In 2023, 20 DPAs considered their funding to be insufficient, according to data gathered by the EDPB [42]
 EDPB, Contribution of the EDPB to the report on the application of the GDPR under Article 97, 2023, p. 33.
. Other studies and reports have also documented the inadequacy of DPAs’ financial resources to be able to perform their tasks over the years [43]
 EDPB,Contribution of the EDPB to the report on the application of the GDPR under Article 97, 2023, pp. 15 and 31; EDPB, Overview on resources made available by Member States to the data protection authorities and on enforcement actions by the data protection authorities,2022, p. 5; EDPB, Overview on resources made available by Member States to the data protection supervisory authorities, 2021. See also Commission staff working document accompanying Commission communication – Data protection rules as a pillar of citizens empowerment and EUs approach to digital transition – Two years of application of the general data protection regulation (SWD(2020) 115 final), Chapter 2.4; Council of Europe, Report on the Funding of Data Protection Authorities, Strasbourg, 2021.
.

A large majority of interviewees stated that, overall, DPAs’ budgets were increased after the entry into force of the GDPR. Nonetheless, this increase has not enabled DPAs to expand their institutional capacity sufficiently to carry out all the tasks and exercise all the powers set out in Articles 57 and 58 of the GDPR [44]
 Art. 57 of the GDPR outlines DPAs’ tasks, such as monitoring and enforcing the application of the GDPR, promoting public awareness, providing advice to the national parliament and the government, and dealing with complaints lodged by data subjects. Art. 58 lays down the investigative, supervisory, authorisation and advisory powers of DPAs.
. This was mentioned repeatedly during the interviews, including by interviewees working in DPAs that have received significant increases in budget and staff in the last few years. In two DPAs, respondents had diverging views on this issue: while legal officers stated that they were unable to initiate certain investigations on their own initiative due to lack of resources, their managers considered that resources were sufficient.

Insufficient funding was the main cause of staffing shortages (as Section 1.1.2 further explains) and lack of adequate technical equipment. However, the latter is necessary to conduct investigations and supervise innovative technologies. Some interviewees illustrated this by highlighting that, currently, they cannot step up the digitalisation of complaint forms, overhaul their databases or purchase portable forensics devices to carry out on-site investigations.

Some respondents considered national resource audits a valuable tool to assess whether DPAs are equipped with the resources they need to function according to their tasks and mandate, as the box Promising practice: audits and external evaluations assessing adequacy of resources and needs explains.

The GDPR requires that DPAs are adequately staffed [45]
 GDPR, Art. 52(4).
and that ‘each Member State shall ensure that each supervisory authority chooses and has its own staff which shall be subject to the exclusive direction of the member or members of the supervisory authority concerned’ (Article 52(5), GDPR) [46]
 GDPR, Art. 52(5).
.The extent to which DPAs are able to exercise and enjoy independence regarding all aspects of their staff is also critical to their ability to carry out their functions effectively and independently. In 2012, in European Commission v Republic of Austria, the European Court of Justice clarified that ‘… the attribution of the necessary equipment and staff to such authorities must not prevent them [DPAs] from acting “with complete independence” in exercising the functions entrusted to them within the meaning of … Directive 95/46’ [47]
 CJEU, C-614/10, European Commission v Republic of Austria, 16 October 2012, paragraph 41.
.

Since 2010 [48]
 FRA, Access to data protection remedies in EU Member States, Publications Office of the European Union, Luxembourg, 2014, p. 9; FRA, Data Protection in the European Union: The role of national data protection authorities – Strengthening the fundamental rights architecture in the EU II,Publications Office of the European Union, Luxembourg, 2010, Chapter 4.1.1.
, FRA has documented inadequate staffing levels at most EU DPAs. The EDPB has also reported over the years that an overwhelming majority of DPAs do not possess the necessary human resources to carry out mandatory activities under the GDPR – with 24 DPAs stating that they were understaffed in 2022 and 23 DPAs stating the same in 2023 [49]
 See EDPB, Contribution of the EDPB to the report on the application of the GDPR under Article 97, 2023, p. 33;EDPB, Overview on resources made available by Member States to the data protection supervisory authorities, 2022, p. 5; EDPB, Overview on resources made available by Member States to the data protection authorities and on enforcement actions by the data protection authorities, 2021.
.

