DPAs’ investigative powers are described in Article 58 of the GDPR. When asked about their experiences of using these measures, most interviewees agreed that the compliance model and investigatory tools are adequate and sufficient. However, not all DPAs enjoy access to the techniques necessary for the practical implementation of these powers.

Conducting supervision is particularly challenging without adequate resources. This includes human resources (the capacity of DPAs to recruit IT experts, for example), financial resources (the capacity of DPAs to schedule more on-site investigations, for example) and technical resources (the capacity of DPAs to invest in specific software to support their investigations involving hardware and electronic devices). Some interviewees emphasised that, with a reinforced team, their DPA would be able to diversify and, ultimately, strengthen their investigatory methods.

In addition, several interviewees pointed out that, based on their experience, Article 58 lacks concrete investigative techniques that would be useful in data protection-related contexts. For two interviewees, the main challenge lies at the very beginning of the investigation: the identification of the data controller, notably when it comes to online platforms, applications or social networks. In their view, there are no techniques that would support them in doing this in an effective and timely manner.

Some interviewees regretted that neither the GDPR nor the national legislator has provided their DPA with additional concrete investigatory tools, such as the ability to search under a false name, consult computer sites under a client’s name, or make purchases under a concealed identity. In addition, several respondents flagged the question of the admissibility of evidence in the digital era as an issue where DPAs lack guidance. DPAs are left alone to ‘decide how far they should go to prove a violation, how much information is enough to prove systematic problems’.

Actions and functions set by the GDPR are too general. Those are interpreted in the national regulation. And this is where problems start to arise. It is not about the GDPR competency or scope, but it is about the scope of the national regulation. Often problems are related to the fact that we (at the national level) do not have the right tools. It would be more beneficial if the GDPR would describe more concrete tools that could be used by the DPAs.

An EU DPA staff member

Several interviewees highlighted that investigations – both national and cross-border – can be hindered by a too-narrow scope. One explained that their national law does not permit them to extend the scope of the procedure during the investigation.

This issue was raised in the context of handling cross-border cases in particular, with DPAs involved in cases having different rules on extending the scope of the investigation. Despite the mechanisms developed in the GDPR to simplify and harmonise the handling of cross-border cases, difficulties concerning the scope of investigations that have prevented several cases from being resolved in a smooth and timely manner remain. This issue was acknowledged quite early on by DPAs and has been discussed in several EDPB meetings [71]
 EDPB, Minutes of the 43rd plenary meeting, Section 4.1.3, 15 December 2020. See also EDPB, ‘EDPB moves ahead with closer cooperation on strategic cases’, press release, 2022; and EDPB, ‘Swift adoption of regulation to streamline cross-border enforcement needed’, press release, 2023.
. It is one of the key proposals of the European Commission’s 2023 proposed regulation [72]
 Commission proposal for a regulation laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 (COM(2023) 348 final).
.

Several interviewees consider it important to involve data controllers during investigations, including by developing informal contacts with data controllers. Conditions for collaborating with third parties are essential and, therefore, should be better addressed in the GDPR, according to some interviewees.

We are sometimes trying to ease some of these bureaucratic hurdles by having direct exchanges with the controller and with the individual. … There is a large number of cases where, with just one phone call from us, the matter is sorted out. It is not formalistic, but it is effective.

An EU DPA staff member

Most interviewees cited data controllers’ lack of cooperation as their main challenge. For some interviewees, the fact that the DPA cannot perform checks without warning data controllers about its visit is counterproductive, as they may delete or hide relevant information.

What the GDPR says in Article 58 is good; the DPA’s procedure is also good – the problem that the DPA is facing in the field is the lack of interest from the data controller.

An EU DPA staff member

Several interviewees highlighted that the GDPR does not provide any leverage in cases where data controllers refuse to cooperate with the DPA. DPAs are mostly affected by this when attempting to access to relevant documents, but one interviewee said that they also encounter this difficulty when they are assessing a data controller’s claim that data cannot be shared for reason of confidentiality. One expert clarified that this absence of leverage generally results in the initiation of additional proceedings for failure to cooperate with the DPA, which significantly extends the time of the proceedings that have been initiated.

This is probably the biggest problem that we face, namely the data controllers – either not providing that information or providing low-quality information. The long delays in the information that you get from the data controller. That is probably one of the main reasons why quality can sometimes be compromised and [why] certain investigations are very stretched out in time.

An EU DPA staff member

Some interviewees considered the inclusion of sanctions in national legislation as good practice when data controllers refuse to cooperate. However, one interviewee highlighted that, despite the sanctions included in their national legislation in cases of non-cooperation, some data controllers only allow access to their premises when DPA staff are accompanied by a police officer. Other interviewees underlined that it is good practice to establish a good relationship with the police for this purpose.

All in all, investigations are dependent on data controllers sharing relevant information with the DPAs, as emphasised by one interviewee. DPAs that do not have the technological and/or human resources to conduct further audits must rely on the information provided to them by data controllers.

