The European Commission finally appears to take action against the fragmented GDPR enforcement. It envisages an initiative to adopt further specifying procedural rules streamlining cross-border cooperation between national data protection authorities (DPAs). Liberties responded to the Commission's call for evidence, reporting difficulties filing complaints across different EU Member States and providing suggestions for improvements.
While Liberties appreciates how the GDPR has greatly contributed to raising the standards of acceptable data processing practices in the EU, nevertheless there are numerous shortcomings in its enforcement that hold the GDPR short of its full potential.
In 2019 and 2020, Liberties joined forces with its members and partners and carried out a coordinated complaint filing campaign "FixAdTech" against the behavioral advertising industry. About a year after the entry into force of the GDPR, in June 2019, and after the cases did not seem to make progress, again in December 2020, complaints against Google and IAB Europe were brought forward to numerous DPAs.
As IAB Europe is based in Belgium and Google in Ireland, the Belgian ADP/GBA and the Irish DPC should take the role of the lead supervisory authorities respectively. However, some DPAs that received our complaints have declared to have no jurisdiction without taking further action, and others simply failed to communicate with the complainants. A few supervisory authorities treated the complaints merely as "tips" and it was unclear to the complainants who became a party to the procedure, or failed to do so, on what basis. Not all complainants had the same rights, and the communications received did not clarify what rights they have and what they could expect to happen. Generally, the handling of the complaints took much longer than acceptable, leaving the complainants uncertain whether their case was closed, awaiting further steps, or if they could turn to the courts.
Based on these experiences, Liberties argued, among other recommendations, that the new Regulation should:
- set clear deadlines for each step to be taken by supervisory authorities after receiving a complaint;
- ensure that complainants receive clear communication on the status of their complaint and explanation of their rights along the process;
- require supervisory authorities to adopt and communicate a final, binding decision within a set time so that complainants can have access to effective judicial remedy.
