I. Introduction: Digital Omnibus, and the promise of savings
In November 2025, the Commission first presented the Digital packageFootnote 1 as a set of targeted, largely technical amendments intended to simplify compliance with the digital rulebook, lowering its cost and thereby supporting competitiveness and innovation.
Notably, the Digital package comprises three distinct strands (the Digital Omnibus, the Data Union Strategy and the European Business Wallet) and, within them, the Digital Omnibus is composed of two separate legislative proposals, following separate legislative procedures: the first one, the Digital Omnibus on AI, amends Regulation (EU) 2024/1689 and Regulation (EU) 2018/1139, addressing rules on artificial intelligence. The second, formally qualified as the “Digital Omnibus Regulation” and also referred to as the “Data Omnibus,” amends the GDPR, Regulations (EU) 2018/1724, (EU) 2018/1725 and (EU) 2023/2854, and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557.Footnote 2 The current analysis focuses on this latter, and on the innovations it introduces to the data protection framework.Footnote 3 Building on the recommendations of the Letta and the Draghi Reports,Footnote 4 the Staff Working Document accompanying the Digital Omnibus Package estimates that, provided the proposal enters into force by early 2027, the package as a whole could deliver at least €5 billion in administrative cost savings for businesses, and a further 1 billion for public administrations by the end of the Commission mandate in 2029, corresponding to roughly €1.2 billion per year.Footnote 5
It is worth observing, though, that such calculus measures cost lifted from regulated and reporting entities only; on the other hand, there is no corresponding entry regarding the costs that the reform may impose on the authorities charged with supervising the newly amended framework the Digital Omnibus is meant to introduce, nor the indirect cost its new provisions might impose on the courts before which this amended framework will be litigated.
Moreover, the Omnibus package must be located within a broader simplification programme that the European institutions have been inaugurating to foster EU competitiveness in the global market: since early 2025 the Commission has targeted a 25% reduction in administrative burdens for businesses, and 35% for small and medium-sized enterprises, by 2030, corresponding to some €37.5 billion in recurring savings, in response to the competitiveness concerns raised by the Member States.Footnote 6 Overall, ten omnibus packages were presented in 2025 alone, each accompanied by a headline illustrating the expected savings, computed in essentially the same manner.
Against this background, our analysis contends that – whereas parts of the Digital Omnibus might genuinely simplify the European regulatory framework and, in turn, improve competitivenessFootnote 7 – the cost–benefit analysis that grounds the intervention is justifiable only in part, as some of the amendments the reform operates might end up re-allocating the costs on other actors in the European framework (and, in particular, supervisory authorities and courts) rather than eliminating them. This might, in turn, foster a revision of the underpinnings of the Omnibus itself.
To better illustrate this claim, attention is devoted in particular to two of the most debated amendments to the General Data Protection Regulation (GDPR) that the Digital Omnibus proposes: the codification of an entity-relative concept of personal data in Article 4(1), and the rewriting of the discipline of automated decision-making in Article 22.
Notably, when analysed in their performative dynamic, both these amendments entail the risk of shifting regulatory burdens away from data controllers, moving them onto the public authorities charged with supervision and, through them, indirectly onto the data subjects whom that supervision protects by reducing their effective access to justice.
As a preliminary matter, it is necessary to “unpack” how the burden was counted in the first place, analysing its components and procedural conditions. Hence, we discuss (Sections II and III) how the cost–benefit analysis underlying the Digital Omnibus was conducted, how public administrations are considered within it, ultimately observing how supervisory authorities and courts fall outside the perimeter of the cost–benefit assessment. Then (Sections IV and V), we focus on the first of the two illustrative amendments discussed, i.e., the entity-relative definition of personal data, identifying a set of new costs and burdens emerging on supervisory authorities because of the intervention. Subsequently (Section VI) we turn to the second amendment, that is, the rewriting of Article 22 GDPR, and to the channel through which it operates and (Section VII) analyse the joint effects of the two amendments, before turning (Section VIII) to the distributive question of whom the resulting re-allocation favors; then (Section IX), the research widens the frame of the analyses to the omnibus method and to its procedural dynamics, in order to clarify how they had a role in producing the metrics for the cost-benefit analysis. Lastly, we devote attention (Section X) to the relevance of imposing additional costs on the supervisory side in terms of impact on the rule of law and access to justice. Conclusions (Section XI) follow.
II. The cost–benefit analysis in the Digital Omnibus
1. Better regulation and the standard cost model
The quantification that accompanies the Digital Omnibus is the byproduct of an administrative exercise that the Union has been conducting for roughly two decades, and whose assumptions are essential to understand its content: its lineage runs from the Regulatory Fitness and Performance programme launched in 2012 – which conceived simplification as the reduction of regulatory burdens while equally meeting the relevant policy objectivesFootnote 8 – through the 2015 Better Regulation agenda, which committed the Commission to accompany each simplification proposal with estimates of potential benefits and cost savings,Footnote 9 to the current Better Regulation Guidelines and Toolbox, which supply the operative methodology observable in the Omnibus. Within that methodology, the main benchmark for quantifying administrative burden is the Standard Cost Model, which expresses the cost of an information obligation as resulting from three terms: the price of the labour required to perform it, the time the performance takes, and the frequency with which it recurs.Footnote 10
Three features of this instrument deserve emphasis, both because of their relevance, and as they are not directly observable in the final cost-analysis accompanying policy documents.
The first element concerns its unit of analysis: the Standard Cost Model prices obligations, that is discrete, legally imposed tasks whose addressee, content and periodicity can be read off as directly stemming from the legislation. Notable examples in the field of data protection law are the obligations to notify a data breach, to maintain a record of processing activities, or to provide information to data subjects: each of them has an identifiable performer, a describable task, and a frequency that the legislation itself fixes or that past practices allow to directly estimate. Whereas the model performs well with regard to such domain, what falls outside this analysis is any cost that does not take the form of an obligation owed by an addressee: this includes, for instance, the costs of exercising a discretionary function, of investigating, of adjudicating, of interpreting.
