GDPR Procedural Regulation Will Worsen Privacy Enforcement, Group Says

A European Commission-proposed GDPR procedural regulation aimed at simplifying enforcement among national data protection authorities (DPA) is now under negotiation by the EC, European Parliament and Council, Noyb noted. But, it said, the final talks in this trilogue have led to a "legislative mess that will likely make procedures more complex, slower and prone to legal challenges."

The GDPR envisions that DPAs will cooperate on enforcement, but it doesn't explicitly explain how, Noyb said. National procedures, such as for sharing evidence or for formally issuing valid decisions, differ, and even basics such as sharing information about a case with other DPAs don't work in practice, it added.

That has led to "extremely slow GDPR procedures, lost documents and failed enforcement actions," Noyb said. When the EC said it would fix the problems, it promised to achieve effective enforcement through faster, streamlined and simpler processes. As things stand, however, the EU institutions are about to produce an even more complex, inflexible and inconsistent "procedural nightmare" that will harm GDPR enforcement.

Among other problems, Noyb said, is the fact that the EC never conducted a proper impact assessment and stakeholder engagement before floating its proposal. Another is that the parties to a data protection complaint should be involved in the case as early as possible, not after a DPA has already issued preliminary decisions.

Another issue is a lack of procedural know-how by the EC, Parliament and Council, Noyb said. Procedural law is the domain of national governments and is generally dealt with by lawyers with expertise in the subject, it noted. In addition, the organization said, there doesn't seem to be a final resolution on deadlines for enforcement procedures.