Most respondents stressed the unavailability of sufficiently qualified personnel to perform DPAs’ functions properly. Interviewees from DPAs in only six Member States considered that their DPA had the necessary staffing level to effectively carry out its mandatory functions.

Several challenges related to securing an adequate number of qualified staff were mentioned to FRA. Understaffing was often linked to underfunding by the state. In a couple of Member States, respondents noted with concern that other national agencies and bodies with a supervision mandate were better staffed than the DPA.

Inadequate staffing also results in gaps in technical and legal expertise. This expertise is crucial to addressing challenges stemming from the use of new technologies to perform complex data processing – such as data-intensive online platforms. In almost 10 Member States, interviewees stressed that there were too few information and communications technology (ICT) experts.

Specialised expertise was necessary, for example, when analysing the proposal for transferring public administration data into the cloud. Analysing this governmental ordinance required a thorough understanding of the regulated aspects from a technical perspective.

An EU DPA staff member

In at least eight Member States, interviewees reported that it is difficult to hire qualified professionals with adequate data protection knowledge and ICT expertise, particularly if recruitment is carried out through general public administration competitions, which several DPAs have to rely on when selecting new staff. Insufficient legal expertise affects DPAs’ ability to deliver on their advisory function, to the point that, in one Member State, the DPA referred data controllers to EDPB guidelines when providing advice on new technological developments in almost every case.  Chapter 3 of this report further explores the impact of inadequate staffing levels on DPAs’ advisory role, while Chapter 4 looks in more detail at DPAs’ capacity to effectively contribute to EDPB activities.

These data protection topics are very specific and are not widely known. It is not like hiring professionals in the area of accounting or human resources; there is not a broad availability.

An EU DPA staff member

Recruitment and retention of qualified staff was found to be a major challenge which was repeated by multiple interviewees.  Low remuneration and less advantageous working conditions were often cited as the main reasons. In some cases, DPAs are limited by national recruitment rules from offering competitive remuneration. In at least eight DPAs, interviewees stressed that ICT specialists with high salary expectations would move to the private sector after being trained at the DPA. Attracting and retaining competent staff in this field was highlighted as a key issue in Member States with an overall shortage of ICT experts. One interviewee lamented the fact that specialist staff working at the DPA were not allowed to receive higher wages, as staff working for some other public agencies did.

The main issue we have faced is the low pay of staff over the last 4–5 years. We experienced high personnel turnover in the complaints and investigations unit. Only two colleagues have been in the DPA for more than 6 years. In the past 2 years, we have seen a 30 % increase in staff, but some colleagues have left within a year of employment. The main reason, that they share informally, relates solely to remuneration, which is too low for the expected expertise and workload.

An EU DPA staff member

The DPA makes great effort to attract skilled workers. The DPA competes for experts with the private sector – during both recruitment and retaining processes. The DPA’s experts are highly valued employees for private companies. The DPA has two IT experts, which is insufficient.

An EU DPA staff member

The DPA often hires personnel without previous experience. They receive training, and they are in demand in the private sector within 3–4 years and often leave, especially lawyers.

An EU DPA staff member

In a few Member States, it was observed that staff recruited from the public administration pool seek to move to other public institutions shortly after their recruitment. They often move to services that better match their education and professional backgrounds. In general, the extreme workload affects staff performance and mental well-being in some Member States, it was reported to FRA. Legal experts often struggle to handle the high number of complaints and carry out investigations in complex areas of law. Often, backup systems to cover absences are not in place; as a consequence, many professionals leave.

To address insufficient human resources, staff are obliged to optimise performance and invest more time beyond regular working hours. This, however, is not necessarily a good practice.

An EU DPA staff member

Several staff members from the DPA fell sick with burnout, which peaked last year, leading to long-term absences. The colleagues, who remained in service, experienced stress-related consequences (such as weight gain).

An EU DPA staff member

Constant changes in personnel hinders DPAs’ ability to develop a consistent approach to exercising their mandate. Staff turnover may also affect their overall autonomy, objectivity and coherence when exercising their powers. For example, several interviewees mentioned that regular participation in EDPB activities was disrupted by frequent staff changes. Others said that this issue limits their ability to supervise evolving technological developments. Finally, the regular transfer of DPA employees to other public services or the private sector may also affect DPAs’ perceived independence.

It is hard to find a data protection specialist without any links with some stakeholders in the field and who would not be in a conflict of interest.

