Fact-checked by Grok 2 weeks ago

European Data Protection Board

The European Data Protection Board (EDPB) is an independent European body with legal personality established to ensure the consistent application of the General Data Protection Regulation (GDPR) and the Data Protection Directive in the law enforcement sector across the European Economic Area (EEA).^[1] Comprising the heads of the data protection authorities from the 27 EU member states, plus those from Iceland, Liechtenstein, and Norway, along with the European Data Protection Supervisor, the EDPB promotes uniform enforcement of data protection rules while fostering cooperation among national supervisory authorities.^[1] Its binding decisions in cross-border cases have influenced major enforcement actions, such as the 1.2 billion euro fine imposed on Meta Platforms Ireland Limited for unlawful data transfers to the United States.^[2] Created under Article 68 of the GDPR, which was adopted on 27 April 2016 and became applicable on 25 May 2018, the EDPB succeeded the Article 29 Data Protection Working Party to address the need for coordinated oversight in an increasingly digital single market.^[3] Headquartered in Brussels with secretarial support from the European Data Protection Supervisor's office, it is led by a chair and two deputy chairs elected for five-year terms, currently Anu Talus as chair with deputies Irene Loizidou Nicolaidou and Zdravko Vukić.^[1] The board's structure emphasizes consensus among members, though it can adopt decisions by qualified majority if necessary, reflecting a balance between national autonomy and EU-wide harmonization.^[4] Among its core duties, the EDPB issues guidelines and recommendations to clarify GDPR interpretations, such as those on legitimate interests, consent, and the interplay between the GDPR and the Digital Markets Act, having produced dozens of such documents to guide controllers and processors.^[5]^[6] It also renders opinions to the European Commission on proposed adequacy decisions for third-country data transfers and investigates potential risks to uniform application on its own initiative.^[4] While these efforts have advanced data protection standards, the EDPB's opinions—such as on the concept of a controller's main establishment—have drawn scrutiny for potentially complicating the GDPR's one-stop-shop mechanism, which designates a single lead authority for multinational firms, thereby challenging the efficiency of centralized enforcement for tech giants often based in Ireland.^[7] In its 2024-2027 strategy, the board prioritizes emerging challenges like AI and international data flows, underscoring its adaptive role amid criticisms of uneven enforcement burdens across member states.^[8]^[9]

History and Establishment

The EU's data protection framework prior to the General Data Protection Regulation (GDPR) relied on Directive 95/46/EC, adopted by the Council on 24 October 1995 and published in the Official Journal on 23 November 1995, which harmonized national laws on personal data processing while mandating the establishment of independent supervisory authorities in each Member State.^[10] Member States were required to transpose the Directive into national legislation by 24 October 1998, leading to the creation of national data protection authorities (DPAs) tasked with enforcement, oversight, and citizen complaints handling.^[10] These authorities operated independently but lacked a centralized EU-level enforcement mechanism, resulting in varying interpretations and applications across jurisdictions. To address coordination needs, Article 29 of the Directive established the Article 29 Data Protection Working Party (WP29) as an advisory body, which began operations in 1996.^[11] Composed of one representative from each Member State's DPA—initially from the 15 EU states at the time, expanding with enlargement—plus a representative from the European Data Protection Supervisor, WP29 functioned as an independent entity without binding decision-making powers.^[12] Its primary roles, outlined in Article 30 of the Directive, included advising Member States on data protection matters, promoting uniform application of the Directive through cooperation among DPAs, providing opinions to the European Commission on proposed measures or codes of conduct, and examining developments in information technology affecting privacy.^[12] Over its two decades, WP29 issued over 200 documents, including opinions, recommendations, and guidelines on topics such as data transfers, profiling, and privacy impact assessments, fostering informal alignment among national authorities despite the Directive's limitations in cross-border enforcement.^[13] For instance, it addressed third-country data adequacy decisions and coordinated responses to emerging technologies, though its outputs were non-binding and often reflected compromises among divergent national views.^[12] This consultative structure highlighted gaps in consistency—such as uneven fines and complaint resolutions—that the GDPR later sought to remedy by replacing WP29 with the European Data Protection Board on 25 May 2018, granting the new body enhanced powers for binding decisions.^[11]^[14] The European Data Protection Board (EDPB) was established as an independent body of the Union with legal personality under Article 68 of the General Data Protection Regulation (GDPR), a legislative measure adopted by the European Parliament and the Council on 27 April 2016 and published in the Official Journal of the European Union on 4 May 2016.^[15]^[16] The GDPR aimed to harmonize data protection rules across EU member states by replacing the earlier Data Protection Directive 95/46/EC, thereby necessitating a new supervisory mechanism to oversee consistent implementation and resolve cross-border disputes among national data protection authorities.^[11] The EDPB formally commenced operations on 25 May 2018, coinciding with the date of GDPR applicability across the European Union.^[17] This transition marked the dissolution of the predecessor Article 29 Working Party, which had functioned as an advisory body under the 1995 Directive since 1997 but lacked the binding decision-making powers granted to the EDPB.^[11]^[17] Article 68(1) GDPR explicitly mandates the Board's creation to promote cooperation and uniformity in data protection enforcement, empowering it with enhanced authority over national authorities to address fragmentation risks in the single market.^[16] Initial formation involved the assembly of representatives from the heads of each EU member state's data protection authority, alongside the European Data Protection Supervisor as a full member and the European Commission in an advisory capacity, totaling up to 30 voting members depending on national configurations.^[16] This structure reflects the GDPR's emphasis on decentralized yet coordinated oversight, with the Board's secretariat hosted by the European Data Protection Supervisor in Brussels to facilitate administrative independence.^[15] The establishment thus operationalized a shift toward more robust, enforceable pan-EU data protection governance amid rising concerns over digital privacy and cross-border data flows.^[18]

Initial Operations and Transition

The European Data Protection Board (EDPB) commenced operations on 25 May 2018, coinciding with the applicability of the General Data Protection Regulation (GDPR), which established the Board as an independent EU body to replace the Article 29 Working Party (WP29). The WP29, an advisory body under the predecessor Data Protection Directive 95/46/EC, ceased to exist on the same date, with the EDPB endorsing 16 of its outstanding guidelines to ensure continuity in data protection interpretations across member states.^[17]^[19] This transition facilitated a seamless shift to the EDPB's enhanced powers, including binding decision-making in cross-border cases, while building on WP29's preparatory work under the GDPR's two-year implementation period from 2016.^[19] The EDPB's inaugural plenary meeting occurred on 25 May 2018, during which it elected Andrea Jelinek, head of the Austrian Data Protection Authority, as its first Chair for a five-year term, along with two Deputy Chairs.^[20]^[19] The meeting also addressed immediate priorities, such as adopting rules of procedure and initiating cooperation mechanisms with the European Data Protection Supervisor (EDPS). Preparations for operational readiness included establishing a dedicated EDPB Matters sector within the EDPS in 2017 and early 2018, culminating in a Memorandum of Understanding signed on 25 May 2018 to formalize the Secretariat's support from the EDPS.^[19] The Secretariat, based in Brussels, provided analytical, administrative, and logistical assistance to enable the Board's functions from the outset.^[21] From May to December 2018, the EDPB conducted five plenary sessions and 36 expert subgroup meetings, focusing on transitional tasks like registering 255 cross-border processing cases and initiating 574 procedures to identify lead supervisory authorities.^[19] It issued 26 consistency opinions on data protection impact assessment (DPIA) lists submitted by member states and adopted four new guidelines on topics including certification criteria, derogations, territorial scope, and supervisory authority accreditation, marking the shift to proactive enforcement under the GDPR.^[19] These early outputs underscored the Board's role in promoting uniform GDPR application amid rising complaint volumes and enforcement demands.^[19]

Organizational Structure

Membership Composition

The European Data Protection Board (EDPB) consists of 28 members: the head of one supervisory authority from each of the 27 EU member states and the European Data Protection Supervisor (EDPS).^[16] ^[22] These members, or their respective representatives, participate in a personal capacity but represent their national data protection authorities (DPAs), ensuring decisions reflect the collective expertise of EU-wide enforcement bodies.^[16] ^[22] Representatives from the three EEA EFTA states—Iceland, Liechtenstein, and Norway—attend EDPB meetings and contribute to discussions but lack voting rights, aligning with the EEA's extension of GDPR applicability without full decision-making parity.^[23] This structure, established under Article 68 of the GDPR effective May 25, 2018, replaced the prior Article 29 Working Party and fosters uniform application of data protection rules across jurisdictions.^[16] ^[18] Membership turnover occurs as national DPA heads change, with the current roster including authorities such as Austria's Datenschutzbehörde, Belgium's Autorité de protection des données, and Bulgaria's Commission for Personal Data Protection, among others listed on the EDPB's official register.^[22] All members are independent, with no alternates permitted beyond designated representatives, to maintain focused and authoritative deliberations.^[16]

Chairmanship and Leadership

The Chair and two Deputy Chairs of the European Data Protection Board (EDPB) are elected from among its members by simple majority vote of those entitled to vote, for a term of five years that is renewable only once.^[24]^[25] Members eligible for election include the heads or designated representatives of the EU member states' data protection authorities and the European Data Protection Supervisor, excluding observers such as the European Commission, which participates without voting rights.^[23] The election process typically involves nominations followed by a secret ballot during plenary sessions, as occurred in the selection of candidates from specific national authorities ahead of votes.^[26]^[27] The Chair coordinates the Board's activities, represents it in external communications, and reports its work to the European Commission, particularly on matters like binding decisions under Article 65 of the GDPR.^[16] Deputy Chairs assist the Chair and assume duties in their absence, contributing to the Board's collegial decision-making, which requires simple majorities for most actions.^[28] This leadership structure ensures consistent application of data protection rules across the EU by fostering cooperation among national authorities, though decisions reflect the diverse enforcement priorities of member states rather than a centralized executive.^[29] As of October 2025, the Chair is Anu Talus, Finland's Data Protection Ombudsman, elected on May 25, 2023, succeeding Andrea Jelinek of Austria, who served from May 2018 to May 2023 as the Board's inaugural Chair during the initial GDPR implementation phase.^[1]^[30] The current Deputy Chairs are Irene Loizidou Nicolaidou of Cyprus and Zdravko Vukić of Croatia, with Vukić assuming his role in 2024 following Aleid Wolfsen of the Netherlands.^[1]^[31] Leadership transitions, such as Talus's election, have emphasized continuity in addressing emerging challenges like AI and digital services while maintaining the Board's independence from national biases.^[32]