In other words, as supervision is not an information obligation but, rather, a public function whose intensity is chosen, not prescribed, and whose frequency is endogenous to the resources available, its activity will fall outside the scope of the calculation model.
The second feature concerns the Commission’s own cost taxonomy, and its relationship with the performative dimension of the analysis: theoretically, the Better Regulation Toolbox considers, among the direct costs of regulation, not only the compliance costs borne by regulated entities but also the enforcement costs borne by public authorities, comprising the activities of monitoring, inspection and adjudication that implementation requires.Footnote 11
Whereas such relevant category formally exists, the case of the Digital Omnibus illustrates that it plays no role in the factual analysis: the Staff Working Document quantifies savings on the compliance side and records no corresponding entry, positive or negative, on the enforcement side. Hence, the taxonomy acknowledges enforcement costs as a category of regulatory cost, but the quantification does not populate it.
Lastly, the third feature concerns the treatment of non-quantifiable elements. The Staff Working Document provides estimates where feasible and proportionate, and its headline figure excludes measures that were not immediately quantifiable on the basis of available data.Footnote 12 Whereas this formulation is unobjectionable, as it simply acknowledges a limit of the analysis, the operational consequence of the feasibility filter is that effects which cannot be reduced to the product of the price, time and frequency variables (either because they lack a fixed performer, a stable duration or a legislatively prescribed frequency) are not carried forward as a distinct analytical object and drop out of the balance.
2. Derivative estimation, without an impact assessment
As it was widely underlined in scholarship and stakeholders’ documents,Footnote 13 the Digital Omnibus proposal was not preceded by a full impact assessment, and the Commission’s explanatory documents justify the omission on the ground that the amendments are technical in nature, designed to ensure a more efficient implementation of rules already agreed at political level: there were, in the Commission’s words, no policy options that could meaningfully be tested and compared.Footnote 14 Instead, the Staff Working Document examines the reasoning behind the amendments, outlines stakeholder views, and presents the expected cost savings, oftentimes building on the impact assessments originally carried out for the instruments being amended.Footnote 15
Notably, this constitutes a structural characteristic of most recent Omnibus legislation, as none of the proposals presented since February 2025 was accompanied by a full ex ante impact assessment; in each case the Commission invoked a derogation under the Better Regulation Guidelines, citing the urgency and importance of the initiative and the fact that the amended acts had already undergone assessment.Footnote 16
Accordingly, the estimation technique observable in the Digital Omnibus is essentially derivative: the original impact assessment figures are taken as a baseline and, then, they are adjusted by assumption for the changes the omnibus introduces, updated for inflation, and supplemented by qualitative assessments.Footnote 17 As a result, such technique is structurally ill-suited to introduce categories of cost that the original impact assessments did not measure: if the enforcement side was absent from the baseline, no amount of recalibration will make it part of the analysis.
In addition, it is worth noting that – alongside the expected cost savings – the Staff Working Document outlines stakeholder views gathered inter alia through the call for evidence and the Digital Fitness Check.Footnote 18
As a consequence, while compliance costs tend to have an articulate constituency, because they fall on identifiable entities, which are in a position to express their own obligations in metrics that the Standard Cost Model recognizes, supervisory costs are less readily represented, as supervisory authorities tend to intervene as institutional commentators on the substance of the rules, rather than as parties quantifying a burden of their own. Data subjects, for their part, bear a cost that materialises only ex post and in a diffuse form. This procedural setting matters also when considering that, in the past, the Court of Justice of the European Union has held that the preparation of an impact assessment should be considered a step in the legislative process that, as a rule, must take place where a legislative initiative is liable to have “significant economic, environmental or social implications,” and that dispensing with it is lawful only where the legislature is “in a particular situation requiring it and has sufficient information enabling it to assess the proportionality of the measure.”Footnote 19 It is worth observing, incidentally, that the systematic invocation of urgency across the omnibus programme risks converting this exception into a self-standing rule: if the choice of the omnibus format itself generates the conditions under which the derogation is claimed, then the format may end up operating as a standing exemption from the very requirements designed to make burden claims verifiable.Footnote 20
Whereas this element falls outside the scope of our analysis, the point is worth addressing when considering that the procedure followed by the Digital Omnibus is unlikely to highlight enforcement and litigation costs, as it essentially operates a one-sided recalibration of savings.
3. Costs monetised and benefits asserted
A last critical feature of the estimation carried out in Digital Omnibus concerns the specific treatment of benefits, and its methodological discrepancy from the analysis of costs.
While the costs of the existing rules are monetised, for each obligation, through the Standard Cost Model the benefits expected of the amendments, competitiveness, innovation, legal certainty, are asserted qualitatively; simultaneously, the benefits of the existing rules – and the protection they deliver – are treated as a constant value, assumed to survive the reform without any need for recalibration. This way, the Commission’s framing maintains that the amendments preserve the level of protection while easing the manner of compliance.Footnote 21
Yet, a symmetrical assessment of cost and benefits should have grounded these elements through quantitative estimation as – especially when enforcement is considered – the level of protection delivered by a supervisory system is not independent of the resources it commands and the signals it receives. In other words, the model of the cost–benefit employed by the Commission is one in which enforcement is considered free and infinitely elastic; as it will be observed, though, many of the amendments introduce additional activities (and cost) to the supervisory act and, at the same time, remove a set of “detection signals” for it to operate; yet, these elements are not considered as part of the analysis due to the qualitative methodology employed for the assessment of the benefits arising from the reform.
III. Public administrations in the analysis
1. What the €1 billion measures
As the Staff Working Document estimates around €1 billion in savings “for public administrations,” it might seem for the public sector, after all, to be in the ledger considered in the Digital Omnibus. It is therefore worth noting that public administrations enter the calculus only in their capacity as regulated and reporting entities: in other words they are considered, as controllers and as addressees of information obligations under the amended instruments, whose compliance tasks the reform lightens in the same way as it lightens those of private controllersFootnote 22 ; as a result, a municipality in charge of maintaining records of processing, notifying breaches, or responding to access requests is, in the Standard Cost Model, indistinguishable from a private company performing the same types of tasks. Although this choice is effective in displaying the impact of the Digital Omnibus on “operational” administrative burdens, the figure does not cover the distinct role that public authorities have as enforcers of the framework: the supervisory authorities established under Chapter VI of the GDPR, the cooperation mechanisms through which they act, and the Union-level bodies, such as the EDPB, that coordinate them, are left out of this analysis, and the impact of the Omnibus on their capacity to exercise the supervisory function is not addressed.