An EU DPA staff member

Adequacy of human resources is the major shortcoming. The recruitment system publishes the posts and recruits the staff, and a few months later, after investing in his/her training, the officer moves to another post in the civil service. The only solution is to republish the vacancy and reinvest in a new officer. The DPA’s performance is not negatively impacted, but, with more permanent, experienced officers, the authority could have a greater role in the EDPB subgroups.

An EU DPA staff member

Several DPAs were forced to prioritise certain tasks over others and were not able to fulfil their entire mandate as a result of resource constraints. Complaints handling is usually prioritised, according to many interviewees [50]
 For further details on complaints handling under the GDPR, see Art. 57(1)(f), Art. 77 and Art. 78(2).
. Interviewees said that a lack of resources meant that it was difficult to perform certain tasks, such as carrying out rights-awareness campaigns; providing advice on GDPR compliance to legislators; and providing information to data subjects about their rights and to private bodies about their obligations. Chapter 3 of the report examines this in more detail. Interviewees in several Member States also highlighted that limited time and reduced capacity adversely affected the number of ex officio investigations that their DPA could undertake into the proper application of the GDPR, putting at risk their oversight function, as Section 2.3 further explains.

There is a fundamental problem with the tasks entrusted to the DPA by the GDPR. To be able to fulfil all the responsibilities listed under Article 57 of the GDPR, considerably more personnel would be required. Therefore, mandatory tasks are prioritised while secondary tasks are handled with remaining resources. Complaints handling is a high-priority task … .

An EU DPA staff member

 What the DPA would really like to do is to provide unsolicited advice, but, due to capacity problems, we don’t manage to do so.

An EU DPA staff member

A shortage of resources also jeopardises DPAs’ capacity to effectively cooperate with their counterparts in cross-border cases, as discussed in Section 4.2. Interviewees from at least five DPAs said cross-border cases were too complex and resource intensive. In addition, several DPAs were precluded from actively participating in EDPB working groups and activities because of a lack of resources – either a lack of financial resources to cover the cost of travel, or a lack of qualified staff. Section 4.2 examines DPAs’ involvement in the EDPB in more detail.

The DPA received additional staff after the GDPR, but it would need many more to properly fulfil its mandate. We must persistently remind the budget ministry about the GDPR’s requirement to cooperate with other DPAs in cross-border cases or in the EDPB, for example. The EU Digital Package will involve similar cooperation. Enhancing resources is imperative when entrusting competencies to DPAs. Otherwise, they will be overwhelmed and unable to properly enforce those duties.

An EU DPA staff member

Lack of sufficient funding means that DPAs are not sufficiently technically equipped to be able to supervise and advise on the growing developments in AI-based technologies and the internet of things, according to interviewees in two Member States. Funding is also essential to ensure DPAs’ activities are able to cover a wide geographical area. DPAs were restricted to conducting investigations in the capital city in two Member States due to high travel costs.

Having well-resourced DPAs is essential for the enforcement of the fundamental right of data protection, as set out in the Charter of Fundamental Rights, EU law and CJEU jurisprudence, and acknowledged in FRA’s previous reports on DPAs’ role in the EU [51]
 FRA,Data Protection in the European Union: The role of national data protection authorities – Strengthening the fundamental rights architecture in the EU II, Publications Office of the European Union, Luxembourg, 2010;FRA, Opinion of the European Union Agency for Fundamental Rights on the proposed data protection reform package, 2012.
. Adequate financial, human and technical resources are necessary to ensure that DPAs run efficiently and effectively as independent supervisory authorities [52]
 FRA, Data Protection in the European Union: The role of national data protection authorities – Strengthening the fundamental rights architecture in the EU II, Publications Office of the European Union, Luxembourg, 2010, p. 42.
. FRA has also emphasised that adequate resources are a precondition for the ability of DPAs to perform their advisory, supervisory and awareness-raising tasks and exercise their powers fully independent of any external influence [53]
 FRA, Data Protection in the European Union: The role of national data protection authorities, FRA opinion on GDPR, Vienna, 2010, p. 42.
. Sufficient resources are also key to ensuring the right to good administration and independence, which, as a general principle of EU law, binds all EU Member States. This statement applies equally to other human rights players, such as national human rights institutions and oversight bodies of intelligence services, as described in previous FRA reports [54]
 FRA, Strong and Effective National Human Rights Institutions – Challenges, promising practices and opportunities, Publications Office of the European Union, Luxembourg, 2020; FRA, National human rights institutions in the EU Member States – Strengthening the fundamental rights architecture in the EU I, Publications Office of the European Union, Luxembourg, 2010; FRA, Surveillance by Intelligence Services – Volume I: Member States’ legal frameworks, Publications Office of the European Union, Luxembourg, 2015; FRA, Surveillance by Intelligence Services: Fundamental rights safeguards and remedies in the EU – Volume II: Field perspectives and legal update, Publications Office of the European Union, Luxembourg, 2017; FRA, Surveillance by Intelligence Services: Fundamental rights safeguards and remedies in the EU – 2023 update, Publications Office of the European Union, Luxembourg, 2023.
.

