11
June
2024
Data protection, privacy and new technologies
Data protection
Data protection rules protect privacy and prevent personal information from misuse. When the general data protection regulation (GDPR) came into force in 2018, it strengthened the role of data protection authorities. These supervisory bodies are the key enforcers of the fundamental right of protection of personal data. This report analyses the challenges they face in the GDPR implementation. The findings complement the European Commission's forthcoming evaluation of the GDPR.
Read news item
Order a printed copy from EU Publications website
Read Online
Related
Export to PDF
Search inside this publication
- Key findings and FRA opinions
- Inadequate resources risk undermining the implementation of data protection authorities’ mandate and their independence
- FRA opinion1
- Supervision is key, but would be more effective if supported by additional tools
- FRA opinion2
- Large numbers of complaints are a major challenge and should be addressed by data protection authorities as a priority
- FRA opinion3
- Awareness among the general public of the existence of data protection laws does not necessarily mean that they actually understand these laws
- FRA opinion4
- Providing scientific researchers with advice is a challenge for some data protection authorities
- FRA opinion5
- Advising and supervising public bodies acting as data controllers remains a challenge due to mistrust and misunderstanding of data protection authorities’ competencies
- FRA opinion6
- The general data protection regulation is perceived as insufficient when it comes to concretely addressing the challenges posed by new technologies
- FRA opinion7
- Strengthening cooperation between data protection authorities may require strengthening the European Data Protection Board
- FRA opinion8
- Inadequate resources risk undermining the implementation of data protection authorities’ mandate and their independence
- Introduction
- Why this report?
- What does this report cover?
- Scope and methodology
- 1. Data protection authorities’ complete independence as a fundamental guarantee
- 1.1. Adequate resources– A safeguard for independence and effectiveness
- 1.1.1. Adequacy of funding
- 1.1.2. Adequacy of staffing
- 1.1.3. Consequences of a lack of resources
- 1.2. Freedom from external influence
- 1.2.1. Financial control must not compromise independence
- 1.2.2. Government, parliament and other public body control
- 1.2.3. Appointment of data protection authorities’ leadership: ensuring independence and transparency
- 1.1. Adequate resources– A safeguard for independence and effectiveness
- 2. Data protection authorities as supervisory authorities
- 2.1. Investigatory techniques
- 2.1.1. Lack of diversity of investigatory techniques
- 2.1.2. Extending the scope of investigations
- 2.1.3. Enhanced involvement of data controllers
- 2.2. Handling complaints
- 2.2.1. Large number of complaints
- 2.2.2. Complaints against public administrations
- 2.2.3. Joint operations involving several data protection authorities
- 2.3. Ex officio investigations
- 2.1. Investigatory techniques
- 3. Data protection authorities as advisory authorities
- 3.1. Advising the general public
- 3.2. Advising data controllers
- 3.3. Focus– advising researchers is challenging
- 3.4. Advising on legislative initiatives
- 3.5. Data protection officers: privileged partners for data protection authorities
- 3.6. Lack of expertise to for responding to challenges related to new technologies
- 4. Data protection authorities as cooperating authorities
- 4.1. The European Data Protection Board’s added value
- 4.2. Concerns about the European Data Protection Board
- 4.3. Looking ahead: the European Data Protection Board’s development
- Annex: Methodology
- Abbreviations
- About this publication
In 2024, the general data protection regulation(GDPR) is in its sixth year of implementation. This regulation, adopted in 2016 as a key part of the EU’s data protection reform, amended the legal framework that had been in place since the 1995 data protection directive entered into force. It has enhanced data subjects’ rights, redefined the scope and application of the fundamental right of data protection and harmonised further national legal frameworks across the European Union. It has strengthened the mandate, tasks and powers of supervisory authorities. Supervisory authorities are referred to in this report as ‘data protection authorities’ (DPAs), as key enforcers of the fundamental right of protection of personal data.
Article97 of the GDPR provides for regular evaluation reports by the European Commission. The first evaluation report was published in June 2020 and will be superseded by evaluation reports every 4years. The first report noted, among other things, a significant increase in the amount of work for DPAs, with the number of complaints, notifications of data breaches, investigations and cross-border cases increasing during the reporting period. Discrepancies in terms of DPAs’ resources (human, technical and financial), affecting DPAs’ ability to exercise their role, across Member States were also highlighted. The European Union Agency for Fundamental Rights (FRA) provided specific insights to the European Commission, focusing on the experiences of civil society organisations with applying the GDPR.
