Since 2012, the European Commission has taken numerous steps in order to shape to EU’s digital future. One of these steps included the adoption of the General Data Protection Regulation (GDPR) which entered into force in May 2018. The GDPR aims to protect, in particular, the right of natural persons to the protection of personal data. At the end of 2020, the Commission went a step further and published its proposal for the Digital Services Act (DSA). As part of the EU’s Digital Strategy, it contains provisions to update the e-commerce legal framework.
Infringements of both the GDPR and the DSA do not stop at the Member States’ borders. An incident at Twitter, for instance, led to a situation where Twitter users had their Tweets, dating back to 2014, publicly accessible without their knowledge. This breach of the GDPR affected at least 88.726 EU and EEA Twitter users all across the continent. For this reason, it is essential that national authorities of different Member States cooperate in order to adequately enforce such breaches. Cooperation is fundamental here because it enhances the enforcement capacity and quality (van der Heijden 2016) – e.g., when investigating and sanctioning infringements that take place in multiple Member States, authorities can benefit from sharing resources and knowledge, which also speeds up the enforcement process. Keeping enforcement mainly the responsibility of national authorities, also respects the Member States’ desire to keep these competences at national level and it offers functional benefits since national authorities often have better access to information at national level (Hofmann 2008; Coen and Thatcher 2008; Eberlein and Grande 2005. Börzel and Heard-Lauréote 2009). Therefore, both the GDPR and the DSA provide that national authorities of different Member States cooperate, under the coordination of an EU body. Nevertheless, the GDPR experience proved that enforcement of cross-border infringements is not an easy task and the complexity of such structures could even lead to under-enforcement.
This blogpost aims to shed light on the complex enforcement procedures and speculates as to whether the Commission has learnt any lessons from the enforcement challenges that materialize under the GDPR. In order to assess the potential of the DSA enforcement structure, we discuss the horizontal (national authorities cooperating) and vertical (national authorities cooperating with an EU body) enforcement procedures of both systems, and the challenges that arise under the GDPR system.
Continue reading “The DSA Enforcement Framework, Lessons Learned from the GDPR?”