Secretariat and Operations

The Secretariat of the European Data Protection Board (EDPB) is provided by the European Data Protection Supervisor (EDPS) and operates exclusively under the Board's direction, as established by Article 75 of the General Data Protection Regulation (GDPR).^[33] Located in Brussels, it delivers analytical, administrative, logistical, and IT support to facilitate the Board's core functions, including the preparation, drafting, translation, and publication of opinions, guidelines, and binding decisions.^[21] The Secretariat comprises approximately 21 staff members employed by the EDPS but directed by the EDPB Chair, ensuring operational efficiency in promoting consistent GDPR application across EU member states and the European Economic Area.^[34]^[21] In response to a growing workload, the Secretariat underwent a structural reorganization in early 2023, expanding into five specialized sectors: Litigation and International Affairs, Legal Affairs—Cooperation and Enforcement, Information and Communications, Administrative Matters, and IT Matters.^[35]^[21] The Litigation and International Affairs sector manages dispute resolution and external relations; Legal Affairs handles cooperation mechanisms and enforcement coordination; Information and Communications oversees public outreach and institutional liaison; Administrative Matters provides logistical support for meetings and events; and IT Matters delivers technical tools, including platforms supporting around 1,500 staff from EEA supervisory authorities.^[21]^[35] This setup enables the handling of over 360 meetings annually, the coordination of cross-border cases, and the dissemination of data protection resources, such as the 2023 Data Protection Guide for Small Businesses.^[35] Operations are governed by the EDPB's rules of procedure and a Memorandum of Understanding with the EDPS, which delineates resource allocation and cooperation terms while upholding the Board's autonomy from EU institutions.^[36]^[21] Leadership includes Head of Secretariat Isabelle Vereecken and Deputy Head Gwendal Le Grand, with sector heads such as Myriam Gufflet (Litigation and International Affairs) and Effrosyni Panagou (IT Matters) overseeing specialized functions.^[21] By streamlining internal processes and fostering inter-authority collaboration, the Secretariat contributes to the EDPB's mandate of ensuring uniform enforcement, though its limited size has prompted ongoing adaptations to handle escalating demands from digital regulation challenges.^[37]^[38]

Core Functions and Powers

The European Data Protection Board (EDPB) is mandated under Article 70(1) of the General Data Protection Regulation (GDPR) to ensure the consistent application of the GDPR and other Union data protection legislation throughout the European Union and the European Economic Area (EEA).^[33] This obligation encompasses monitoring the implementation of data protection rules by national supervisory authorities, fostering cooperation to prevent divergent interpretations, and addressing discrepancies that could undermine the internal market's uniformity in personal data handling.^[4] The consistency mechanism, established by Article 63 GDPR, underpins these efforts by requiring supervisory authorities to collaborate, exchange information, and mutually assist in cross-border cases, thereby mitigating risks of fragmented enforcement.^[39] To operationalize this mandate, the EDPB convenes regular plenary sessions—typically six to eight per year—where representatives from the 27 EU member states' data protection authorities, plus those from Iceland, Liechtenstein, and Norway, deliberate on emerging issues and align positions.^[40] These meetings facilitate the identification of enforcement gaps and the promotion of harmonized practices, such as through the maintenance of a public register of final decisions by national authorities under the cooperation procedure, which enhances transparency and allows for peer review of enforcement outcomes.^[41] As of 2024, the EDPB has emphasized resource allocation to national authorities as critical for effective consistency, noting in its annual assessments that underfunding leads to uneven application, particularly in high-volume complaint handling and investigations.^[42] Further promoting uniformity, the EDPB's 2024-2027 Strategy prioritizes initiatives like the Coordinated Enforcement Framework (CEF), which designates annual focal topics for joint actions by supervisory authorities—such as the right of access in 2024—to synchronize investigative priorities and methodologies across jurisdictions.^[43] Complementing this, the Support Pool of Experts (SPE), launched as part of the strategy, pools specialized knowledge from member authorities to assist in complex cases, including extraterritorial enforcement, ensuring that interpretations of GDPR principles like lawfulness and proportionality remain aligned despite varying national contexts.^[44] These mechanisms have contributed to a reported increase in cross-border case resolutions, with over 1,000 cooperation procedures registered by 2023, though challenges persist due to disparities in national enforcement capacities.^[45]

Issuing Guidelines, Opinions, and Recommendations

The European Data Protection Board (EDPB) issues non-binding guidelines, recommendations, and best practices pursuant to Article 70(1)(b) of the General Data Protection Regulation (GDPR), with the objective of promoting the consistent application and interpretation of data protection rules across EU Member States and associated countries.^[4] These instruments clarify complex provisions, such as the processing of special categories of data, the right to data portability, and obligations for data protection officers, thereby assisting national supervisory authorities, controllers, processors, and other stakeholders in achieving harmonized compliance.^[46] While lacking direct legal force, their persuasive authority stems from the EDPB's composition—heads or representatives of national data protection authorities (DPAs)—and they often inform national enforcement practices and court interpretations.^[47] The development process for guidelines typically involves drafting by sub-groups of Board members, followed by internal review, public consultation to solicit stakeholder input, and adoption by a two-thirds majority vote in a plenary session.^[4] Adopted guidelines, such as those on consent requirements under Article 7 GDPR or data breach notification timelines under Article 33, include practical examples and checklists to guide implementation, with the EDPB required to periodically review their practical application and update them as needed.^[46] Recommendations and best practices, often shorter and more targeted, address procedural or sector-specific issues, like certification mechanisms under Article 42 GDPR, to encourage voluntary adoption of effective safeguards.^[4] In parallel, the EDPB issues opinions under Article 70(1)(c) and (s) GDPR, providing formal advice to the European Commission on proposed measures, including adequacy decisions for third-country data transfers, or to national DPAs on matters with cross-border implications.^[48] These opinions, adopted by simple majority, evaluate alignment with GDPR principles; for example, opinions on draft implementing decisions assess whether frameworks like the EU-US Data Privacy Framework ensure an essentially equivalent level of protection.^[49] National DPAs may also request EDPB opinions on issues affecting multiple Member States, ensuring coordinated approaches to general application challenges.^[48] Unlike guidelines, opinions are more reactive and case-oriented but contribute to precedential consistency by influencing subsequent DPA decisions and Commission actions.^[47]

Binding Decisions in Disputes

The European Data Protection Board (EDPB) exercises its authority to issue binding decisions under Article 65 of the General Data Protection Regulation (GDPR), which establishes a dispute resolution mechanism for conflicts among national supervisory authorities in cross-border data processing cases.^[50] This provision activates when a concerned supervisory authority raises a relevant and reasoned objection to the draft decision of the lead supervisory authority (LSA), particularly regarding the existence of a GDPR infringement or the proportionality of proposed remedial measures, including administrative fines.^[51] The EDPB must then adopt a binding decision by a two-thirds majority of its members, which becomes enforceable across all involved authorities and binds the LSA to amend its decision accordingly within one month.^[52] This mechanism ensures consistent application of the GDPR by overriding national divergences, with the binding decision addressing all objected matters, such as data processing lawfulness or transfer validity.^[53] The process begins with the LSA referring the dispute to the EDPB after failing to resolve objections through mutual consultation under Article 60(4) GDPR; the Board may suspend proceedings if needed and prioritizes urgency in cases involving urgent remedial action.^[51] Adopted decisions are implemented uniformly, fostering harmonized enforcement while allowing limited national variations only on non-core elements like fine calculation methods, subject to Board oversight.^[54] Notable examples include the EDPB's 2022 binding decisions on Meta Platforms Ireland Limited (Meta IE), resolving disputes over behavioral advertising practices on Facebook, Instagram, and WhatsApp; these rejected contractual necessity as a lawful basis for processing special category data, mandating the Irish Data Protection Commission (DPC) to impose fines and cease unlawful processing.^[55] In Binding Decision 1/2023, the EDPB addressed Meta's international data transfers, instructing the DPC to prohibit reliance on standard contractual clauses without supplementary measures and to fine the company up to 4% of global turnover, resulting in a €1.2 billion penalty—the largest GDPR fine to date.^[56]^[2] Another instance, Binding Decision 5/2022, examined Meta's processing for service improvement, deeming it unfair and instructing remedial actions.^[57] These decisions have faced judicial scrutiny, as seen in ongoing challenges before the Court of Justice of the European Union (CJEU), where the EDPB's authority to expand investigations beyond the LSA's scope was upheld in early 2025 rulings on Meta cases, affirming the Board's role in ensuring comprehensive GDPR compliance.^[58] By December 2023, the EDPB had issued over a dozen such binding decisions, primarily targeting large tech firms in cross-border disputes, demonstrating the mechanism's focus on high-impact enforcement while highlighting tensions between national authorities like the DPC and more stringent counterparts.^[59]

Key Activities and Outputs

Early Guidelines and Opinions (2018–2020)

