The document discusses challenges facing data protection authorities (DPAs) in enforcing technology regulations like GDPR. It notes that while there are 3,520 staff across European DPAs, only 8.6% are specialist tech investigators. The UK Information Commissioner's Office has 680 staff but only 22 roles involve technology and just 8 people conduct tech investigations. DPAs' budgets increased before GDPR but have slowed since, while complaints have accelerated. Ireland's DPA supervises major tech firms but budget increases are decelerating despite faster complaint growth. Overall, the summary is that DPAs lack specialist technical expertise and resources to properly enforce regulations against large technology companies.

1. @johnnyryan

2. @johnnyryan

3. @johnnyryan
Real time bidding:
a chronology of complaints
against Google

4. @johnnyryan
Real time bidding:
a chronology of complaints
against Google
The GDPR
does not
really exist

5. @johnnyryan
680825215436839605534 105 140 170 20 30 44 12 182101 24 39 49 47 191 792361821 38
UKGermanyAustria Belgium Bulgaria Croatia Cyprus Denmark Estonia Finland France Hungary Ireland Italy Latvia Lithuania Lux. Netherl.MaltaCzech
Republic
Romania Slovakia Slovenia Spain SwedenPortugalPolandGreece
3,520 people work at European DPAs that regulate the private sector.

6. @johnnyryan
680825215436839605534 105 140 170 20 30 44 12 182101 24 39 49 47 191 792361821 38
UKGermanyAustria Belgium Bulgaria Croatia Cyprus Denmark Estonia Finland France Hungary Ireland Italy Latvia Lithuania Lux. Netherl.MaltaCzech
Republic
Romania Slovakia Slovenia Spain SwedenPortugalPolandGreece
3,520 people work at European DPAs that regulate the private sector.
101‡
4‡ 42641†8
21
28
3842†55† 7† 2 4
22
36‡
4
11‡
82
12
But only 8.6% are specialist tech investigators.

7. @johnnyryan
UKGermanyAustria Belgium Bulgaria Croatia Cyprus Denmark Estonia Finland France Hungary Ireland Italy Latvia Lithuania Lux. Netherl.MaltaCzech
Republic
Romania Slovakia Slovenia Spain SwedenPortugalPolandGreece
101‡
4‡ 42641†8
21
28
3842†55† 7† 2 4
22
36‡
4
11‡
82
12
3,520 people work at European DPAs that regulate the private sector.
But only 8.6% are specialist tech investigators.

8. @johnnyryan
UKGermanyAustria Belgium Bulgaria Croatia Cyprus Denmark Estonia Finland France Hungary Ireland Italy Latvia Lithuania Lux. Netherl.MaltaCzech
Republic
Romania Slovakia Slovenia Spain SwedenPortugalPolandGreece
101‡
4‡ 42641†8
21
28
3842†55† 7† 2 4
22
36‡
4
11‡
82
12
This is the thin line
policing big tech

9. @johnnyryan
2017 2019
€16.5
€32.3
€56.1
Increases to DPA budgets
accelerated before the GDPR.
2018
Total increases to DPA annual budgets,
in millions of Euro, rounded.
The GDPR was
applied on 25 May

10. @johnnyryan
2017 2019 2020
€16.5
€32.3
€56.1
€32.6
2018
But governments have reduced DPA
budget increases since the GDPR.
Total increases to DPA annual budgets,
in millions of Euro, rounded.
The GDPR was
applied on 25 May

11. @johnnyryan
41
127
92
87
64
56
45
25
20 18 17 16 14
11 10 9 8 7 6 5 4 3 2 2 1 1 0 0
Ireland
Germany
Lux.
France
UK
Netherl.
Spain
Belgium
Sweden
Malta
Austria
Italy
Cyprus
Hungary
Estonia
Poland
Czech
Finland
Denm.k
Latvia
Lithuan.
Romania
Greece
Portugal
Bulgaria
Croatia
Slovenia
Slovakia
One Stop Shop “lead authority” case load per country

