Report on International Data Protection Enforcement Cooperation

Report on international data protection enforcement cooperation b y Dr. Helena Kastlová Report on International data protection enforcement cooperation by Dr. Helena KASTLOVÁ 1 As part of the SPE programme, the EDPB may commission contractors to provide reports and tools on specific topics. The views expressed in the deliverables are those of their authors and they do not necessarily reflect the official position of the EDPB. The EDPB does not guarantee the accuracy of the information included in the deliverables. Neither the EDPB nor any per son acting on the EDPB’s behalf may be held responsible for any use that may be made of the information contained in the deliverables. Some excerpts may be redacted or removed from the deliverables as their publication would undermine the protection of legitimate interests, including, inter alia, the privacy and integrity of an individual regarding the protection of personal data in accor dance with Regulation (EU) 2018/1725 and/or the commercial interests of a natural or legal person. Document submitted in September 2025 2 (2) Joint Investigations Frameworks ................................ ................................ ........................... 38 (3) Dedicated International Cooperation Units, Resource Pooling and Capacity Building ........ 39 (4) Research and Analysis ................................ ................................ ................................ ........... 39 (5) Global Cooperation Fora Engagement ................................ ................................ ................... 39 (6) Integrating Cooperation Commitments into Adequacy Frameworks ................................ .... 39 C. Addressing Specific Cooperation Challenges Through Government - Level Interventions ........ 40 (1) Ensure Adequate Resourcing ................................ ................................ ................................ . 40 (2) Cross - Border Enforcement Mechanisms ................................ ................................ ............... 40 (3) Reciprocity and Dual Unlawfulness Solutions ................................ ................................ ...... 40 4 D. Guidance and Standard - Setting ................................ ................................ ................................ .. 40 (1) Comprehensive Enforcement Cooperation Guidance ................................ ............................ 40 (2) Model Agreements and Templates ................................ ................................ ........................ 41 (3) Toolkit of Legislative Actions ................................ ................................ ............................... 41 E. Strengthening Institutional Framework ................................ ................................ ...................... 41 ANNEX 1: ABBREVIATIONS ................................ ................................ ................................ ................ 43 ANNEX 2: QUESTIONNAIRE ................................ ................................ ................................ ................ 46 AUTHOR’S DISCLAIMER ................................ ................................ ................................ ..................... 53 5 INTRODUCTION AND SCOPE This Report examines the current state of international enforcement cooperation in the field of data protection, in particular with regard to cooperation between EEA data protection authorities (DPAs) and DPAs in countries with an EU adequacy decision, whi le also exploring how insights from other regulatory fields may inspire improvements to strengthen cross - border enforcement cooperation. The central question analyzed in this Report is the current state of international enforcement cooperation 1 in data protection, whether there is room for improvement, and to what extent useful lessons can be drawn from the related cooperation frameworks in consumer protection and competition law. To this end, the Report reviews both legally binding and “soft la w” instruments currently available to DPAs, evaluates their practical use, and identifies the challenges that hinder more robust forms of cross - border cooperation. The ultimate aim is to provide the EDPB, together with DPAs in countries with an EU adequacy decision, with a forward - looking set of recommendations for enhancing international enforcement cooperation in data protection. The findings presented in this Report are primarily based on desk research and analysis of Questionnaire 2 responses received from 18 DPAs across the EEA countries and countries with an EU adequacy decision. The Report proceeds as follows: the first section maps the existing legal instruments and practices available for enforcement cooperation among DPAs, analyzes the extent of such cooperation in practice, and identifies key challenges and limitations; the se cond section provides a comparative analysis of international enforcement cooperation frameworks in consumer protection and competition law, highlighting practices and instruments that could inform improvements in the data protection field; and the final s ection presents recommendations for fostering international enforcement cooperation. 