Simple and advanced reflexivity in GDPR enforcement: empirical evidence from DPA activity

Key Points The General Data Protection Regulation (GDPR) has introduced a reflexive approach to data protection in the European Union, based among others on meta-regulation, risk-based approach, double-loop learning, and regulatory pyramids. There is no empirical evidence of whether the European Union (EU) Member States have effectively implemented the strategy of reflexive regulation in data protection. This article offers a case study of the data protection authority (DPA) in Poland to answer this question. The researched DPA has successfully adopted simple reflexivity that allows for ad hoc, case-to-case reflexive enforcement. Still, the absence of more advanced and principled forms of reflexive data protection may jeopardize the objectives of GDPR. One of the main reasons for incomplete reflexivity on the part of DPAs is that the GDPR contains inconsistencies and promotes reflexivity of data controllers but not of supervisory authorities. The EU General Data Protection Regulation (GDPR)1 has defined new routes for personal data protection. Its revolutionary impact has already crossed the borders of the European Union (EU), serving as a source of inspiration for other jurisdictions2 and a ‘global benchmark’3 in the field. This article examines to what extent the revolutionary ambition of GDPR, proscribed on paper, has been substantiated in actual enforcement practices of supervisory authorities at the national level. Yet to answer this question, one first needs to properly understand the nature of the revolution. The change in regulatory approach to data protection has been triggered by two parallel global trends: the increasing social, political, and economic relevance of privacy protection on the one hand, and the growing complexity of data processing on another.4 Hence, when creating a new European normative regime in this field, the challenge was to find an approach that might combine efficiency in fulfilling the objectives with flexibility and adaptability of the designed means. The solution adopted in the GDPR was to redefine the roles of both data controllers and supervisory authorities. From the perspective of the theory of regulation that this article adopts,5 the GDPR brings a threefold reform based on self-regulation, risk-based approach, and meta-regulation. First, data controllers become self-regulators, which means entities that define and implement standards regulating their own activity.6 In this vein, they are granted more flexibility and discretion in adopting appropriate measures of data protection, while being made responsible for fulfilling the general principles (Article 5) and the objective (Article 1) of the Regulation.7 Secondly, when self-regulating, data controllers should adopt a risk-based approach: they should assess and manage risks related to their data processing activities and ‘calibrate’8 protective measures accordingly. The ‘riskification’ is perhaps the most explicitly stated innovation in the text of GDPR9 and the one that attracts the most attention in the literature.10 Thirdly, the emphasis on self-regulation and risk management of controllers finds its counterpart in the new, meta-regulatory role of supervisory authorities (data protection authorities, hereinafter also as DPAs). Instead of directly determining standards for data protection, DPA takes a back seat and controls the standards adopted by data controllers. Hence, in a typically meta-regulatory manner, DPAs have become ‘regulators of self-regulation’11—they supervise and regulate self-regulatory activities of data controllers as risk managers.12 Each part of the triad of self-regulation, meta-regulation, and risk-based approach forms a relevant component of the regulatory regime established by the Regulation. This notwithstanding, it would be wrong to separate them from each other.13 As the last paragraph already suggests, all three are closely interwoven. Only when working together, they can show their revolutionary impact on data protection. This is the mix of all three that makes the GDPR-based regime unique.14 Hence, they should be as three of one regulatory From the of the theory of they all to the of reflexive this is reflexivity that the of regulatory approach, to the of the Regulation. regulation that in in the the of reflexive is based on regulatory and In it a mix of self-regulation and with Still, it is to what is it is to the of In to the is to be a more and regulatory From the from based on for it the meta-regulatory of the The of the approach are by regulation and to to In the for one of the European in regulatory approach has been adopted in the by authorities among the and and the and authorities supervise in which new that regulatory and enforcement In the regulatory are based on principles and the of which may change and the of which is to discretion on the part of the can be in by general the and might be reasons the European has to reflexivity as its main regulatory strategy in data it is for national DPAs to this reasons in the the of reflexive that properly to regulatory that are more to and for they also for more of enforcement and the of the for regulatory as privacy and data protection, with their and and growing Hence, it is not that reflexive have already been in this for the GDPR them new is this There is no empirical evidence of whether DPAs in the EU Member States have successfully made of the reflexive of the Regulation in The has not been researched This study to this Its main objective is to the of of the of reflexive regulation by the GDPR. This is a case study of the of the DPA in one EU Member the supervisory the Data Protection hereinafter this article examines three what extent the DPA makes of the reflexive regulatory by of reflexivity is in the of are the for and of reflexive regulation in the of personal data empirical with that its have the but not for DPAs that not been reflexive of As the already suggests, the case as a to more and for reflexive data protection. The of the regulatory and enforcement of DPAs in the EU is The approach to empirical in this is and data from a of EU Member This approach brings the is a of of In other it for it a enforcement in but of is is more case of DPAs from the of reflexivity in regulatory and enforcement activities is