Scarce Regulatory Resources: Tactical Enforcement and Hybrid Data Governance in the Cloud

Abstract

European data protection authorities (“EU DPAs”) play crucial roles in protecting the data privacy rights of individuals. However, many EU DPAs do not have adequate resources to be effective regulators. Although, the data privacy law and regulation literature recognises that many EU DPAs operate within such constraints, to date, there has been a dearth of empirical studies on how limited resources can impact on enforcement and data governance in practice. This article makes a modest attempt to address this empirical gap by analysing selected findings from the author’s empirical study of the investigations of multinational cloud providers by EU DPAs (“Cloud Investigations”). This article draws on the fields of socio-legal studies and regulation to interpret these empirical findings and advances three arguments. First, due to their resource constraints, some EU DPAs often have to make tactical enforcement decisions, such as whether to initiate Cloud Investigations or determine their methods and scope. This decision-making process is often not transparent to individual stakeholders. It can also be challenging for EU DPAs who have to not only consider but also balance several factors including external pressures, compliance motivations and enforcement styles. Second, during enforcement activities, such as Cloud Investigations, the “regulatory space” can often be complex, diffuse and diverse as EU DPAs delegate certain regulatory tasks to private and other governmental actors due to their limited or finite resources. Finally, this article suggests that delegated enforcement requires careful thought and design to ensure effective and robust data governance. Suggestions are made on how the “regulatory space” can be designed to promote accountability, trust, effective and robust data protection and multi-actor collaboration.