Our biggest challenge lies in the technological retrieval of data – and the police have the know-how for this. This expertise is something we lack. If we were to carry out an unannounced inspection and copy the server to verify what data are stored there, it would require certain technical know-how to be able to crack it and get the necessary security credentials.

An EU DPA staff member

Another interviewee regretted that, in many Member States, obligation to cooperate in an investigation is limited to data controllers and data processors, when it could greatly benefit the investigation to extend the duty to collaborate to every person or institution of interest.

Finally, some interviewees pointed out the difficulty of dealing with data processing by individuals. Unlike legal entities, individuals generally process personal data at home rather than in a public office. In such cases, the power of the DPA to access premises can conflict with individuals’ right to inviolability of the home. If the person does not grant access voluntarily, the only way for the DPA to exercise its powers is to obtain permission from the court, which is a lengthy process, and may give individuals time to destroy evidence. For one interviewee, such situations leave an impression of impunity, undermining the effectiveness of the sanctions, which are either delayed by more than a year or not imposed at all.

The GDPR is built as a legal act limiting big data controllers. But we need to apply it to trivial cases. The majority of cases are about settling disputes between two natural persons... Application of a legal act aimed at something big to small cases is complicated.

An EU DPA staff member

Most interviewees highlighted how their capacity to supervise the enforcement of the GDPR was jeopardised by the large number of complaints they continue to receive on a regular basis. For several interviewees, lack of resources remains the main issue challenging their ability to comply fully with their supervisory obligations. In some cases, DPAs have to request the support of colleagues from other departments/specialities in supervision tasks related to the handling of complaints, to compensate for its lack of human and/or technical resources. Furthermore, some investigatory techniques that could help process complaints in a swifter manner are not being used due to the lack of appropriate experts in-house.

In two cases, interviewees stated that a lack of human and financial resources also prevents them from conducting inspections across the whole country. To overcome this, one interviewee said that they ask notaries to conduct on-site investigations for them, but that they do not consider this good practice, as notaries and their colleagues may not have the expertise and technology that the DPA needs to efficiently conduct the inspection. The interviewee highlighted the fact that ‘in many cases, the notary’s on-site inspection is useless; therefore, we end up having to go there to conduct the investigation’.

Several respondents stressed that, when it comes to the obligation of DPAs to respond to data subjects, a less stringent set of rules and more efficient criteria should be provided, as DPAs differ in size, level of resources and degree of governmental support.

In this regard, there is a notable tension between Article 77 of the GDPR, which states that all complaints must be processed, and Article 57(1)(f) of the GDPR, which indicates that complaints must be processed to the extent necessary. Does every individual complaint need to undergo the litigation process, or is there a prioritisation to be made? This type of discourse is touchy, but in any case, a structured approach to complaints must be organised in a reasonable and rational manner by each national legislator.

An EU DPA staff member

A few interviewees mentioned that national legislation prevents them from using the full spectrum of levies in cases involving public administrations. In one case, the interviewee criticised the fact that their powers for supervising public bodies in charge of security or human rights-related matters, such as ombudspersons, have been greatly reduced. Similarly, two interviewees from the same Member State highlighted the opt-out of the public sphere from administrative punishment altogether as ‘a major loophole’ in the GDPR. Some interviewees regretted that public authorities cannot be fined.

There are now certain limitations here that did not exist before. There has been a considerable reduction in the control of the DPA over (public bodies), which I do not think is appropriate. In general, it is not okay for anybody to be exempt from the DPA’s oversight. What the GDPR has stipulated, that DPAs are not competent for the courts when they are adjudicating in court cases, is fine. However, it is not fine that a body remains outside the scope of the DPA.

An EU DPA staff member

In a recent judgment, the CJEU clarified that a parliamentary committee of inquiry set up to supervise the executive power must respect the GDPR – as long as the purpose of their inquiry is not to safeguard national security [73]
 CJEU, ‘A parliamentary committee of inquiry must in principle comply with the general data protection regulation’, press release, Luxembourg, 2024.
. Public bodies that operate in fields related to national security are not de facto exempted from the GDPR. Each data processing activity must be assessed individually, and the public body is only exempt from GDPR provisions in cases where data processing activities are intended to safeguard national security.

Article 62 of the GDPR allows DPAs to conduct joint operations involving two or more EU DPAs, either joint investigations or joint enforcement measures. For a joint operation to take place, certain conditions need to be fulfilled. Five joint operations were initiated between 2018 and 2023, according to the EDPB’s annual reports [74]
 EDPB, Annual Report 2021, 2022, p. 66; EDPB, Annual Report 2020, 2021, pp. 55 and 68; and EPDB, Annual Report 2019, 2020, pp. 29 and 31.
and its contribution to the report on the application of the GDPR under Article 97 [75]
 EDPB, Contribution of the EDPB to the report on the application of the GDPR under Article 97, 2023.
.

Joint operations could be a useful tool for DPAs to strengthen mutual learning and understanding of the application of the GDPR, according to some interviewees. A couple of respondents argued that since joint operations are not an established practice, DPAs might not be inclined to resort to them.

