Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory … (b) promote public awareness and understanding of the risks, rules, safeguards, and rights in relation to processing. Activities addressed specifically to children shall receive specific attention.

Article 57(1)(b) of the GDPR

FRA’s findings identified similar trends in the public’s understanding of data protection safeguards. On the one hand, DPAs noticed that awareness of data protection increased greatly following the adoption of the GDPR, which resulted in a rapid and substantial increase in complaints. On the other, DPAs found that a large majority of complaints are trivial or unfounded, and that very few complaints are lodged concerning sensitive data processing and misuse of personal data in the digital sphere.

In other words, while individuals’ awareness of their rights has increased, an understanding of what the right to data protection entails is still lacking.

A majority of interviewees agreed that providing advice and reinforcing the public’s understanding of what data protection means is an effective use of DPAs’ resources and, ultimately, improves their ability to fulfil their mandate. Here again, lack of resources was said to have a negative impact on the ability of DPAs to provide direct and adequate advice in response to individual requests. For instance, some interviewees mentioned their incapacity to meet with individuals living outside the capital.

The DPA lacks the financial means to organise events or to take part in other events – especially outside the capital. Because the authority doesn’t have regional offices to decentralise the work, it needs to answer demands from opinions from all over the country via email – to mayors, to governmental county-level services (e.g. health insurance, pensions), to data controllers, etc.

An EU DPA staff member

In some Member States, DPAs have set up hotlines for individuals to enable the authority to assess the merits of their grievance before they file an official complaint. Most interviewees pointed out to FRA that a handful of staff must be dealing with high numbers of minor or petty complaints, often similar in content (e.g. related to neighbours installing a CCTV camera, a recurring complaint mentioned by most interviewees). Nonetheless, these hotlines require additional human and financial resources, which many DPAs are lacking.

Systematic complaints handling – as explained in the box Promising practice: a group of DPAs investigated Vinted UAB for GDPR non-compliance – also supports DPAs in finding the appropriate advice for the general public and data controllers in a swift and evidence-based manner.

The idea is that they (junior lawyers) are there to take legal questions, but, in practice, it is more than this, such as questions about the processing of current cases, and, when the public hears our name, many people think that our organisation handles much more than what is in our mandate, with individuals calling in to report how their integrity has been violated, putting our colleagues in a therapist-like role at times.

An EU DPA staff member

Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory: … (d) promote the awareness of controllers and processors of their obligations under this Regulation.

Article 57(1)(d) of the GDPR

The controller shall consult the supervisory authority before processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk.

Article 36(1) of the GDPR

A majority of respondents highlighted the importance of providing guidance to data controllers, both to ensure correct implementation of the GDPR and to reduce workload when investigating data processing. Interviewees from multiple DPAs said that such requests must be prioritised given the tight deadline to respond established in the GDPR [83]
 GDPR, Art. 36, provides that ‘Where the supervisory authority is of the opinion that the intended processing referred to in paragraph 1 would infringe this Regulation, in particular where the controller has insufficiently identified or mitigated the risk, the supervisory authority shall, within period of up to eight weeks of receipt of the request for consultation, provide written advice to the controller’.
.

Several interviewees referred to the obligation, under Article 35 of the GDPR, to conduct a data protection impact assessment (DPIA) in cases where ‘a type of processing, in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons’. When the data processing would result in a high risk to individuals’ right and freedoms, and in the absence of measures taken by the controller to mitigate the risk, Article 36 of the GPDR requires data controllers to consult with the DPA.

However, some respondents noted that, in practice, data controllers rarely seek the DPA’s advice pursuant to Article 36 of the GDPR. The scarcity of requests and prior DPIAs is a direct consequence of many data controllers’ lack of understanding of the potential risks of inadequate data processing. Interviewees agree that awareness-raising actions targeting specific fields of activities should be conducted to prevent inadequate data processing.

Several interviewees highlighted specific difficulties that further complicate DPAs’ function of advising data controllers in both the public and private sectors. First, in some cases DPAs might not be able to assess the potential risks of a processing operation without carrying out an on-site visit; however, as reported by some interviewees, this can only happen during ex post inspection. Second, some interviewees found that the lines between their advisory and investigatory roles are sometimes blurred. While DPAs wish to provide data controllers with clear guidance on data protection safeguards in data processing, in practice they can give only general advice. Interviewees clarified that this was to avoid DPAs, in the case of investigations, having to supervise the implementation of their own guidance.