The Commission is due to publish its second evaluation report in 2024. The evaluation is taking place in a context where the processing of data is at the core of several EU legal initiatives. The additional requirements stemming from these initiatives and recently adopted legislation have increased or will increase the roles and responsibilities of DPAs. In April 2021, the European Commission presented an artificial intelligence (AI) package, including a proposal for regulating AI. In November 2022, the Digital Services Act and the Digital Markets Act entered into force, which aim to, among other things, reinforce the fundamental rights of users of digital services. In November 2023, the EU Data Act, which provides rules on access to and use of data, for example by users of smart devices, was adopted. Similarly, the Data Governance Act, which entered into force in June 2023, strengthened mechanisms for increasing data availability and overcoming technical obstacles to the reuse of data. In addition, duties contained in the EU’s new pact on migration and asylum will add to DPAs’ responsibilities.
Ahead of the second evaluation, the European Commission requested that FRA collect data on the experiences, challenges and practices identified by DPAs in implementing the GDPR.
In response to this request, between June 2022 and June 2023, FRA undertook 70 qualitative interviews with DPA representatives from all 27 EU Member States. Three staff members were interviewed separately at each DPA, with the exception of five DPAs, where fewer staff members were interviewed. The three staff members were the head of the DPA, an official in charge of international cooperation and an official in charge of processing complaints, investigations and/or sanctions at the DPA. Interviewees were questioned on their experiences in the following areas: DPAs’ independence; the institutional capacity of DPAs; modern technological challenges; raising public awareness; the investigatory powers of DPAs; sanctioning GDPR violations; cooperation between EU DPAs and the GDPR consistency mechanism; cooperation with other national regulators; and the protection of personal data and competing fundamental rights.
This report discusses some of the challenges and promising practices identified and highlighted by DPA staff. It does not provide any comparative legal analysis, nor does it provide an in-depth analysis of DPA work based on qualitative data, such as DPAs’ annual budgets, the number of complaints received or the number of investigations conducted. The aim of the report is to complement such data– available in DPA, European Data Protection Board (EDPB) and European Commission reports– with concrete and detailed examples of practices developed and difficulties faced by DPAs.
From the fieldwork data, FRA identified four key areas related to the challenges faced by DPAs when implementing the GDPR. These are covered by the report as follows. Chapter1 focuses on independence. Here, FRA analyses what DPAs perceive as challenging in terms of maintaining their independence, looking at both the adequacy of their resources and their freedom from external influence. Chapters2 and 3 look at the two pillars of the DPAs’ mandate: their supervisory powers and advisory powers, respectively. Finally, Chapter4 looks into the cooperation established by DPAs with other regulators at the national level and with other DPAs and the EDPB at the EU level.
All these areas are affected, directly or indirectly, by the DPAs’ availability of human, financial and technical resources. While several reports at the national and EU levels have already pointed out that DPAs are lacking resources across the EU, FRA’s research provides a practical understanding of the diverse and multilayered difficulties that DPAs face in the day-to-day management of fulfilling their mandate and in enforcing the right of data protection in the EU. The research also identifies solutions developed to mitigate these challenges. In addition, it gathers details on promising practices that DPAs have developed to mitigate the challenges they face in implementing the GDPR.
The findings of this report should be interpreted in the context of findings from previous FRA publications on DPAs’ role, effectiveness, functioning and independence. Trends in the data can be seen when comparing the findings of the current research with FRA findings published in 2010 and 2014. In particular, this report shows that, 14 years on, gaps in DPAs’ financial and human resources remain, while the number of tasks that DPAs are responsible for has increased.
The research is intended to complement the evidence gathered by the European Commission, and the studies and reports prepared by the European Parliament, the Council of the European Union and the EDPB. Therefore, to avoid any duplication with the European Commission’s data collection, this report provides input focused on the role and circ*mstances of DPAs, drawing on their practical experiences, without conducting a comprehensive assessment of GDPR enforcement by DPAs.