In its first plenary session on 25 May 2018, coinciding with the GDPR's enforcement date, the EDPB adopted initial guidelines on core implementation aspects, including certification criteria under Articles 42 and 43 (Guidelines 1/2018), derogations for international data transfers under Article 49 (Guidelines 2/2018), and identifying the lead supervisory authority.^[60] These documents, largely building on prior Article 29 Working Party outputs, aimed to standardize supervisory practices across member states, with Guidelines 1/2018 specifying measurable criteria for data protection certifications to foster compliance mechanisms. Additional 2018 adoptions covered personal data breach notifications, the right to data portability, and transparency requirements, emphasizing timely reporting thresholds (e.g., 72-hour breach notifications) and clear information provision to data subjects.^[19] The Board also issued early opinions on legislative proposals, such as Opinion 23/2018 on derogations in the proposed ePrivacy Regulation, critiquing potential conflicts with GDPR principles like data minimization and purpose limitation.^[19] Guidelines 3/2018 on the GDPR's territorial scope (initially adopted November 2018, finalized November 2019) clarified extraterritorial applicability, applying to non-EU entities offering goods/services to EU residents or monitoring behavior therein, regardless of data location.^[61] Guidelines 4/2018 on accrediting certification bodies (December 2018) outlined procedural standards to ensure independence and expertise in oversight roles.^[46] In 2019, the EDPB focused on procedural and sector-specific guidance, adopting Guidelines 1/2019 on codes of conduct and monitoring bodies (February 2019) to enable industry self-regulation under Article 40, requiring binding commitments and independent audits. Guidelines 2/2019 addressed Article 6(1)(b) necessity for online services to children, mandating age-appropriate verification to avoid disproportionate parental consent burdens.^[62] Later outputs included Guidelines 3/2019 on video device processing (July 2019), prohibiting systematic facial recognition in public spaces absent explicit legal bases, and Guidelines 4/2019 on data protection by design/default (November 2019), enumerating seven key elements like data minimization at source and default privacy settings.^[63]^[64] Guidelines 5/2019 on the right to be forgotten in search engines (December 2019) refined delisting criteria beyond EU borders for global visibility. By 2020, amid the COVID-19 pandemic, the EDPB accelerated outputs on emerging issues, issuing Guidelines 3/2020 and 4/2020 (April 2020) on health data processing and location tracing tools for outbreak control, stressing proportionality, anonymization preferences, and secondary use restrictions to balance public health with rights. Revised Guidelines 5/2020 on consent (May 2020) reinforced freestanding, informed requirements, invalidating bundled or pre-ticked options, particularly for tracking technologies.^[65] Other adoptions included Guidelines 6/2020 on PSD2-GDPR interplay (July 2020), clarifying exemptions for payment services while upholding access controls, and Guidelines 7/2020 on controller-processor concepts (September 2020), delineating responsibility chains with joint controllership thresholds based on influence over processing. These early documents established interpretive frameworks, with over 20 outputs by end-2020 fostering harmonization amid initial enforcement challenges.^[19]

Post-Pandemic and Tech-Focused Outputs (2021–2023)

Following the implementation of its multiannual Strategy for 2021-2023, adopted in December 2020, the EDPB prioritized addressing risks from emerging technologies, including artificial intelligence, biometrics, profiling, and international data transfers, while promoting consistent GDPR enforcement amid accelerated digital transformation post-COVID-19 restrictions.^[66] The strategy outlined four pillars—such as monitoring technological developments and issuing targeted guidance—with specific actions to foster harmonized application of data protection rules to innovative processing activities.^[67] This shift emphasized proactive guidance over pandemic-specific derogations, focusing on tech-driven challenges like automated decision-making and cross-border flows to non-EU tech providers.^[68] In April 2021, the EDPB finalized Guidelines 8/2020 on the targeting of social media users, clarifying responsibilities for platform providers and advertisers in processing personal data for behavioral advertising.^[69] The guidelines specify that social media intermediaries act as controllers when enabling targeting based on user interactions, requiring transparency, lawful basis assessments, and risk mitigation for inferred sensitive data categories.^[70] They highlight heightened risks from opaque algorithms amplifying echo chambers or discrimination, mandating data protection impact assessments for high-risk targeting.^[71] The EDPB advanced biometrics-focused outputs with Guidelines 05/2022 on the use of facial recognition technology in law enforcement, adopted in 2022 and finalized in May 2023 after public consultation.^[72] These guidelines outline GDPR-compliant conditions for real-time and post-processing systems, stressing necessity, proportionality, and minimization under Articles 8 and 10 of the LED, while cautioning against categorizing individuals via AI-clustered biometrics without explicit legal bases.^[73] They provide lawmakers and authorities with criteria for balancing public security against rights infringements, including storage limitations and oversight mechanisms.^[74] In January 2023, the EDPB launched its first coordinated enforcement action on cloud-based services in the public sector, yielding recommendations for GDPR compliance in procurement and use.^[75] Public bodies were urged to conduct transfer impact assessments for non-EU clouds, ensure processor agreements under Article 28, and verify data localization where sovereignty risks arise.^[76] Complementing this, February 2023 Guidelines on the interplay between Article 3 GDPR and international transfer provisions addressed extraterritorial applicability for tech firms, requiring supplementary measures beyond standard contractual clauses for adequacy-deficient destinations.^[77] The EDPB's Opinion 5/2023, adopted February 28, critiqued the European Commission's draft adequacy decision for the EU-U.S. Data Privacy Framework, arguing it insufficiently curbs U.S. surveillance under laws like Section 702 of FISA, thus necessitating ongoing transfer tools for EU exporters.^[78] In November 2023, draft Guidelines 2/2023 on the technical scope of Article 5(3) ePrivacy Directive targeted tracking technologies, delineating "storage" and "access" to device data for consent-exempt scenarios like essential analytics.^[79] These outputs collectively reinforced GDPR's extraterritorial reach on global tech ecosystems, with the EDPB's 2022 and 2023 annual reports documenting over 20 guidance documents and enhanced cooperation on tech disputes.^[38]^[37]

Recent Developments (2024–2025)

In 2024, the EDPB adopted its multiannual strategy for 2024–2027, emphasizing enhanced cooperation among data protection authorities, proactive guidance on emerging technologies, and alignment with new EU legislation such as the AI Act and Digital Services Act (DSA).^[8] The strategy prioritizes addressing data protection challenges in AI systems, cloud computing, and international data transfers amid evolving digital landscapes.^[80] Key outputs included guidelines on the interplay between the GDPR and Article 48, which governs transfers of personal data to third-country authorities for judicial purposes, finalized in June 2025 to clarify transfer validity and safeguards.^[81] The EDPB also issued Opinion 28/2024 in December 2024, providing interpretive guidance on AI model training and deployment under GDPR principles like lawfulness, transparency, and data minimization, stressing that generative AI outputs can constitute personal data processing when involving identifiable individuals.^[82] ^[83] In October 2024, final guidelines 02/2023 on Article 5(3) of the ePrivacy Directive were published, detailing consent requirements for storing or accessing information on user devices, including cookie banners and tracking technologies.^[84] For 2025, the EDPB launched its Coordinated Enforcement Framework (CEF) action focused on the right to erasure (Article 17 GDPR), aiming to harmonize enforcement across member states by examining compliance in areas like automated decision-making and online content removal.^[85] Draft Guidelines 3/2025 on the DSA-GDPR interplay were opened for public consultation, addressing overlaps in platform obligations for risk assessment and transparency.^[86] In October 2025, the EDPB adopted opinions supporting the extension of EU adequacy decisions for the United Kingdom until December 27, 2025, evaluating post-Brexit safeguards while noting ongoing concerns over UK surveillance laws and data access mechanisms.^[87] ^[88] Judicial scrutiny arose in May 2025 when the EU General Court ruled that EDPB Opinion 08/2024 on valid consent in "consent or pay" models—challenging practices by platforms like Meta—lacked direct legal effect, limiting its enforceability as a non-binding consistency mechanism.^[89] The EDPB's 2024 annual report, released April 23, 2025, documented over 20 consistency opinions, multiple binding decisions in cross-border cases, and statements on legislative proposals, underscoring a 15% increase in plenary meetings to handle rising dispute volumes.^[8] ^[90]

Role in Enforcement and Cooperation

Handling Cross-Border Cases

Cross-border cases under the General Data Protection Regulation (GDPR) involve personal data processing that affects or is likely to affect data subjects in more than one EU member state, triggering the one-stop-shop mechanism where a lead supervisory authority (LSA) assumes primary responsibility, in cooperation with concerned supervisory authorities (CSAs) from other involved states.^[47] The LSA, determined by the controller's or processor's main establishment—defined as the place of central administration or principal place of business where decisions on data processing purposes and means are taken—prepares a draft decision, which CSAs review and may object to via relevant and reasoned objections (RROs).^[91] This cooperative framework aims to ensure consistent GDPR application and prevent forum shopping, but procedural divergences among national authorities have led to delays and inconsistencies in enforcement.^[92] The European Data Protection Board (EDPB) intervenes in cross-border cases primarily through its dispute resolution powers under Article 65 GDPR, issuing binding decisions when supervisory authorities (SAs) cannot reach consensus.^[93] Triggers include CSAs' RROs to an LSA's draft decision without agreement (Art. 65(1)(a)), disputes over LSA identification (Art. 65(1)(b)), or an SA's failure to seek or adhere to an EDPB opinion under the consistency mechanism (Art. 65(1)(c)).^[93] Upon referral by the LSA within one month of failed consensus, the EDPB adopts a binding decision by a two-thirds majority within one month (extendable by one month for complex cases), or by simple majority if needed thereafter; SAs must implement it nationally within one month, though they may challenge it before the Court of Justice of the EU within two months.^[93] EDPB binding decisions have addressed high-profile cross-border disputes, such as the 2020 resolution of objections to the Irish Data Protection Commission's draft on Twitter's data breach notification failures, marking the first such ruling.^[94] In 2022, the EDPB issued three decisions concerning Meta Platforms Ireland Limited's processing for Facebook and Instagram behavioral advertising, requiring amendments to the LSA's draft.^[55] Further rulings involved TikTok, WhatsApp, and Accor, while a 2023 decision compelled a €1.2 billion fine on Meta for unlawful EU-US data transfers.^[95]^[96] By 2025, the Court of Justice upheld the EDPB's authority to mandate broader investigations beyond an LSA's draft in one-stop-shop cases, reinforcing its role in uniformity.^[97] To address persistent enforcement challenges, a provisional agreement reached on June 16, 2025, between the Council and European Parliament proposes a new regulation harmonizing cross-border procedures, imposing binding deadlines (12 months for simpler cases, 15 months for complex ones, extendable by 12 months), and potentially expanding EDPB dispute resolution involvement under Article 65.^[98]^[99] The EDPB has supplemented these powers with guidelines, including final 2023 guidelines on Article 65(1)(a) application and earlier clarifications on urgency procedures, emphasizing swift resolution to protect data subjects' rights across borders.^[54]^[100]