1 Any further reference to “International” enforcement cooperation in this Report refers to cooperation between EEA DPAs and DPAs from countries with an EU adequacy decision , and/or cooperation among DPAs from countries with an EU adequacy decision . 2 Questionnaire on data protection enforcement cooperation tools and related challenges faced by DPAs, prepared in April 2025 by the EDPB, circulated to EEA DPAs and DPAs from countries with an EU adequacy decision , attached as Annex 3 to this Report. For the purposes of this Report, the term "Questionnaire" also includes the replies of DPAs from G7 countries to a questionnaire addressing similar topics provided to them as part of a parallel project of the G7 Data P rotection and Privacy Authorities’ Roundtable. 6 EXECUTIVE SUMMARY Unlike the structured daily enforcement cooperation among EEA DPAs under the GDPR, enforcement cooperation between authorities at the international level is rather limited and primarily consists of soft forms of cooperation, such as informal exchanges of b est practices, general information sharing, or participation in global fora. The analysis reveals that although a variety of legal instruments support s some forms of enforcement cooperation between DPAs, there is a substantial gap between the theoretical p ossibilities and their practical utilization, with most efforts concentrated among only a few countries. In addition, enhanced forms of cooperation — such as conducting joint investigations, providing investigative assistance, or enforcing DPA decisions abro ad — often lack adequate legal support or require additional mechanisms, sometimes beyond the direct control of DPAs. The findings of this Report confirm that DPAs face a number of legal and practical challenges : legal barriers to sharing confidential information and exercising investigatory powers on behalf of foreign DPAs, the existence of reciprocity requirements, the absence of mechanisms for enforcing DPA decisions in third countries, as well as resource and operational constraints. In addition, enforcement cooperation suffers from fragmentation into multiple overlapping multilateral fora with varying mandates, and so me initiatives appear to have limited enforcement value. Experience from consumer protection and competition law provides useful inspiration. In the consumer protection field , the International Consumer Protection and Enforcement Network (ICPEN) serves as the primary forum for multilateral enforcement cooperation, with participation from most regulators in EEA countries and countries with an EU adequacy decision. ICPEN’s econsumer.gov secure platform enables regulators worldwide to share consumer complaints and investigative information with the express consent o f the data contributors. This model demonstrates how technological solutions, supported by consent mechanisms and confidentiality safeguards, may help overcome some barriers to information exchange. Further, the OECD’s “Implementation toolkit on legislativ e actions for consumer enforcement cooperation” illustrates how international organizations can assist regulators in reducing legal barriers to cross - border collaboration. In the competition field , cooperation frameworks are even more mature and formalized. Bilateral “second - generation” intergovernmental agreements frequently include detailed provisions on investigative assistance, information exchange, and coordination of enforcement actions betwe en competition authorities. Competition authorities also benefit from a well - developed body of practical cooperation tools, such as templates and best practice guidelines, produced through the International Competition Network (ICN) . The widespread use of confidentiality waivers — particularly in merger investigations — demonstrates how voluntary mechanisms can effectively bypass legal obstacles to sharing confidential business information. Furthermore, the principles of negative comity (avoiding interference with other jurisdictions) and positive comity (actively assisting other jurisdictions) might help authorities to coordinate enforcement in a manner that avoids conflicts and allocates cases to the best - placed regulator. 