Executive summary of the report

Download the full report here

This report has been produced to assess the strategies developed by data protection authorities (DPAs) across the globe, and to consider how they adapt to future challenges, including the regulation of emerging technologies.

The aim is to enable discussion within the data protection community about the strategic direction of regulation, based on the factual observation of current practices, and analysis of upcoming challenges and opportunities. The report contains the following key findings:

1

Strategies are often developed in a similar way but DPAs do not always use consultation as a mechanism to shape their strategy.

We found that there are common features of the strategy development process that provide a set of good practices for DPAs to learn from. For some DPAs, effective consultation (externally and with staff) is a particularly important component of the process, though it is not clear that all strategies undergo consultation pre and post drafting. Despite the commonality in the development process, there is broad variation in the formats and structures of strategies.

2

Strategies usually begin with a vision and a mission.

A clear and concise vision and mission should be foundational to all strategies. Most regulatory strategies published by DPAs do contain these foundational elements, although 30% don’t contain a vision and 28% don’t contain a mission. Many of the visions and missions reviewed share similar themes and concepts.

3

Objectives were a central component of the strategies examined but do not always reflect real choices or priorities in where the DPA would place its resources.

There is a risk that some objectives replicate legal functions rather than shape a direction to deliver those functions. There are a wide range of objectives deployed by DPAs, though there are some common themes. The most popular objective theme was ‘promoting and enabling compliance’ and, specifically for new DPAs, ‘raising awareness’.

4

Not all DPAs are fully proficient in measuring performance and success but many recognise that effective use of Key Performance Indicators (KPIs) is critical.

Measurement ensures that the implementation of regulatory strategies remains on track, and is essential to reviewing the overall success and impact of the strategy, and to providing transparency and accountability to regulated persons and data subjects. Our research indicates that this is an area that DPAs find particularly challenging (notably to identify both short-term and long-term KPIs) but recognise that it is a “must” in a resource-limited regulatory landscape. DPAs should share knowledge and work together in this challenging task.

5

International cooperation is evolving from important to integral.

Because of cross-border data protection challenges (e.g., the growth of the global digital economy, data driven business models, cloud computing, international data transfers, AI), international cooperation is either implicitly or explicitly referred to in a high number of strategies. Some DPAs identified international engagement and alignment as a specific objective or priority. In interviews, all recognised the added value of global or regional alignment and collective activities. While many DPAs have often cooperated regionally, globally cooperation is becoming a necessary component for a number of DPAs.

6

Some DPA strategies have started to respond to the specific challenges of global and digital regulation.

As the opportunities and risks from new technologies continue to emerge, the challenges of regulating in a digital era are becoming greater. A number of DPAs are starting to recognise this in their strategies and are developing new approaches to regulation. However, DPAs have more to do to develop a strategic approach to regulation of personal data and AI, and to also determine how to leverage benefits from these technologies in their own operations, notably to address resources and budgetary constraints. This task will also require DPAs to balance local and global pressures - taking account of the risks and opportunities specific to their own jurisdiction, alongside the growing importance of the global context.

7

New DPAs learn from experienced DPAs’ knowledge and practices – and experienced DPAs learn from new DPAs’ innovative tools and mechanisms.

After conducting over 20 interviews with DPAs across different geographies, scales and states of maturity, it became clear that DPAs around the world nurture a ‘virtuous circle’, learning from one another. It is not only emerging DPAs learning from experienced ones: as some new DPAs are ‘digital first’, and have launched innovations in the delivery of regulatory services, experienced DPAs can also learn from their new approach. This circle of learning should be expanded and receive further international support.

Page updated

Google Sites

Report abuse

Executive summary of the report

1

2

3

4

5

6

7

Privacy notice Get in touch at team@dpa-strategy.org