Cooperation Among National DPAs

The cooperation among national data protection authorities (DPAs) in the European Union is mandated by Chapter VII of the GDPR, which establishes mechanisms for mutual assistance, joint operations, and coordinated enforcement to ensure consistent application of data protection rules across member states. Article 61 GDPR requires DPAs to provide each other with mutual assistance, including the exchange of relevant information requested for the performance of their tasks, such as carrying out investigations or inspections, with responses due within one month and without undue delay.^[101] Requests must specify their purpose and legal basis, and information provided may only be used for that purpose, with refusals permitted only if the requested DPA lacks competence or if compliance would infringe the GDPR or other applicable laws.^[101] Article 62 GDPR further enables joint operations, allowing DPAs to conduct collaborative investigations, data protection audits, or inspections where necessary for effective enforcement, particularly in cases involving multiple member states. The EDPB supports these processes by promoting transparency, such as through its public register of final decisions adopted by DPAs under Article 60 GDPR's cooperation procedure, which covers cross-border enforcement outcomes.^[41] This register enhances accountability and allows stakeholders to track how DPAs collaborate on cases, fostering harmonized practices.^[41] A key EDPB initiative for structured cooperation is the Coordinated Enforcement Framework (CEF), launched to streamline joint efforts on priority topics selected annually by EDPB plenary vote.^[102] Under the CEF, DPAs undertake national-level fact-finding, investigations, or follow-ups using agreed methodologies, then aggregate findings into an EDPB-wide report with recommendations to improve compliance.^[102] Examples include the 2023 CEF on the role of data protection officers, the 2024 focus on the right of access, and the 2025 action on the right to erasure, demonstrating how the framework builds expertise and consistency without mandatory obligations on individual DPAs.^[102] These efforts operationalize GDPR cooperation mechanisms, including mutual assistance and joint operations, as highlighted in the EDPB's 2024 annual report.^[103]

Oversight of Major Fines and Sanctions

The European Data Protection Board (EDPB) oversees major fines and sanctions primarily through its dispute resolution powers under Article 65 of the GDPR, issuing binding decisions when national supervisory authorities disagree on draft enforcement actions in cross-border cases. These decisions compel the lead supervisory authority to impose specified corrective measures, including administrative fines up to €20 million or 4% of global annual turnover, whichever is higher, thereby ensuring consistent application of sanctions across EU member states. As of September 2024, the EDPB has adopted nine such binding decisions in dispute resolution procedures, several of which have directly resulted in multimillion-euro penalties against large technology firms.^[104]^[59] Notable examples include the EDPB's December 2023 binding decision rejecting the Irish Data Protection Commission's (DPC) draft decision on Meta Platforms Ireland's data transfers to the United States, which violated GDPR Chapter V following the Schrems II ruling; this instructed the DPC to impose a €1.2 billion fine—the largest under the GDPR to date—and cease unlawful processing.^[2] In another case, the EDPB's September 2021 binding decision on WhatsApp Ireland's processing practices led to a €225 million fine by the DPC for transparency violations and lack of legal basis under Articles 13, 14, and 6 GDPR. Similarly, an August 2020 binding decision instructed the Dutch Data Protection Authority to pursue enforcement against TikTok for child data protection failures, contributing to subsequent national investigations and fines exceeding €300 million across multiple jurisdictions. To further standardize sanctions, the EDPB issued Guidelines 04/2022 on the calculation of administrative fines, finalized on May 24, 2023, outlining a five-step process: (1) identification and classification of infringements, (2) assessment of seriousness and gravity, (3) determination of applicable legal maximum, (4) adjustment for aggravating or mitigating factors, and (5) establishment of the final amount within limits.^[105] These non-binding but influential guidelines aim to mitigate disparities in national enforcement, though the EDPB's interventions remain limited to disputed cases, with most fines handled unilaterally by lead authorities without escalation.^[106]

Impacts and Evaluations

Achievements in Privacy Protection

The European Data Protection Board (EDPB) has contributed to privacy protection by issuing binding decisions that enforce GDPR compliance across member states, notably resolving disputes over cross-border data processing. In December 2023, the EDPB's binding decision compelled the Irish Data Protection Commission to impose a €1.2 billion fine on Meta Platforms Ireland Limited for unlawful transfers of EU users' personal data to the United States using standard contractual clauses deemed inadequate against U.S. surveillance laws, thereby safeguarding data from foreign government access risks without adequate protections.^[2] This intervention highlighted the EDPB's role in upholding Article 48 of the GDPR, which restricts transfers absent an adequacy decision or suitable safeguards, and set a precedent for scrutinizing third-country data flows.^[2] Through guidelines and opinions, the EDPB has standardized privacy practices in emerging technologies, enhancing protections against novel risks. In April 2025, it released guidelines on processing personal data via blockchain technologies, outlining compatibility with GDPR principles like data minimization and purpose limitation to mitigate pseudonymity challenges in decentralized systems.^[107] Similarly, in January 2025, the EDPB issued an opinion on AI systems, stressing case-by-case GDPR applicability, accountability for training data involving personal information, and record-keeping obligations to prevent opaque profiling or biased decision-making.^[82] These outputs promote proactive compliance, as evidenced by harmonized enforcement methodologies, including guidelines on administrative fine calculations adopted in May 2022, which ensure proportionate sanctions for violations.^[108] The EDPB's coordinated efforts have also bolstered individual rights enforcement. In January 2025, a joint action with the European Data Protection Supervisor revealed systemic shortcomings in EU institutions' handling of data access requests, prompting targeted supervisory improvements to facilitate individuals' verification of personal data processing.^[109] Its 2024-2027 strategy further prioritizes consistent application amid digital evolution, including statements on AI Act integration and procedural reforms for GDPR enforcement, fostering a unified framework that has empirically correlated with enhanced organizational security practices post-GDPR rollout.^[8]^[103]^[110]

Economic and Innovation Consequences

The enforcement of GDPR through EDPB guidelines and decisions has imposed substantial compliance costs on European businesses, with 88% of surveyed organizations spending over €1 million annually on ongoing GDPR maintenance and 40% exceeding €10 million.^[111]^[112] These costs encompass data protection officers, audits, and technology investments, disproportionately burdening small and medium-sized enterprises (SMEs), which report expenditures ranging from €1,000 to €50,000 despite limited resources.^[113] Empirical analyses indicate that GDPR compliance, standardized by EDPB oversight, has reduced firm profitability by an average of 8.1% and sales by 2% for entities targeting EU markets, with SMEs experiencing the heaviest impacts due to scaled regulatory demands.^[114]^[115] A 2024 ZEW survey found that 25% of information economy firms, rising to 38% among large ones, reported slowed innovation attributable to GDPR requirements, including EDPB clarifications on data processing and fines.^[116] On innovation, panel data from German firms shows GDPR has curbed product development activities, with a majority perceiving it as a barrier to experimentation in data-driven sectors like AI and online services.^[117]^[118] Venture capital investment in EU tech startups declined post-GDPR, alongside fewer app launches and reduced data utilization for computation, limiting competitive entry for new entrants reliant on personal data flows.^[119]^[120] EDPB guidelines on pseudonymization and cross-border transfers have further constrained data availability, exacerbating these effects by mandating uniform, risk-averse practices across member states.^[121]^[122] While some compliance investments have spurred privacy-enhancing technologies, net effects remain negative, with estimates of 3,000 to 30,000 lost jobs in data-intensive industries due to diminished startup activity and investment.^[123] Central European startups, per a 2024 survey, cite EU data regulations—including EDPB-influenced enforcement—as elevating workflow burdens and eroding global competitiveness.^[124]

Empirical Assessments of Effectiveness

Empirical evaluations of the European Data Protection Board's (EDPB) effectiveness center on its coordination of national data protection authorities (DPAs) under the GDPR, measured through enforcement outputs like fines, complaint resolutions, and cross-border dispute settlements, as well as downstream impacts on privacy practices and compliance behaviors. A 2023 systematic review of nearly three decades of empirical GDPR-related research (up to March 2022) identified fragmented evidence, with studies showing heightened organizational awareness of data protection but insufficient causal links to reduced privacy harms or enhanced individual rights enforcement; the review advocates for longitudinal data to disentangle EDPB-guided harmonization from national DPA variations.^[125]^[126] Enforcement statistics reveal substantial financial penalties, totaling approximately €5.88 billion in GDPR fines by January 2025, including EDPB binding decisions such as the €1.2 billion sanction against Meta Platforms in December 2023 for unlawful U.S. data transfers using standard contractual clauses.^[127]^[2] By March 2025, 2,245 fines had been issued across the EU, a 7.6% increase from prior periods, with EDPB opinions influencing high-profile cases involving tech giants.^[128] Yet, analyses indicate that only 1.3% of DPA investigations culminate in fines, pointing to inefficiencies in progressing from complaints—numbering over 1,000 annually per major DPA—to corrective actions, potentially undermining deterrent effects.^[129] Privacy outcome studies provide mixed evidence of EDPB-influenced efficacy. Post-GDPR implementation, empirical data from firm surveys and web tracking analyses document reductions in data collection volumes, such as a 10-20% drop in third-party cookies and tracking scripts on EU websites, attributable in part to EDPB guidelines on consent and transparency.^[130] However, no broad decline in reported data breaches has materialized, with EU notifications stable at around 1,200 major incidents monthly in 2024, suggesting that coordinative efforts have not proportionally curbed systemic risks like unauthorized processing.^[131] Economic proxies further qualify effectiveness: a 2023 study of EU firms found the GDPR prompted a reorientation toward non-data-heavy innovations without curtailing overall patent output, implying adaptive compliance rather than stifled creativity, though small enterprises reported disproportionate administrative burdens exceeding €1 million annually in some sectors.^[118] Critiques from practitioner surveys highlight EDPB's role in fostering inconsistent enforcement, with cross-border cases resolving slower than national ones—averaging 18-24 months—due to dispute resolution bottlenecks, as evidenced by ongoing delays in lead authority designations.^[132] Overall, while EDPB mechanisms have amplified sanction visibility, empirical gaps persist in quantifying net privacy gains against coordination frictions, with calls for independent metrics beyond self-reported DPA data.^[133]