With the GDPR’s entry into force, DPAs have been assigned more tasks and their powers have been strengthened. Article57 of the GDPR lists a number of tasks that DPAs must carry out, such as providing advice to different stakeholders, raising awareness, handling complaints and investigating data protection breaches on their own initiative and when requested.
This research confirms FRA’s findings on the role of DPAs published in 2010 and 2014, and findings published as part of the 2020 and 2021 Fundamental Rights Reports, which emphasised that DPAs face difficulties in fulfilling the entirety of their mandate due to a lack of resources.
This research acknowledges Member States’ efforts to increase DPAs’ overall budgets and staffing when the GDPR entered into force. Nonetheless, an overwhelming majority of interviewees stated that DPAs’ workloads also increased significantly with the introduction of the GDPR. They repeatedly highlighted the mounting workloads that DPAs need to manage with limited staff and inadequate funding.
Concerns expressed by interviewees relate mainly to the extremely large and growing number of individual complaints being submitted, including minor complaints, which DPAs are obliged to handle within a reasonable time under Article57(1)(f) of the GDPR. This report shows that, because DPAs find themselves underfunded and understaffed, many are obliged to prioritise complaints handling over other regulatory tasks that the GDPR has entrusted to them– such as promoting awareness among public administration bodies and the private sector of their obligations under the GDPR, raising people’s awareness on the right of data protection and providing high-quality advice to public institutions on legislative proposals. Some interviewees pointed out that, due to a lack of resources, their DPA was not able to undertake on its own initiative investigations of data processing operations that could pose risks for data subjects. This limitation would appear to hinder DPAs’ ability to provide independent oversight, including oversight of public institutions and other bodies. Moreover, insufficient resources have been reported to undermine DPAs’ ability to contribute effectively to the EDPB’s increasing volume of activities and to take part in external cooperation mechanisms established under ChapterVII of the GDPR.
In addition, several respondents emphasised that new EU legislation, adopted after the GDPR entered into force, has tasked DPAs with additional duties and responsibilities, extending their workload further, even though the level of resources remains the same. Some interviewees mentioned that EU law requires DPAs to supervise the implementation of new, large-scale EU information technology (IT) systems in the area of migration and border control. These include the Entry/Exit System, which will process the biometric data of hundreds of millions of people at borders coming to the EU for short-term visits as of the end of 2024. Some respondents indicated that new supervisory roles may also arise in the context of the development of AI-driven technologies, with the pending adoption of the Artificial Intelligence Act.
To effectively carry out their duties in evolving and complex technical areas, DPAs need qualified legal and IT professionals with data protection knowledge. However, several interviewees indicated that recruiting professionals with the appropriate legal and technical expertise is a challenge, especially given that DPAs have to compete with the private sector. Some respondents also emphasised that, in their Member State, the recruitment process is conducted through public service competitions, which tend to attract generalists. This has limited DPAs’ autonomy to select and recruit qualified staff, meaning that training on the job has been required, negatively affecting the quality and timeliness of DPAs’ work.
Hence, a large majority of interviewees emphasised that inadequate financial and human resources are a major obstacle to their DPA carrying out the full extent of the tasks required under the GDPR under Article52 and recital121 of the GDPR.
Article52 of the GDPR stipulates elements of DPAs’ independence that Member States should safeguard. These elements include freedom from external influence and enabling them to ensure that their human, financial and technical resources are adequate for performing their mandatory tasks. FRA research published in 2010 and 2014, as well as FRA’s Fundamental Rights Report– 2021 and FRA’s Bulletin2 on the fundamental rights implications of the COVID-19 pandemic, found that external political pressure was exerted on some DPAs, particularly during the COVID-19 pandemic. This was reported less often during the current fieldwork research. A few interviewees suggested that a DPA’s independence might be at risk if that DPA’s budgetary proposal has to be approved by a ministry that manages a large number of databases that process personal data in various fields. Under-resourcing may also negatively affect DPAs’ perceived independence, by limiting their ability to conduct investigations on their own initiative and to duly oversee governments and public authorities when acting as data controllers.
