As the Commiussioners’ hearings kick off today, the Parliament, Council, and Commission are set to sit down to discuss the GDPR enforcement procedures regulation. It’s not expected to be anything more than a handshake trilogue for this heavily technical but very important file.
Another trilogue is pencilled in for 12 December, with one or two technical meetings per week to start after the hearings end on 12 November.
The Hungarian Presidency of the Council thinks the negotiations can finish by the end of the year, before their seat is passed on to Poland, although that is unlikely, the file’s rapporteur Markéta Gregorová (Greens, Czechia) told Euractiv.
People familiar with the file that Euractiv spoke to also said that they don’t expect a lot of disagreements on the political level. Some tensions may come between the Parliament and Council on one side, who aligned more with what data protection authorities had been asking for, including the European Data Protection Board, and the Commission on the other.
There are some discrepancies between the Parliament’s and the Council’s proposals as well, for example around how to set deadlines for handling complaints.
The legislative initiative started in 2020, when the Commission found in its evaluation report of the GDPR several problems with enforcement, including the fact that complaints often take years to resolve.
In large part, this file is meant to fix problems found with the Irish Data Protection Commission (DPC), and to a lesser extent the Luxembourg’s DPC. Many Big Tech companies have their EU headquarters in these two countries, particularly in Dublin. So the two DPCs are critical to the implementation of the GDPR, given that complaints are to be handled by the authority where the company is headquartered in Europe.
These two DPCs have been proven to be exceptionally sluggish in handling complaints, and some in civil society say are “complicit” in lax enforcement. Perhaps chief among them is Noyb, the digital rights NGO founded by Max Schrems, who leads the pack in complaints work for data protection.
The players
It’s an interesting time for this file to go through, with the Commissioner-designate responsible for Democracy, Justice, and the Role of Law, and therefore GDPR, being Ireland’s Michael McGrath. In his written responses to MEPs he said that:

He is “committed” to enforcement in “large-scale cross-border cases”
He is working on “a rapid adoption of the Commission’s GDPR procedural rules proposal”
But he also said that he wants to ensure the GDPR “remains in line with” competitiveness and security, which could hint at a larger focus on fostering data markets rather than data protection
On the Parliament side, the shadow rapporteurs don’t have much experience with data protection at least in their parliamentary experience, except for Axel Voss (EPP, Germany), who has also been quite vocal in calling for a reopening of the GDPR itself. The shadows are:
Kristian Vigenin (S&D, Bulgaria), who has returned to the European Parliament after a long absence. He primarily worked on trade and foreign affairs matters
Jacek Ozdoba (ECR, Poland), a new MEP
Michael McNamara (Renew, Ireland), another new MEP who is also co-leading the Parliament’s monitoring group for the implementation of the AI Act
Ă–zlem Demirel (The Left, Germany), a second-time MEP who also primarily worked on foreign affairs