Criticisms and Controversies

Alleged Overreach and Bureaucratic Burden

Critics contend that the European Data Protection Board (EDPB) has overstepped its mandate under the General Data Protection Regulation (GDPR) by issuing binding decisions and opinions that impose interpretations exceeding the regulation's original intent, such as prioritizing non-explicit social objectives over data processing necessities. For example, national data protection authorities (DPAs), coordinated by the EDPB, have been accused of ultra vires actions when framing GDPR enforcement through lenses like social justice, thereby expanding regulatory scope beyond privacy protection to influence broader societal outcomes.^[134] The EDPB's Opinion 2/2024 on main establishments exemplifies alleged overreach, asserting that decision-making powers exercised by EU-headquartered firms but located outside the Union—such as in the United States—do not qualify as a "main establishment," thereby nullifying the GDPR's one-stop-shop mechanism and subjecting companies to multiple national DPAs rather than a single lead authority. This approach risks fragmenting enforcement, amplifying compliance challenges during crises like cyberattacks, and contradicting the GDPR's aim for streamlined cross-border processing under Article 56.^[7] Such positions contribute to bureaucratic burdens, with EDPB-influenced GDPR guidelines requiring extensive documentation, audits, and consent mechanisms that disproportionately affect small and medium-sized enterprises (SMEs). Empirical analysis indicates GDPR compliance, enforced consistently via EDPB coordination, resulted in an average 8.5% profit decline for SMEs, alongside reduced venture capital investment and internet fragmentation favoring large incumbents over innovative startups.^[114]^[135] EDPB guidelines on consent models, including Opinion 08/2024, have drawn fire for deeming "pay or consent" options invalid in many ad-supported services, effectively curtailing free-tier business models and imposing revenue losses estimated in billions for digital platforms reliant on behavioral targeting. Similarly, the board's rigid stance in Guidelines 1/2025 on online advertising interoperability under the Digital Markets Act (DMA) has been criticized for mandating excessive data disclosures, hindering targeted ads and elevating operational costs without proportionate privacy gains.^[136]^[137] These burdens prompted the European Commission's May 2025 Omnibus IV proposal to amend GDPR Article 30, exempting micro-enterprises and smaller firms from full records-of-processing obligations to curb administrative overload, targeting a 25% overall reduction and 35% for SMEs by 2029—a tacit admission of regulatory excess in EDPB-aligned enforcement.^[138]^[139]

Impacts on Business and Startups

The European Data Protection Board's (EDPB) issuance of binding guidelines and decisions on cross-border data processing has imposed substantial compliance requirements on businesses, particularly startups reliant on personal data for operations such as user analytics and targeted services. These guidelines, including those on automated decision-making and data breach notifications, necessitate detailed record-keeping, privacy impact assessments, and consent mechanisms that disproportionately burden small entities with limited resources. For instance, startups often allocate significant early-stage budgets to legal consultations and technical implementations to align with EDPB interpretations of the GDPR, diverting funds from product development.^[140] Empirical studies indicate that EDPB-coordinated enforcement under the GDPR has correlated with reduced venture capital investment in European tech startups, with EU firms experiencing double-digit percentage declines in funding relative to U.S. counterparts following the regulation's 2018 implementation. This stems from heightened risks of fines—up to 4% of global annual turnover—and operational constraints, such as restrictions on data-driven experimentation, which deter investors seeking scalable models. Aggregate startup investments in the EU dropped by approximately one-third post-GDPR, exacerbating challenges for data-intensive sectors like fintech and adtech.^[141]^[142] While some analyses suggest mixed effects, with GDPR prompting privacy-enhancing innovations in established firms, the net impact on startups appears constraining due to asymmetric compliance costs: large corporations absorb expenses through dedicated teams, whereas startups face existential threats from EDPB-mandated uniformity that limits agile pivots. Recent EU proposals in 2025 to simplify record-keeping for SMEs acknowledge these burdens but have yet to fully mitigate them, as EDPB guidelines continue to emphasize stringent accountability. Critics, including former Italian Prime Minister Mario Draghi, have highlighted GDPR's role—bolstered by EDPB oversight—as a symbol of regulatory complexity stifling SME growth and innovation.^[143]^[144]^[145]

Debates on Enforcement Inconsistencies and Political Influences

Critics have highlighted significant inconsistencies in GDPR enforcement across EU member states, despite the EDPB's mandate to promote uniformity through guidelines and dispute resolution. National data protection authorities (DPAs) vary in their application of fines and investigative rigor, with some countries like Luxembourg and Ireland issuing disproportionately fewer penalties relative to case volumes compared to others such as France or Germany, as evidenced by EDPB-compiled statistics showing total fines ranging from millions to billions of euros per authority by 2024.^[146] This disparity arises partly from resource constraints, with 77% of DPAs reporting insufficient budgets and staff, leading to uneven prioritization of cases.^[147] Moreover, the one-stop-shop mechanism, where a lead DPA handles cross-border complaints, often results in prolonged disputes when concerned authorities object, exacerbating delays and perceived forum-shopping by companies establishing EU headquarters in lenient jurisdictions.^[148] These enforcement gaps have prompted debates over structural flaws in the GDPR framework, including inconsistent EDPB guidance that allows interpretive flexibility among DPAs, potentially undermining the regulation's goal of a single digital market. For instance, analyses of post-2018 enforcement trends reveal that certain violations, such as those related to consent or security, are fined more frequently in proactive jurisdictions, while others evade penalties due to differing procedural standards across states.^[149] In response, the EU adopted a new procedural regulation in June 2025 to standardize cross-border cooperation, impose timelines for decisions, and enhance EDPB oversight, acknowledging prior inconsistencies that delayed resolutions in high-profile cases involving large-scale data processors.^[150] Proponents argue this addresses "unequal burden sharing" inherent in the system, where lead authorities bear disproportionate loads without adequate harmonization.^[9] Debates on political influences center on the independence of national DPAs, whose heads are appointed by member state governments, raising concerns that domestic priorities compromise impartial enforcement. In Ireland, the DPA has faced accusations of leniency toward U.S. tech firms headquartered there—contributing over 10% to national GDP—evident in delayed or reduced fines in cross-border cases like those against Meta, where EDPB interventions were required to override draft decisions.^[151] This perception intensified with the 2025 appointment of a former Meta lobbyist to a senior DPC role, criticized by privacy advocates as evidencing industry capture and eroding public trust in regulatory neutrality.^[152] ^[153] Similarly, in politically charged areas such as election data processing or national security exemptions, some DPAs have been alleged to align with government interests, though empirical evidence remains case-specific and contested, with overall fine rates across the EU hovering at just 1.3% of investigated complaints from 2018 to 2023.^[154] Such influences, critics contend, fragment the EDPB's consistency efforts, as national variances reflect not only legal interpretations but also economic and political incentives misaligned with EU-wide data protection objectives.^[155]