Several respondents challenged the practical applicability of joint operations and pointed out five reasons why they are significantly underused.

1. A large majority of interviewees claimed that effective implementation of joint operations, including joint investigations, would require the EU to harmonise administrative rules and procedures. At present, DPAs must follow national procedures, which are Member State specific. Procedural challenges may arise concerning admissibility of complaints, which range from formal handwritten or electronically signed submissions in some Member States to less formal email submissions in others. Different administrative deadlines to comply with, and differences in the procedural rights of the complainant, might also hinder effective coordination among DPAs. Generally, national laws do not often permit public officers from other countries or other authorities to participate in on-site inspections, due to confidentiality clauses and non-disclosure obligations.

Even among comparably similar national legal systems, these [joint operations] can be problematic.

An EU DPA staff member

2. Multiple interviewees agreed that joint investigations are resource-intensive, in terms of both human and financial resources. They often concern complex cross-border cases, requiring specialist legal knowledge, or sometimes IT expertise. These resources are already under strain at most authorities, as Section 1.1 of this report highlights. Significant financial and staffing constraints do not allow for spare capacity for external endeavours, particularly if this involves redirecting legal or IT experts. One respondent reported an instance when a joint investigation was not initiated for these reasons, and added that there should be a special team of employees for joint investigations.

Speaking about joint investigations, the problem of lack of resources is relevant again. The DPA is a bit reluctant to initiate a joint investigation or participate therein, because such investigations will normally be needed for big cases, and they require a lot of resources. If the DPA joins one joint investigation, it might need to put on hold some national cases. This is something that can benefit more the large DPAs – with more resources.

An EU DPA staff member

If seven people work on investigations in the whole of the country and that is not enough to meet all [national] needs, then it is difficult or impossible to conduct joint investigations outside the country.

An EU DPA staff member

3. The employment relationship between the lead DPA and the experts deployed from other DPAs remains unclear, according to one interviewee. National rules and practices might regulate the remuneration of external public officers and their secondment differently, and in the absence of a common approach a memorandum of understanding or other arrangements should be in place before undertaking joint operations.
4. Some interviewees mentioned that identifying and using a common work language in joint operations was challenging. Language skills and knowledge might vary among DPA officers, and official documents might be available only in the national language. Interpretation and translation should be provided, although the language of the data subject should be used when delivering decisions.

It is possible to prepare and coordinate a document in English, but then it has to be translated into a national language and presented as a decision from one Member State’s authority. So something as simple as that can influence the decision to cooperate.

An EU DPA staff member

5. Some interviewees claimed that there is an imbalance between relatively well-funded DPAs (that have the necessary resources to respond to cross-border cases without seeking the support of other DPAs) and DPAs with fewer resources (that might need support but might find it difficult to get involved because of a lack of resources).

From the perspective of a smaller data protection supervisory authority and a smaller EU Member State, I understand that for the supervisory authorities of Member States that have a much larger role, are bigger, have 10 times as many employees – joint investigations are probably not their priority when they have their own investigations in which they issue fines of hundreds of millions of euros. To put it in simple terms, these (joint investigations) are not high on their priority list. Perhaps they could assign a few employees to handle such cases as part of their activities, in order to enable smaller supervisory bodies, in terms of population and number of employees, to participate more promptly and adequately.

An EU DPA staff member

In addition to these practical difficulties, several interviewees argued that formal ways of cooperating under the GDPR do not lead to swift cooperation schemes, particularly in the framework of joint operations. Formal requirements combined with different interpretations of the GDPR risk prolonging the decision-making process in cross-border cases requiring an urgent response. Some interviewees considered that informal ways of cooperating can deliver better and more timely results. A few cooperation models have been tested in practice, as described in the boxes below.

Joint investigations are difficult in any case as every country is different, it has different companies, etc., so these investigations would never end if DPAs would do it jointly. In small groups it is doable; for example, the Baltic countries have a more similar culture and procedural rules.

An EU DPA staff member

Several interviewees referred to the DPAs’ commitment to fostering joint operations in cross-border cases, as expressed in the ‘Statement on enforcement cooperation’ in April 2022 [76]
 EDPB, Statement on enforcement cooperation, 28 April 2022.
. Some suggested that the following could be further explored in the short term, with EDPB support:

• the identification of strategic priorities for cross-border cases when initiating joint operations;
• the collection of information on best practices from initiatives similar to joint operations;
• the development of an example of a joint investigation; the EDPB secretariat could take the initiative to conduct a joint investigation in a Member State to elaborate on the methodology for joint investigations and identify key procedural steps and resource needs;
• the development of training activities; the EDPB secretariat could facilitate training for all DPAs, to develop a common understanding and find a solution for practical issues in joint operations.

Most interviewees supported reform of the GDPR to set out a uniform procedure, binding at the EU level, that harmonises procedures and rules. A few interviewees underlined that ‘binding’ procedural mechanisms may be constitutionally challenging if, for instance, the supervisory authority from one Member State was able to conduct investigations in another Member State without the approval of its authorities.