from the that on the of reflexive regulation in personal data protection are on the risk-based this from at three First, is a relevant and the actual a the and nature of is This notwithstanding, the actual typically on adopted in this approach, self-regulation, meta-regulation, risk-based approach regulatory pyramids. Secondly, the not explicitly the of reflexive regulation of this it answer the of what of is adopted in the of data protection. Thirdly, most of the on the of the of reflexive regulatory strategy in the GDPR other related not are in is a in the the which not the of and the of reflexive data protection, which empirical of This is this article in its to the actual reflexive practices of the supervisory The as The the of reflexive a the of reflexive regulation with the its two and and and both are based on and in in it is to understand to which in data protection enforcement. This the also from a normative both its and In this it one more simple and advanced The of ad hoc, case-to-case reflexive of the regulatory the and on a normative for As it is the allows for of and its this the regulation in the of reflexive regulation in the text of GDPR, while and the of the As the a of reflexive personal data protection in Poland is a the supervisory authority has effectively implemented measures of simple but of its more advanced The for this more are that might be for DPAs in other EU Member relevant is the in the text of the Regulation promotes the reflexivity of data controllers both simple and advanced but not of supervisory authorities. The last the The of reflexivity might be on of from general to In this for the approach, as to reflexivity in regulatory This notwithstanding, with general from the of the regulatory theory on the of reflexivity and reflexive and forms of in to which of them are adopted in regulatory on two a a of and a simple an advanced of The is in the the is by As it is also to understand the actual practices of in data protection. reflexivity is but to the and of the in In a reflexivity in a of and a reflexive its own and its In this vein, reflexivity as of of as a of its and In the of reflexivity means the on forms of self-regulation, learning, and to the strategy of reflexive regulation is a regulatory approach, as in the case of not have a it might be as a and approach, forms of which a three to the of by a of the of normative and the strategy is to and forms of regulatory which are from an perspective in to regulatory all of reflexive regulation the of learning, a of and In other reflexivity in regulation has both and it the of a regulatory authority more and it the authority and their general can be in that of In brings a mix of and As and already reflexive regulatory on the regulation of self-regulation other regulatory may be on the needs and the of the the two most in are the of and The of on of reflexive the and self-regulatory of the of the regulatory authority is on as the of a general for In this regulatory authority a risk management regulation The of in this is to the of self-regulating, This is meta-regulation, which two First, it can on them an to in other it them to their own reflexive Secondly, it standards that the self-regulation by are that a role in this The regulatory are and in to the of One of the and of this approach is the which has that of to Still, the have been with discretion as for the and the of of the has been in the that are it and the of each should be that the can also a more and that it the of the of The of a regulation in is that should be to the of in whether and to with enforcement of among other the of and regulatory and enforcement measures the regulatory The is based on the of and has been by a of regulatory a regulation the and of the of and the regulatory This is in a and the regulatory authority and the which also to a in and of in As a a regulatory is on and in enforcement and In the of of is This general for the is to regulatory and The of this approach is by the of and in the The discretion of authorities which on the of principles is in by with and general on and As this of both suggests, they are based on and in Each of them is also more in Hence, to understand and actual regulatory it is to which it is to that the actual practices on a mix of from both to in that should DPAs reflexive The answer to this might be that this is what the GDPR from them as show not in a the strategy has not been introduced the GDPR by are not it is that the may First, to more regulatory is more to of in as data protection. Secondly, to its nature and the that it regulatory it may be for in a to the when to as data protection have risks and can also data processing for they more in a Hence, with regulatory they can be more in regulatory allows for of enforcement a regulatory not to with all regulatory activities the can on entities and activities that the risks to regulatory reflexive being and makes for increasing the of and also to a in their and to this not that reflexive regulation is that it is a of an are and of the regulatory The more regulatory approach may be on the other hand, it one and the of for all (data controllers and data are The flexibility of that be more others and that in not be when with a approach, may the regulatory authority at the of and in the the strategy of its as a for in a to the last the strategy discretion to regulatory authorities, which may to and to both and Hence, the challenge for regulatory authority is to flexibility with in its to to the what they can an of being of the that the authority may to in each from both authority and as as a of the and In the show with of a of reflexive regulation in data protection in the the to to simple and advanced reflexivity that may also be as the one and As simple reflexivity allows for a reflexive own in which they are and their This allows for ad of which in the may in is is the and of which the risk of and The advanced of reflexivity offers a for it that the of In this a reflexive and to define a and general normative for In with the of the of this is an and the are The simple and advanced explicitly has been by can be for from the that and and risk-based to regulatory to the risks with a and is also in of of reflexivity in its of to the most advanced in which not its but also its own and the that makes and double-loop reflexive The controls the is and