What happens when data protection collides with the relentless pace of digital innovation? That’s the question the European Data Protection Board (EDPB) seemed to confront head-on in 2024, a year marked by unprecedented technological momentum and intensifying debates about digital rights. The EDPB’s Annual Report for the year doesn’t merely catalog regulatory milestones—it tells the story of an institution not just keeping pace, but actively shaping the course of European privacy in a digitally saturated era.
From the outset, the EDPB approached 2024 with a sharpened vision. In April, it unveiled a strategy for 2024–2027, underpinned by four guiding pillars: harmonized compliance, robust enforcement, forward-looking technology governance, and strengthened international engagement. These weren’t just bureaucratic goals; they were a framework to ground Europe’s privacy safeguards amidst expanding AI capabilities, shifting legislative terrain, and the global intensification of data-centric business models. “We reaffirmed our commitment to safeguarding individuals’ fundamental rights to privacy and data protection in a fast-changing digital landscape,” said Chair Anu Talus, setting the tone for a year of assertive direction.
What followed was a marked evolution in the Board’s approach to regulatory clarity. Nowhere was this clearer than in its use of Article 64(2) GDPR. Traditionally used sparingly, the EDPB turned to this mechanism with growing frequency in 2024, issuing eight opinions that confronted some of the year’s most contested data practices. Among the most consequential was the Board’s stance on the increasingly controversial “Consent or Pay” model. These systems, common among large online platforms, presented users with a binary choice: either agree to behavioral data tracking or pay a fee to avoid it. The EDPB’s conclusion was pointed out—most implementations of these models, as they currently stand, do not meet GDPR’s standards for freely given consent. The implication was clear: monetizing consent can’t be a backdoor to compliance.
Other opinions dealt with similarly nuanced terrain, from the use of facial recognition at airports to the legal basis for AI model training. With each document, the EDPB positioned itself not just as a regulator but as an interpreter of evolving norms, offering guidance that balanced legal consistency with technical reality. Its opinion on AI model development emphasized that developers could, under certain conditions, rely on legitimate interest as a lawful basis—but only if they passed a rigorous three-step test evaluating necessity, proportionality, and fairness. This balance—supporting responsible innovation while reinforcing privacy safeguards—defined much of the EDPB’s approach to AI regulation.
The backdrop to these legal and ethical debates was a rapidly expanding digital legislative landscape. The EDPB didn’t operate in a vacuum. Instead, it integrated its efforts with new EU legislation such as the Digital Markets Act, the Digital Services Act, and most prominently, the AI Act. These new laws reflected a recognition across Europe that the GDPR was no longer enough on its own. But rather than compete with these frameworks, the EDPB worked to align them. It joined the High-Level Group for the DMA and collaborated closely with the EU AI Office, ensuring that cross-regulatory coherence wasn’t an aspiration but an operational reality.
This strategic coordination extended to the Board’s interactions with stakeholders. Throughout 2024, the EDPB expanded its public consultation footprint and held two major stakeholder events. The first explored Consent or Pay mechanisms, while the second delved into the challenges of AI model compliance under the GDPR. Both events fostered vibrant debates and demonstrated the Board’s commitment to transparency, not as a formality but as a fundamental component of legitimacy.
But strategy means little without accessibility. One of the less headline-grabbing, but arguably most impactful, elements of the 2024 Annual Report is the Board’s emphasis on communication. The EDPB made it a priority to translate its legal and technical guidance into clear, plain language. It expanded the reach of its Data Protection Guide for Small Business, making it available in 18 languages, and began producing easy-to-digest factsheets summarizing the essence of complex guidelines. This wasn’t just about optics—it was a reflection of a regulator trying to meet people where they are.
In parallel, the Board’s work supporting enforcement grew more targeted. While no binding decisions were issued for the first time since 2020, the year saw extensive cross-border enforcement coordination. National data protection authorities pursued headline-grabbing cases involving the misuse of sensitive biometric data, failures in platform transparency, and unlawful AI data training processes. Each case demonstrated the EDPB’s emphasis on harmonized enforcement and proactive oversight. Meanwhile, projects like the ChatGPT Taskforce showed the Board’s willingness to confront the complexities of large language models with both caution and conviction.
As the report draws to a close, the EDPB turns its attention forward. The digital world is expanding faster than laws can evolve, but the EDPB isn’t content with playing catch-up. It sees its role as a guide through this acceleration—a body that not only applies the rules but helps define their meaning in a world of ever-shifting contexts.
And that brings us back to where we began. In a world where technological innovation outpaces the very frameworks meant to govern it, what becomes of the right to privacy? For the EDPB, 2024 was a year of asserting that privacy isn’t a casualty of innovation—it’s the compass by which digital transformation must be navigated.
News Sources
- EDPB annual report 2024: protecting personal data in a changing landscape (European Data Protection Board)
- EDPB Annual Report 2024 – Full Report and Executive Summary (European Data Protection Board)
Assisted by GAI and LLM Technologies
Source: HaystackID published with permission from ComplexDiscovery OÜ
