GDPR Controversies

Stefan Coetzeecreated 2026-05-12updated 2026-06-086 min readcross-cutting
Vault note, not reviewed against the source. Written in the knowledge vault on 2026-05-12 by models working with Stefan Coetzee and published as it stands, with private addresses, e-mail addresses and an employer name redacted. Check claims against the primary source before relying on them.

Contested points and known concerns about the GDPR after eight years of enforcement. The regulation is the global privacy benchmark; critiques deserve attention as the operational reality of implementation diverges from the regulatory ideal in places.

One-stop-shop friction

The lead-DPA / concerned-DPA mechanism (Articles 60-65) was designed to reduce regulatory fragmentation. In practice:

  • Ireland DPC bottleneck: many US tech companies (Meta, Google, TikTok, LinkedIn, others) headquartered in Ireland. Ireland DPC has been the lead DPA for major cross-border cases. Persistent criticism for slow enforcement.
  • Luxembourg CNPD similar concentration for Amazon and others.
  • Concerned DPAs with substantial affected populations have limited direct power against companies headquartered elsewhere.
  • EDPB consistency mechanism intervenes but slowly. Multiple major fines (Meta WhatsApp, Meta Instagram, Meta SCCs) have required EDPB binding decisions to escalate Ireland DPC drafts.

Reform proposals:

  • Procedural reforms (Commission proposal 2023) to speed cross-border enforcement.
  • More direct role for concerned DPAs.
  • Faster EDPB consistency-mechanism response.

Status: proposals in trilogue 2024-2026; reform plausibly 2026-2027.

Enforcement asymmetry across member states

DPAs vary widely:

  • Active / aggressive: France CNIL, Italy Garante, Spain AEPD, Netherlands DPA, Germany state DPAs.
  • More conservative: Ireland DPC (in lead-DPA role), some smaller-member-state DPAs.

Two-tier enforcement creates regulatory arbitrage perception. Establishments in lighter-enforcement jurisdictions may benefit indirectly.

Compliance cost

GDPR compliance costs:

  • DPO appointment and salary (€80-200k+ for in-house, similar fees for external DPO).
  • Records of processing maintenance.
  • DPIA performance for high-risk processing.
  • Data subject rights response infrastructure.
  • TOM implementation and maintenance.
  • Vendor due diligence.
  • Breach notification capability.
  • Training programs.

For SMEs, costs can be material. No formal SME exemption; Article 30(5) records-of-processing exemption is narrow.

Reform proposals include SME relief; political traction limited.

Cookie banners and consent dialogs ubiquitous post-2018. Effects:

  • User fatigue: most users click through without informed engagement.
  • Quality of consent: arguably degraded; "informed" criterion stretched.
  • Dark patterns: persistent attempts to nudge users toward consent (challenged enforcement-side).
  • Banner asymmetry: "Accept all" prominent, "Reject" hidden — CNIL and other DPAs increasingly enforcing against this pattern.

ePrivacy Regulation (proposed) was intended to streamline; stuck in trilogue since 2017. Reform of the consent landscape remains pending.

Schrems II ongoing complexity

The transfer landscape post-Schrems II is operationally complex:

  • Transfer-impact assessment per transfer is burdensome.
  • Supplementary measures technically demanding.
  • Vendor changes trigger reassessment.
  • EU-US DPF provides relief but is itself under challenge.
  • Smaller orgs struggle with TIA depth that the framework expects.

If Schrems III invalidates DPF, the disruption repeats. CJEU case pending.

Legitimate interests balancing test

Article 6(1)(f) is the most flexible basis but also most contested:

  • Subjective balancing test: data subject interests / rights vs controller interests.
  • DPA opinions vary: same processing may be legitimate-interests-OK in one jurisdiction, not in another.
  • Documentation expectation high: Legitimate Interests Assessment (LIA) should be written; many orgs skip.
  • CJEU jurisprudence developing: each major decision shifts boundaries.

Article 22 ambiguity

Automated decision-making rights (Article 22) operational reality:

  • "Solely automated": human-in-the-loop typically removes from strict scope. But CJEU SCHUFA decision (C-634/21, 2023) broadened: "solely automated" includes situations where human merely rubber-stamps automated decision.
  • "Legal or similarly significant effects": credit, employment, denial of service clearly in. Recommendations, rankings, content moderation — debated.
  • Right to explanation: Article 22 + Recital 71 provide right to "meaningful information about logic" but operational depth varies. AI Act Article 86 provides parallel right to explanation for high-risk AI.

For AI-assisted decision-making, classification work matters.

