EU GDPR Procedural Reform Risks More Complexity in Cross-Border Enforcement
The European Union’s planned update to the General Data Protection Regulation (GDPR) Procedural Regulation aims to improve cooperation between data protection authorities (DPAs) across borders. The GDPR, introduced in 2018, protects citizens’ rights regarding their personal data. However, when complaints involve companies based in different EU or EEA countries, the process requires coordination between the DPA in the complainant’s country and the DPA in the company’s home country. This cross-border system has often been criticized for being slow, unclear, and lacking accountability, which has hindered effective enforcement of the GDPR.
To address these issues, the European Commission proposed a new regulation in 2023 designed to harmonize procedural rules and speed up decision-making. Yet, privacy advocacy groups such as noyb have raised concerns that ongoing trilogue negotiations between the Commission, the European Parliament, and the Council have resulted in a complicated draft. Instead of simplifying procedures, the draft introduces up to ten different types of GDPR processes, increasing legal complexity and potentially delaying investigations further.
Max Schrems, a prominent privacy lawyer and founder of noyb, has expressed strong criticism, calling the proposal a “legislative mess.” The NGO argues that the draft fails to resolve core problems in cross-border enforcement and instead creates multiple procedural paths that may prolong case resolution. Privacy advocates are calling for clearer rights for individuals, including the right to be heard and to appeal, as well as more streamlined processes. Currently, DPA procedures vary widely in duration and transparency, especially regarding access to documents.
European Parliament negotiator Markéta Gregorová emphasized that the Parliament’s goal is to create a fair and functional process that benefits individuals, authorities, and businesses alike. She assured that the focus remains on timely decisions and effective remedies, particularly strengthening complainants’ voices. Despite these assurances, critics warn that the new regulation could generate more disputes rather than solving existing problems. The proposal is still under discussion, with the next trilogue meeting scheduled for May 21.