practices adopted in an to this is one more of reflexive learning, on which the the reflexivity of of its regulatory the of their self-regulation, and its regulatory regime accordingly. this of the most advanced the the regulatory authority and The advanced reflexivity brings a not a of the at the of the First, it and be with the of reflexive regulatory authority should be principled and based on a normative to the and of the the a of and they be to reflexive and In other it is not for the to the the and objectives that are be for Secondly, the of a regulatory authority and the reflexivity of both the one hand, the regulatory authority the and self-regulatory of the it and hand, the authority is not reflexive its and of it is by a more The of this is the advanced reflexivity of learning, is by reflexive and As already in the the text of the GDPR the main on the self-regulation of data controllers. In that it the controllers to become reflexive risk the of (Article serving as a for the self-regulation, the measures by the GDPR as risk (Article data protection impact (Article (Article of (Article The role in that should be by data protection in the data among to and of the to that the in the of The the data protection is the of of data controllers. double-loop and advanced reflexivity in data processing and data protection by data controllers is no in that self-regulatory activities of data controllers should be to by the GDPR not which the authorities should adopt while their meta-regulatory the DPAs discretion in that regulatory of both the are first and the of (Article and (Article the this is the of in the which may be and enforcement measures Hence, the GDPR for both and of as as of two of from the of the GDPR. own the GDPR emphasis on the reflexivity of supervisory authorities of data controllers. not to adopt a reflexive advanced not the authorities to their regulatory normative is implemented and to a in (Article the to with other supervisory authorities may advanced reflexivity but they are not in that role should be to measures that the GDPR not with its of 1) not that DPAs of advanced reflexivity to in a principled The from this is by the GDPR that learning, and the advanced reflexivity of both and to This is the case with the most meta-regulatory as of and in they may be as a that the advanced reflexivity has been effectively the Regulation not in that The meta-regulatory actual in a personal data protection as other reflexive to be This is the of the part of this In and on the main forms of of the supervisory from of the GDPR in on made by the of in The are not regulatory and enforcement for the supervisory but they also in as the main means of the authority and the general of data The part of the was based on a of the and other activities of to and data of of all on the in the in Poland by Poland in This was by other data of the the of the in which the of a data with the supervisory The been from the main with the of the for and its This to for the of to the authority the of and as as what it from data controllers in of The part also the of and other of the to answer the of whether explicitly to the strategy of reflexive regulation its in the it this the was designed to also with that would for an the and regulatory of In to the authority of the strategy of introduced by the GDPR, their of the reflexive regulatory and their of with data controllers. in that by of the to this part of the In to on more of regulatory on it is in all of the adopted a and the of the of when the data for This to the of the regulatory approach adopted by the the have the which of the reflexive approach to regulation that are in the of the In to a of the reflexivity of the have both and of as as of both its and As in the regulation in the this is the regulatory for the and the of for the attention is to the of simple advanced The most of the regulatory by the DPA is its and Only a of by of a personal data in an and a with the authority an of the of the Regulation a the researched it was and of both show a to activities of the DPA the researched own The of are in a of with data controllers. should be that not that was no data in the it means is that the not find the and that it the measures by a as it no in a Hence, this of forms the the of the regulatory a enforcement at the of the of from In the case of an the authority measures of both and enforcement. in with its the has no general on data processing which might be as the most in of the GDPR. The of in which the has is increasing This an and the growing complexity of the in allows also to that are and to the of an This is a from a approach in the first of the of the GDPR. The of in made by the in which the of the Regulation was own The can also be in the that the on the the controllers and the In the of its the DPA not to the of in its The first case in which this was was a the GDPR from in which the supervisory authority of a as a The of has been to on a no the DPA has as a relevant and has explicitly it from the controllers. In with its general approach, the the of as a a on a data to of GDPR. the at a of to change its and to the that the authority to to it as a are not The makes ad for each in a with the that the DPA simple in its The more advanced forms of reflexive regulation are First, the DPA is as most of its is to and of a data The more approach is In the not for practices regulatory also not the of personal data protection by data controllers. This might be by this part of the is and In the the from to both and is the main the of the for is not by the for in two and of for a the of to is made and based on ad activities of the data protection authority in own is the measures that more advanced reflexivity both from the regulatory authority and In the of the GDPR, this forms of DPAs and data controllers as of and In the researched no of be that the DPA is on the European Data Protection which is in of and that the of in that is in the in the researched of have been in Member and two others have been in in and two in and the the takes to the of data controllers from in the of and it of in that Still, are of is more is the of a more introduced by the GDPR, that is Each the DPA a of for in but all of them to The study has The most one from the designed of the as a case study of one the in regulatory and enforcement among EU Member in of to and