If someone wants very detailed advice on their own system, for example, it could easily create a situation where, if the data subject later complains to us, we would have to assess the actions of a controller that we have previously advised on. [Hence,] we can [only] provide general guidance.

An EU DPA staff member

Third, some respondents highlighted difficulties that apply specifically to advising public authorities and bodies when they are acting in their capacity as data controllers, that is, when the DPA provides advice to them on specific data processing, and not within the procedure of advising on draft laws or legal initiatives. In some Member States, DPAs are not allowed to issue fines to public entities, only recommendations. Hence, as one interviewee explained, DPAs’ advisory role is not sufficiently acknowledged by public authorities, as recommendations are not enforceable. Some interviewees also claimed that public bodies distrust, and sometimes fear, DPAs when it comes to asking them for opinions on data processing, as highlighted in Section 2.2.2. For instance, one respondent witnessed a case where a public sector body developed a data processing operation without contacting the DPA in advance because of a fear of a ‘no’ from the DPA’s side. Thus, ‘public authorities rather develop and deal with consequences later … ’, as one interviewee put it.

To support research and innovation, the GDPR includes a ‘special regime for scientific research’ in Article 89, as explained in the EDPS’s preliminary opinion on data protection and scientific research [84]
 EDPS, A preliminary opinion on data protection and scientific research, 2020, p. 16. See also European Parliamentary Research Service,How the general data protection regulation changes the rules for scientific research, PE 634.447, 2019.
, which applies to the processing of personal data for ‘archiving in the public interest, scientific or historical or statistical research purposes’ [85]
 GDPR, Art. 89 and Art. 5(1)(b).
. In this context, Article 89 of the GDPR allows for certain exceptions to the data protection guarantees under certain conditions (e.g. the existence of technical and organisational measures).

During the COVID-19 pandemic, several DPAs were confronted with increasing requests to provide advice on the use of sensitive medical data of COVID-19 patients for research purposes. The box Promising practice: develop targeted and sector-specific guidance describes an example.

Most respondents, however, could not recall any practical experience of providing advice to researchers in the field of scientific research, apart from the advice delivered during the COVID-19 pandemic. Among those who could recall some examples, only a few stated that the GDPR has allowed for a certain consistency and awareness the of safeguards that should be put in place when processing personal data for research-related purposes.

There is an incentive among researchers to carry out a lot of anonymisation, pseudonymisation and encryption, decentralised data storage and early deletion, because this gives them the freedom to use data for their own purposes.

An EU DPA staff member

For several interviewees, however, the implementation of Article 89 of the GPDR has been challenging [86] GDPR, Article 89, provides for safeguards and derogations in relation to processing data for archiving purposes in the public interest, for scientific or historical research purposes or statistical purposes.
. In 2019, national differences in the implementation of Article 89 were identified in a study commissioned by the EDPB [87]
 EDBP, Study on the appropriate safeguards under Article 89(1) GDPR for the processing of personal data for scientific research, 2019.
. In this report, FRA research identifies the following two challenges.

