Procedural Challenges of Cross-border Cooperation and Consistency in Personal Data Protection in the EU

Data protection is an increasingly important topic in the European administrative field at national and cross-border levels. Such a trend reflects different phenomena in contemporary society, which further leads to a more focused concern for a harmonised elaboration by the Member States despite their autonomy, in principle, regarding EU law implementation. However, as revealed by the Slovenian case in this article, the European Data Protection Board and national supervising authorities, mostly information commissioners, express the need to regulate some issues more decidedly. Interestingly, yet not surprisingly, their focus is on procedural aspects, as according to administrative science and several European Commission documents, procedure strongly influences the results. As a result, the article elaborates on the relevant procedural issues to be addressed to ensure a harmonised enforcement of the General Data Protection Regulation (GDPR) in force since 2018. Various research methods are employed, combining qualitative, normative, and comparative analyses and quantitative approaches, emphasising statistical data obtained from annual reports for 2020, 2021, and 2022. The results show a lack of procedural provisions in several aspects, including the definition of the parties to the procedure and their defence rights, particularly access to the file, to be heard, and complain, as well as one-stop-shop access to legal protection, deadlines, and investigation powers. Such gaps are expected to be covered by procedural institutions enshrined in National Administrative Procedure Acts (APA). However, as suggested by the Slovenian experience, such a solution is minimal due to differing national regulations and relatively low awareness of APA relevance in data protection even among supervising authorities. Hence, the authors argue that there is a need to develop and adopt standard EU rules to regulate such issues.