References

[1]
European Data Protection Board - European Union
The European Data Protection Board (EDPB) is an independent European body with legal personality. It ensures that the General Data Protection Regulation and ...
[2]
1.2 billion euro fine for Facebook as a result of EDPB binding decision
Meta Platforms Ireland Limited (Meta IE) was issued a 1.2 billion euro fine following an inquiry into its Facebook service, by the Irish Data Protection ...Missing: controversies | Show results with:controversies
[3]
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679
[4]
Tasks and duties - European Data Protection Board
The EDPB's goal is to ensure a consistent application and enforcement of data protection law across the European Economic Area, EEA.
[5]
https://www.edpb.europa.eu/our-work-tools/general-guidance/gdpr-guidelines-recommendations-best-practices_en
[6]
DMA and GDPR: EDPB and European Commission endorse joint ...
Oct 9, 2025 · This is the first time that the EDPB and the European Commission prepare guidelines jointly. This approach maximises usefulness of the guidance ...
[7]
EDPB Versus Ireland? Does the Opinion on “Main Establishments ...
Mar 8, 2024 · On February 13, 2024, the European Data Protection Board (EDPB) released its opinion on the notion of the main establishment of a controller ...
[8]
EDPB annual report 2024: protecting personal data in a changing ...
Apr 23, 2025 · The report provides an overview of the EDPB work carried out in 2024 and reflects on important milestones, such as the adoption of the 2024-2027 strategy.
[9]
10 years after: The EU's 'crunch time' on GDPR enforcement - IAPP
Jun 28, 2022 · Unequal burden sharing, procedural law differences hampering cooperation and the fact that the European Data Protection Board, which gathers ...
[10]
A brief history of the General Data Protection Regulation (1981-2016)
Feb 15, 2016 · This resource provides a detailed timeline of the EU GDPR from 1981 through 2016.
[11]
Legacy: Art. 29 Working Party | European Data Protection Board
The EDPB replaces the Article 29 Working Party (Art. 29 WP), established by Directive 95/46/EC and that dealt with issues relating to the protection of privacy ...
[12]
[PDF] ARTICLE 29 DATA PROTECTION WORKING PARTY
This Working Party was set up under Article 29 of Directive 95/46/EC. It is an independent European advisory body on data protection and privacy.
[13]
Article 29 Working Party Documents Archive 1997-2018
This page contains a comprehensive database of the materials issued by the Article 29 Working Party. The database covers all materials issued between 1997 and ...
[14]
European Data Protection Board replaces Article 29 Working Party
Jul 2, 2018 · On 25 May 2018 the European Data Protection Board (EDPB) formally replaced the Article 29 Working Party as the European advisory committee ...Missing: precursors | Show results with:precursors
[15]
Legal Framework | European Data Protection Board
The EDPB was created by the EU General Data Protection Regulation (GDPR), adopted on 27 April 2016 and published in the EU Official Journal on 4 May 2016.<|separator|>
[16]
Art. 68 GDPR - European Data Protection Board
1711. Art. 68 GDPR European Data Protection Board. The European Data Protection Board (the 'Board') is hereby established as a body of the Union and shall ...Missing: EDPB date
[17]
the article 29 working party ceased to exist as of 25 may 2018
Jun 11, 2018 · As of 25 May 2018 the Article 29 Working Party ceased to exist and has been replaced by the European Data Protection Board (EDPB).
[18]
The European Data Protection Board (EDPB) - CNIL
Oct 26, 2020 · The European Data Protection Board has been established by the General Data Protection Regulation (GDPR). It replaces the Article 29 Working Party.
[19]
[PDF] EDPB Annual Report 2018 1
Sep 25, 2018 · • The election of its chair and deputy chairs. • The EDPB's ... During its first plenary meeting on 25 May 2018, the EDPB endorsed ...
[20]
First Plenary of the European Data Protection Board
During its first plenary meeting on 25 May the Board elected its Chair and two Vice-Chairs. The EDPB Chair will lead the Board for the coming five years and ...Missing: activities | Show results with:activities
[21]
EDPB Secretariat | European Data Protection Board
The EDPB Secretariat is based in Brussels and offers analytical, administrative and logistical support to the EDPB.Missing: 2018 | Show results with:2018
[22]
Our Members | European Data Protection Board
The EDPB is composed of representatives of the EU national data protection authorities, and the European Data Protection Supervisor (EDPS).About EDPB · EDPB and Chairmanship · EDPB Cookie Policy · Notify a data breach
[23]
Who are the members of the Board? - European Data Protection Board
The EDPB brings together the EU DPAs and the European Data Protection Supervisor (EDPS). The EEA EFTA countries (Iceland, Liechtenstein and Norway) are also ...Missing: composition | Show results with:composition
[24]
The European Data Protection Board (EDPB) - tasks, composition ...
GDPR Article 73 says that, again via a simple majority vote, each five years the European Data Protection Board elects a chair and two deputy chairs.
[25]
The procedure for electing a new Chair of the European Data ...
Apr 27, 2023 · The Board elects one Chair and two Deputy Chairs amongst its members, by simple majority for a term of office of 5 years, which is renewable only once.
[26]
EDPB Initiates Procedure for Electing a New Chair
Apr 27, 2023 · The new EDPB Chair will be selected between the heads of the Supervisory of Authorities of Bulgaria, Finland and the Netherlands. For the ...
[27]
EDPB Initiates Procedure for Electing A New Chair
The new Chair and Deputy Chair will be elected for a period of five years and the election will be carried out through a secret ballot on the EDPB's May 25, ...
[28]
[PDF] EUROPEAN DATA PROTECTION BOARD RULES OF PROCEDURE
May 25, 2018 · All majorities referred to by the GDPR or by these rules of procedure always refer to the total number of members of the Board entitled to vote ...Missing: chairperson | Show results with:chairperson
[29]
[PDF] European Data Protection Board
It is to be replaced by the EDPB, which will similarly be made up of the heads of national supervisory authorities (or their representatives) and the EDPS. The ...Missing: composition | Show results with:composition<|separator|>
[30]
Anu Talus elected new Chair of the European Data Protection Board
May 25, 2023 · The EDPB has elected Anu Talus as the new Chair of the European Data Protection Board (EDPB) to replace outgoing Chair Andrea Jelinek.
[31]
European Data Protection Board (EDPB)
Apr 9, 2025 · The EDPB ensures consistent application of the GDPR and the Directive on data protection in the law enforcement sector throughout the EU. The ...
[32]
Anu Talus elected new Chair of the European Data Protection Board
May 30, 2023 · The EDPB has elected Anu Talus as the new Chair of the European Data Protection Board (EDPB) to replace outgoing Chair Andrea Jelinek.
[33]
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679
[34]
European Data Protection Board – EDPB | European Union
The European Data Protection Board ensures that EU countries consistently apply EU rules on data protection. Find out more about its work.
[35]
SAFEGUARDING INDIVIDUALS' DIGITAL RIGHTS
Jun 1, 2023 · Following the changes made in early 2023, the EDPB Secretariat is now composed of five sectors. This structural improvement was necessary to ...
[36]
Rules of procedure and Memorandum of Understanding
The rules of procedure contain the most important operational rules of the EDPB. They describe: how the EDPB is organised;; how its members work together; ...<|separator|>
[37]
[PDF] EDPB Annual Report 2023 - European Union
Apr 3, 2024 · I am pleased to present the European Data Protection Board's (EDPB). 2023 Annual Report. In this report, you will find details about the ...
[38]
[PDF] EDPB Annual Report 2022 - European Union
have materialised without the efforts of everyone involved at the EDPB, and, not in the least, at the EDPB Secretariat. The EDPB Secretariat is a small and very ...
[39]
Article 63 GDPR. Consistency mechanism
(135) In order to ensure the consistent application of this Regulation throughout the Union, a consistency mechanism for cooperation between the supervisory ...Missing: mandate | Show results with:mandate
[40]
https://www.edpb.europa.eu/about-edpb_en
[41]
GDPR Cooperation and Enforcement
The EDPB promotes transparency by publishing a register with all the final decisions taken by National Data Protection Authorities under the cooperation ...
[42]
EDPB: Application of the GDPR successful, but sufficient resources ...
Dec 15, 2023 · The EDPB has consolidated its position as the EU body in charge of ensuring the consistent application of the GDPR, making use of the full set ...
[43]
[PDF] Strategy 2024-2027 - European Data Protection Board
The mission and legal task of the European Data Protection. Board (EDPB) is to ensure the consistent application of EU data protection rules and to promote ...
[44]
Coordinated Enforcement Framework: EDPB selects topic for 2026
The CEF is a key action of the EDPB under its 2024-2027 Strategy, together with the creation of a Support Pool of Experts (SPE). The two initiatives aim to ...
[45]
[PDF] Report on extraterritorial enforcement of GDPR
Oct 31, 2024 · This report was commissioned as part of the EDPB's Support Pool of Experts initiative, which aims to support cooperation among Data Protection ...
[46]
Guidelines, Recommendations, Best Practices
We issue general guidance (including guidelines, recommendations and best practice) to clarify the law and to promote common understanding of EU data ...Guidelines 02/2024 on Article... · Guidelines 01/2025 on... · Guidelines 1/2024
[47]
Role of the EDPB | European Data Protection Board
The Board is not only issuing guidelines on the interpretation of core concepts of the GDPR but it is also called to rule by binding decisions on disputes ...
[48]
Opinions | European Data Protection Board
The national Supervisory Authorities can request EDPB opinions on any matter of general application of the GDPR, or any issue producing effects in more than one ...
[49]
Opinion (Art. 70) - European Data Protection Board
Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU-US Data Privacy Framework.
[50]
Art. 65 GDPR – Dispute resolution by the Board
Rating 4.6 (9,723) The binding decision shall concern all the matters which are the subject of the relevant and reasoned objection, in particular whether there is an infringement ...
[51]
[PDF] Guidelines 03/2021 on the application of Article 65(1)(a) GDPR ...
May 24, 2023 · Article 65(1)(a) GDPR is a dispute resolution mechanism meant to ensure the correct and consistent application of the GDPR in cases ...
[52]
Article 65 GDPR. Dispute resolution by the Board - GDPR-Text.com
The Board shall adopt a binding decision in the following cases: (a) where, in a case referred to in Article 60(4), a supervisory authority concerned has ...<|separator|>
[53]
What is the dispute resolution mechanism of Art. 65 GDPR?
This means that the LSA is obliged to refer the case to the European Data Protection Board (EDPB) and the dispute resolution role of the EDPB is activated (Art.
[54]
The EDPB's Final Guidelines on Binding Decisions and ...
Jun 30, 2023 · As a creation of the GDPR, the EDPB is able to make decisions that bind a panel of DPAs under Article 65(1)(a). The Lead DPA is the primary ...