EU Member States should secure the necessary financial, suitably qualified human and appropriate technical resources for DPAs, in light of obligations contained in Article52 of the GDPR. As a key element of independence, DPAs should be provided with the means to adequately perform the entirety of their regulatory tasks, as defined in Article57 of the GDPR. This especially concerns tasks where DPAs can act on their own initiative, which includes the timely provision of advice and opinions on draft legislation and conducting their own investigations of public authorities.
When allocating budgets, Member States should consider that DPAs have been entrusted with additional roles and responsibilities, many of which flow from new requirements under recently adopted EU law. As DPAs’ role expands, so must their resources. An assessment of the adequacy of their resources should be made with reference to all tasks and powers of DPAs.
Member States should consider funding DPAs under a separate and independent budget line from the state budget, to make their budget visible. Where budgets are authorised at the government level, DPAs should be free to determine the allocation and prioritisation of the resources allocated to them, in line with Article52(6) of the GDPR.
While ensuring core funding for DPAs in the public budget, national budgetary authorities could consider stepping up funding for DPAs in relevant sectoral budgetary lines, in areas where DPAs’ expertise is required, for example asylum, migration, digitalisation of services and internal security.
Member States should support independent and objective reviews of DPAs’ workload to assess whether current budgets and human resources permit them to cope with their mandates and tasks.
The EDPB could consider facilitating exchanges of promising practices of national DPAs, as regards managing available resources to carry out tasks defined in the GDPR.
Member States should ensure that DPAs have the autonomy to recruit competent staff, including IT experts and specialist lawyers, and offer adequate remuneration to prevent frequent staff turnover.
Interviewees highlighted that supervision is their core task. Supervision includes all mandatory tasks aimed at investigating potential GDPR breaches (Article58 of the GDPR), either on the DPA’s own initiative or following a complaint. A thorough investigation is a precondition for effective supervision. For some DPAs, these investigatory and supervisory tasks should take precedence over any other function (notably in relation to advising), as investigating GDPR breaches is an obligation established in the GDPR. However, several interviewees highlighted various challenges that prevent DPAs from conducting their supervisory and investigatory tasks effectively. Several respondents explained that investigatory measures listed in the GDPR are appropriate but could be complemented with other tools to reinforce their supervisory capacity, such as concrete techniques to identify data controllers of digital services, or investigatory measures allowing for undercover investigations. These should be complemented by more in-depth and technical tools. Interviewees discussed difficulties in launching ex officio investigations, the importance of being able to expand the scope of an investigation based on preliminary findings and the difficulty in assessing electronic evidence collected during investigations. Another recurring challenge mentioned by interviewees relates to the difficulties some may face regarding data controllers’ cooperation with the DPA during the investigation, as such cooperation is not mandatory in many Member States.
In addition, as highlighted above, human resource shortages may force DPAs to concentrate resources on complaints, not leaving enough time for ex officio investigations. Moreover, in most interviews, DPA staff highlighted that they are still adapting to the broadened mandate DPAs were entrusted with by the GDPR, identifying the most efficient way to deal with the high number of complaints.
The European Commission should assess, with the support of the EDPB, which technical and procedural tools – required to fully implement the investigatory tasks and powers prescribed under Article57(1)(h) and Article58(1) of the GDPR – DPAs lack. Notably, DPAs should be able, with appropriate safeguards, to collect information under a secret or concealed identity, and extend the scope of the investigation based on their findings, if further potential GDPR violations are discovered during the investigation. Any proposed amendment to the GDPR could also clarify the conditions for the admissibility of electronic evidence.
The European Commission should consider introducing reforms to enhance DPAs’ ability to conduct both ex officio and complaints-related investigations in an adequate, effective and timely manner. Any proposed reform should reinforce the legal framework so that data controllers under investigation have an obligation to cooperate with DPAs.
Most interviewees highlighted that the GDPR requires them to respond to every complaint that has been lodged but that they lack the time and human resources to do so. Complaints concern issues of unequal gravity and some can be petty and repetitive. DPAs have developed a wealth of practices to address complaints more effectively, through prioritisation, grouping, templates, automation or standard replies. However, FRA findings show that there is still no harmonisation and no sufficient exchange of such practices among DPAs to effectively tackle such challenges.
