Towards a patchwork of data protection and supervision under the Data Governance Act

This paper examines the role of supervisory authorities in ensuring compliance with the EU's data protection rules under the General Data Protection Regulation (GDPR) and the Data Governance Act (DGA), highlighting the significant overlap between the two frameworks. While both aim to support the EU's internal market, their focuses diverge. While the GDPR centres on personal data protection, the DGA promotes the European data economy and digital single market. This overlap risks bringing about legal uncertainty, regulatory fragmentation, and potential incoherence regarding personal data protection in the EU's digital market. Although the DGA expressly notes that it operates without prejudice to the GDPR, this paper argues that the DGA's supervisory mechanisms are inadequate to prevent inconsistencies in applying and enforcing EU data protection rules. Data Protection Authorities (DPAs) are infrequently designated as competent bodies under the DGA, limiting their role in its enforcement, even when personal data issues arise. Despite provisions requiring cooperation between DPAs and competent authorities under the DGA, issues may emerge with regard to competence allocation and the requirement of complete independent supervision of personal data protection. Furthermore, informal cooperation mechanisms may hinder quick and transparent responses to data protection violations. Ultimately, these complexities jeopardize the individual's right to data protection through effective public enforcement, threatening the coherence and effectiveness of the EU's regulatory framework.