First, the complexity of the applicable legal framework and uncertainty about the legal basis of data processing were repeatedly mentioned as an issue of concern in this context. In addition to the GDPR, specific legislation may apply to the processing of personal data in a certain field; for example, sectorial laws regulating medical research [88]
 Directive 2004/23/ECof the European Parliament and of the Council of 31 March 2004 on setting standards of quality and safety for the donation, procurement, testing, processing, preservation, storage and distribution of human tissues and cells (OJ L 102, 7.4.2004, p. 48).
, clinical drug trials [89]
 Regulation (EU) No 536/2014 of the European Parliament and of the Council of 16 April 2014 on clinical trials on medicinal products for human use (OJ L 158, 27.5.2014, p. 1); European Commission, ‘Question and answers on the interplay between the clinical trials regulation and the general data protection regulation’, 2014; EDPB, Opinion 3/2019 concerning the questions and answers on the interplay between the clinical trials regulation (CTR) and the general data protection regulation (GDPR), 2019.
and statistics [90]
 Several pieces of EU legislation govern statistics depending on the subject area. See ‘EU legislation on statistics’.
, at both the EU and national levels [91]
 For an overview of sectorial legislation adopted at the national level to regulate the use and collection of personal data for research purposes and its interplay with the GDPR, see Milieu, Study on the appropriate safeguards under Article 89(1) GDPR for the processing of personal data for scientific research, 2021. The study was commissioned by the EDPB.
. The plethora of applicable EU and national legislation has made it difficult for researchers – and data controllers – to identify a legal basis for a processing operation, according to many interviewees. Many interviewees mentioned that EDPB guidance in the area of clinical trials is useful in this respect [92]
 EDPB, Opinion 3/2019 concerning the questions and answers on the interplay between the clinical trials regulation (CTR) and the general data protection regulation (GDPR), 2019.
. The data subjects concerned may also be affected by the lack of legal clarity, ultimately discouraging them from exercising their rights [93]
 See also European Commission, Directorate-General for Health and Food Safety, Assessment of the EU Member States’ rules on health data in the light of GDPR, Publications Office of the European Union, Luxembourg, 2021.
. Both researchers and the general public would therefore benefit from further guidance on correctly applying the GDPR for the purpose of research, to avoid legal uncertainty hindering innovation. The importance of providing further guidance, especially on sharing sensitive data with researchers and monitoring discrimination caused by bias in algorithms, was underlined in FRA’s previous work [94]
 FRA, Bias in Algorithms – Artificial intelligence and discrimination, Publications Office of the European Union, Luxembourg, 2020, p. 15.
.

Second, respondents noted that in some Member States public authorities have been reluctant to grant access to personal data for research purposes and that, in a couple of Member States, the GDPR has often been used as justification for refusing such access. One respondent explained that the GDPR states only under what circumstances information might be provided, but does not address under which circumstances it must be provided, hence creating uncertainty. Therefore, granting access to data for research purposes by public authorities is another field that requires further clarification, potentially through the development of specific EDPB tools or guidance.

In addition, some interviewees mentioned that the GDPR should not be used to justify refusing access to data, but as a legal framework governing this access.

We have provided guidance to researchers in several cases, and we often had to open doors to researchers where the added value of the research warranted this, and the data controller was being extra, and unnecessarily, cautious. The role of the DPA is to open doors by suggesting anonymisation and proposing different methodologies, encouraging researchers to exercise proportionality, because often researchers ask for significantly more information than what is needed to extract their conclusions.

An EU DPA staff member

Against this background, interviewees from a few Member States questioned whether the GDPR provides sufficient legal clarity to enable them to consistently transpose the derogations and safeguards provided for in Article 89 across the EU. One respondent suggested that the provision should require Member States to adopt national legislation on the applicable derogations under the GDPR when data are processed for scientific research purposes. Such legislation is prescribed in Article 85 of the GDPR, which states that the applicable derogations for processing data for journalistic purposes should be prescribed in national law [95] GDPR, Article 85(2), provides for exemptions and derogations from some GDPR chapters, when processing of personal data is conducted for journalistic purposes or the purpose of academic artistic or literary expression. Article 85(3) obliges Member States to adopt laws based on Article 85(2).
.

As a final point, some respondents brought to FRA’s attention that in most EU Member States DPAs are no longer providing prior authorisation for the use of personal data for scientific research purposes. This was a requirement under Directive 95/46/EC [96]
 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).
, repealed by the GDPR. In one Member State, the DPA still provides ‘permission’ for certain personal data processing for research purposes, but it does not authorise the processing of sensitive data, which falls under the competency of the national ethics committee. Some respondents found that the authorisation system was useful for keeping DPAs informed, updated and aware of potential data protection risks in data processing in the field of research.

DPAs have developed several practices and initiatives to address these concerns and raise awareness among researchers and data controllers of the applicable data protection safeguards when processing data for research purposes. Some of these practices are highlighted in the following boxes.

Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory: … (c) advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to processing.

Article 57(c) of the GDPR

Member States shall consult the supervisory authority during the preparation of a proposal for a legislative measure to be adopted by a national parliament, or of a regulatory measure based on such a legislative measure, which relates to processing.