2. Why supervisory authorities fall outside the calculus: rationales and discussion
The exclusion of supervisory activities from the quantification is not defended in the Staff Working Document, implicitly emerging from the calculus and because of its structural characteristics.
This result can be traced, first and foremost, to the – already discussed – ontology of the employed metrics: as the Standard Cost Model requires a task with a price, a time and a frequency to measure the costs of a specific activity, it should be observed that public enforcement acts – while encompassing prices and times that can be measured – have no frequency prescribed by the legislation; the execution of supervisory and enforcement activities is determined by the authority, as the exercise of its discretion, within the limits of its resources and in response to the signals it receives from the market and its stakeholders.
In addition, enforcement costs depend on contested elements and parameters, behavioural responses, as well as on the composition of future caseloads.
It follows that an instrument built to price obligations might not have an effective slot to measure such a function and, under a methodology that resolves the non-quantifiable elements by omission, might end up being the first category to drop out. Yet, this consideration seems contestable, as it could – at the very least – be hypothesised that the frequency of enforcement activities might be estimated by counting the enforcement acts the authority performed in previous attempts by the Commission,Footnote 23 demonstrating that the supervisory side of a regulatory framework can be measured within the Better Regulation model.
Another element to be considered to explain the absence of supervisory activities from the cost assessment pertains to the structure of the amended body of law, i.e., the GDPR. Reg. 2016/679 places the duty to resource supervisory authorities on the Member States, and Article 52(4) requires each Member State to ensure that its authority is provided with the human, technical and financial resources necessary for the effective performance of its tasks.Footnote 24 The budgetary consequence of this choice is that the cost of supervision is a national budget line, formally outside the perimeter of the Union’s regulatory accounting as the expenses will materialise, if at all, in Member States’ national budget procedures. In such a sense, the Digital Omnibus reform might end up externalising a cost at a different level from the one at which the burden-reduction claim is made; this aspect is, furthermore, strictly related to Member States Supervisory Authorities’ independence, as rooted in Article 8(3) of the Charter, in Article 16(2) TFEU and as elaborated in Chapter VI of the GDPR.
Whereas an institutional reticence of the Commission in modelling the workload of national bodies is, in principle, understandable, it is noteworthy that the principle of independence is supposed to guarantee the authorities’ decisional autonomy, not their statistical invisibility vis-à-vis EU bodies,Footnote 25 and the EDPB itself frequently performs and publishes analyses counting the budget Member States allocate to Data Protection Authorities.Footnote 26
Nevertheless, as a result of not considering these costs within the analysis carried out in the development of the Digital Omnibus, a substantive component of the regulatory burden arising from the intervention is, indeed, absent.
3. The Digital Omnibus’ impact on courts, and their placing outside the calculus
Like supervisory authorities, courts too are absent from the Digital Omnibus’ ledger, as no strand of the Better Regulation practice attempts to estimate the judicial workload a legislative amendment generates. Part of the explanation for this is, again, attributional and jurisdictional in nature: the organisation of national judiciaries and the (heterogeneous) procedures before them are matters for the Member States within the framework of their procedural autonomy; while being subject to the requirements of equivalence and effectiveness, judicial costs are, from the Union’s accounting perspective, part of someone else’s budget. In addition, litigation costs are intrinsically ex post and contingent on the behaviour of parties,Footnote 27 and hypothesising the expected frequency for future disputes – especially at Member State’s level – would be genuinely speculative when enacting enactment an EU law.
Yet, the choice not to consider – even without the need to operate a specific quantification – the impact of the amendments on litigation introduces a major vulnerability in the regulatory design: as it will be observed, when changes such as the new statutory language of Article 4(1) entail the risk of introducing operational uncertainties,Footnote 28 then an expected need for clarification by the courts (national, or even the Court of Justice) should be at least envisaged.Footnote 29 More generally, any mechanism that implies interpretive effort potentially translates uncertainty into judicial workload; still, none of this workload has specific consideration within the cost–benefit exercise.
This choice is of particular significance within the field of data protection: the GDPR itself guarantees by design the availability of judicial remedies both against the supervisory authority and against the controller; hence, every new contestable threshold the amendment creates could multiply litigation along both routes (the appeal against the authority’s applicability finding, and the action against the controller in which the same finding must be established).
In addition, such costs are borne asymmetrically by the different stakeholders involved. A controller contesting the applicability of a provision is typically a repeat player, with professional experience and more-than-once involvement in legal disputes; furthermore, for this type of entity, the pendency of the threshold question can be seen as suspending exposure (i.e., liability costs) across an entire set of processing operations; conversely, the data subject is generally a one-shot litigant for whom the passage of time consumes the value of the remedy and crystallises the violation of rights. For these reasons, a procedural innovation that lengthens proceedings cannot be interpreted as distributionally neutral – even before any merit is reached – and the transfer of costs occurs primarily from the regulated entity toward the protected individual.
The cost–benefit analysis underlying the Digital Omnibus was conducted as a derivative recalibration of compliance-side savings, conducted without a full impact assessment and using an instrument whose unit of analysis is the priced obligation – under a feasibility filter that tends to resolve the non-quantifiable elements by omission. As a consequence of this approach, public administrations enter the exercise only in their capacity as regulated entities, and supervisory authorities fall outside it: the calculation instrument has no slot for a discretionary function and their costs – that are the least immediately quantifiable – sit in national budgets beyond the EU accounting boundary. Courts are not considered for similar reasons, compounded by procedural autonomy and the contingency of litigation. For a full-fledged appreciation of the intervention’s effects it is, therefore, worth asking what the cost–benefit would look like if these elements were – even qualitatively – restored.
