Extract from the Commission's 2003 report on implementation of 1995 Direcitve on data protection

"Given (or despite) the ubiquitous character of personal data processing, it is hard to obtain accurate or complete information about its compliance with the law. The input which the Commission received in response to its call for contributions did not cast much new light on this issue. Anecdotal evidence, however, combined with various elements of "hard" information available to the Commission [footnote] suggests the presence of three inter-related phenomena:

- An under-resourced enforcement effort and supervisory authorities with a wide range of tasks, among which enforcement actions have a rather low priority;

- Very patchy compliance by data controllers, no doubt reluctant to undertake changes in their existing practices to comply with what may seem complex and burdensome rules, when the risks of getting caught seem low;

- An apparently low level of knowledge of their rights among data subjects, which may be at the root of the previous phenomenon.

The supervisory authorities themselves in many Member States are also concerned about this, in particular their lack of resources. Resource difficulties may affect independence. Independence in the taking of decisions is a sine qua non for the correct functioning of the system.

This aspect requires further investigation, but if these tendencies are confirmed, they are reasons for serious concern and reflections need to be undertaken between the Commission and the Member States and the supervisory authorities to determine their causes and design feasible solutions.

The fact that the three aspects are linked means that addressing one of them successfully can have positive spill-over on the others. More vigorous and effective enforcement will improve compliance with the legislation. Better compliance will result in data controllers providing more and better information to data subjects about the existence of the processing and their rights under the law, with a beneficial effect on the level of awareness about data protection among citizens in general.

Footnote: For example the relatively small number of individual complaints received by the Commission itself and the low number of authorisations by national authorities for transfers to third countries notified to the Commission in accordance with Article 26 (3)"