Article 36(4) of the GDPR

Providing advice and legal opinions to governmental or public bodies is not a new responsibility of DPAs. Some respondents highlighted that, prior to the GDPR, domestic legal frameworks entrusted DPAs with advisory responsibilities, that is, providing detailed opinions on legislative draft proposals or other administrative measures affecting the individual rights to data protection. In some cases, however, respondents emphasised that the GDPR did make clear the obligation of state authorities to consult the DPA. Some interviewees did acknowledge increased interest from the government in the DPA’s opinions.

Several interviewees indicated that providing advice on draft laws is a crucial task, if not a priority, as it may prevent future complaints and data protection risks by ensuring the inclusion early on of data protection safeguards in the law. The sense of making it a priority is strongly reinforced when they see the direct impact of their recommendations in the amendments, or even sometimes in the withdrawal, of draft legislative texts, according to some interviewees.

The DPA is a kind of preventive supervisor of legislation. It is actually quite nice that the DPA has this function of advisory body. The DPA recently issued its opinion on a new bill … In this opinion the legislator was told that this bill cannot become law because it is in violation of the EU Charter. … Because the DPA is a supervisory body with investigatory and sanctioning powers, its opinions and recommendations carry more weight. These are not really opinions but legality assessments.

An EU DPA staff member

DPAs should be able to provide advice on their own initiative, by commenting on any legislative initiative, as long as there are data protection implications, according to some interviewees. They should not only respond to official requests prior to the enactment of legislation. In practice, however, lack of resources prevents DPAs from providing unsolicited recommendations, despite their will to do so.

What the DPA would really like to do is provide unsolicited advice, but, due to capacity problems, we don’t get around to doing that.

An EU DPA staff member

Only a few respondents acknowledged increased interest from the government in their opinions following the entry into force of the GDPR. Most respondents pointed out some deficiencies undermining the delivery of independent advice, as Section 1.2.1of this report outlines.

• Several respondents underlined that DPA recommendations, being non-binding, are not always considered by the legislator. The same goes for policymakers, who are not obliged to incorporate DPAs’ advice into negotiated legislation. However, interviewees insisted on the importance of acting proactively during legislative processes.
• Some respondents noticed differences between DPAs and other comparable public bodies (e.g. ombudspersons) in the provision of legal advice and recommendations on draft laws. In one case, an interviewee expressed concern over the fact that a recent amendment now prohibits the DPA from providing fundamental comments, that is, comments that should be considered by the authority in charge of the legal proposal. In another Member State, the DPA is not allowed to request a constitutional review unless an inspection procedure is launched – while other public bodies may do so.
• Several interviewees lamented the fact that their government does not always consult the DPA prior to the enactment of legislation that affects the protection of personal data. Several reasons were indicated. In some cases, the failure to request the DPA’s opinion was attributed to a lack of understanding of the potential data protection implications of a draft law. In one case, the interviewee mentioned some hostility from the government, which perceives the DPA as a barrier to innovation – but clarified that such hostility ceases after the DPA provided clarification.

And then there are still issues that the government and parliament still forget on matters of data protection. For example, when changes to the … Law were under discussion, the DPA was not heard.

An EU DPA staff member

We are not seen in a good light by certain quarters because, for them, data protection is there to stop innovation, to stop processes, to pose restrictions, to put safeguards which might stifle innovation. So, this is a general perception.

An EU DPA staff member

• Fourth, the absence of government consultation, or the very short deadline provided to the DPA to respond to a request for legal opinion – as described in Section 1.2.1 – were noted to not only hinder DPAs’ capacity to provide advice during legislative processes, but also contribute to the large volume of complaints received by DPAs, as the quotes below describe.

The COVID-19 pandemic was a difficult experience for the DPA, which would have preferred that the government contacted the DPA when drafting the measures, but did not – there would have been much less anger among the people and the DPA would have received far fewer complaints.

An EU DPA staff member

For example, the DPA received a hundred complaints, virtually identical, as a result of one processing of personal data, until the DPA announced, through the media, that it was already dealing with the matter and that no further reports were necessary. The DPA would have had far fewer problems if the government had consulted the DPA. On many occasions, the DPA learned of the content of a draft law through journalists.

