EDPB – Final Report: Study on the enforcement of GDPR obligations against entities established outside the EEA and falling under Art. 3 (2) GDPR

The strengthening of international cooperation seems to be the best avenue for better and easier enforcement of Supervisory Authorities (SA’s) investigative and corrective powers against third-country data controllers or data processors that fall under scope of Article 3 (2) GDPR, but who are not willing to cooperate with SA’s and did not designate an EEA representative. In the short term, the EDPB recommends the conclusion of MoU. The use of legal instruments in the matter of criminal cooperation (such as the Mutual Legal Assistance Treaty (MLTA) concluded with the US) could be considered.

The study was published per April 13, 2023, has 66 pages and can be found here.