Privacy & Information Security Law Blog

According to a report issued by the EU Agency for Fundamental Rights (“FRA”), European data protection authorities lack sufficient independence and funding.  In addition, DPAs impose few sanctions for violations of data protection laws.  DPAs “are often not equipped with full powers of investigation and intervention or the capacity to give legal advice or engage in legal proceedings.”  In a number of countries, including Austria, France, Germany, Latvia, the Netherlands, Poland and the UK, “prosecutions and sanctions for violations are limited or non-existing.”  The report also highlights EU citizens’ limited awareness of the DPAs’ existence.  The FRA Director, Morten Kjaerum, noted that “improvements need to take place concerning the independence, effectiveness, resources and powers of data protection authorities.”