IV. The evidential burden of identifiability under an amended Article 4(1) GDPR
1. The amendment and its structure
The Digital Omnibus would modify the definition of personal data under Article 4(1) GDPR, codifying an entity-relative concept of identifiability. More specifically, the proposed amendments clarify that information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person; that information shall not be personal for a given entity where that entity cannot identify the data subject taking into account the means reasonably likely to be used by that entity; and that such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the person. Footnote 30
The Commission presented the amendment as a codification of the Court’s judgment in EDPS v SRB, Footnote 31 even though such consequentiality is contestable: in EDPS v SRB, the Court held that identifiability is assessed relative to the entity in question; at the same time, it confirmed – in continuity with its earlier case lawFootnote 32 – that otherwise impersonal data may become personal when placed at the disposal of a recipient with means reasonably likely to be used for identification, and that in such cases the data are personal both for that recipient and, indirectly, for the entity making them available.Footnote 33
On this ground, among others, the EDPB and the EDPS have been arguing that the change is neither targeted nor technical, and that it would significantly narrow the concept of personal data at the core of Article 8 of the Charter.Footnote 34 It is also worth recalling that the current conception, anchored in Recital 26 GDPR, requires account to be taken of all the means reasonably likely to be used – whether by the controller or by another person – and of objective factors such as the cost of and time required for identification, assessed in the light of available technology and its development, including (but not limited to) singling out. The proposed amendment, however, overlooks the concept of singling out.Footnote 35
For the argument developed here, though, the entity-relative concept itself – which is common to every reading of the amendment – is substantial: under the new definition, whether given information is personal data is no longer an ontological property of the information but rather, the result of the relation between the information and a particular entity’s means; as it will be observed, this relational structure reorganises the administrative economy of supervision.Footnote 36 Hence, it is possible to identify a set of trajectories of interpretive workload the amendment would entrench, introducing a set of threshold questions in enforcement even before the merits can be reached.
2. The reallocation of costs in proving the personal nature of processed data
The reorganisation arising from the proposed amendment of Article 4(1) concerns, in the first place, the burden of proof.
Under the existing objective conception, an authority confronting a processing operation can ordinarily take the applicability of the GDPR as given whenever the data relates to identified or identifiable persons, on any reasonable view: the personal nature of data is rarely litigable, and the supervisory authority can focus on the merits – and, generally, on the identification of the legal basis for data processing.
Conversely, under an entity-relative standard, an authority wishing to assert the GDPR’s application must first establish that the data are personal for that controller; this means that if the controller cannot, given its own means, identify the data subjects, then the Regulation does not apply to its processing. This requires the authority to be provided – against the controller – with means and resources to construct (and eventually defend in court) a counter-assessment of the controller’s identification capabilities.
This shift is administratively significant along (at least) three dimensions.
The first dimension is procedural, as the amendment introduces a new, contestable, phase into the supervisory act: the nature of the data must be determined for the specific entity before the merits can be reached, and the determination must be elevated to a standard capable of surviving judicial review, since the qualification of the processed data as personal will lay the foundations of the authority’s competence in the individual case. The second dimension is evidentiary, because the object of proof is the controller’s own means of identification: in practice, this means that the authority is required to reconstruct – from outside – the re-identification capabilities of the controller and the resources it could reasonably deploy. Intuitively, the information asymmetry behind this requirement is structural, as the main elements determining applicability are in the controller’s hands, and the party bearing the burden is the one without access to them.Footnote 37 Lastly, the amendment produces a set of epistemic impacts: since assessing the robustness of a de-identification or pseudonymisation claim is a technical task, data protection authorities (staffed predominantly by lawyers) and, even more critically, courts might face growing difficulties in carrying out the evaluation about singling-out, linkage and inference risks and about the trajectory of re-identification techniques.Footnote 38 This new burden, indeed, demands a kind of capacity that many authorities, on their own account, might struggle to retain.
Two additional considerations complete the picture.
The first refers to the multi-level time consumption arising from the new, proposed, Article 4(1) formulationFootnote 39 : as the applicability of the GDPR following from the classification of data as personal is a preliminary issue that can be contested, appealed and even used to generate a reference for a preliminary ruling, this means that the qualification burden is likely to propagate into each judicial stage of enforcement, where courts will be asked to revisit the same threshold before reaching the merits, lengthening the whole procedural lifecycle.
The second element is related to the multiplication of demonstrations required by the new evidentiary threshold: because identifiability becomes entity-relative, then the same dataset may be personal data for one controller and not for another, and the number of applicability determinations grows with the number of entities and arrangements, rather than with the number of datasets. It follows, that the amendment may induce controllers to engineer structures that detach their processing from the means of identification (including by artificially outsourcing activities or capabilities to external companies) to remove processing from the scope of the GDPR, while preserving its effects.Footnote 40 This is consistent with already existing practices in the digital market, where activities such as authentication, payment and user management are increasingly externalised to third parties, leaving the first-line controller holding only pseudonymous identifiers.Footnote 41 Each arrangement, genuine or contrived, introduces a new determination the authority must detect, contest and defend, and that is not part of the cost–benefit assessment.
In addition, it is worth noting that identifiability, as required by the proposed amendment, is not stable over time, as means that are not reasonably likely today for an entity may become so tomorrow (particularly where re-identification techniques advance quickly). As the Court has already held that any assessment must take account of foreseeable technological development,Footnote 42 an entity-relative determination is therefore intrinsically volatile: an authority that establishes – at all the costs described above – that given data are not personal for a given controller has established a conclusion that is supposed, at least, to generate a minimum span of legitimate expectations; and yet, changed capabilities, changed partnerships or changed technique can reopen it within a short time. Overall, this means that the evidential burden of identifiability would not entail a one-off cost of transition to the new definition but, rather, a recurring burden built into the definitional structure of the new Article 4(1).