[55]
EDPB adopts Art. 65 dispute resolution binding decisions regarding ...
The EDPB adopted three dispute resolution decisions on the basis of Art. 65 GDPR concerning Meta Platforms Ireland Limited (Meta IE).
[56]
Binding Decision 1/2023 on the dispute submitted by the Irish SA on ...
The EDPB Binding Decision 1/2023 relates to an own volition inquiry on transfers of personal data outside of the EU/EEA carried out on the basis of standard ...
[57]
Binding Decision 5/2022 on the dispute submitted by the Irish SA ...
The EDPB Binding Decision 5/2022 relates to a complaint-based inquiry on the lawfulness and fairness of the processing for service improvement, ...
[58]
CJEU Upholds EDPB's Authority to Order Broader Investigations in ...
Feb 3, 2025 · ... EDPB binding decisions concerning Meta's data processing practices for Facebook, Instagram, and WhatsApp. The EDPB had instructed the DPC to ...<|control11|><|separator|>
[59]
Binding Decisions - European Data Protection Board
EDPB adopts Art. 65 dispute resolution binding decisions regarding Facebook, Instagram and WhatsApp
[60]
EDPB adopted the final version of the Guidelines on derogations ...
During its first plenary meeting, the EDPB adopted the final version of the Guidelines on derogations applicable to international transfers (art 49).
[61]
Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)
Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) - version adopted after public consultation. 12 November 2019. Final version.Missing: early | Show results with:early
[62]
[PDF] Guidelines 2/2019 on the processing of personal data under Article ...
Oct 8, 2019 · Version 1.0 9 April 2019. Adoption of the Guidelines for publication consultation. Page 3. 3. Adopted. 1. Part 1 – Introduction.
[63]
Guidelines 3/2019 on processing of personal data through video ...
Guidelines 3/2019 on processing of personal data through video devices. 30 January 2020. Final version. See the First version of this publication drafted ...
[64]
[PDF] Guidelines 4/2019 on Article 25 Data Protection by Design and by ...
The Guidelines also contain guidance on how to effectively implement the data protection principles in Article 5, listing key design and default elements as ...
[65]
Guidelines 05/2020 on consent under Regulation 2016/679
European Data Protection Board Guidelines 05/2020 on consent under Regulation 2016/679 4 May 2020 Guidelines 05/2020 321.3KB
[66]
EDPB Strategy 2021-2023
Dec 15, 2020 · The mission of the European Data Protection Board (EDPB) is to ensure the consistent application of. European data protection rules and to ...
[67]
[PDF] Enhancing the depth and breadth of data protection
An Executive Summary of this report, which provides an overview of key EDPB activities in 2021, is also available. Further details about the EDPB can be found ...
[68]
New GDPR strategy to tackle new technology, data security ...
Over the next two years, the EDPB will continue to monitor the risks of new technology and will issue guidances outlining policies on AI, biometrics, profiling, ...
[69]
Guidelines 8/2020 on the targeting of social media users
Guidelines 8/2020 on the targeting of social media users. 13 April 2021. Final version. See the First version of this publication drafted before public ...
[70]
[PDF] Guidelines 8/2020 on the targeting of social media users
Apr 13, 2021 · When it comes to assessing the level of responsibility of social media provider, the EDPB observes that several targeting mechanisms rely on ...
[71]
EDPB Guidelines on targeting social media users - Bird & Bird
Oct 18, 2020 · The EDPB considers that targeting may pose significant risks to individuals; targeting could involve using data in ways that individuals do not ...
[72]
Guidelines 05/2022 on the use of facial recognition technology in ...
The European Data Protection Board welcomes comments on the Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement.Missing: AI cloud computing
[73]
[PDF] Guidelines 05/2022 on the use of facial recognition technology in ...
In the same vein, the EDPB considers AI-supported facial recognition systems categorising individuals based on their biometrics into clusters according to.Missing: cloud | Show results with:cloud
[74]
EDPB adopts final version of Guidelines on facial recognition ...
The guidelines provide guidance to EU and national lawmakers, as well as to law enforcement authorities, on implementing and using facial recognition ...Missing: cloud computing 2021-2023
[75]
EDPB determines privacy recommendations for use of cloud ...
Jan 18, 2023 · The EDPB underlines the need for public bodies to act in full compliance with the GDPR and includes recommendations for public sector ...
[76]
[PDF] 2022 Coordinated Enforcement Action Use of cloud-based services ...
Jan 17, 2023 · With this first CEF action, the EDPB intends to: - foster GDPR-compliance of products and services, relying on cloud-based solutions, by the.
[77]
EDPB Guidelines on international transfers: 6 key takeways
Mar 13, 2023 · On 14 February 2023, the European Data Protection Board (EDPB) published its Guidelines on the interplay between Article 3 and the provisions in ...
[78]
[PDF] Opinion 5/2023 on the European Commission Draft Implementing ...
Feb 28, 2023 · It is important to recognise that the EDPB does not expect the US data protection framework to replicate European data protection law.
[79]
EDPB Issues Draft Guidelines on Technical Scope of ePrivacy ...
Nov 20, 2023 · On November 16, 2023, the European Data Protection Board (“EDPB”) issued draft Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy ...
[80]
[PDF] Work Programme 2024–2025 - European Data Protection Board
Oct 8, 2024 · The EDPB's 2024-2025 work program focuses on promoting GDPR understanding, providing guidance, developing compliance measures, and ...
[81]
EDPB Finalizes Guidelines on Data Transfers to Third Country ...
Jun 6, 2025 · The European Data Protection Board (EDPB) published the final version of Guidelines 02/2024 on Article 48 of the GDPR (the Guidelines) regarding data transfers ...
[82]
EU: EDPB Opinion on AI Provides Important Guidance though Many ...
Jan 14, 2025 · A much-anticipated Opinion from the European Data Protection Board (EDPB) on AI models and data protection has not resulted in the clear or definitive guidance.
[83]
The European Data Protection Board Shares Opinion on How to ...
Mar 14, 2025 · The European Data Protection Board's (EDPB) Opinion 28/2024 provides valuable insights into the intersection of artificial intelligence and data protection.
[84]
Developments in Data Protection Law – New EDPB Guidelines and ...
Nov 29, 2024 · On Oct. 16, 2024, the EDPB published the final guidelines 02/2023 on the application of Art. 5(3) of the ePrivacy Directive 2002/58 ...
[85]
EDPB CEF 2024 & 2025: Data Subject Rights (& Wrongs)
Jul 1, 2025 · The European Data Protection Board (EDPB) has launched its Coordinated Enforcement Framework (CEF) action for 2025, which will centre on the right to erasure.
[86]
Guidelines 3/2025 on the interplay between the DSA and the GDPR
The European Data Protection Board welcomes comments on the Guidelines 3/2025 on the interplay between the DSA and the GDPR. Such comments should be sent 31st ...Missing: developments | Show results with:developments<|separator|>
[87]
https://www.hunton.com/privacy-and-information-security-law/edpb-adopts-opinions-on-eu-uk-adequacy-decisions
[88]
Adequacy of the European Patent Organisation and extension of the ...
The extension of the adequacy decisions until 27 December 2025 should allow the European Commission to assess the legal framework as it may be ...
[89]
EU: General Court adopts order on EDPB Binding Opinion | News
May 6, 2025 · The General Court of the European Union ruled that the EDPB Opinion 08/2024 on Valid Consent in Consent or Pay Models lacks legal effect.
[90]
EU: EDPB releases 2024 annual report | News - DataGuidance
Apr 23, 2025 · The European Data Protection Board (EDPB) published its 2024 Annual Report on April 23, 2025, detailing its activities including issuing consistency opinions ...
[91]
EDPB Provides Guidance on Determining a 'Main Establishment ...
Feb 28, 2024 · EDPB Provides Guidance on Determining a 'Main Establishment' and the 'One-Stop-Shop' Mechanism · it takes the decisions on the purposes and means ...
[92]
From cooperation to confusion: The state of cross-border GDPR ...
Jun 27, 2025 · The GDPR establishes a (complex) cooperation mechanism according to which national SAs across different Member States are required to coordinate the outcome of ...
[93]
[PDF] Article 65 FAQ How does cross-border cooperation work under the ...
More specifically, every competent SA has the duty to request an opinion from the EDPB before adopting national measures pursuant to article 64(1) GDPR. Such ...
[94]
EU: EDPB adopts first decision under Article 65 of the GDPR | News
Nov 10, 2020 · EDPB adopts first decision under Article 65 of GDPR, resolving objections to DPC's draft decision on Twitter's data breach.
[95]
Binding decision of the Board (Art. 65)
Binding decisions under Art. 65 of GDPR are made by the EDPB to resolve disputes, such as those involving TikTok, Meta, and WhatsApp.
[96]
https://www.iccl.ie/digital-data/complaint-v-ireland-to-european-commission-re-process-appointing-ex-meta-lobbyist-as-data-protection-commissioner/
[97]
2025 data protection CJEU case round-up - Kennedys Law
Apr 1, 2025 · CJEU upholds EDPB's authority to order broader investigations in cross-border cases · The ruling confirms that the EDPB can intervene to ensure ...
[98]
Data protection: Council and European Parliament reach deal to ...
Jun 16, 2025 · The regulation will speed up the process of handling cross-border GDPR complaints filed by citizens or organisations, and any follow-up investigations.
[99]
EU reaches provisional agreement to speed up cross-border GDPR ...
Jun 17, 2025 · This objective is to speed up the process of handling cross-border GDPR complaints filed by citizens or organizations." The provisional ...
[100]
[PDF] Guidelines 03/2021 on the application of Article 65(1)(a) GDPR ...
May 24, 2023 · Article 65(1)(a) GDPR requires the EDPB issues a binding decision whenever a Lead Supervisory. Authority (LSA) issues a draft decision and ...
[101]
Art. 61 GDPR – Mutual assistance - General Data Protection ...
Rating 4.6 (9,706) Art. 61 GDPR requires supervisory authorities to provide mutual assistance, including information requests and measures like prior authorizations, inspections, ...
[102]
Coordinated Enforcement Framework
The process is managed internally by EDPB members and coordinated by the EDPB Secretariat and one or several Data Protection Authorities (DPAs).
[103]
[PDF] EDPB Annual Report 2024 - European Union
Apr 23, 2025 · The EDPB Secretariat assists the EDPB Members in enforcing data protection laws by fostering consistency and promoting cooperation among ...
[104]
Does the GDPR Need Fixing? The European Commission Weighs In
Sep 5, 2024 · ... European Data Protection Board (EDPB) via its Opinions, with the following highlights: Almost 2400 case entries were registered in the ...<|control11|><|separator|>
[105]
Guidelines 04/2022 on the calculation of administrative fines under ...
Guidelines 04/2022 on the calculation of administrative fines under the GDPR. 24 May 2023. Final version. See the First version of this publication drafted ...
[106]
EDPB issues Guidelines on GDPR fines - White & Case LLP