of the to other are not Still, as show in the to be based on normative and determining the DPA supervisory is by the and The study was based on the of that of the actual and among the DPA is in actual practices might for that the of the with data controllers is a that the authority is more and in can and the regulatory and of Yet is the of a to on the perspective of a Hence, the of the supervisory authority to the of the as as what and the authority not is data controllers assess and whether they the authority as and answer the of to what extent data controllers are in their of reflexive measures in data protection. As have already this is the of that the of the The for may be in among The of and with controllers. the supervisory authority to the with data controllers and the of on an level. it finds the actual data not and the measures adopted by a it no in the In the authority The of a approach to enforcement. This is a enforcement that the of and a of in measures from the of the The emphasis on the of data controllers with the authority and the that controllers the perspective of the As can be in the the DPA that both its and its of There are no for for data for a to an This is to the last that The of of and Data controllers are to answer and in with the that the authority the case This not that the DPA has adopted the approach in a In have not for a of a regulatory In the the the of reflexive regulation of its not directly to more of this as enforcement The of regulatory approach is not In the DPA not of other regulatory from the as for practices and This brings a risk that the strategy adopted be the of regulatory As the DPA is in of simple the the advanced reflexivity is This is as simple reflexivity is by the risk of and the supervisory authority is to more advanced forms of on of regulatory in for an answer to this question. with to Poland and to more general of and normative nature that may to other EU Member States as is to the with the of this is not by is to the DPA as has a the GDPR The in this and was the EU In the DPA is in the EU in in As the it has also the to with a in the of in it was the in the by of the have a in and from may be might be the of the supervisory also this finds no in the There is evidence a that the has been by In the and of the of data it is to the of a is more is the of the is a of the in The of the of by the that as the of the two in a The of the of DPA as and most the is no evidence that it its regulatory The the of and in the supervisory to this the is to implement reflexive it both and in that to this in with for the reasons in the of by it was Hence, to the There are of evidence that may this The first one is the of with which a of in on the own The one is the absence of to and its in the The of in the of the of in the is the general and in The is not to the and of new regulatory The is on a the EU is and in the of and Poland is among by the and all three and of the and are among the in the As the that the of Poland is from the of Poland is not for the reflexive approach, it is based on on the one hand, and in and its on In an it might be to implement new regulatory the reflexive In this of the reflexive approach by the DPA may be as a of of data controllers. in for an for the absence of more advanced forms of one should to the DPA and not to The first is the of data controllers. is a that reflexive when to and of for reflexive and are to with a regulatory of is in the case of personal data protection. Data controllers are with a of entities with with and with the and with the DPA are of data controllers are and to in reflexive and with In other this is not the supervisory authority but also data controllers and in reflexive of the GDPR. to to reflexivity in the text of the GDPR. This may at that the Regulation is on the general of reflexivity in data protection. its may the reflexivity of to the they As already in the regulation in the are the of data not of supervisory authorities, that have been in the of reflexive as risk data protection impact of data to and of main of reflexive approach in the all to a for their double-loop and reflexive approach is by the of data protection the of in data The measures that reflexivity and double-loop of supervisory in are The main in that is and the of it this not that DPAs in a and principled In other the GDPR the reflexivity of the on a general in it that the reflexivity of one of a regulatory is not in that that the that more advanced forms of reflexivity from both and as of in This reflexivity of the GDPR may the of the reflexive of personal data protection. This article has to the it a simple and advanced of reflexivity are based on and in the the of ad hoc, case-to-case Only the in a general normative more and the regulatory regime the of reflexive it not to simple forms of but it needs to its advanced Hence, the a and the one hand, it allows for a and of the regulatory the other hand, it may to more regulatory the empirical this article examines to what extent the general on which the GDPR has been find their to actual practices of supervisory authorities and to the data protection that authorities are in the of the reflexivity that is in the Regulation. on the case of this article that this is the national DPA has successfully implemented the of simple reflexivity in its as to the but it has not to adopt the measures of more advanced reflexivity that for more and data protection. relevant are for other Member States the EU as a of the would be The actual of reflexivity of DPAs in other EU and This notwithstanding, are at of study that the First, one may that to Poland This to Member States with they on the approach to data protection they to the of data protection in the case of they risk and of the reflexive of the GDPR. Secondly, in of the Regulation in a challenge to in this on the European level. one to data protection not in but also in one should that all in the are Thirdly, have and normative to reflexive data protection, as a and regulatory of data controllers. are not to but have the The is more in the of the inconsistencies in the text of the the Regulation the reflexivity of the on a general it that the reflexivity of data controllers The reflexivity of DPAs is This for a reform of the GDPR that for a more of both data controllers and supervisory authorities. The has been by the of Poland