V. Supervision, and the role of time: capacity, clearance and delay in enforcement
1. The baseline
Overall data pertaining to cross-border cases suggest that the burden EU GDPR supervisory authorities currently carry is contained in absolute terms, yet demanding relative to the resources available: the Commission’s report on the application of the GDPR – drawing on the Board’s information-exchange systems – records roughly 2,400 cross-border case entries, around 1,500 draft decisions by lead authorities, and somewhat under a thousand final decisions as of late 2023.Footnote 43 This caseload is carried by authorities of which, on their own reporting, only around 18% consider their budget sufficient and 14% their staffing, with several operating below their statutory establishment.Footnote 44 Cross-border cases routinely run to years, and the conclusion rates of successive cohorts decay sharply with their complexity.Footnote 45
The data protection enforcement framework at EU level is, therefore, a system that operates by handling a contained caseload, but slowly and at – or beyond – the limit of the resources devoted at Member States level: National Competent Authorities receive breach notifications alone in the thousands per year (with peaks of the order of 9,000 in Denmark and close to 8,000 valid notifications in Ireland in a single yearFootnote 46 ), against enforcement outputs across the entire Union measured in the hundreds: the national system’s filtering ratio, from signal to concluded case, is therefore essential to manage the overall workload of data protection enforcement.
Intuitively, time is a structural condition for this system to properly operate, as time is what actually constrains how much enforcement occurs, as an authority’s budget translates – in the short run – into a fixed complement of staff, and the staff into a fixed stock of working hours in the year. As already noted, on the authorities’ own reported condition, that stock is already insufficient, and the same reporting shows that own-initiative activity is among the first elements to be reduced when it runs shortFootnote 47 : where capacity cannot be expanded, and, additional work per case cannot translate into additional expenditure that a budget line could absorb, this leads to fewer cases being inspected, processed, and resolved.
In such a context, the personal data qualification might introduce a new, mandatory stage in every contested case, where the national authority must establish, to a standard capable of surviving review, that the data are personal for the specific controller before any question of the merits arises. That stage takes time, and every hour it consumes is withdrawn from the stock available for other cases. Whereas the amount of this new cost might substantively differ across authorities and case types, in no case can the impact of the amendment in additional time required for the enforcement be considered as a null value.
As it will be observed,Footnote 48 the same reasoning accommodates the proposed amendment to Article 22 as well, by restricting the complaint channel through which most matters reach the authority in the first place. At the same time, ironically, fewer matters arriving would partially relieve a congested docket: hence, the visible backlog may even improve while protection deteriorates, because the numerical improvement is built on violations that go undetected.
2. The propagation of delays to the courts
Beyond its relevance for supervisory activity, the Article 4(1) amendment introduces a preliminary procedural question before courts as well, as the nature of the data must be pleaded, evidenced, and reasoned before the substance of the complaint is reached.
This repeats at every stage of the litigation: where the applicability determination is appealed, the reviewing court must revisit the same threshold question, once again before reaching the merits. This new burden thus propagates from the administrative into the judicial stage of enforcement, feeding the very adjudication costs that the cost–benefit exercise conducted by the Commission does not record. Additionally, it does so with the already examined distributive asymmetry: for the repeat-player controller, the pendency of the threshold question delays exposure and is an asset; for the one-shot complainant, the passage of time undermines the effectiveness of the action and of the remedy.
VI. Article 22: severing the detection channel
1. The amendment
Significant shortcomings – and, in turn, prejudicial effects in terms of regulatory burden – can be observed also by looking at the proposed amendments to Article 22(1) and (2) GDPR. According to the Omnibus, solely automated decisions producing legal or similarly significant effects should no longer be framed under a general right not to be subject to them; they should instead be permitted in principle, where one of three alternative conditions is met: necessity for entering into or performing a contract between the data subject and the controller, authorisation by Union or Member State law laying down suitable safeguards, or the data subject’s explicit consent.Footnote 49 It is worth noting, first and foremost, that these exceptions already existed, and that the safeguards of Article 22(3) – including the rights to obtain human intervention, to express one’s point of view and to contest the decision – continue to operate whichever condition the automated decision-making relies on. The relevant change, though, lies within specifics of the contractual condition, as according to the proposed amendment the necessity of the automated decision should be assessed regardless of whether the decision could be taken otherwise than by solely automated means. Footnote 50
Under the current text – supported by the interpretation of the Article 29 Working Party – a controller invoking the contractual exemption must show that no less privacy-intrusive method, including a method involving human decision-making, could achieve the same purpose; the amendment removes that comparator from the necessity assessment,Footnote 51 and relaxes the necessity criteria that accompanied the prohibition in principle recognised by recent holdings of the Court, such as in SCHUFA. Footnote 52
When discussing this amendment, the EDPB and the EDPS have welcomed the goal of clarifying the exceptions, accepting that the mere theoretical availability of a human decision-maker should not, of itself, preclude reliance on the contractual condition.Footnote 53 And yet, they underline that the proposed formula risks conveying the belief that automated decision-making is permitted whenever a contract exists; which would be in contrast with the core principle that a condition of necessity must exclude – in all cases – the availability of equally effective, less intrusive means.Footnote 54
In addition, as the general necessity requirement of Article 6(1)(b), together with the horizontal effect of the data-minimisation principle, continues to apply,Footnote 55 the net legal effect of the amendment is overall unclear: on one reading, it merely restates constraints that survive elsewhere in the Regulation; on another it signals, and in practice licenses, a substantially wider recourse to fully automated decision-making in the contractual setting.Footnote 56 When focusing on the potential burdens arising on supervisory authorities and courts, it is this second reading’s consequences that matter the most.
2. Complaints as a detection infrastructure
In terms of burden analysis, the amendment operates counter-intuitively: it does not increase the authorities’ caseload which might, in principle, be reduced by a wider framework of exceptions.
Yet, when considering the supervisory system’s information economy, it should also be considered that supervision in the field of data protection is predominantly reactive: authorities learn where to look, overwhelmingly, from the complaints of data subjects and the notifications of controllers. Hence, the data subject’s complaint is the bottom-up signal that activates the protection system: it operates, in the economic idiom, as the detection mechanism of the regime; furthermore, this happens at close to zero marginal cost for authorities, as the complaint is financed by the initiative of the persons affected.
