Five years of GDPR: Lessons for Procedures, Agencies and Powers

After five years of General Data Protection Regulation (‘GDPR’) enforcement, the difficulties in the complex enforcement system have become apparent. Challenges for developing procedural rules for putting rights to the protection of personal data are manifold. The GDPR’s model has deficiencies resulting from overly complex composite procedures largely excluding individuals – especially complainants – from being able to play a meaningful role in the procedure, despite the fact that individual complaints raise the real-life issues necessary for enforcement. We argue in this chapter that agency design and the role of agencies in the procedures should be re-thought and, arguably, re-designed. This also is a matter not only for the role of the European Data Protection Board (‘EDPB’) but also of the European Commission in the system of data protection.