DATA PROTECTION RESOURCE STATISTICS
By Mugurel Olariu, RPD protectie date
The European Data Protection Board has evaluated and published a series of statistical data on the resources allocated by EU Member States to national supervisors■[1]. The move was made at the request of the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (LIBE Committee). Please note that the statistics cover both the 26 EU members and 3 EFTA countries – Iceland, Liechtenstein and Norway, which together form the EEA – the European Economic Area.
Below we present a selection of data categories – resources and application, and the answers provided, indicating the landmarks declared for the first and last ranked, and specifying Romania’s position within them, as follows:
I.Resources made available to the authorities by the Member States:
A. FINANCIAL RESOURCES.
Budgets of national supervisors – hereinafter SA, must be interpreted in the light of possible differences in the area of competences, activities and financial responsibilities at national level. Data for 2020 and 2021:
1.Germany – 82,601,600 Euro and 94,793,900 Euro
…….
26. Romania – 1,005,843 Euro and 1,023,563 Euro
……
29. Malta – 550,000 Euro and 620,000 Euro.
The vast majority of SAs explicitly state that they do not have sufficient resources – 82%, while there are some SAs that do not see the need for additional financial resources at this stage – 18%.
B.HUMAN RESOURCES.
The charts provide information on the human resources made available to the EEA SA in 2020 and 2021■[2]. These resources must be interpreted in the light of possible differences in the area of competences, activities and financial responsibilities at national level.
The first chart is divided into 2 chapters, with over 100 and under 100 employees. In the first chapter – over 100 employees, there are 9 Member States, of which Germany has a number of 1004 employees in 2020 and 1084 employees in 2021. Romania is in 15th place among the 20 Member States in the second chapter – under 100 employees, with a number of 29 employees, both for 2020 and 2021. The last ranked is Lichtenstein with 7 employees in 2020 and 2021.
The vast majority of SAs explicitly stated that they do not have sufficient human resources – 86%, while there are some SAs that do not see the need for additional resources at this stage – 14%.
1). Number of staff working on complaints, enforcement and sanctions (FTE) Current situation on 01.01.2021
1.Germany = 717
……
22.Romania = 14
…..
29. Liechtenstein = 2
2). % of staff working on cross-border and national cases – on 01.01.2021.
Of the 22 states, the top 3 reporting 100% for transnational and national cases are Cyprus, Bulgaria and Luxembourg. Romania declares a percentage of 50% for the transnational ones, ranking 8th with Sweden and 100% for the national ones.
3). Number of staff by position and studies
Number of staff by SA and by position (full-time equivalent, occupied positions) on 01/01/2021. It is divided into General Assistance, Legal, IT and Others. The “General Assistance” section covers the administrative assistance of the secretariat, the human resources department, the budget and finance, translation, data protection officers and the freedom of information departments. The “Other” section may cover, for example, directors, staff working for communication or education departments, researchers.
Germany | Romania | Liechtenstein
General assistance = 195 | 6 | 1
Legal = 380 | 6 | 4
IT = 103 | 0 | 2
Other = 17 | 3| 0
II.Enforcement
1. Total number of enforcement cases (national and cross-border cases)
Number of national application cases (from 25/05/2018 to 31/05/2021)
The concept of enforcement cases should be generally understood as a case where the SA is questioned about compliance with data protection legislation, including the handling of complaints, advice and signals regarding possible non-compliances and cases for which no formal investigation is launched.
Number of national enforcement cases registered per year:
Germany | Romania | Cyprus
2018, from 25.05.2018: 28.296 | 294 | 5
2019 = 57,278 | 527 | 36
2020 = 62,451 | 296 | 34
2021, until 31.05.2021: 17,616 | 288 | 19
Number of cross-border enforcement cases
The SA cooperates with each other under Chapter VII of the GDPR using Internal Market Information (IMI) and some procedures dedicated to cooperation under the GDPR. There are different procedures, such as for the identification of the Main Supervisory Authority (LSA) and the Supervisory Authorities involved (CSA), for the launch of a request for mutual assistance in accordance with Article 61 of the RGPD or for one-stop shops.
Number of cross-border cases per LSA and CSA
Germany | Romania | Liechtenstein | Slovenia
CSA 887 | 285 | 225 | 305
LSA 183 | 5 | 5 | 0
2. Complaints / Complaints
Number of cases based on complaints
Number of cases based on complaints received under art. 77 RGPD
Germany | Romania | Cyprus
2018, from 25.05.2018 = 13,252 | 4,822 | 5
2019 = 27,474 | 5,808 | 12
2020 = 40,309 | 5,082 | 21
2021, until 31.05.2021 = 8,098 | 1,733 | 9
Status on 31/05/2021 of cases based on complaints
Number of cases based on status complaints (Romania does not appear in statistics)
France | Germany | Liechtenstein
Complaints resolved 32,000| 25,849 * | 169
Complaints pending 10,103| 19,752 | 11
* – reported figures do not include values from all SAs in Germany
3. Ex officio investigations
Based on the GDPR, all SAs are competent to initiate ex officio investigations. Statistics on the number of ex-official investigations launched on SA, per year are included in the graph presented. Please note, however, that the concepts of what constitutes an ex officio investigation may vary between Member States, for example, based on national law.
Number of ex officio surveys launched per year
Romania | France | Malta
2018, from 25.05.2018 = 64 | 170 | 3
2019 = 385 | 301 | 5
2020 = 398 | 247 | 4
2021, until 31.05.2021 = 133 | 162 | 1
The situation on 31/05/2021 of the ex officio investigations
Romania | Denmark | Spain
Resolved = 980 | 511 | 0
Still pending= 0 | 135 | 2
4. Exercise of the corrective powers of the HS in national and cross-border cases (from 25/05/2018 to 31/05/2021)
The total number of cases in which corrective powers were exercised
Ireland | Spain | Romania
Number of cases in which the SA limited or
prohibited data processing activities = 0 | 0 | 176
The total number of cases in which they were
executed corrective powers = 4086 | 2094 | 359
Total number of decisions with a fine per SA
Number of decisions with a fine per SA –
Germany | Romania | Slovenia
606 | 52 | 0
Number of decisions with fine per year and per SA
Number of cases with a fine per year and per SA (25/05/2018 to 31/05/2021)
Germany | Romania | Liechtenstein
2018 = 25 | 0 | 0
2019 = 166 | 28 | 0
2020 = 263 | 9 | 2
2021 = 152 | 15 | 0
The highest fine issued by SA
France | Romania | Liechtenstein
The largest fine issued by SA:
50 million Euro | 150,000 Euro | 4,400 Euro
Proportion of cases with ranges of fines
76% = less than 10,000 Euros,
19% = between 10,000 and 100,000 Euros
3% = between 100,000 and 500,000 Euros
2% = over 500,000 Euros
Allocated resources – funds and staff, relative to the volume of activity, show a fairly clear perspective in the exercise of SA responsibilities.
We do not believe that it can be absolute depending on the results, but the statistical figures of the activities carried out in the two years – 2020 and 2021, are quite comprehensive and especially convincing.
———————————————————————————————————
■[1] https://edpb.europa.eu/our-work-tools/our-documents/other/overview- resources-made-available-member-states-data-protection_en
■[2] The EDPB has already provided an overview of the human resources of the SA from 2016-2019 in his contribution to the GDPR evaluation carried out in 2020 at the request of the European Commission.
https://edpb.europa.eu/sites/default/files/files/file1/edpb_contributiongdprevaluation_20200218.pdf, pp. 26-27.