DPAs have developed a set of practices to mitigate inadequate human and financial resources, using them in the most effective way despite constraints, as described in the boxes in this section.

The financial control that each DPA is subject to under national law must not affect its independence, according to the GDPR [58]
 GDPR, Art. 69.
. National budgetary procedures can significantly affect DPAs’ ability to work independently, as pointed out by FRA in previous reports [59]
 FRA, Data Protection in the European Union: The role of national data protection authorities – Strengthening the fundamental rights architecture in the EU II,Publications Office of the European Union, Luxembourg, 2010.
.

In most Member States, DPAs must submit their budgetary requests to the Ministry of Justice or other ministries for approval. Although responsible ministries may not decide on the breakdown of expenditure, they might have the power to scale down the DPAs’ overall budget size. A few interviewees reported an underlying risk of underfunding, preventing DPAs from carrying out their duties with full autonomy. This may be the case particularly when the DPA’s budget is attached to a ministry that is also the data controller of large national databases, processing sensitive personal data, as was reported in one Member State. It could create an impression of conflict of interest, whether valid or not, in cases where DPAs are not undertaking investigations of their budgetary authorities on their own initiative, a few interviewees said.

In addition, government delays in delivering budgets may also adversely affect DPAs’ ability to conduct planned activities. It took approximately 2 years for DPAs in two Member States to receive their annual budget allocations, according to respondents.

Insufficient political support for DPAs’ role and functions generally, often resulting in lower budgetary allocations, was noted in certain Member States. This is due to the following.

• There are misconceptions about DPAs’ independent supervision of data processing, mostly among ministries of finance. For example, the GDPR can be seen as a hindrance to innovation, and there is a misconception that data protection does not generate revenue for the state and/or is not a primary need of the general population.
• There is a lack of understanding of the role and responsibilities of DPAs. In four Member States, budgetary authorities declined to increase DPAs’ budgetary resources on the basis that the DPAs’ functions had remained unaltered over time, unlike those of other public agencies. In two Member States, DPAs received fewer resources than other national regulators and agencies with a narrower mandate (e.g. cybercrime, corruption).
• Public awareness of the GDPR remains low in certain Member States.

In certain Member States, intense advocacy efforts by the DPA, targeting the public and national and EU institutions, have resulted in budgetary increases.

Another cause of the lack of resources is the perception of privacy as a luxury and not as a primary need. Nonetheless, when reading the proposal for an AI regulation discussed at the EU level, one can identify a list of potential risks related to data protection, confirming the need to have strong – and properly staffed – oversight mechanisms, such as DPAs.

An n EU DPA staff member

Most respondents agreed that DPAs operate independently from their government, parliament and any other public bodies. A majority of respondents also agreed that national accountability procedures – such as annual reporting to parliament or the European Court of Auditors’ audits and evaluations – do not challenge DPAs’ independence. Rather, they are used to verify the sound spending of budgets and identify deficiencies in DPAs’ administration.

A few DPAs were also subject to national ombudspersons’ inquiries on the handling of cases. In one Member State, it was reported that, while the DPA at first found it difficult to accept the opinion of another independent authority, it took on board the authority’s critical assessment of how the DPA handled complaints, and it valued the review by an independent authority to firmly ground their request for a budgetary increase.

