Interview with EU's data protection supervisor, Giovanni Buttarelli, on GDPR, the rising tide of privacy-focused legislation around the world, and more
First GDPR fines coming this year is just the start, says data protection supervisor Giovanni Buttarelli
Context & Ripple Effects
This interview lands months after GDPR took effect, when no major fine had yet been issued and Giovanni Buttarelli is setting expectations: the first wave of decisions and fines would arrive within the year, and a rising tide of privacy legislation would follow Europe's lead. The prediction matters because it frames GDPR not as a one-off compliance event but as the opening move in a global regulatory arc.
The subsequent coverage validates both halves of that forecast — and exposes the gap between them. Fines climbed from a slow start to €159M by early 2021 per FT research on the ~40% year-on-year rise, while the Commission's two-year review conceded enforcement needed to be more vigorous, and ICCL pressure eventually forced regulators into six-times-a-year reporting under the 2023 Commission changes.
First-order effects
- Data protection authorities across the EU shift from guidance mode to enforcement mode, with the Irish Data Protection Commission — already handling 2,864 complaints in 2018 versus 2,642 in all of 2017 — positioned as the de facto top tech regulator.
Second-order effects
- Compliance becomes an industry of its own: privacy tech vendors helping corporations comply and the cybersecurity insurance market both grow on the back of GDPR-style regimes, while the relatively high compliance costs fall hardest on small companies.
- Major tech companies route around slow EU enforcement — through late 2019 the only substantial privacy action against a major platform was the $5B Facebook fine issued in the US, exposing how unevenly the regime bites.
Third-order effects
- If the pattern holds, GDPR becomes the template for privacy legislation worldwide, but its credibility depends on closing the enforcement gap — which is exactly what later structural fixes like mandatory regulator reporting were designed to address.
The trend: Privacy regulation is spreading globally on the GDPR template, with the real battleground shifting from writing laws to enforcing them at scale against large platforms.