of data protection with enforceable rights, an evaluation of the regulation found. Two years after the landmark regulation took effect, the first major evaluation found that more work is needed still to ensure the rules are applied uniformly across the EU and cross-border cases are handled more efficiently.
In a statement on the evaluation report, the European Commission praised the GDPR as a "reference point around the world" for a high level of personal data protection. In addition to strengthening citizens' rights and raising their awareness on key elements of digital services, the regulation is creating a new governance culture among businesses, the Commission noted. Some companies have started to compete based on the high level of data protection provided, and concepts such as privacy by design are inspiring new forms of innovation.
The main challenge since the GDPR took effect in 2018 has been enforcement. Most national data protection regulators have needed a big increase in staff and budgets in order to handle the jump in GDPR-related complaints and investigations. Overall, there has been a 42 percent increase in staff and 49 percent rise in budgets for all national data protection authorities together in the EU between 2016 and 2019. However, there are still "stark differences" across the member states, the report found.
The national authorities are also struggling with the 'one-stop shop' concept, which allows companies operating in multiple countries to answer to a single national regulator where they are based. Only 79 decisions had been issued in such cross-border cases as of the end of 2019. In particular, the Irish regulator has come under fire for its slow investigation of complaints against big multinationals such as Facebook and Google. The handling of cross-border cases "calls for a more efficient and harmonised approach and an effective use of all tools provided in the GDPR for the data protection authorities to cooperate," the Commission said.
The European Data Protection Supervisor, which helps coordinate EU policy on data protection, said it agreed with the Commission's positive evaluation, while noting that the "consistent and efficient enforcement of the GDPR remains a priority". The EDPS called for more "solidarity" among countries and said it supported the idea of setting up a pool of experts that can help national authorities when they are dealing with complex and demanding cases.
Additional evaluations of the GDPR will be conducted every four years going forward.
