EU Big Tech enforcement reaches crisis point ahead of 5-year anniversary, says new ICCL data

15 May 2023, Updated 31 May 2023

Irish Data Protection Commission (DPC) repeatedly overruled by EU colleagues, who demand tougher Big Tech sanctions

Almost five years after it was implemented, the GDPR is failing to enforce against Big Tech, according to a new report from the Irish Council for Civil Liberties (ICCL).

Ireland remains Europe’s enforcement bottleneck against Big Tech. Since the start of GDPR in 2018, it has only eight finalised decisions in big investigation cases. The Irish DPC is out of step with its European colleagues: the European Data Protection Board has voted by majority to overrule the Irish DPC and impose tougher sanctions in 67% of the DPC’s decisions on investigative EU cases.

The strong investigative and enforcement powers of the GDPR, which took effect on 25 May 2018, have not been taken up. Despite the hype that greeted the introduction of Europe’s landmark data law, the data in the registry of approved decisions show only 50 compliance orders (the most powerful GDPR enforcement tool) and 29 fines by late 2022.

Speaking today, author of the report, ICCL Senior Fellow Dr Johnny Ryan, said:

“Five years on, the data now show a stark failure to enforce the GDPR – particularly against Big Tech. That failure exposes everyone to serious digital hazards: discrimination, manipulation, information distortion, and invasive AI. We urge the European Commissioner for Justice, Didier Reynders, to finally take action.”

Lack of funding for Europe’s data protection authorities, an issue ICCL has highlighted in the past, does not appear to the primary problem. Europe’s GDPR enforcers now have a combined budget of a third of a billion Euro (€337.6 million). Ireland’s budget has risen dramatically and in now the fifth largest in the EEA.

Updated 31 May 2023: the EDPB has informed us that a single decision during this period that it had previously not categorised in its Register  of Article 60 Final One-Shop-Stop Decisions has now been re-categorised to appear in that Register. We have updated our statistics to reflect this.