In some Member States, FRA research revealed DPA difficulties in performing certain mandatory tasks, primarily due to forms of ‘indirect’ influence by either the executive or the legislative body. This was further exacerbated by inadequate human and financial resources. Issues reported to FRA included:

• legislators being resistant to taking advice on incorporating data protection safeguards into the development and use of technologies; this was raised when tracking technology was set up to fight the spread of COVID-19 (as FRA has previously reported [60]
   FRA, Coronavirus Pandemic in the EU – Fundamental rights implications: With a focus on contact-tracing apps, Bulletin 2, Publications Office of the European Union, Luxembourg, 2020.
  and with respect to the use of technological equipment for security purposes;
• the government refusing to implement some suggestions made by the DPA with respect to its reorganisation and the distribution of its competencies, which the DPA considered important for enabling it to fully exercise its powers;
• the head of the DPA not being entitled to publicly answer to matters related to the DPA’s work in parliament, since this is the responsibility of the ministry the DPA is attached to.

Interviewees raised specific concerns about some governments’ practices, saying that they adversely affected their DPA’s advisory function (Chapter 3 of this report looks into DPAs’ advisory role in more detail). Several interviewees observed that governments set tight deadlines when requesting legal opinions on proposed legislation and/or addressed multiple, simultaneous requests to DPAs, which hindered their ability to deliver legal advice of sufficient quality. For instance, in one Member State, the DPA had 1 or 2 days to provide an official reply to a governmental request. Understaffed DPAs found this particularly problematic, and occasionally it resulted in the refusal to comply with the request. Furthermore, around five DPAs reported situations where legislators did not consult them, or consulted them only at a very late stage, on key files. Examples reported to FRA are described below.

• Interviewees from two Member States highlighted that during the legislative process the responsible parliamentary commissions do not systematically consult the DPA on policy and legislative initiatives involving the processing of a large number of personal data. This was particularly the case during the COVID-19 pandemic. In the opinion of one respondent, in most cases the government endorses the DPA’s suggestions only to prevent public outcry, as it is only when the media picks up the DPA’s concerns that these are considered by the legislator. In one Member State, a respondent stressed that regular exchanges with a dedicated parliamentary commission for data protection issues have ceased to exist.
• One interviewee stated that on many occasions the DPA found out about draft legislation through the media, as it had not published on the official portal as required.
• Several employees from one DPA affirmed that the government is generally reluctant to consult the DPA and only does so when it is compulsory.
• One interviewee observed that very few public bodies seek the DPA’s advice (no more than two to three consultations per year), as they fear the outcome of the DPA’s assessment.

We can determine the compliance of an action with data protection law only during an inspection. When we are asked for advice, we can only give basic instructions and guidelines – we point out some past cases, what was the solution, what they didn’t pay attention to, etc. We cannot carry out a thorough assessment.

An EU DPA staff member

Member States shall provide for each member of their supervisory authorities to be appointed by means of a transparent procedure by their parliament, their government, their head of State, or an independent body entrusted with the appointment under Member State law.

Article 53 of the GDPR

Ensuring that DPAs’ leadership is free from any external influence or incompatible occupation is an essential guarantee of DPAs’ independence, according to the GDPR [61] GDPR, Art. 52(2).
. In addition, DPA members should refrain from any action incompatible with their duties and perform their tasks free of any conflict of interest [62]
 GDPR, Art. 52(3).
. They should be selected through a ‘transparent procedure’ [63]
 GDPR, Art. 53(1).
.

FRA has stressed the importance of DPAs’ leadership being appointed in a transparent manner as an effective guarantee of independence from the political branches of government [64]
 FRA, Data Protection in the European Union: The role of national data protection authorities – Strengthening the fundamental rights architecture in the EU II,Publications Office of the European Union, Luxembourg, 2010, Chapter 4.1.1.
.

Interviewees did not report deficiencies in the transparency of DPA leadership nominations as a common problem across Member States. However, some interviewees highlighted ongoing challenges in ensuring the independence of DPAs’ leadership. In one Member State in particular, interviewees stressed that the selection of the DPA’s leadership is highly ‘politicised’.

Some interviewees pointed out that conflicts of interest might occur when DPAs are institutionally attached to one ministry and are led by one director without a collegial body. In many EU Member States, the ministry of justice can potentially exercise some form of control over the DPA’s activities by deciding on the overall size of its budget, as highlighted in Section 1.2.1. of this report. Interviewees from one DPA observed that this risk might be exacerbated when the ministry of justice has to approve the director’s leave, promotions, business trips, etc. Theoretically, the ministry can always exercise some form of influence on the director’s activities, putting DPAs’ independence at risk. One interviewee suggested that the ministry could refuse a director’s trip to the EDPB sessions because the DPA has issued a decision of data breach against the Ministry of Justice (imaginary example).