There were queues snaking their way out of the Brussels Convention Centre as attendees registered and met other data and privacy professionals from around the world. With over 2,600 attendees the main hall was at capacity, with large numbers of delegates watching the opening general session on screens elsewhere. The GRIP team was there observing and making new connections with an impressively knowledgeable, engaged, but very friendly and welcoming crowd.

Joe Jones, IAPP research and insights director, was the able moderator of a panel that kicked off this premier event. He got straight to the weighty subject of enforcement of data protection rules in the EU.

Dale Sunderland, the Irish DPC commissioner, said that while it had taken some time to set up the internal systems to be able to run effective and procedurally fair investigations, there was “significant progress that has been achieved in cooperation enforcement” with the EDPB “well-positioned to deal with the challenges of the future.” As an illustration of this success he cited the €4.5 billion ($5.2 billion) in fines imposed by the Irish DPC since GDPR went into effect.

However, he also addressed some of the challenges facing the regulator and pointed out that effective enforcement leads to wider awareness and more complaints. The Irish DPC was currently handing a caseload of 30 large-scale inquiries, with complaints having increased by 50% year on year. He suggested that the regulator will need to be pragmatic by looking at issues that represent “high systemic risk” and result in the “greatest harm to individuals.”

Strategic and proactive

In order to make the best use of limited resources, the regulator intends to be more strategic, but also more proactive going forward. Firms subject to complaints should expect the regulator to be “very probing early on in the investigation” and need to be prepared to provide “very clear and complete answers.” The regulator is also intent on leveraging available technology and legal skills in order to bring investigations to a swift conclusion.

Ana Talus, chair of the EDPB and the head of the Finnish DPC, was keen to emphasize that the level of regulatory complexity has increased significantly in the last five years. Cooperation between data protection authorities and regulators in other fields is a rapidly developing theme in response to this development – as is cross-border cooperation.

She welcomed the EU’s digital omnibus as an attempt to address the challenges of complexity and confusion when implementing and complying with regulations. But she said that simplification can only be acceptable if it does not undermine the core data protection principles that the authority is tasked with upholding, emphasizing that “the core principles must remain untouched.”

Sunderland echoed her comments by suggesting that while regulators should try to ensure that there are no “barriers to allowing all of us in the EU to enjoy the benefits of new technologies,” compliance with the law and the mitigation of harm are also important considerations. He said it should be possible to enable an “innovation growth agenda” while ensuring “responsible innovation.”

The conversation turned to the question of data sovereignty. Wojciech Wiewiórowski, the European data protection supervisor, suggested that data sovereignty is not synonymous with data localization, but is all about values and the “cooperation with those who share” European values in the area of data protection and privacy. He was at pains to emphasize that the focus on data sovereignty is not a data localization project, but rather one intended to ensure that regulators are able to implement and enforce rules on topics “that are most important for Europeans.”

It was an energizing session and, as Jones said in his conclusion, a sneak preview “of these big issues that will really be dominating and animating our field, the conversations today, and beyond for some time.”