The amendment, though, degrades this mechanism at its source. Under the current regime – as read, for instance, in SCHUFA – a data subject exposed to a significant automated decision holds a position framed as a right, whose infringement does not need to be individually invoked in order exist; the framing of the entitlement gives the objection a neat legal perimeter, and a clear object for the complaint. Conversely, under the hypothetical regime the Digital Omnibus suggests the same person would be exposed to a processing whose central condition, contractual necessity, has been widened to disregard the availability of human alternatives.
As a result, the class of automated decisions that shelter under the contractual condition grows and – correspondingly – the class of decisions about which a complaint is straightforwardly well-founded shrinks. In other words, the signal that a complaint sends (when it arrives at all) is noisier, because the threshold question of whether the decision was even capable of infringing Article 22 is harder for the complainant to assess.
This translates into a potential domino effect: fewer footholds mean fewer complaints, and fewer complaints mean fewer detected violations. Although on the Commission’s one-directional metric this can read as a saving (fewer matters arriving, less cost to be considered), this is, intuitively, just part of the story.
3. Detected and undetected violations
A reform that reduces expected complaints, though, does not necessarily suppress the underlying violations; rather it converts them from detected into undetected.
The cost of infringements does not disappear from the system: it merely shifts away from the authority and translates onto the data subject every time a harm goes unremedied because the signal that would have surfaced it has been removed. This point identifies a second blindness of the metric, distinct from one concerning costs imposed on the authority, as in this case the burden is potentially displaced onto individuals. In addition, this could hinder the overall effectiveness of the data protection supervisory system.
Theoretically, supervisory authorities are not without a response to the case of a thinning complaint channel, as they can complement complaint-led supervision with ex officio monitoring. Still, own-initiative investigation requires the authority to finance, from its own fixed budget and its constraints, the detection work that an effective complaint system autonomously performsFootnote 57 : it is, therefore, unlikely for the authority to compensate for it.
Additionally, the loss is likely to concentrate in those areas, where automated decision-making (and its problems) is particularly concentrated: activities such as credit scoring, platform account decisions, automated selection in employment, education and insurance, the high-volume, high-stakes business-to-consumer settings, all occur in situations in which fully automated rejection is already frequent and, on the evidence gathered by civil-society analysis, deeply opaque to those subjected to it.Footnote 58
This detection argument does not, moreover, stand on Article 22 alone because other proposed amendments to the GDPR, such as the limitation of the right of access in Article 12(5) – which would allow controllers to refuse, or charge for, requests exercised for purposes other than data protection – raise similar concerns. Indeed, access requests are the primary instrument with which data subjects assemble the factual record on which a complaint is built; hence, a limitation of access is, functionally, a limitation of the complaint itself, as it affects the evidence available to would-be complainants.Footnote 59
Whereas analysing each provision falls outside the scope of the present work, it is worth underlining that such modifications can affect overall, the informational inputs of supervision, complaints, access requests, notifications, that are structural to the functioning of the GDPR; whereas these reforms are able to reduce the workload on administrations and private actors, promoting competitiveness in digital market, their corresponding effect on detection, and its effectiveness, should be considered as well.
VII. The joint effect of the amendments amidst explicit and total burden
As observed, two amendments impact on two distinct margins of the data protection system, even though in different ways: amended Article 4(1) might raise the time each contested case consumes, and the new version of Article 22 might lower the share of the inflow that the complaint channel generates, displacing the corresponding burden onto the data subject. None of these harms is considered in the cost-benefit analysis carried out as part of the Digital Omnibus proposal’s drafting.
The reason for this can be, overall, related to a discrepancy in the magnitudes that the Commission’s accounting considers.
The Digital Omnibus takes into account the explicit burden of the amendments only, i.e., the set of costs that the reform’s measurement exercise recognises and records; in previous Sections, these costs have been shown to be the compliance costs of regulated and reporting entities, priced through the Standard Cost Model. It does not consider, though, the total burden of the amended Regulation, that is, the burden the amended framework actually generates across the system as a whole. This includes the compliance costs, to be read together with the supervisory time the framework requires, the judicial workload it creates, and the harm that goes unremedied where supervision does not reach.
When this element is considered, cases such as the two amendments examined show that explicit and total burden might significantly diverge.
Amendments to Article 4(1) widen the gap from the cost side, as the qualification phase it introduces adds time to every contested supervisory act and, through appeal and reference, to the judicial proceedings that follow; this burden is borne in staff-hours by authorities and courts, and in waiting time by data subjects. Modifications to Article 22 also broaden the gap, but operate on the count of cases rather than on their length: by thinning the complaint channel, they potentially increase the risk of GDPR infringements being undetected; in such cases, the supervisory burden is displaced onto the very same person the oversight is meant to protect.
Even if the explicit burden falls – as fewer obligations, fewer notifications, fewer cases arriving all register as savings – once the potential added supervisory time is considered, the total burden may rise, being augmented by the unrecorded time of Article 4(1), by the displaced harm of Article 22, and by the additional judicial workload the two provisions may generate. This shows, more generally, that a reform can lower the specific burden the regulation considers while, at the same time, raising the overall burden that same regulation creates.
In addition, such discrepancy is not static over time, as the two amendments interact through deterrence, feeding back into the volume of infringements itself,Footnote 60 and both amendments potentially depress the detection probability. Article 22 thins the private signal that tells the authority where to look, and Article 4(1) lowers the rate at which the authority can address cases, as its cost-structure remains fixed. Theoretically, then, a proper calculation of the total burden should include a third, dynamic component, that is the risk of additional violations induced by weakened enforcement: more expensive and slower enforcement, under a binding budget, is less enforcement, and less enforcement operates (not a saving, but) a transfer of costs.
At the same time, all these elements are difficult to reconcile with the static, one-period accounting of the Staff Working Document, and they unfold – once again – outside the burdens considered.