Furthermore, some respondents emphasised that, 5years after the entry into force of the GDPR, DPAs’ decisions in GDPR investigations and lack of timely response to complaints are increasingly challenged in courts at the EU and national levels. Defending themselves against these challenges is costly and resource intensive for DPAs.
The EDPB could consider strengthening the exchange of national practices and experiences, specifically on improving handling large numbers of complaints. Notably, the issues of prioritisation and grouping of complaints would benefit from further guidance from the EDPB, namely guidance on which criteria and safeguards to implement in order to ensure each complaint is properly addressed.
While the majority (69%) of people in the EU-27 have heard about the GDPR, as FRA’s Fundamental Rights Survey on data protection and privacy showed in 2020, the large number of trivial or unfounded complaints received by DPAs indicates that a proper understanding of what the right to personal data entails is lacking. However, for most DPAs, despite their wish to provide advice and raise awareness among data subjects and the general public, doing so is challenging given their lack of resources.
As reported to FRA, DPAs receive very few requests for prior consultation from data controllers based on Article36 of the GDPR, which requires data controllers to consult their DPA when the result of a data protection impact assessment (DPIA) shows that the risk to the protection of personal data is high. The limited number of prior consultation requests and of DPIAs gives rise to concerns about the actual understanding of the data protection implications of processing operations among data controllers. The low number of prior consultation requests and the low number of DPIAs suggests, according to interviewees, that, even if data controllers are aware of data protection risks, they do not fully understand what these risks entail or what they should do to identify and prevent them. Interviewees considered the lack of knowledge of data controllers on the application of data protection provisions especially striking when it comes to the development of AI systems.
EU institutions and Member States should further support and promote awareness and understanding of data subjects’ rights and data controllers’ obligations among the general public. This is particularly important for tackling the currently low number of DPIAs, as identified by DPAs.
To increase the understanding of data protection implications in complex fields, notably, but not only, when it comes to the use of new technologies, the EDPB could develop further specific guidance on data processing involving new technologies or related to complex fields.
Most of the respondents interviewed by FRA did not recall any practical experience of providing advice to researchers in the field of scientific research, apart from during the COVID-19 pandemic. Those interviewees who did recall giving advice identified three main challenges that DPAs face when advising researchers. First, some DPAs reported that researchers found Article89 of the GDPR– which provides for safeguards and derogations when data are processed for research purposes (including statistical, scientific or historical purposes)– to be a complex provision. This is reinforced by the fact that researchers also reported to DPAs that the number of applicable EU and national laws confuses them when attempting to identify the correct legal basis for processing data for scientific and statistical purposes, and DPAs would welcome further field-specific guidance to enable them to properly advise researchers.
Second, some data controllers tend to be unwilling to provide access to data for research-related purposes. Lastly, several interviewees emphasised how the shift to an accountability system (from the pre-GDPR authorisation scheme) has affected their ability to advise researchers. These respondents indicated that they did not appreciate that DPAs are no longer responsible for authorising the processing of sensitive data. While general guidance has been developed by the EDPB and the European Data Protection Supervisor (EDPS), most interviewees emphasised that what they are lacking is field- and technology-specific guidance to enable them to appropriately advise researchers.
The EDPB should consider developing further specific guidance on processing personal data for research purposes, including processing of sensitive data. More guidance, and, where relevant and feasible, more tools, should be provided to clarify the application of derogations prescribed in Article89 of the GDPR. This guidance should address both researchers and the data controllers that researchers may contact to access specific databases. The guidance should clarify that granting or refusing access to data for research purposes is only based on Article89 of the GDPR and that the GDPR should not be used as a justification to deny access to data for research purposes. The EDPB could also consider collecting and promoting relevant promising practices identified at the national level.
According to Article57(1)(c) of the GDPR, DPAs shall provide advice to national institutions and bodies on legislative measures that relate to the protection of personal data. Some interviewees reported specific difficulties concerning advising public bodies acting as data controllers. Interviewees indicated cases where, due to either fear or distrust of the DPA, public bodies did not consult with the authority before launching a data processing operation.
