The European Commission has published a proposed regulation aimed at bolstering how EU countries enforce GDPR, which is now under discussion between the European Parliament, the Council, and the Commission as part of the legislative trilogue process. The initiative has opened a Pandora’s box of infighting between lobbies and regulators.
The GDPR has become a powerful example of the so-called Brussels effect, inspiring similar privacy-protecting laws in numerous jurisdictions and highlighting widespread unease among consumers about companies “watching” their behaviour and targeting ads.
DPAs and the “one-stop shop” rule
Adopted in 2016, the GDPR was a watershed moment in global tech regulation, forcing companies to abide by new standards, such as asking for consent to collect people’s data online against threats of hefty fines. These infringements could result in a fine of up to €20 million or 4% of the company’s worldwide annual revenue from the preceding financial year, whichever amount is higher.
In practice, the determination of national data protection authorities to issue fines is tied to their resources, which in most cases, are limited. The Irish Data Protection Authority plays a crucial role under the so-called “one-stop shop” rule. This one-stop shop for organizations established in the European Union and carrying out cross-border processing of personal data allows your organization to deal with a single lead supervisory authority for most of your processing activities.
This rule hugely implicates Ireland because technology companies like Meta, Google, and Apple have established their European headquarters there. Under the GDPR, technology companies are supervised by the national regulator of the EU country where they are headquartered. The Irish Data Protection Commissioner is crucial in enforcing the EU’s General Data Protection Regulation. In recent months, the Irish authority has imposed significant multi-million-euro fines for GDPR violations by Meta, the parent company of Instagram and Facebook. However, since 2023, the Irish authority has faced growing criticism for the slow pace and perceived leniency of some of its decisions. These concerns have contributed to the European Commission’s decision to propose new procedural rules to improve enforcement consistency and cooperation across Member States.
Finally, large tech companies have been mostly successful in complying, while smaller tech companies face high compliance costs. The mixed record of the GDPR has convinced European regulators that they need to rethink how their regulations are applied. In addition to the GDPR, organisations must now navigate a growing set of overlapping EU regulations — including the Data Governance Act (DGA), the Digital Services Act (DSA), and, in the health sector, the upcoming European Health Data Space (EHDS) regulation — all of which increase the complexity and cost of compliance for smaller players.
New law to solve enforcement flaws of the GDPR
Last year, European data protection authorities pledged to strengthen their cooperation in handling cases of strategic importance. In October, the European Data Protection Committee sent the Commission a “wish list” of procedural law changes to improve the application of the regulation. These include setting deadlines for the different procedural steps in handling a case and harmonizing the rights of the various parties involved in investigations throughout the EU.
In response, the European Commission published in 2023 a draft Regulation on GDPR Procedural Rules, aimed at establishing clear procedural rules for national data protection authorities dealing with cross-border investigations and breaches. As of 2025, this draft regulation is undergoing interinstitutional negotiations (trilogue) between the European Parliament, the Council, and the Commission. According to the European Commission, the law will “harmonize certain aspects of administrative procedure” in cross-border cases and “support the smooth functioning of the GDPR’s cooperation and dispute resolution mechanisms.”
The Commission wants to keep future regulations focused and limited, partly because it is preparing for tense discussions with data privacy watchdogs, activists, and lobbyists for large technology companies. However, several civil society organisations, including NOYB and Access Now, have criticised the draft regulation for lacking ambition — particularly regarding complainants’ rights and transparency in cross-border procedures.
Key elements of the initiative include:
- Clarifying procedural deadlines for cooperation between supervisory authorities in cross-border cases;
- Providing tools for supervisors to promote cooperation early in the investigation process;
- Clarifying the position of complainants in the investigation process, including the possibility for complainants to make their views known;
- Streamlining the manner in which the parties under investigation are heard during the process; and
- Clarifying how information is shared between the investigating supervisor and other supervisory authorities at different stages of the procedure.
- Introducing greater transparency obligations for lead supervisory authorities, particularly toward complainants and concerned authorities;
- Allowing the European Data Protection Board (EDPB) to issue procedural guidance to harmonise interpretations among DPAs.
MyData-TRUST: Your GDPR Compliance Partner
MyData-TRUST was created over five years ago to assist organizations in the healthcare sector with their compliance with the various international regulations on personal data protection, particularly the General Data Protection Regulation (GDPR).
MyData-TRUST helps organizations define strategies and procedures to properly manage their data (data governance) through various adaptable services, including Gap analysis, legal support, DPO and DPR subscriptions, or training options.