12. @johnnyryan
2010 20202000
Lead authority case load per country
Twenty years of
annual budgets
30
60 UK
56 cases
Germany (federal € only)
92 cases
Ireland
127 cases
France
64 cases
Luxembourg
87 cases
0
€61
MillionsofEuro,rounded.
The GDPR was
applied on 25 May

13. @johnnyryan
But only 3% of its staff are tech specialists.
Organigram of ICO staff whose roles or training are primarily technical.
Head of tech.
policy
Head of privacy
innovation
Tech. adviser
(secondment)
Tech. adviser
(secondment)
Data ethics
adviser
Executive director
Technology policy & innovation unit
Group manager
technology
policy
Group manager
digital economy
Principal tech.
advisor
Principal tech.
advisor
Post-doctoral
fellowship in AI
Senior tech.
officer
Senior tech.
officer
Team manager
Group manager
Cyber incident response & investigation unit
Principal cyber
investigations
officer
Principal cyber
investigations
officer
Principal cyber
investigations
officer
Lead technical
investigations
officer
Lead technical
investigations
officer
Vacancy
Team manager
Lead technical
investigations
officer
The UK ICO is Europe’s biggest DPA.
It has 680 staff.
Its budget doubled from 2018 to 2020, to €61M.
22 people

14. @johnnyryan
Only 8 people at the ICO appear to be
employed to actually conduct tech
investigations.
Team manager
Group manager
Cyber incident response & investigation unit
Principal cyber
investigations
officer
Principal cyber
investigations
officer
Principal cyber
investigations
officer
Lead technical
investigations
officer
Lead technical
investigations
officer
Vacancy
Team manager
Lead technical
investigations
officer

15. @johnnyryan
Team manager
Group manager
Cyber incident response & investigation unit
Principal cyber
investigations
officer
Principal cyber
investigations
officer
Principal cyber
investigations
officer
Lead technical
investigations
officer
Lead technical
investigations
officer
Team manager
8 peopleactually conduct ICO tech investigations
1 vacancy
+

16. @johnnyryan
2017 2019 2020
37% requested from
government
10% actually given
79% 75%
60%
31%
% increase in budget
% increase in GDPR complaints received
Ireland’s DPA supervises Google and Facebook in Europe.
Even though increases in complaints are accelerating,
2018
56%
increases
to its budget are decelerating.

17. @johnnyryan
Annual budget (millions €)
Numberoftechspecialists
Spain
Netherlands
60
100
120
20
40
80
0
100604020 120800
Italy
Ireland UK
Germany
Greece
France
Other EU Member States
This includes Länder
(regional) and federal DPAs

18. @johnnyryan
German Länder DPAs
Not included on this chart:
Federal Commissioner for Data Protection and
Freedom of Information (BfDi): 185 staff, 22 of these
roles (including 10 vacancies) are tech specialists.
BfDI is responsible for postal and
telecommunications services, government
departments and federal institutions.
Bayern has a separate DPA that deals with the public
sector. Its 44 staff include 5 tech specialists.
‡Saarland tech specialist figure is an
estimate based on DPA response.
8 3
288
8 25
456
716
53
27
23
24
10
5
5
4
3
4
3
3
1
19
19
25
Baden-Württemberg
Bayern
Berlin
Niedersachsen
Hamburg
Bremen
Rheinland-Pfalz
Brandenburg
Hessen
Sachsen-Anhalt
Sachsen
Schleswig-Holstein
Vorpommern
Saarland‡
Nordrhein-Westfalen
Thüringen
1
465
283
5
29
49

19. @johnnyryan@johnnyryan

20. @johnnyryan@johnnyryan

21. @johnnyryan@johnnyryan

22. @johnnyryan@johnnyryan
Ireland can build enforcers

23. @johnnyryan