This contribution is part of ongoing research in the framework of the IBOF project available at https://futureproofinghumanrights.org.
Introduction
The EU’s approach to regulating digital technologies has led to what may appear to be regulatory chaos. Various authorities at both the EU and national levels seek to oversee the digital sphere. Nonetheless, if this apparent confusion is managed thoughtfully, it could serve as a source of strength rather than a weakness.
This blog post is based on our paper “EU Cross-regime Enforcement, Redundancy and Interdependence: Addressing Overlap of Enforcement Structures in the Digital Sphere after Meta,” published in the Technology and Regulation Journal in December 2024. We analyse the overlap of enforcement structures in EU digital regulation. Drawing on Colin Scott’s examination of the concept of “extended accountability” (in his paper ‘Accountability in the Regulatory State’ from the early 2000s), we seek to provide a novel perspective on this phenomenon and discuss the path forward.
Since our article was published, the European Data Protection Supervisor (the EDPS) has released a visionary Concept Note for Digital Clearinghouse 2.0, aimed at ‘achieving a consistent, cooperative, and coherent approach to enforcing EU laws regulating digital markets’ (January 15, 2025). The Note’s insights are precious and daring, resulting in concrete and welcomed proposals. For example, the EDPS advocates for enhancing the previously proposed Digital Clearing House initiative while maintaining its flexibility through the ‘variable geometry’ of regulators; additionally, it supports new EU legislation aimed at streamlining cross-regime cooperation by establishing clear legal grounds for joint actions, allowing for institutionalised information sharing while safeguarding due process rights.
The Cross-Regime Digital Enforcement
Data protection authorities (DPAs), the European Commission as an enforcer of the Digital Markets Act (DMA), and (partially) the Digital Services Act (DSA), as well as competition authorities supervising digital markets and regulators under the AI Act and data space legislation. At first glance, this proliferation of digital authorities seems problematic, leading to confusion and inefficiency.
Although post-GDPR legal acts acknowledge this risk, they offer only fragmented cross-regime cooperation instruments. It remains unclear in which situations this cooperation should be initiated, how procedural actions should be executed, whether cooperation is obligatory, and what the consequences of failing to cooperate may be. Yet, if handled carefully, this regulatory tangle could benefit effective oversight.
Can Multiple Digital Regulators Make Sense?
Digital technologies pose interconnected challenges that affect various aspects of reality. Each challenge can be tackled from a different regulatory perspective. For example, the same practices of social media platforms could lead to simultaneous data protection issues (GDPR), competition concerns (DMA and competition law), and challenges related to content moderation or targeted advertising (DSA). How do we enforce this stack of issues? Who should do it? Who is first? Shall it go wrong? Is oversight better off with only one main enforcer?
These questions bring us to Colin Scott’s writings on ‘extended accountability’. From this standpoint, involving various regulators with diverse expertise in supervising overlapping issues can enhance overall oversight. Indeed, it may be unfounded to claim that the GDPR tools alone can address every challenge associated with safeguarding fundamental rights to personal data protection and privacy in the digital sphere.
Scott highlights two features of extended accountability: redundancy and interdependence. If one regulator lacks resources or fails to address a specific issue, others can step in (redundancy). For example, while data protection authorities struggle, competition authorities could address particular concerns through their investigations of abuse of dominant position. Furthermore, when multiple authorities supervise the same domain, they may become mutually dependent (interdependence), which incentivises them to coordinate their actions and consider one another’s perspectives.
However, there are risks involved. Scott highlights that interdependency might lead to regulatory capture. Regarding redundancy, Scott underscores the challenge of distinguishing between necessary and excessive redundancy. Establishing a mature cooperation framework could mitigate them partially.
Learning from the CJEU Meta Case
The Meta judgement (2023) rendered by the Court of Justice of the EU (CJEU) illustrates the potential for cooperation among digital regulators. The CJEU determined that competition authorities can take into account GDPR compliance when investigating market abuses if they collaborate closely with DPAs. Competition authorities should: 1) Adhere to existing decisions from DPAs; 2) If there is no decision, competition authorities should seek guidance from DPAs; 3) If they do not receive feedback or objections within a reasonable time, they may proceed on their own.
In this judgment, the CJEU strikes a balance, helping to maintain the unique role of DPAs protected by the EU primary law while allowing other regulators to take action in the digital sphere. Still, valid questions remain unanswered: How can the scope of res judicata of DPAs’ decisions be determined? How should potential deviations from these decisions be assessed? Which matters would require DPAs’ consultation?
Towards a Mature Cooperation Framework
Although the judgment in the Meta case represents a step towards cross-regime cooperation, the establishment of such a mature framework is only in its early stages. The recent EDPB statement emphasises the necessity for robust and consistent cross-regime cooperation. Below, we explore approaches to advancing it through ‘hard law’ and ‘soft law’ measures.
On the ‘hard law’ route, the most straightforward tool would be to create clear EU-wide (administrative) procedural rules for cross-regime cooperation among digital authorities. However, implementing such rules uniformly across various legal systems of EU member states presents challenges due to member states’ procedural and institutional autonomy and varying administrative settings and cultures.
The ‘soft law’ path offers more flexibility. Potential measures include developing joint guidelines, establishing national coordination bodies (drawing on successful examples from the UK and the Netherlands), and creating an EU-level forum for collaboration among digital authorities, for instance, by developing the Digital Clearing House 2.0.
Looking Ahead
The EU has been developing a comprehensive proposal for digital regulation. Whether the EU will be ‘fit for the Digital Decade’ also hinges on the effectiveness of enforcing its digital laws, which should be pursued as a coherent, cross-border, and cross-regime system. While arguing that this ambitious project will likely fail due to structural constraints may be tempting, we believe such an argument is premature.
Given the EU’s limitations and experiences with GDPR, valid questions remain about measuring the effectiveness of enforcement and cooperation instruments and ensuring the independence of DPAs in the elaborate system of cross-regime enforcement. Legislative initiatives at the EU level may emerge in the coming years to clarify these issues. The activities of the new Commission in this respect are worth following.
Paul De Hert
Paul De Hert is Full Professor at Vrije Universiteit Brussel and Associate Professor at Tilburg University. He is Senior Researcher at iBOF project ‘Future-proofing human rights. Developing thicker forms of accountability.’ He is also Director of the Fundamental Rights Research Center at VUB and founder of conferences including the CPDP Conferences, Privacy Salon, and Brussels Privacyhub. His research interests are focused on privacy & technology, criminal law, and human rights.
Paweł Hajduk
Pawel Hadjuk is an EU-qualified lawyer (Polish advocate), a Ph.D. Researcher at the Department of Informatics Law at Cardinal Stefan Wyszyński University in Warsaw (Poland) and a Data Protection Officer.