Similarly, several interviewees noted both mistrust and misunderstandings from the executive when it comes to consulting with the DPA, although lawmakers agreed on the importance of providing adequate comments on draft laws to ensure effective implementation of data protection principles, which is prescribed by Article57(1)(c) of the GDPR. In some instances, DPAs’ opinions were not considered in final draft legislation, while in other instances DPAs were not consulted or were given tight deadlines. Some interviewees also highlighted how staff shortages can negatively impact DPAs’ ability to advise public institutions, as DPAs lack the expert knowledge in-house needed to provide administrative bodies with exhaustive and detailed analysis on questions that are sometimes very technical or sector specific. Several interviewees reported to FRA that mistrust of data protection principles (often perceived as globally hampering the effectiveness of proposed legislation), combined with a misunderstanding of DPAs’ competencies, were the main reasons for not consulting DPAs on draft legislation.
Several interviewees reported difficulties when investigating public administrations because some institutions competent in human rights or national security issues are sometimes granted a general derogation from certain obligations contained in the GDPR under national law, under Article23 of the GDPR.
Member States should ensure that data protection principles and requirements are mainstreamed in the work and procedures of public bodies and public authorities. They should promote the principle of data protection by default for all data processing, provide public officials with adequate guidance and regular training, and encourage a more systematic consultation of public institutions via their data protection officers (DPOs).
Member States should ensure that any restrictions allowed to public entities under Article23 of the GDPR are granted on a restrictive basis.
Member States should guarantee that DPAs are equipped with the necessary resources to enable them to provide high-quality and specialist advice to public bodies, in line with Article57(1)(c) of the GDPR. This includes both technological resources and human expertise, which implies granting DPAs additional resources for recruiting experts and developing in-house training.
Member States should ensure that data protection principles are taken into account when drafting legislative proposals, by consulting with DPAs and seeking their advice in advance. Member States should ensure that sufficient time is given to DPAs to provide detailed, relevant and exhaustive advice.
FRA research shows that, while the majority of interviewees believe that the requirements and tools provided in the GDPR are, in theory, adequate, most interviewees also highlighted that in practice the GDPR remains insufficient to regulate new technologies. Several interviewees said that DPAs are mostly unprepared when it comes to understanding and supervising new technologies (e.g. the implementation of AI-based systems). Some respondents emphasised the importance of dedicating more time and resources to the development of regulatory approaches for testing technologies, such as sandboxes (schemes used to test innovations in a controlled environment). Several interviewees expressed concern over the lack of clarity on the role their authority may have to play in the enforcement of data-related EU acts that have been proposed or adopted since the entry into force of the GDPR, in particular the proposed Artificial Intelligence Act.
The EDPB should consider providing DPAs with further guidance on the application of the GDPR to new technologies. Specifically, the EDPB is invited to collect information from DPAs to identify specific technology-related areas where further explanation is needed to apply the GDPR to data processing. Member States should ensure that DPAs can further engage in research– for example using sandboxes– to identify challenges and have potential solutions ready with respect to new fields where data protection oversight is required. To avoid duplication of work, DPAs are encouraged to foster cooperation with other DPAs and share knowledge and expertise on specific data processing involving new or complex technologies.
The EU legislator should ensure that the competencies of supervisory authorities envisaged in new data-related acts (notably, the draft Artificial Intelligence Act) do not conflict with the competencies of DPAs. Should DPAs be entrusted with any additional tasks and competencies, Member States should ensure that this is accompanied by the provision of relevant additional financial, human, and technological resources.
FRA interviews confirmed that strong cooperation between DPAs will ensure swift enforcement and a harmonised interpretation of the GDPR. According to recital123 of the GDPR, reinforced and harmonised cooperation between DPAs is a key objective of the GDPR, and the EDPB was provided with a broader mandate than its predecessor to fulfil this objective. The EDPB’s broad mandate described in Article70 of the GDPR can greatly support DPAs and reduce their workload by ensuring cooperation and consistency and by developing guidance. Interviewees were mostly positive about the EDPB, recognising the quantity of work performed by an institution that many recognise to be understaffed. However, interviewees did identify room for improvement. Some interviewees argued that, although the work of the EDPB is welcome, it has led to significant additional work for DPAs, notably in their participation in working groups and numerous meetings. In this context, several DPAs identified a need to restructure the way in which the EDPB operates and its internal procedures.