An EU DPA staff member

• Fifth, interviewees insisted that neutrality and prudence are key when approached by ministries with questions related to future draft laws. DPAs may give advice during the drafting of a text but they must clarify that this is not a formal assessment on their part and it is not a guarantee that the draft proposal is data protection compliant.

We are expected to say in such a case that one solution is legal and another is not. We cannot say that. We can only do that when there is an inspection, when some personal data processing is actually under way, and only then can we make an assessment … We give basic instructions, we point out some past cases, what was the solution, what they didn’t pay attention to, etc. We certainly give some guidelines. The problem with this is that you don’t get all the relevant information. It is human nature to give information that leads to the conclusion that a certain solution is appropriate. They don’t tell you the downside, either deliberately or not, because they are not aware of (the downsides), because that’s why they come to us for our opinion.

An EU DPA staff member

• Sixth, and contrary to the trend identified by some DPAs, several interviewees highlighted that they receive a high number of official requests to comment on draft laws, even when these have no data protection implications. Interviewees expressed different views on this. It was perceived by some as a positive trend where the legislator is taking the protection of personal data seriously. However, some respondents were concerned that such a large number of requests from governmental bodies is hampering DPAs’ activities and may ultimately prevent them from developing in-depth analyses. Two interviewees said they believe this to be intentional.
• Seventh, in some Member States, DPAs have noted that their government still lacks an understanding of the potential risks to data protection. This is particularly the case in the area of legislation on the digitalisation of public processes.

This lack of understanding translates into concrete challenges, delaying the provision of legal opinions, according to some interviewees. On the one hand, it has resulted in a lack of clarity about certain data processing operations. On the other hand, DPIAs are rarely conducted before consulting the DPA.

The requirement included in Article 37 of the GPDR to establish a DPO was not a new requirement of the GPDR. However, the regulation did broaden the obligation to data controllers and data processors that might not have been required to contract a DPO under the 1995 directive. The task of the DPO is to inform, advise, and act as a contact person between the controller/processor and the DPA.

A large number of DPOs were recruited in a short period of time following the entry into force of the GDPR. In 2019, a study by the International Association of Privacy Professionals [97]
 IAPP is a large association that brings together professionals and experts on privacy and data protection. It is a non-profit organisation working to develop and foster understanding related to privacy and data protection.
(IAPP) estimated that 500 000 organisations had registered a DPO across Europe [98]
 IAPP, ‘Study: An estimated 500K organizations have registered DPOs across Europe’,16 May 2019.
.

Several interviewees discussed the impact of this on DPAs. Some respondents connected it with their recruitment difficulties, associating the large-scale DPO recruitment by private and public entities with a data protection experts’ ‘brain drain’. Interviewees also flagged the salary imbalance that can exist between private and public sector employment as an additional difficulty for DPAs when competing with the private sector to recruit high-level experts in such a niche field, as Section 1.1.2 discussed in more detail. This difficulty is shared by public authorities in general. In three Member States, the DPA evidenced the absence of a DPO either in public bodies or in both private and public bodies and requested these bodies to hire a DPO, it was reported to FRA.

The majority of municipalities either no longer have the data protection officers (they are required to have one, but as they are exempted from fines, they usually opt for saving the money and are no longer paying for DPOs), or outsource the issue to someone who does not function properly.

An EU DPA staff member

Some interviewees highlighted how DPOs have been playing a crucial role in their work, by preventing potential violations of the GPDR, thanks to their understanding of the legal frameworks, and by developing a meaningful and useful communication channel between the DPA and data controllers.

The role of the DPO is regarded as an essential preventive measure for effective enforcement of the GDPR, and, for several interviewees, DPOs are considered to be partners.

Rapid technological developments and globalisation have brought new challenges for the protection of personal data. The scale of the collection and sharing of personal data has increased significantly. Technology allows both private companies and public authorities to make use of personal data on an unprecedented scale in order to pursue their activities. … Those developments require a strong and more coherent data protection framework in the Union, backed by strong enforcement, given the importance of creating the trust that will allow the digital economy to develop across the internal market.

