The European Union has just agreed to new procedural rules for enforcement of the General Data Protection Regulation (GDPR), touting faster investigation deadlines and streamlined cooperation between data-protection authorities. But celebrating 15-month investigation timelines as progress reveals just how far we’ve strayed from reasonable regulatory practice.
This “steroids shot” for GDPR enforcement, as Politico calls it, fundamentally misdiagnoses the patient. The problem isn’t that privacy authorities are too slow; it’s that they wield enormous power through a privacy-absolutist lens, with no obligation to balance data protection against innovation, economic security, or other fundamental rights.
Setting deadlines won’t fix a system where data-protection authorities (DPAs) act as both prosecutor and judge, issuing fines of hundreds of millions of euros based on interpretations that treat privacy as the only value worth protecting. It won’t address the chilling effect on European innovation when startups can’t predict whether their good-faith compliance efforts will satisfy regulators who keep their options perpetually open.
The European Commission itself has acknowledged that businesses are overwhelmed by regulations that are too complex and costly to comply with. Yet instead of withdrawing this procedural band-aid and pursuing real structural reform—such as creating independent tribunals that balance all European values—they’re doubling down on a broken framework.
The solution is smarter enforcement. Here’s what real reform would look like:
First, separate investigation from judgment. DPAs would retain their investigative powers but would have to present their findings to an independent EU tribunal for consequential cross-border cases. No more prosecutor-judge fusion that inevitably skews toward maximalist interpretations.
Second, ensure genuine multi-disciplinary expertise. These tribunals wouldn’t be stacked with privacy lawyers, but would include economists, business experts, and generalist judges who understand that privacy isn’t Europe’s only value. When deciding whether an AI startup’s data practices merit millions in fines, someone in the room should understand both innovation economics and fundamental rights beyond privacy.
Third, mandate a formal balancing of interests. The tribunal would be legally required to articulate how each decision balances data protection against other fundamental rights and economic realities. No more lip service—every decision would create a written record showing how privacy was weighed against freedom of expression, the right to conduct business, or Europe’s desperate need for technological competitiveness.
Fourth, create institutional advocates for non-privacy interests. Drawing from the EU Court of Justice model, we could appoint “advocates general” specifically tasked with highlighting and defending interests beyond data protection.
Fifth, build transparency and harmonization through unified decisions. Because this tribunal would speak with a single EU-level voice, we’d see less fragmentation and more consistent decisionmaking—directly answering calls for simplification and legal certainty.
Finally, review existing regulatory guidance. The tribunal should have power to review the European Data Protection Board’s documents before they become final, preventing mistakes like the vastly disproportionate “cookie law” guidance that requires website owners to ask would-be fraudsters and attackers to consent to anti-fraud measures. Past problematic guidance could also face review procedures.
In short, we need balanced protection of all Europeans’ vital interests, including innovation, economic security, and freedom of expression. Faster enforcement of imbalanced rules isn’t progress; it’s going fast nowhere.
The EU had a chance to align GDPR enforcement with its competitiveness agenda. Instead, we got stopwatch metrics for a race nobody should be running. If Europe truly wants to compete globally while protecting citizens, it’s time to stop tinkering with procedures and start rethinking the entire enforcement philosophy.