EU institutions should provide the EDPB with sufficient human and financial resources to allow it to fully fulfil its mandate and, as appropriate, support the work of EDPB members, including, where relevant, by developing appropriate tools. In turn, the EDPB should consider reflecting on its working procedures to ensure they do not create unnecessary burdens for DPAs.
Introduction
Related
Report / Paper / Summary
Data protection
Data protection, privacy and new technologies
24
May
2023
Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU - 2023 update
This report provides a partial update on the findings of the 2017 European Union Agency for Fundamental Rights (FRA) report Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU. It was prepared at the request of the European Parliament, which asked FRA to update its 2017 findings to support the work of its committee of inquiry to investigate the use of Pegasus and equivalent surveillance spyware (PEGA).
Read news item
Download 2017 surveillance report
Report / Paper / Summary
Artificial intelligence and big data
Data protection, privacy and new technologies
Equality, non-discrimination and racism
8
December
2022
Bias in algorithms - Artificial intelligence and discrimination
Artificial intelligence is everywhere and affects everyone – from deciding what content people see on their social media feeds to determining who will receive state benefits. AI technologies are typically based on algorithms that make predictions to support or even fully automate decision-making.
Read news item
Fundamental Rights Report
Asylum, migration and borders
Data protection, privacy and new technologies
Equality, non-discrimination and racism
Justice, victims’ rights and judicial cooperation
Support for human rights systems and defenders
10
June
2021
Fundamental Rights Report 2021
FRA’s Fundamental Rights Report 2021 reviews major developments in the field in 2020, identifying both achievements and areas of concern. It also presents FRA’s opinions on these developments, including a synopsis of the evidence supporting these opinions. This year’s focus chapter explores the impact of the COVID-19 pandemic on fundamental rights. The remaining chapters cover: the EU Charter of Fundamental Rights; equality and non-discrimination; racism, xenophobia and related intolerance; Roma equality and inclusion; asylum, borders and migration; information society, privacy and data protection; rights of the child; access to justice; and the implementation of the Convention on the Rights of Persons with Disabilities.
Read press release
Handbook / Guide / Manual
Asylum, migration and borders
17
December
2020
Handbook on European law relating to asylum, borders and immigration - Edition 2020
The European Convention on Human Rights and European Union law provide an increasingly important framework for the protection of the rights of foreigners. European Union legislation relating to asylum, borders and immigration is developing fast. There is an impressive body of case law by the European Court of Human Rights relating in particular to Articles 3, 5, 8 and 13 of the ECHR. The Court of Justice of the European Union is increasingly asked to pronounce on the interpretation of European Union law provisions in this field. The third edition of this handbook, updated up to July 2020, presents this European Union legislation and the body of case law by the two European courts in an accessible way.
Report / Paper / Summary
Artificial intelligence and big data
Data protection, privacy and new technologies
14
December
2020
Getting the future right – Artificial intelligence and fundamental rights
Artificial intelligence (AI) already plays a role in deciding what unemployment benefits someone gets, where a burglary is likely to take place, whether someone is at risk of cancer, or who sees that catchy advertisem*nt for low mortgage rates. Its use keeps growing, presenting seemingly endless possibilities. But we need to make sure to fully uphold fundamental rights standards when using AI. This report presents concrete examples of how companies and public administrations in the EU are using, or trying to use, AI. It focuses on four core areas – social benefits, predictive policing, health services and targeted advertising.
Read the press release
Watch the launch video
Read press release
Report / Paper / Summary
Data protection
Data protection, privacy and new technologies
18
June
2020
Your rights matter: Data protection and privacy - Fundamental Rights Survey
This document presents data from the FRA Fundamental Rights Survey. It includes data on opinions and experiences of people in the European Union (EU) linked to data protection and technology.
Watch videos
Access all survey reports
More survey info
Fundamental Rights Report
Equality, non-discrimination and racism
Asylum, migration and borders
Data protection, privacy and new technologies
Justice, victims’ rights and judicial cooperation
Support for human rights systems and defenders
11
June
2020
Fundamental Rights Report 2020
FRA’s Fundamental Rights Report 2020 reviews major developments in the field in 2019, identifying both achievements and areas of concern. It also presents FRA’s opinions on these developments, including a synopsis of the evidence supporting these opinions. This year’s focus chapter explores how to unlock the full potential of the EU Charter of Fundamental Rights.