7 These tools, while developed in a different regulatory context, could be adapted to the data protection field. To overcome the identified obstacles and close the gap between theoretical cooperation possibilities and their practical implementation, the Report recommends a combination of legal, technical, and operational measures, drawing insights from successful pra ctices in consumer and competition law while addressing the specific challenges DPAs are facing. From a legal standpoint, DPAs could make fuller use of existing frameworks and adopt less restrictive interpretations of relevant legal provisions, while governments could pursue comprehensive cooperation agreements possibly modeled on competition law practice. Model waivers adapted from competition practice could be developed to facilitate the cross - border sharing of certain confidential information across jurisdictions. At the government - level, mutual recognition agreements or enforcement assistance treaties should be negotiated to address the absence of mechanisms for enforcing DPA decisions abroad — one of the most frequently cited cooperation gaps. Governments should also allocate sufficient resources for dedicated personnel, technical expertise, and operational infrastructure to enable meaningful participation in international cooperation. Furthermore, DPAs could encourage the European Commission to integrate cooperation commitments into adequacy frameworks. From a technical and operational perspective, DPAs should prioritize creation of a secure information - sharing platform , possibly modeled on econsumer.gov . Such a platform should allow for complaint submissions with clear indication of access rights , confidential information sharing with case - specific agreements, routine notifications, and language support features. The DPAs would also benefit from standardized frameworks for joint investigations . At the institutional level, establishing dedicated cooperatio n units, developing resource - pooling initiatives, creating joint training programs, and addressing the current fragmentation across multiple global enforcement cooperation fora — for example, by coordinating activities to avoid duplication — could strengthen c ross - border collaboration. The EDPB could further support these efforts by developing comprehensive guidance on international enforcement cooperation, including interpretation of Article 50 GDPR and clarification of confidentiality and professional secrecy obligations. DPAs in countries with an EU adequacy decision could also issue guidance clarifying these term s under their own legal frameworks. In addition, the EDPB and DPAs from countries with an EU adequacy decision could develop standardized templates and a legislative “toolkit , ” modeled on OECD consumer protection initiatives, to provide governments and DPAs with practical instruments for enhancing cooperation. Implementing these recommendations requires a combination of leadership, concrete actions and operational reforms from DPAs, together with national governments’ engagement, but such measures are instrumental to maintaining the credibility and enforceability of data protection law in an increasingly interconnected global digital economy. 8 I. INTERNATIONAL ENFORCEMENT COOPERATION IN THE FIELD OF DATA PROTECTION E nforcement cooperation between EEA DPAs under the GDPR operates through a mandatory and sophisticated framework that constitutes the most advanced model of cross - border regulatory cooperation globally, enabling DPAs to function as a unified enforcement net work rather than merely cooperating agencies. This section of the Report shifts focus to examine the current state of international enforcement cooperation , understood here in particular as cooperation between EEA DPAs and DPAs in countries with an EU ade quacy decision, as well as cooperation among DPAs in such countries themselves. The findings presented in this section are primarily based on desk research and on the results and analysis of Questionnaire responses received from 18 DPAs. Where appropriate, an assessment is provided. Relevant recommendations for improvement are presented mainly in section III of th is Report. 1. Existing Legal Instruments Available for International Enforcement Cooperation among DPAs There is variety of legal instruments supporting enforcement cooperation between DPAs, with differences in their scope and legal value. The majority of DPAs reported that , based on these instruments , they can engage in “soft law” cooperation, such as sharing best practices, conducting joint enforcement awareness campaigns, or exchanging general information related to ongoing or past enforcement actions. Results in the survey show that more enhanced kinds of cooperation — such as conducting joint investigations, sharing internal documents or third - party materials related to ongoing enforcement actions, exchanging legal analyses , or providing investigative or enforcement assistance — are often not supported by the existing instruments, or additional legal mechanisms or arrangements (often beyond the control of the DPAs) are required, or additional steps must be taken to enable such cooperation . 