Recitals 6 and 7 of the GDPR

Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory: … monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular, the development of information and communication technologies and commercial practices.

Article 57(1)(i) of the GDPR

Respondents were asked about the capacity of their authority to respond to challenges stemming from new technologies, such as AI and machine learning, and encompassing blockchain and crypto assets, the internet of things, facial recognition and connected vehicles, for example.

A majority of respondents believe that the tools provided in the GDPR are, in theory, sufficient. However, most of them also mentioned several issues that can have an impact on their effectiveness in addressing issues stemming from the use of new technologies.

• First, several respondents indicated they are mostly unprepared when it comes to understanding and assessing new technologies.
• Second, a number of interviews were ambivalent about the adequacy of the GDPR, believing that it is adequate but insufficient. Most interviewees referred to the generic and technological neutrality of the GDPR as both a positive and negative. With regard to AI, it leaves too much room for interpretation, and DPAs believe that guidance is greatly needed. For instance, one interviewee explained that when it comes to AI the GDPR is reaching its limits, as AI is creating a conflict with the data minimisation principle.
• Third, several interviewees expressed concerns about the clarity of their role in the constellation of multiple data-related acts. Because other EU laws on new technologies (such as the Digital Services Act and the proposed Artificial Intelligence Act) also directly touch upon data protection issues that are covered in the GPDR, how to coordinate and deal with potential overlaps of mandates of supervisory authorities remains unclear [99] Council of the European Union, Council position and findings on the application of the GDPR – Consultation of Member States, Brussels, 8 November 2023, para. 18.
  .

The GDPR is technology neutral. But it is difficult to pigeonhole some new technologies. An example concerns blockchain: who is the controller and who is the processor?

An EU DPA staff member

The technological neutrality of the legislation in this matter leaves the task of constructing an understanding of new technologies, and their relation to the GDPR and other regulatory instruments, on the shoulders of the judicial system. Often these interpretative matters are not limited only to constructing what is personal data, but more broadly what is technology.

An EU DPA staff member

Most respondents indicated that their authority has had almost no practical experience or concrete cases involving new technologies. For those who have had some experience, the cases related mainly to video surveillance, the use of biometrics, the use of AI and machine learning, and large-scale leaks of personal data. According to these respondents, the main challenges when dealing with AI and new technologies lie in:

• the access given by the data controller to the DPA inspector, which depends on the level of trust the data controller has in the inspector, given the related trade secrets and sensitivity attached to such technologies;
• the access to information/premises by non-EU data controllers, and, notably, these being based in non-EU countries (e.g. the United States or China);
• the feasibility of assessing the proportionality of the use of personal data;
• the feasibility of assessing the explainability and transparency of the use of such technologies.

Despite the relative absence of concrete cases, the majority of respondents underlined that they mostly feel unprepared when it comes to new technologies. Interviewees identified (1) the lack of time to conduct research, test cases, etc. on specific technologies and (2) a shortage of IT experts among DPA staff with knowledge and experience of new technologies.

Respondents highlighted this as an issue that is preventing them from (1) conducting appropriate research on the tensions between new technologies and data protection, and (2) providing data controllers with appropriate guidance. For instance, two respondents referred to blockchain as an example of a technology that may not be compliant with some provisions of the GDPR. Given that blockchain works with an unchangeable chain of blocks it may not be compliant with the principle of accuracy [100] GDPR, Art. 5(1)(d).
or the right to rectification [101] GDPR, Art. 16.
or erasure [102] GDPR, Art. 17.
. Another respondent emphasised that anonymity is a real issue when dealing with cases involving new technology, as more advanced technologies cannot rely on fully anonymised data. In addition, anonymisation becomes more difficult, as modern techniques allow for tracking anonymised data back to data subjects. At the same time, the GDPR requires data used for the development of these technologies to be anonymous.

A few respondents also noticed unpreparedness on the side of the data controllers regarding new technology, further reinforced by the fact that data controllers do not use tools such as prior consultations and DPAIs.

Several respondents once again made a link to human resource shortages, notably IT specialists, as indicated in Section 1.1.2. Several interviewees believe that the only way to overcome these difficulties is to increase cooperation with the EDPB and with other DPAs from EU Member States and European Economic Area countries. Some respondents highlighted the potential for the EDPB pool of experts to provide DPAs with technological expert knowledge they may lack.