Read the press release
Download country studies
Report / Paper / Summary
Data protection
Data protection, privacy and new technologies
Support for human rights systems and defenders
Civil society
12
June
2019
The General Data Protection Regulation – one year on
The General Data Protection Regulation (GDPR) has applied across the European Union (EU) since 25 May 2018. One year on, this paper looks at how the new regulation has affected the daily work of civil society organisations (CSOs).
Handbook / Guide / Manual
Unlawful profiling
Asylum, migration and borders
Data protection, privacy and new technologies
Data protection
Equality, non-discrimination and racism
Racial and ethnic origin
Justice, victims’ rights and judicial cooperation
Security
5
December
2018
Last versions available are EL and NL
11 March 2021
Preventing unlawful profiling today and in the future: a guide
This guide explains what profiling is, the legal frameworks that regulate it, and why conducting profiling lawfully is both necessary to comply with fundamental rights and crucial for effective policing and border management. The guide also provides practical guidance on how to avoid unlawful profiling in police and border management operations.
Handbook / Guide / Manual
Data protection, privacy and new technologies
Data protection
25
May
2018
Serbian version now available
18 March 2024
Handbook on European data protection law - 2018 edition
The rapid development of information technology has exacerbated the need for robust personal data protection, the right to which is safeguarded by both European Union (EU) and Council of Europe (CoE) instruments. Safeguarding this important right entails new and significant challenges as technological advances expand the frontiers of areas such as surveillance, communication interception and data storage. This handbook is designed to familiarise legal practitioners not specialised in data protection with this emerging area of the law.
Download the handbook
Watch vlog on data protection
Report / Paper / Summary
Data protection
Data protection, privacy and new technologies
23
October
2017
Surveillance by intelligence services: fundamental rights safeguards and remedies in the EU - Volume II: field perspectives and legal update
This report is FRA’s second publication addressing a European Parliament request for in-depth research on the impact of surveillance on fundamental rights. It updates FRA’s 2015 legal analysis on the topic, and supplements that analysis with field-based insights gained from extensive interviews with diverse experts in intelligence and related fields, including its oversight.
Report / Paper / Summary
Data protection, privacy and new technologies
Data protection
Justice, victims’ rights and judicial cooperation
Security
18
November
2015
Surveillance by intelligence services - Volume I: Member States’ legal frameworks
This report, drafted in response to the European Parliament’s call for thorough research on fundamental rights protection in the context of surveillance, maps and analyses the legal frameworks on surveillance in place in EU Member States.
Report / Paper / Summary
Data protection, privacy and new technologies
Data protection
27
January
2014
Access to data protection remedies in EU Member States – Summary
This summary presents the FRA’s main research conclusions, which are published in full in Access to data protection remedies in EU Member States.
Report / Paper / Summary
Data protection, privacy and new technologies
Data protection
27
January
2014
Access to data protection remedies in EU Member States
Technological advances make it ever more important to safeguard the right to personal data, which is enshrined in the Charter of Fundamental Rights of the European Union. Data protection violations arise principally from internet‑based activities, direct marketing and video surveillance, perpetrated by, for example, government bodies or financial and health institutions, research by the European Union Fundamental Rights Agency (FRA) shows.
Handbook / Guide / Manual
Data protection, privacy and new technologies
5
June
2014
Handbook on European data protection law - 2014 edition
This handbook is designed to familiarise legal practitioners who are not specialised in the field of data protection with this area of law. It provides an overview of the EU’s and the CoE’s applicable legal frameworks.
Report / Paper / Summary
Data protection, privacy and new technologies
Data protection
Support for human rights systems and defenders
National human rights systems and bodies
7
May
2010
Data Protection in the European Union: the role of National Data Protection Authorities (Strengthening the fundamental rights architecture in the EU II)
The EU plays a pioneering role in the protection of personal data. The Charter of Fundamental Rights of the EU enshrines the right to data protection as an autonomous fundamental right. Despite the underlying importance and centrality of the right to data protection in the EU, many deficiencies are present in the data protection system. This study on data protection identifies deficiencies in the EU Member States.