VIII. The expected distribution of gains and losses
The analysis developed so far suggests that the reform might, overall, re-allocate, rather than eliminate, some of the burdens currently arising from the data protection framework. It is now necessary to discuss in short, under a distributive perspective, whom this re-allocation might favour in the end.
When looking at the amendment of Article 4(1), immediate beneficiaries appear to be found in those regulated entities capable of organising themselves to take advantage of an entity-relative criterion; once qualified as relational, the identifiability becomes a variable that can be managed by data controllers and processors, as it can depend on the means at the disposal of a given entity. Such means depend, in turn, on how functions are distributed across contractual boundaries along the operational chain: for instance, an operator able to allocate operations, such as authentication, payment and user management to different entities, and to retain only pseudonymous identifiers, may place a substantial share of its processing outside the scope of the Regulation without altering the underlying operation in any respect that matters to the data subject. Furthermore, the benefit of the amendment is likely to be regressive within the regulated entities themselves, accruing least to the small and medium-sized enterprises,Footnote 61 and most to the largest and most vertically integrated operators. The same asymmetry attaches to procedural phases, since contesting an authority’s applicability finding presupposes a capacity for sustained litigation that is, again, not evenly distributed amongst companies of different size.Footnote 62
On the other hand, advantages arising from the proposed amendment to Article 22 are distributed according to a different criterion, as its beneficiaries are essentially those entities deploying automated decision-making at volume against individuals in a contractual relationship (e.g., credit scoring and insurance underwriting, platform account and content decisions, automated screening in employment and in access to services).
Looking at those subjects, suffering additional costs as a result of the Omnibus, first come supervisory authorities, which are expected to bear an additional determination in every contested case, while receiving a thinner flow of the signals on which their reactive supervision depends, and which are expected to conduct their activities under budgets fixed at national level and, on their own reporting, already insufficient.Footnote 63 Similar concerns also apply for national courts, before which the qualification question might be pleaded and re-pleaded at every instance.Footnote 64 Lastly, data subjects, who might be exposed to undetected violations because the signaling mechanism that would have surfaced them has been removed, or since the effectiveness of their remedy is consumed by the time the threshold question takes to resolve along each procedural stage.
When considered in their entirety, it is possible to observe that, whereas gains are concentrated amongst major and sector-specific operators, the losses tend to spread – either directly or indirectly – over the whole community. Furthermore, the gains are (quantifiable) economic savings on the compliance side; in contrast the loss potentially arising on the supervisory side impacts on the effectiveness of guarantees laid down by Article 8(3) of the Charter and Article 16(2) TFEUFootnote 65 which are conditions of the fundamental right to data protection itself.
IX. The structural level: simplification in the Omnibus method
The two amendments examined so far relate to specific provisions; yet the asymmetry they exhibit between explicit and total burden is also visible at the more general level of the Omnibus’ defining technique: the consolidation of many instruments into fewer, presented as a form of simplification.
First, the model does not seem to consider the relocation of interpretive labour arising from the Omnibus since, as observed, when rules are – allegedly – simplified, the interpretive questions they raise can re-emerge as new elements to be considered in litigation and supervision. Consolidation in one place – such as the one generated by the modifications to Article 4(1) proposed in the Omnibus – might create an interpretive seam in the overall structure of the GDPR, and the burden of policing seams, of producing the guidance, coordinating the positions and litigating the boundary cases, is transferred from policymakers to the institutions that operate the Regulation.
In addition, as already mentioned, different provisions entail the risk of eroding the information base of data protection supervision. Indeed, several strands of the simplification programme operate by extending reporting intervals, raising notification thresholds or deleting information obligations outright. Whereas some of these changes are meant to increase the breach-notification threshold and, as a result, to cut excessive inflows of notifications without actual relevance in terms of protection,Footnote 66 it should be considered that information obligations are also the signals for the supervisory apparatus.
Each obligation removed is an informational stream switched off, and a systematic removal of such streams risks creating informational blind spots, weakening feedback loops on which regulatory correction depends.Footnote 67 Whereas these gaps can be compensated through additional supervisory efforts, this – once again – introduces additional costs for the system to internalise. Considering these aspects does not mean stating that the impact of the Digital Omnibus is not, overall, welfare enhancing. This claim should, though, be assessed against a full-fledged overview of the changes the regulation introduces in the system, including the implicit costs it creates.
This is relevant especially when considering – as it was already noted in literature discussing the Digital OmnibusFootnote 68 – that the consolidation strategy followed in the proposal is both substantive and procedural: significant changes, including the two amendments, have been advanced in a fast-tracked simplification model, based on a characterisation of the amendments as technical.Footnote 69
X. The constitutional stakes of (additional) supervisory burdens
Devoting proper attention to the impact of the Digital Omnibus on the supervisory costs arising from the amendments, as well as on the impact it has on the effective access to justice of data subjects is not only a managerial effort for the sake of completeness of the cost–benefit analysis; it involves a set of relevant constitutional implications and directly intersects the framework designed by the Charter and by the Treaties.
Article 8(3) of the Charter provides that compliance with data-protection rules must be subject to control by an independent authority, and Article 16(2) TFEU repeats the guarantee at the level of primary law. The Court of Justice has long described the supervisory authorities as the guardians of the fundamental rights and freedoms at stake in the processing of personal data, and has treated the effectiveness and independence of their supervision as a pre-condition of the protection the right affords, striking down national arrangements that compromised their roleFootnote 70 .
The impact on supervision is therefore not a collateral by-product of the Digital Omnibus reform and cannot be traded against compliance burden – for public administrations and private parties alike – on an equal basis. It is, rather, one of the legal preconditions of the framework the reform amends, and the effet utile of the guarantee is engaged.