We as an institution would like to deal with new technologies and their impact. Because, in my opinion, it is the aim of the GDPR – to follow the new technologies and to ensure that those do not violate human rights and that we maintain the balance ... However, unfortunately, due to minor disputes between private persons (that represent a large part of complaints received), we are unable as a supervisory authority to examine those cases which really impact the aim of the GDPR.

An EU DPA staff member

Interviewees were ambivalent about the adequacy of the GDPR to answer such challenges. For most of them, the technological neutrality of the EU data protection legislation is a positive thing. However, a majority of respondents indicated that the GDPR is not sufficient for addressing data protection concerns related to the use of new technologies. One respondent observed, for example, that ‘what is complicated is how to judge whether a new technology fits within the GDPR’. Giving the example of AI, the respondent said that it is difficult to assess whether algorithms that have used personal data for training purposes but do not process personal data once launched would be covered by the scope of the GDPR.

The challenge of applying data protection law to new technologies, such as AI and algorithms, was also highlighted in FRA’s 2020 report on AI and fundamental rights [103]
 FRA, Getting the Future Right – Artificial intelligence and fundamental rights, Publications Office of the European Union, Luxembourg, 2020.
.

So, there is always a rather large gap between the important questions that come up in the context of new technological development and the guidance EDPB can give; I think this gap will always be a large one.

An EU DPA staff member

Several DPAs expressed some uncertainty about what to expect regarding their role in the European Commission’s numerous recently adopted and proposed acts related to data, including the Artificial Intelligence Act [104]
 Commission proposal for a regulation laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) and amending certain Union legislative acts (COM(2021) 206 final).
, the Digital Services Act [105]
 Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a single market for digital services and amending Directive 2000/31/EC (Digital Services Act) (OJ L 277, 27.10.2022, p. 1).
, the Digital Markets Act [106]
 Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act) (OJ L 265, 14.9.2022, p. 1).
, the Data Act [107]
 Commission proposal for a regulation on harmonised rules on fair access to and use of data (Data Act) (COM(2022) 68 final). See also European Parliament, ‘Parliament backs plans for better access to, and use of, data’, press release, 2023; European Council, ‘Data Act: Council adopts new law on fair access to and use of data’, press release, 2023.
, the Data Governance Act [108] Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724 (Data Governance Act) (OJ L 152, 3.6.2022, p. 1).
, the interoperability acts [109]
 See European Commission, ‘Interoperability’, for a list of acts related to interoperability, namely Regulation (EU) 2019/818, Regulation (EU) 2019/817, Delegated Regulation (EU) 2021/2103, Implementing Regulation (EU) 2021/2224 and Delegated Regulation (EU) 2021/2222.
and the Single Digital Gateway Act [110]
 Regulation (EU) 2018/1724 of the European Parliament and of the Council of 2 October 2018 establishing a single digital gateway to provide access to information, to procedures and to assistance and problem-solving services and amending Regulation (EU) No 1024/2012 (OJ L 295, 21.11.2018, p. 1), as amended on 24 September 2023.
. Several interviewees also expressed concern that the relevant legal frameworks may be fragmented, potentially resulting in contradictory legal requirements and conflicts with other national regulatory authorities.

In July 2022, the EDPB and EDPS expressed similar concerns about the Commission’s proposal for a regulation on the European Health Data Space: ‘Regarding the governance model created by the proposal, the tasks and competencies of the new public bodies need to be carefully tailored, particularly taking into account the tasks and competencies of national supervision authorities, the EDPB and the EDPS in the field of processing personal (health) data. Overlap of competencies should be avoided and fields of and requirements for cooperation should be specified’ [111]
 EDPB and EDPS, Joint Opinion 03/2022 on the proposal for a regulation on the European Health Data Space, 2022, p. 4.
.

It also becomes more and more complex with the upcoming new legal instruments, for example with the new legal acts (the Artificial Intelligence Act, the Data Governance Act, the Data Act, etc.) for which the DPA will certainly play a role even though such role is not yet exactly clear yet. Our challenge is: how can the DPA give proper supervision on this?

An EU DPA staff member