The responses received by FRA concerning the EDPB were mostly positive. Several interviewees – notably from smaller Member States – said that the EDPB is playing a positive role in reinforcing the cooperation, exchanges and discussions between them. Specifically, they said that the pilot exchange programme [114]  EDPB, Annual Report 2019, 2020, which includes details of the 2023-2024 work programme; and EDPB plenary minutes. is a good source of expertise from more experienced DPAs. The EDPB’s secondment programme was established in 2019. Paused during the COVID-19 pandemic, it started again in a pilot phase in 2022 and will be deployed throughout 2023 and 2024. The programme aims to facilitate the exchange of staff members, for a short period of time, between authorities.

The EDPB works as a discussion forum, where the national supervisory authorities can share information and discuss topics of interest such as national practices, differences in the national procedural rules, and protocols.

An EU DPA staff member

The second aspect of the EDPB that was praised by interviewees is the number of opinions, guidelines and guidance documents it produces (see Figure 1). Several interviewees underlined how useful the guidance is in supporting their work, highlighting some of them in particular. The usefulness of the EDPB’s guidelines on the enforcement of sanctions and fines was often mentioned, but also its guidelines on the transfer of data to non-EU countries and those on measures to supplement transfer tools to ensure compliance with the EU’s level of protection of personal data. One interviewee also mentioned an example of positive collaboration with the EDPB in a case where they asked for further information on a procedure that lacks detail in the GDPR. Another interviewee highlighted the work conducted within the EDPB subgroup as ‘becoming more and more important for day-to-day enforcement issues’. Some interviewees mentioned that they often use, or refer to, EDPB guidelines to inform data controllers. Finally, some interviewees also highlighted the EDPB initiative to create a pool of experts, allowing DPAs to call on experts with specific professional backgrounds to complement their work.

For some interviewees, the EDPB’s work in this regard is particularly important, as it supports, from a more global perspective, the aim of the GDPR to effectively harmonise data protection across the EU, despite Member States’ procedural differences. One interviewee said that ‘the EDPB guidelines allow [us] to find a common starting point’.

Figure 1 – EDPB documentation published, 2021 to 2023

Number of opinions, general guidance (including guidelines) and binding decisions published by the EDPB, per year.

Sources: EDPB, ‘Guidelines, recommendations, best practices’, 2024; EDPB, ‘Binding decisions’, 2024; EDPB, ‘Opinions’, 2024.

The EDPB does a great job of establishing a uniform approach; however, the lack of an EU-level uniform procedural code is still an obstacle that even the EDPB cannot overcome.

An EU DPA staff member

Several interviewees praised the work of the EDPB while noting that the secretariat is understaffed. One said: ‘The secretariat is generally found to be reliable, neutral and unbiased’. Interviewees said that the secretariat provides DPAs with ‘a very high level of expertise’, and, in short, that ‘the role of the EDPB secretariat is the very heart of the EDPB’.

The EDPB secretariat does a great job. It facilitates national data protection authorities in cooperation with tools. It is understaffed, but the people working there are very competent and dedicated.

An EU DPA staff member

The EDPB secretariat is key and has so far duly responded to its mission despite its own understaffing problems.

An EU DPA staff member

One interviewee also said that, while ‘the system is not perfect and needs some fine-tuning, the EDPB is proactive in seeking feedback, comments and proposals for improvements’.

However, despite interviewees’ generally positive views on the EDPB, several of them also highlighted that they expect the EDPB to reinforce its role in several aspects. The next section outlines recommendations proposed by some of the interviewees.

While the majority of respondents generally praised the numerous guidelines produced by the EDPB as a useful tool to support both their work and their awareness-raising activities, some interviewees suggested that these could be improved by enhancing their quality and developing more practical (less theoretical/broad) guidance. One interviewee mentioned that, in their experience, the guidelines are ‘massive’ and ‘unapproachable for audiences without legal training’.

Practically, the data controller does not know how to implement what the EDPB recommends.

An EU DPA staff member

The guidelines of the EDPB are there, but there might be small details in cases examined at the national level that differentiate a case from the other and can change the entire picture.

An EU DPA staff member

The EDPB has issued opinions that are interesting and useful to some extent, but, when you see their examples, they are rather easy cases and do not reflect what usually happens in practice.

An EU DPA staff member

The issue of resources was also raised by several DPA staff members when discussing the EDPB. While the board is praised for the amount of work it produces, several interviewees voiced concerns about the considerable amount of additional work for DPAs that the EDPB’s related tasks represent, stating that they invest ‘heavily’ in the EDPB’s work. This was raised not only by interviewees from smaller EU Member States; however, interviewees from smaller Member States expressed regret that their current size is preventing them from participating in all EDPB activities as they are expected to.

Due to the lack of resources, the DPA does not get as involved in the cross-border cases and into EDPB work as it could.

An EU DPA staff member

Some interviewees highlighted the inner bureaucracy of the board, which affects the speed of its processes, with one mentioning up to ‘400 meetings’ to discuss similar topics. One interviewee believes that ‘during the elaboration of the EDPB documents too much attention is paid to some petty issues’.

The EDPB could work more to make the processes more effective in their entirety, everything from plenary meetings to more strategic discussions of the large problems facing the EU.

An EU DPA staff member

Some interviewees were more pessimistic about the ability of the EDPB to overcome the inherent complexities of its tasks. One interviewee insisted that the significant differences between DPAs, notably in terms of human resources, cannot be overcome through cooperation within the board.

Some interviewees suggested ways of furthering the positive impact of the board. For several of them, the Internal Market Information System (i.e. the IT platform helping national authorities across the EU to cooperate and exchange information) is not user-friendly enough and should be revised. Some interviewees also emphasised that the case database should be more consistent and could also include statistics/metrics on the DPAs’ work. Finally, one interviewee believed that exchanges within the EDPB could be more transparent.

The current case database available on the EDPB’s website is sporadic and does not necessarily contain all decisions a national DPA may find relevant and important.

An EU DPA staff member