Cybersecurity Policy Report, NOYB, EDPB Offer Divergent Views on Privacy Outcomes Under GDPR, (Jan 28, 2025)

By Tony Foley

The European Data Protection Board (EDPB) celebrated today’s international observance of Data Protection Day, as it’s known in Europe, with a video discussing the importance of the protections afforded to individuals by the European Union’s General Data Protection Regulation (GDPR), while Max Schrems’ European Center for Digital Rights (NOYB) offered a significantly less cheery view, focusing on the small number of cases heard by data protection authorities (DPAs) resulting in fines.

EDPB. “If someone asked you to answer 100 questions about your personal life to sell the answers, would you agree? Most likely not,” EDPB said in its news release marking the day. The agency noted the difficulty inherent in keeping control over one’s data and keeping it safe. Through activities such as online shopping and social media browsing, every click, share and login leaves a digital trail. EDPB emphasized that the GDPR ensures that individuals’ data can only be used in ways they agree to and that such individuals can access any information about themselves.

The video features passersby in Brussels who discussed the importance of protecting their data and how the GDPR protects their personal data, imposes obligations on data controllers and processors, and provides for recourse against controllers and processors that fail to comply with GDPR requirements.

NOYB. In its own news release today, NOYB acknowledged that the GDPR gives consumers tools to ensure their fundamental data rights and empowers DPAs with extensive investigatory powers and the ability to impose significant fines, but added that, seven years after going into effect, the reality of GDPR enforcement is much bleaker. The consumer advocate analyzed current statistics from the EDPB and found that only 1.3% of all cases before EU DPAs resulted in a fine, in spite of the fact that data protection experts agree that fines are the best deterrent to violations of the law.

“European data protection authorities have all the necessary means to adequately sanction GDPR violations and issue fines that would prevent similar violations in the future. Instead, they frequently drag out the negotiations for years—only to decide against the complainant’s interests all too often,” Mr. Schrems said.

The release notes that some EU countries (like Slovakia at 6.84%) resolve a slightly higher percentage of cases with fines but adds that these figures are consistently in the single digit range, with some countries being even lower. NOYB specifically cites the Dutch DPA, Autoriteit Persoonsgegevens, as imposing fines in only 0.03% of cases brought before it, followed by France (0.10%), Poland (0.18%), Finland (0.21%), Sweden (0.25%), and Ireland (0.26%). And while the amounts of fines being imposed by Ireland and a few other countries may seem large, the companies on which they are being levied tend to be the biggest major tech and social media companies, like Apple, Inc., Google LLC, and Meta Platforms, Inc.

Citing enforcement numbers from Spain, NOYB maintained that the apparent lack of serious consequences resulting from a violation seemed to be specific to data protection. “Somehow, it's only data protection authorities that can't be motivated to actually enforce the law they're entrusted with,” Mr. Schrems said. “In every other area, breaches of the law regularly result in monetary fines and sanctions. At the moment, DPAs often seem to be acting in the interests of companies rather than the people concerned."

News: InternationalLegislation DataPrivacy GDPR LitigationEnforcement