A recent study released by the European Data Protection Board (EDPB) has revealed that over 80% of national data protection authorities in the EU consider their budgets inadequate for their statutory activities. Additionally, 86% of these authorities report staffing levels below what is necessary for their tasks. This finding highlights significant resource constraints in the enforcement of the General Data Protection Regulation (GDPR).
The EDPB, which consolidates national authorities to aid in GDPR enforcement, indicates that the limited budget impacts staffing. For example, in Italy, there are 61 unfilled positions, partly due to the salary disparities compared to the private sector.
An open letter addressed to Roberta Metsola, President of the European Parliament, and Edita Hrdá of the Czech permanent representation to the EU, expressed concerns about the staffing of the EDPB’s secretariat. The letter warns that this understaffing could hinder the EDPB’s ability to fulfill its legal duties, potentially weakening the enforcement of data protection rights and undermining the credibility of the GDPR.
This situation prompted the EDPB and the European Data Protection Supervisor (EDPS), the latter responsible for data protection supervision in EU bodies, to request the Council of the EU and the European Parliament to consider their budget proposal, rather than the one proposed by the Commission.
The EDPS, covering activities for both EDPS and EDPB, had earlier submitted two budget proposals, both rejected by the Commission. Despite taking on new tasks and facing a tripling of legislative consultation requests in 2021, the financial and staffing constraints remain unaddressed.
The report also notes that some national authorities experienced significant budget cuts between 2020 and 2021, with Greece, Hungary, Luxembourg, and Slovakia being notable examples. These cuts come at a time when national supervisory authorities are dealing with an increase in individual complaints and new regulatory tasks.
The decision on the budget proposals for the EDPS and EDPB now lies with the European Parliament and Council. The outcome of this decision will be crucial in determining the future efficacy of data protection regulation and supervision across the EU.
