European Commission releases a two year review of GDPR, celebrating some aspects but calling for more “vigorous” enforcement
Context & Ripple Effects
The Commission's two-year review lands a month after reporting showed GDPR stymied by underfunded regulators, thin staff, and stalling by tech companies — and weeks after the Irish Data Protection Commission marked the anniversary itself under pressure to act amid doubts about its enforcement ability. The review is Brussels' official response to that gap: credit where the law has bedded in, but a demand for more vigor.
It matters because the Commission has no direct enforcement power over GDPR — national watchdogs like the Irish DPC do — so its leverage is political and procedural. Complaint volume was already climbing before the law took effect (2,864 complaints to the Irish DPC in 2018 vs. 2,642 across all of 2017), meaning caseloads were set to strain weakly resourced agencies regardless.
First-order effects
- National data protection authorities, above all the lead regulator in Ireland where most major tech firms file their EU establishment, come under explicit Commission pressure to move faster on pending cases.
- Large US tech platforms that have stalled investigations lose their main shield — regulatory inertia — as the Commission signals enforcement pace, not the law's text, is now the problem to fix.
Second-order effects
- Member state governments face calls to fund and staff their watchdogs properly, turning GDPR enforcement into a budget fight between Brussels and national capitals.
- The ad industry, which related coverage describes as littered with potential abuses under GDPR, becomes the likeliest target once regulators are pushed toward vigorous action.
Third-order effects
- If the pattern holds, GDPR oversight evolves from independent national agencies toward supervised, reported-on regulators — a direction that later surfaced when human rights group ICCL pressure led the Commission to require regular reports from Ireland and other watchdogs.
- The broader structure points toward EU-wide digital regulation becoming an enforcement project first: rules only bind when the Commission actively audits whether member states apply them.
The trend: GDPR is shifting from a rights framework on paper to an enforcement test of member-state regulators, with the European Commission using reviews and reporting requirements to close the gap.