The GDPR is strict, but individuals still can't see whether their data is protected

My position first: I support the GDPR’s strictness, because it puts individual rights ahead of company cost. But strict rules have a gap in practice. An individual has no way to check whether their data is actually protected.

The EU admits convergence is unfinished

In an October 8 column, Isabelle Roccia, IAPP’s managing director for Europe, asks whether the EU’s predictability and coherence can make up for the lack of full regulatory convergence.¹ She separates two words. Coherence means the rules fit together. Convergence needs the parties to move the same way, and the two are not interchangeable.¹ Her answer: if full alignment is unlikely, companies can still use predictability to benchmark their compliance and governance plans.¹ She also notes the Digital Omnibus initiatives, which aim to cut unnecessary administrative burden, merge overlapping requirements and lower compliance costs.¹ The column doesn’t discuss how audits work. But it leads straight to the question below: rules are being simplified, so who checks them?

Three parties can check, and the individual isn’t one

The GDPR text gives each party very different tools. An individual (the data subject) can ask a company for a copy of their data and for the purposes, recipients and retention period,² and can complain to a supervisory authority.³ Both are ways to ask for information or report a problem. Nothing in the text lets an individual inspect a company’s systems. A company that hires someone to process data can require proof from that processor and may audit and inspect it.⁴ Regulators hold the most power: they can run data protection audits, demand access to all the data they need, and enter premises to inspect equipment.⁵

So an individual receives the company’s account of its practices. Whether the systems match that account is something only periodic regulator inspections or complaint-driven investigations can reveal. If an individual insists on checking, the only route is a complaint, and that pushes cost onto regulators and companies, which is the administrative burden I worry about.

Fewer, standard data centres would be easier to audit, but concentration has a price

One idea I’d put forward: build standardised data centres and move EU companies’ data into a few of them for protection and oversight. Storage would cost less, and regulators could step in at any time.

The legal text half-supports this. Regulators’ powers include entering premises and inspecting equipment,⁵ so fewer, more standard sites make each inspection cheaper and routine checks more realistic. It also points the same way as the Digital Omnibus goal of lighter administration.¹

Neither the text nor the column answers the other half. Once data is concentrated, one failure reaches many more companies and people. That is my own inference, not a legal conclusion, and the convenience of inspection has to be weighed against concentration risk. If it is tried, a safer order is to require the centres to give regulators a standing audit interface first, and to consolidate second.

The GDPR’s strictness takes individual rights seriously, and I still back it. But strict has to come with checkable. If individuals can’t check, someone must check for them, and checking has to be affordable.