DPO role inconsistency

Article 37-39 DPO requirements interpreted variably:

  • Some orgs appoint nominally with limited empowerment, failing Article 38 independence.
  • External DPO arrangements range from substantive partnership to compliance theater.
  • DPO competence varies: certifications (IAPP CIPP/E, CIPM, others) provide signal but practice variable.
  • Conflict-of-interest concerns: in-house DPO with other functions risks Article 38(6) conflict.

DPA guidance (and some enforcement) tightening DPO expectations.

DPIA quality variance

Article 35 DPIAs:

  • High-quality DPIAs: substantive risk identification, meaningful safeguards, iterative process.
  • Ceremonial DPIAs: completed at end of project, rubber-stamping, minimal substantive analysis.
  • DPA expectations varying: some DPAs (France CNIL) publish detailed templates; others less prescriptive.
  • DPIA-required lists per Article 35(4) vary across member states.

For AI work, DPIA + AI Act impact assessment integration emerging but not standardized.

GDPR vs AI Act overlap

Both regulations apply concurrently. Friction points:

  • Article 22 vs AI Act Article 86: rights to explanation in both; relationship unclear in detail.
  • AI training data: GDPR lawful basis required; AI Act has training-data governance obligations. Not always aligned.
  • High-risk AI Act DPIA-equivalent vs GDPR DPIA: overlapping but not identical. Best practice: integrate both.
  • GPAI obligations vs GDPR controller/processor: model providers' role under both regulations.
  • DPAs vs AI Office: jurisdiction and enforcement coordination still developing.

EDPB-AI Office joint guidance expected; pace uncertain.

Insufficient protection in practice

Civil society critique:

  • Data broker industry: continues operating despite GDPR; enforcement uneven.
  • Adtech ecosystem: real-time bidding, tracking, profiling continue with questionable consent quality.
  • Government access: GDPR Article 23 restrictions allow significant government access; oversight uneven.
  • Cross-border data flows: in practice US, Chinese, other jurisdictions access EU data through various mechanisms; enforcement against extraterritorial access limited.

Some civil society voices argue GDPR has not delivered the protection level the rights-based framing promised.

"GDPR has been a success" vs "GDPR has been overhyped"

Two views in industry / academic discourse:

Success view

  • Comprehensive global privacy law.
  • Brussels effect — global influence.
  • Substantial enforcement and growing case law.
  • Industry compliance maturity.
  • Rights-based framing.

Critique view

  • Compliance cost without proportionate consumer benefit.
  • Innovation suppression (debated; data limited).
  • Enforcement asymmetry.
  • Persistent low-quality consent / advertising practices.
  • AI Act, NIS2, DSA, DMA adding compliance layers without consolidating.

Reality likely between: meaningful protection achieved, gaps remain, costs are real, refinement needed.

Recent / upcoming reform discussions

  • Cross-border enforcement reform (Commission proposal 2023): procedural improvements.
  • ePrivacy Regulation (pending trilogue since 2017): would replace ePrivacy Directive.
  • GDPR substantive reform: no major proposals on table; Commission position has been "stability."
  • Sector-specific extensions: EHDS (health data), Data Act, Data Governance Act all overlay GDPR.

Brexit and UK GDPR divergence

Post-Brexit:

  • UK GDPR retained EU GDPR with minor amendments.
  • Data Protection and Digital Information Bill (UK) — proposed reform, complicated trajectory, may diverge from EU GDPR.
  • Adequacy decision for UK (Implementing Decision 2021/1772) — sunset 2025; renewal subject to UK reform direction.
  • Material divergence risk for renewal.

"Right to be forgotten" practical limits

Article 17 right to erasure intersects with:

  • Freedom of expression / press: Article 17(3)(a) exception substantial.
  • AI training data: emerging question on whether trained models "remember" deleted data subjects.
  • Backup retention: erasure across backup systems operationally difficult.
  • Blockchain / immutable systems: technically incompatible with erasure.

Resolution often: practical proportionality rather than absolute deletion.

Counterpoint: what GDPR still does well

The critique is calibrative. Structural benefits:

  • Rights-based framing is principled.
  • Comprehensive scope captures personal data broadly.
  • Brussels effect achieved — global privacy benchmark.
  • Substantial enforcement demonstrates regulatory teeth.
  • Cross-regulator cooperation matured.
  • Case law accumulating improves predictability.
  • Industry compliance infrastructure mature.
  • DPA capacity scaling — most DPAs have grown.
  • Mature EDPB guidance — substantial corpus.
  • Privacy as design discipline has shifted engineering practice.

The critique is calibrative: GDPR is foundational privacy law for the EU and global benchmark. Treating it as perfect implementation, complete privacy protection, or unchanging baseline is the user error. Iterative refinement and complementary regulation (AI Act, sector-specific) expected.

See also