Jun 29, 2023 · The European Data Protection Board (the "EDPB") announced its adoption of Guidelines 04/2022 on the calculation of fines under the GDPR.
[107]
From Blocks to Rights: Privacy and Blockchain in the Eyes of the EU ...
May 7, 2025 · On April 14, 2025, the European Data Protection Board (EDPB) released guidelines detailing how to process personal data using blockchain technologies.
[108]
A look behind the EDPB's move to enhance enforcement cooperation
May 24, 2022 · The initial result from the two-day meeting was a statement on enforcement cooperation, in which authorities "will collectively identify ...
[109]
Coordinated Enforcement Action: EDPS findings highlight ...
Jan 20, 2025 · The EDPS findings will shape future supervisory and enforcement actions, aiming to improve how EUIs address individuals' right of access.Missing: examples | Show results with:examples
[110]
3 Years Later: An Analysis of GDPR Enforcement - CSIS
Sep 13, 2021 · Three years later, even though challenges remain for a more effective implementation, GDPR enforcement has led to improved security practices.
[111]
The impacts of GDPR on global organizations - Cloudi-Fi
May 25, 2024 · According to a PwC report, 88% of respondents spend more than 1 million dollars to maintain GDPR compliance, and 40% spend more than 10 million ...
[112]
How Much Does GDPR Compliance Cost in 2023? - IT Governance
May 10, 2023 · But when it comes to the cost of maintaining GDPR compliance, it found that 88% spend more than $1 million and 40% spend more than $10 million.
[113]
Millions of small businesses aren't GDPR compliant, our survey finds
We were surprised to learn that over half of small businesses report spending between €1,000 and €50,000 on GDPR compliance, including consultants and ...<|separator|>
[114]
A New Study Lays Bare the Cost of the GDPR to Europe's Economy
Apr 9, 2022 · On the whole, European businesses exposed to the law saw their profits shrink by an average of 8.1 percent. The main burden falls on SMEs, which ...
[115]
Financial Consequences of the GDPR - CitiGPS
Jun 28, 2022 · The study finds that companies targeting EU markets saw an 8% reduction in profits and a modest 2% decrease in sales. But these negative effects were not ...
[116]
Press Release: Six Years of GDPR: Companies Remain Critical | ZEW
May 22, 2024 · One in four companies in the information economy say that the GDPR has slowed down innovation, with this figure rising to 38 per cent for large ...<|separator|>
[117]
The Impact of the EU General Data Protection Regulation on ...
Oct 26, 2022 · This study provides empirical evidence on the impact of the GDPR on innovation activities in firms. Exploiting panel data from the German ...
[118]
The impact of the EU General data protection regulation on product ...
Oct 30, 2023 · This study provides evidence on the likely impacts of the GDPR on innovation. We employ a conditional difference-in-differences research design and estimate ...Missing: EDPB | Show results with:EDPB
[119]
GDPR & European Innovation Culture: What the Evidence Shows
Feb 5, 2023 · GDPR and other regulations greatly limit the flow of data to innovative upstarts who need it most to compete, leaving only the largest companies ...
[120]
GDPR reduced firms' data and computation use - MIT Sloan
Sep 10, 2024 · A new study suggests that firms' GDPR costs could be mitigated if the regulation targeted the most sensitive data and provided exemptions ...
[121]
Practical Implications of the New EDPB Pseudonymization Guidelines
May 27, 2025 · The EDPB's pseudonymization guidelines significantly shape how organizations handle data, effectively making it safest to treat all data as ...
[122]
Insights from the EDPB's Latest Guidelines - Grant Thornton Malta
Jun 16, 2025 · For businesses, adhering to the EDPB's guidelines is crucial to avoid legal repercussions and maintain customer trust. By following these ...
[123]
The Price of Privacy: The Impact of Strict Data Regulations on ...
Jun 3, 2021 · For example, the NBER study also estimated that GDPR cost 3,000 to 30,000 new jobs due to the decreased investment and startup activity. As the ...
[124]
Survey: The impact of EU Data strategy regulations on CEE startups
Nov 19, 2024 · EU data strategy regulations have increased the burden on workflows and resulted in additional compliance expenses, limiting the global competitiveness of CEE ...
[125]
Mapping the empirical literature of the GDPR's (In-)effectiveness
Industry-supported research argues that the GDPR stifles technological innovation, with claims that the law is 'killing innovative apps'. These diverse ...
[126]
Mapping the Empirical Evidence of the GDPR (In-)Effectiveness - arXiv
Oct 25, 2023 · We conduct a comprehensive review and synthesis of empirical research spanning nearly three decades (1995- March 2022), advocating for a more robust ...<|control11|><|separator|>
[127]
20 biggest GDPR fines so far [2025] - Data Privacy Manager
The DPC identified several GDPR violations, including inadequate breach notification, failure to document the breach, and lapses in data protection in system ...Missing: controversies | Show results with:controversies
[128]
Numbers and Figures | GDPR Enforcement Tracker Report 2024/2025
Now, in the 6th edition of the GDPR Enforcement Tracker Report, with a cut-off date of 1 March 2025, a total number of 2,245 fines (+159 in comparison to the ...Missing: EDPB | Show results with:EDPB
[129]
Data Protection Day: Only 1.3% of cases before EU DPAs result in a ...
Jan 28, 2025 · The data shows that, on average, merely 1.3% of cases before DPAs result in a fine. However, data protection professionals say that fines are the most ...
[130]
[PDF] Lessons from the GDPR and Beyond
Finally, empirical research shows post-GDPR reductions in data collection that suggest objective improvements in con- sumer privacy. The economics literature ...
[131]
[PDF] The GDPR's First Six Years: Positive Impacts, Remaining ...
May 1, 2024 · In advance of the European Commission's (EC) pending “health check” of the General Data Protection Regulation (GDPR).
[132]
GDPR and the indefinable effectiveness of privacy regulators
We research what practitioners think are the objectives of data protection regulators and how they evaluate their effectiveness.
[133]
GDPR is not loved, but does it work? | International Data Privacy Law
Oct 14, 2025 · The piece briefly traces considerations of effectiveness, efficiency, and legitimacy that must be examined in careful detail with respect to the ...
[134]
GDPR Overreach? - Verfassungsblog
Apr 15, 2024 · The data protection authorities would exceed their powers and act ultra vires if they were to interpret the GDPR from a social justice ...Missing: criticism | Show results with:criticism
[135]
[PDF] The 10 Problems of the GDPR - Senate Judiciary Committee
Mar 12, 2019 · The GDPR has strengthened large firms, weakened small businesses, hurt the venture capital market, and splintered the internet.
[136]
[PDF] Critical-Analysis-European-Data-Protection-Board's-Opinion-08 ...
Jun 26, 2024 · 1.1. This White Paper offers a critical analysis of the European Data Protection Board's. (the “EDPB”) Opinion 08/2024 on “Valid Consent in ...
[137]
'Rigid' guidelines impact online platform advertising - Pinsent Masons
Sep 17, 2025 · The guidelines are also subject to potential update – the EDPB is inviting comment on them until 31 October 2025. The EDPB said it is working on ...<|control11|><|separator|>
[138]
EU Plan To Simplify GDPR To Make Businesses More Competitive
May 30, 2025 · Their goal is to reduce administrative burdens by 35 percent for SMBs, and by 25 percent overall by 2029. In the meantime, the European ...
[139]
Omnibus IV simplification package – what does this mean for GDPR ...
Oct 13, 2025 · The package aims to simplify rules in the single market, and reduce bureaucracy, making it easier for businesses to operate, innovate and grow, ...
[140]
How Data Protection Regulation Affects Startup Innovation
Nov 18, 2019 · Our results show that the effects of data protection regulation on startup innovation are complex: it simultaneously stimulates and constrains innovation.
[141]
The short-run effects of GDPR on technology venture investment
Jan 7, 2019 · EU technology firms, on average, experienced double-digit percentage declines in venture funding relative to their US counterparts after GDPR ...<|separator|>
[142]
Academic Study Shows European Startup Investments Diminished ...
Aug 6, 2021 · The aggregate number of startup investments dropped by about a third in the EU after the GDPR became law.Missing: EDPB | Show results with:EDPB
[143]
[PDF] How Data Protection Regulation Affects Startup Innovation
We therefore study how data protection regulation affects startup innovation, exploring this question during the ongoing introduction of the EU General Data ...
[144]
The make-or-break moment for EU data protection - IAPP
Jul 22, 2025 · The GDPR, Draghi argues, has become a symbol of legal complexity and compliance burden. For small- to medium-sized enterprises and startups, ...
[145]
Is GDPR undermining innovation in Europe? - Silicon Continent
Sep 11, 2024 · Evidence suggests GDPR may harm Europe's tech ecosystem, slowing innovation, reducing new app entries, and venture capital deals, especially ...
[146]
Seven years in, GDPR faces growing challenges from AI and ...
Jun 12, 2025 · The EU-wide regulator of the General Data Protection Regulation (GDPR) has issued its latest annual report detailing some of the enforcement trends from 2024.
[147]
GDPR Privacy: The Good, The Bad and The Enforcement - CEPA
Feb 7, 2023 · According to a recent report published by the European Data Protection Board, 77% of DPAs complain about a lack of budget and personnel.
[148]
The Future of GDPR Enforcement - Verfassungsblog
Nov 28, 2024 · The cross-border nature of GDPR enforcement in the EU means that a lack of formal decision-making may result in a lack of transparency in case ...
[149]
[PDF] An Analysis of Enforcement Trends by EU Data Protection Authorities
Jun 1, 2020 · This paper explores the reasons certain European countries issued GDPR fines and enforced certain GDPR violations during the May 2018 to March ...<|separator|>
[150]
EU reaches agreement to streamline cross-border GDPR enforcement
Jul 14, 2025 · The new Regulation seeks to fix the delays and inconsistencies that have undermined the handling of cross-border GDPR complaints. It sets out a ...
[151]
Why Ireland is the Achilles Heel of the EU's fightback against Big Tech
Jan 23, 2025 · A surprising body has been complicit in these Big Tech companies evading EU laws – the notorious Data Protection Commission (DPC) of Ireland.
[152]
Big Tech lawyer played key role in picking Ireland's new ... - Politico.eu
Oct 9, 2025 · Big Tech lawyer played key role in picking Ireland's new privacy regulator · Revolving door complaint · Government stands by appointment.
[153]
https://euobserver.com/digital/ar6c78a452
[154]
GDPR enforcement data shows low fine rates across European ...
Jan 29, 2025 · Analysis of European Data Protection Board statistics reveals only 1.3% of GDPR cases resulted in fines between 2018-2023.Missing: debates | Show results with:debates
[155]
A serious target for improving EU regulation: GDPR enforcement
Feb 27, 2025 · We see it in how the European Data Protection Board (EDPB) issues opinions that preserve enormous enforcement “flexibility” for DPAs without ...Missing: disparities countries