An analysis of the newly proposed rules to strengthen GDPR enforcement in cross-border cases

Summary:

After years of pressure from civil society organisations and the European Parliament, in 2023 the European Commission tabled a proposal to improve the General Data Protection Regulation (GDPR) cross-border enforcement procedure. The proposal lays out detailed and innovative rules that would promote harmonisation, yet this analysis shows that more could be done to deliver on the promise of strong and timely enforcement. It follows from the nature of the Commission's targeted approach that the scope of the envisaged regulation is limited and therefore some GDPR enforcement issues would remain outside its boundaries. It is much less apparent whether the proposed rules would achieve their desired effect. Building on two related EPRS briefings that explain the proposal's logic, context and reception, this analysis uncovers a host of shortcomings. Contrary to political announcements, the proposal may actually slow down cross-border enforcement and deepen discord among supervisory authorities, not least by introducing additional procedural steps and ambiguous terms and by weakening the role of the supervisory authorities concerned and that of the European Data Protection Board.

• Alternative Source 1