A European Commission proposal published today which should have led to speedier and more effective cross-border enforcement of the EU’s signature law on data protection – the General Data Protection Regulation (GDPR) – is unlikely to be of much help to consumers. The European Parliament and Member States have to substantially amend it to truly improve cross-border enforcement and improve complainants’ rights.

The five-year-old law has suffered from painstakingly slow enforcement, especially in cross-border situations, which has made it very difficult for consumers to have their rights respected in a timely manner, as BEUC, and many other stakeholders have repeatedly highlighted.

The Commission proposes to harmonise some procedural rules that authorities have to apply when working together, undertaking investigations and dealing with complaints of data subjects and their representatives.  

Regrettably, the Commission’s proposal falls short on one important aspect which is to improve complainants’ rights to be heard and to get access to timely and important information from the investigation an authority carries out. This is something BEUC has highlighted as a problem. There is a chance today’s proposal even worsens the current situation for consumers, the organisations representing them in a case against multinational companies, and data protection authorities themselves.

The proposal at least includes requirements for authorities from different countries to cooperate earlier and more closely in an investigation that concerns several or EU-wide GDPR infringements.

Ursula Pachl, Deputy Director General of the European Consumer Organisation (BEUC), said:
“As good as the GDPR is on paper, it has been hamstrung by weak enforcement when it comes to EU-wide infringements by big companies. Consumer organisations have repeatedly experienced how difficult it is for consumers to have their rights respected if authorities do not act faster and in a more coordinated way. Weak and slow enforcement only suits Big Tech and other companies who make money from trampling on people’s right to personal data protection.

“The Commission has recognised the situation but the cure it is proposing is unlikely to help the patient. The Parliament and national governments need to substantially improve the proposal and rectify what is missing, such as giving consumer organisations the same procedural rights as defendants in a case. With the EU elections on the horizon, we need a new and better approach to enforcement to show people that the EU cares about their rights and they can be enforced in practice.

“It is crucial that this EU law does not prevent better procedural rights already in place or which may be adopted in the future in EU member states.”

BEUC and a number of its members, who are national consumer groups, have launched two major GDPR enforcement cases against tech giant Google, first for its location data tracking practices in 2018, and last year for unduly pushing users to accept to more extensive and invasive data processing when they create a Google account. We have shown in a report in 2020 that a lack of harmonised binding administrative procedures to deal with cross-border complaints and the slow pace of proceedings have been hugely detrimental to consumers’ rights under the GDPR. We are still awaiting decisions on both sets of complaints.

Notes
You can find more about our recommendations to improve GDPR enforcement in our policy paper here.