3 3 E.g., French DPA can provide investigative assistance or share information in their possession with foreign DPAs only if a binding international agreement is concluded by the French Ministry for foreign affairs. In Germany , administrative assistance to a third - country authorities would be subject to international and intergovernmental agreements. Liechtenstein reported that for cooperation in the form of sharing specific information, internal documents, requesting assistance to collect evidence or analyze data to an ongoing investigation or requesting assistance for enforcing a decision, a formal legal cooperat ion mechanism through the Department of Justice must be in place . Swi ss DPA can engage in any formal cooperation only if reciprocity with regard to administrative assistance is guaranteed by the foreign DPA. Upon fulfillment of this condition , the Swiss DPA can render assistance , such as the direct service of documents abroad . Canadian DPA can only share information on conduct that is substantially similar to what would constitute a contravention under Canadian Personal Information Protection and Electronic Documents Act. The UK reported that for exchanging information on DPA’s legal analysis relating to identified possible infringements during an ongoing enforcement action , sharing internal documents and documents produced by third parties and relating to an ongoing enforcement action , requesting assistance to collect evidence or analy z e data relating to an ongoing enforcement action , informing about the legal findings of a past enforcement action, particularly if these are not publicly available , and for requesting assistance for enforcing a decision , they are require d to take additional steps, such as ensuring to possess lawful authority under national law to share confidential information . 9 A. Legally Binding Instruments (1) National Law Provisions The legal frameworks of all EEA countries and all surveyed countries with an EU adequacy decision contain provisions enabling international enforcement cooperation. Provisions of national laws (incl uding EU laws) were also most frequently mentioned as the legal basis for enforcement cooperation between DPAs. However, often, the national frameworks require additional written arrangements. Article 50 of the GDPR (and similarly worded Article 51 of the EUDPR , w hich applies to the EDPS) is directly applicable across all EEA countries and can thus serve as a general legal bases for international cooperation in all of those countries. Under this provision, DPAs “shall take appropriate steps to: […] provide international mutual ass istance in the enforcement of legislation for the protection of personal data, including through notification, complaint referral, investigative assistance and informati on exchange […].” 4 This provision clearly enables international enforcement cooperation. However, it is not clear whether it even mandates such cooperation without any additional framework. In practice, a majority of surveyed DPAs appear to interpret this provision narrowly 5 and often consider it necessary — or at least beneficial — to enter into another supplementary legal arrangement. The UK DPA cited Article 50 of the UK GDPR and another legal provision of the UK Data Protection Act implementing international enforcement coope ration obligations under Convention 108 as legal bases for cooperation. (2) Multilateral International Agreements - Convention 108 (and 108+) . 6 It is a binding international agreement on the ratifying states, but it is not self - executing, meaning its principles — including those on international cooperation — must be implemented through domestic legislation. As a result, the extent of possible cooper ation may depend on the individual status of implementation into national laws — that is unclear. All EEA countries are ratifiers of Convention 108, along with several countries with an EU adequacy decision such as Andorra, Argentina, Switzerland, the UK and Uruguay. Several Questionnaire respondents mentioned cooperation under Chapter IV of the Convention. However, the practical scope of such cooperation is difficult to assess, as the obligations in this Chapter are relatively general. For instance, under Ar ticle 13(1): “The Parties agree to render each other mutual assistance in order to implement this Convention.” Article 13(3) further requires designated authorities, upon request, to (a) provide information on national data protection laws and practices, and (b) take appropriate measures — subject to domestic law — for providing factual information about specific auto matic processing activities, excluding personal data. The modernized version — 4 GDPR, Art. 50 (1). 5 The majority of the EEA respondents reported that they are not aware of any provisions in their legal frameworks enabling/requiring international enforcement cooperation. 6 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, Council of Europe Treaty Series (ETS) No. 108, Council of Europe (January 28, 1981) (Convention 108), available at https://rm.coe.int/1680078b37 , and its “modernized” version - Convention 108+ (2018). The modernized Convention 108+ has been ratified by 33 states so far and it has not yet come into force — 38 ratifications from the 55 existing p arties of the original Convention 108 are required. 10 Convention 108+ — contains more detailed cooperation provisions, but it has not yet entered into force. - European Convention on the Service Abroad of Documents relating to Administrative Matters (1977) . 