If the amendments introduced by the Digital Omnibus were to have an impact on the exercise of oversight, impairing its timely exercise and effectiveness, then the protection awarded by the GDPR is provided in form only; this is, indeed, incompatible with the position held by the Court, since Les Verts, that in a Union based on the rule of law the acts of Member States and institutions cannot escape effective review, which transposes naturally from judicial to administrative supervision.Footnote 71
In addition, the Member States’ duty under Article 52(4) GDPR to provide their authorities with the resources necessary for the effective performance of their tasks completes the frame. If the Digital Omnibus reform increases what effective performance requires, this implies an assumption of what Article 52(4) demands of national budgets: hence, a reform that factually expands an authority’s tasks – by reducing the amount of signal coming from data subjects – either requires to increase resources at disposal of the authority, or to end up drifting into non-performance of a duty, and to condition the effectiveness of a Charter guarantee. And still, none of these elements stems from the cost-benefit analysis accompanying the Digital Omnibus.
This balance is further complicated when considering that, as previously mentioned, the two costs the reform trades against each other are not of the same kind.
According to the Commission’s framing, cost borne by business operators is, in principle, a barrier to competitiveness: this characterisation makes it commensurable with other economic benefits – and even with losses, when present – the reform generates and, in principle, compensable with such amounts.
Conversely, a cost borne by the supervisory function potentially translates into a (either direct or indirect) reduction of the effective protection of data subjects: slower remedies, fewer detected violations, weaker deterrence and opaque data processing, all occur in a field where the individual’s own capacity for self-protection is notably weak, and where the supervisory function is correspondingly most needed. The first cost – and saving – is an entry in an economic calculation, and the second is a variation in the effectiveness of a fundamental right guaranteed by EU law. With regard to this aspect, it is also true that the Charter does not forbid the legislature from recalibrating the level of protection previously chosen; and yet, this recalibration should occur through an open legislative choice, rather than through the creation of a regulatory framework where a constitutionally mandated function ends up being under-resourced following a set of amendments that are framed as merely technical in nature. In such a sense, the cost–benefit analysis should not be understood as a mere accounting exercise but, rather, as a cornerstone element of a reform that implies a constitutional trade-off.
Whereas much of the Digital Omnibus package may well simplify the functioning of the data protection framework as intended – the supervisory authorities themselves support parts of it – the two amendments examined together with the structural features of the method for cost–benefit analysis, overall show that the reform’s evidentiary apparatus might not provide a comprehensive analysis of all the costs it creates; this happens either because those costs fall on institutions the apparatus does not count, or in currencies it does not price (e.g., time) or through mechanisms – degraded detection, displaced harm, and weakened deterrence – that only appear once the supervisory function operates in action, as part of the system being reformed.
XI. Conclusion
Simplification and burden reduction are not overlapping concepts, and the discrepancy between them – when not considered – is likely to manifest on supervisory and judicial side, and through them, on the people whom oversight is supposed to protect. In the absence of a proper impact assessment, the cost–benefit analysis underlying the Digital Omnibus carried out an essentially derivative recalibration of compliance-side savings, using an instrument – the Standard Cost Model – whose unit of account is the priced obligation, and which resolves non-quantifiable elements by omission. Accordingly, public administrations have been brought within the calculus only in their capacity as regulated entities; as such, the supervisory activity of data protection authorities, as well as the impact on the courts, fell outside it for reasons (either based on methodological ontology, budgetary attribution or the feasibility filter) that do not seem to justify a clear-cut exclusion of their costs.
In the context of the Digital Omnibus, both the provisions examined have been presented as a lightening of the load imposed by the GDPR on stakeholders involved in the data market; still, an analysis of their impact shows that the actual effect of their reform appears to be less an elimination of burden than its re-allocation away from controllers (whose obligations are, in fact, eased) and toward authorities – especially Member States’ ones that, on their own account, already operate near the limits of their capacity – and beyond them toward data subjects, in the form of complaints never lodged and remedies delayed in time.
What the Commission estimated, in other words, is the net saving of the simplification activity on the compliance side only; what remains unaccounted for is the gross cost of the operation, which is not simply monetary but comprises the effectiveness of a procedural guarantee (supervision) that primary law places at the core of the fundamental right to data protection. Whether the resulting trade-off is worth making is a question for the EU legislator; still, this trade-off exists, and the instrument chosen to measure the reform has proved structurally unable to record it and to consider its impact in terms of effective protection of data subjects.
This analysis carries implications that go beyond the Digital Omnibus – or, more generally, other omnibus initiatives – and extend to legislative assessment at EU level as such: both the pricing model for obligations arising from regulatory interventions and the exclusion of non-quantifiable elements from cost–benefit assessments are endogenous to the Standard Cost Model itself – not to the Omnibus – and the observed enforcement gap also results from a wider “asynchronicity” between the Better Regulation Toolbox and the simplification agenda.
More generally, under the current mode of analysis, any reform which operates by transferring work from regulated entities to supervisors and courts might systematically appear cheaper than it is. This reflects a structural bias of the assessment methodology in evaluating the procedural implications of regulatory interventions, absent recourse to a full impact assessment: possible corrective strategies include, amongst others, fine-tuning the enforcement-cost category that the Commission’s own taxonomy already contains, treating non-quantifiable elements (at least) as flagged unknowns to be further scrutinised, and, where the impact assessment is not carried out in full ex ante, committing to ex post reviews of enforcement effects with resourcing consequences, so as to ensure that the allocation of burdens – which any simplification reform entails – is decided in full view of its costs and their distribution amongst affected parties.
Acknowledgments
Whereas the present work is the result of a common intellectual effort by the two authors, Antonio Davola mainly contributed to Sections II, IV and V, and Lorenzo Rodio Nico mainly contributed to Sections III, VI and X; Sections I, VII, VIII, IX and XI have been developed jointly. The authors wish to thank Herwig C.H. Hoffman and Sofia Ranchordás for comments and insights on previous iterations of the current work; as always, all mistakes rest with the Authors.
Financial support
Although this paper stems from the research activities carried out within the FIS2 Project “Framing Self-Determination in Digital Ecosystems” (Project ID: H53C24001550001; PI: Prof. Antonio Davola), supported by the Italian Ministry of University and Research, it did not receive any dedicated financial support.
Competing interests
The authors declare that there are no competing interests which have influenced the production of this manuscript.
Use of AI
The authors didn’t use generative AI in drafting this article.
Open access
