Data protection authorities agree to strengthen cooperation on digital challenges

Data protection authorities signed a joint statement to strengthen cooperation on digital challenges, marking the tenth anniversary of the General Data Protection Regulation (GDPR). Its proposals include sharing expertise and developing joint initiatives.

The statement links cooperation to digital transformation, the growth of the data economy and the increasing use of emerging technologies. It also stresses that coordination must respect each authority’s independence. The stated aim is to encourage common approaches without removing the signatories’ autonomy in reaching their own decisions.

The document reaffirms data protection as a fundamental right connected to dignity, the free development of personality and trust in digital environments. It also recognises that this right must be balanced with others in line with the principle of proportionality.

The statement identifies growing complexity in personal-data processing, automated systems and new forms of large-scale data use as challenges. It proposes coordinated responses to anticipate risks and promote a culture of privacy. The approach is preventive, focusing on how new technologies may affect personal data.

Artificial intelligence is specifically named among the technologies whose impact the authorities consider necessary to analyse and monitor. The document proposes exchanging information and technical expertise to strengthen prevention and oversight capabilities.

The statement links the exchange of knowledge, experience and good practices to more efficient administration and coherent application of the rules. It sets out cooperation priorities for the authorities.

Proposed work includes preparing and providing organisations with explanatory materials, guidelines, practical guides and support tools. The statement highlights SMEs, micro-enterprises, third-sector organisations and small municipalities, as well as complex areas such as the judicial sector. The aim is to make compliance easier for organisations with different levels of capacity.

The authorities also consider communication, cooperation and information-sharing mechanisms necessary. The statement envisages working towards shared interpretive criteria to make the rules clearer and their application more predictable, while preserving each authority’s independent judgement.

For organisations handling personal data, the practical implication is to follow guidance issued by the authorities and consider how it can support their compliance processes.

The document recognises the role of data protection officers and other privacy professionals in embedding compliance within organisations. It proposes strengthening their collaborative networks, enabling knowledge-sharing and promoting joint activities to disseminate good practices. It also identifies them as points of contact with the authorities and as contributors to risk prevention.

The statement emphasises functional independence, adequate resources and the involvement of these professionals in organisational decisions so they can advise, monitor and help prevent risks. For organisations, this points to integrating data protection into routine processes rather than limiting it to an occasional review.

The text sets out an institutional priority to strengthen the profession. In practice, it encourages organisations to consider whether their data protection officers and privacy teams can work independently and take part in decisions affecting personal data at an early stage.

The authorities propose initiatives for groups that may face particular risks in digital environments. The document mentions children and adolescents, older people and victims of gender-based violence, and also highlights education and the use of artificial intelligence systems. The focus covers both groups and contexts, with the stated aim of preventing risks and respecting rights.

For the public and judicial sectors, the statement proposes promoting criteria, guidance and good practices for responsible and transparent management of personal data. It also recognises the importance of data protection officers in public organisations, within each authority’s remit.

For the public, the text reaffirms the importance of privacy in digital life and proposes fostering greater public understanding. For administrations and other organisations, it identifies priority areas: protecting vulnerable groups, addressing processing linked to automated systems and managing personal information responsibly.

The statement brings together cooperation priorities: support materials, technical exchanges, analysis of emerging technologies and the sharing of good practices. It expresses institutional commitments and sets out areas for future work.

Organisations can treat it as a signal to follow guidance issued by the authorities and incorporate data protection into decisions about products, services and processes. Organisations with limited resources, the public sector and those working with vulnerable groups are among the intended audiences for the measures described.

The statement proposes providing guides and support tools, sharing technical expertise and anticipating risks from technologies such as artificial intelligence. These activities form part of cooperation between the authorities.