7 One DPA mentioned possible future cooperation based on this convention. It was ratified by only ten countries though, 8 Switzerland being the only one from the countries with an EU adequacy decision. Under this convention, contracting states may request other contracting states to serve documents related to administrative matters on individuals within their territory. Requ ests shall be submitted to the designated central authority of the requested state and are exempt from legalization, apostille, or other formalities. Service may be carried out by post, in accordance with the requested state’s domestic procedures, or by a specific method requested — unless that method conflicts with the law of the requested state. The requested state may refuse the request if, for example, the addressee cannot be located at the specified address and their whereabouts are not easily determined . - EU – U.S. DPF (“DPF”). 9 This legally binding mechanism contains commitments of the regulators for international enforcement cooperation. This regime applies to personal data transfers between the EU and the U.S. and it only regards U.S. organizations that self - certify into the pr ogram. It is administered by the U.S. Department of Commerce (DoC) and the compliance is enforced by the U.S. Federal T rade Commission ( FTC ) and the U.S. Department of Transportation (DoT), as applicable. Once an organization publicly commits to comply with the DPF principles, 10 that commitment becomes enforceable under U.S. law. Enforcement lies primarily with U.S. authorities under domestic rules and mechanisms. EU DPAs may refer suspected non - compliant organizations to the DoC or report false claims of participation. The DoC sh ould also assist DPAs with information regarding self - certification and implementation of DPF requirements. Periodic joint meetings are held between the DoC, the E uropean Commission , interested DPAs, and EDPB representatives. The FTC has committed to cooperation in three key areas: (1) referral prioritization and investigations; (2) seeking and monitoring orders; and (3) enforcement cooperation with EU DPAs. 11 While it lacks powers for on - site inspections in privacy matters, the FTC can compel the production of documents and testimony, and seek injunctions or penalties through the court 7 Available at https://rm.coe.int/1680077325 . 8 Austria, Belgium, Estonia, France, Germany, Italy, Liechtenstein, Luxembourg, Spain, Switzerland. 9 COMMISSION IMPLEMENTING DECISION pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU - U.S. Data Privacy Framework (10.7.2023), available at https://eur - lex.europa.eu/legal - content/EN/TXT/PDF/?uri=CELEX:32023D1795 . 10 S even key principles such as the notice principle, the purpose limitation or security principle, and several supplementary principles . 11 See Annex IV to the COMMISSION IMPLEMENTING DECISION pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU - U.S. Data Privacy Framework (10.7.2023). 11 system. 12 The FTC states that it “will also work closely with EU DPAs to provide enforcement assistance. In appropriate cases, this could include information sharing and investigative assistance pursuant to the U.S. SAFE WEB Act, which authorizes FTC assistance to foreign law enforcement agencies when the foreign agency is enforcing laws prohibiting practices that are substantially similar to those prohibited by laws the FTC enforces.” 13 Other conditions include reciprocity, public interest considerations, and the risk of harm to a significant number of persons. 14 (3) Bilateral International Agreements None of the surveyed DPAs reported existence of any such binding instruments. B. Soft Law Cooperation (1) Memoranda of Understanding The most frequently used “soft law” collaboration instruments, i.e. not creating legally binding obligations, are bilateral MoUs between DPAs. The MoUs have varied scope and specificity - they may provide high - level framework rules for cooperation or they can cover specific compliance issues. Although the national laws of most of the surveyed countries do not specifically require an MoU or other cooperation arrangement for the DPAs to cooperate or share information with a foreign authority, it appears that the DPAs still commonly regard the conclusion of MoUs necessary or beneficial. As to the frequency, some of the surveyed DPAs reported numerous or multiple MoUs in place, 15 while some other DPAs enter ed into only one MoU or none at all (despite the possibility envisaged in their laws). (2) Other Forms of Bilateral Cooperation The respondents mentioned other forms of non - binding bilateral cooperation instruments such as bilateral Declarations of cooperation (which appears to be in essence a high - level MoU for 12 See COMMISSION IMPLEMENTING DECISION pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU - U.S. Data Privacy Framework (10.7.2023), Sec. 2.3.4. 13 See Sec. IV of Annex IV to the COMMISSION IMPLEMENTING DECISION pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU - U.S. Data Privacy Framework (10.7.2023). 14 For details see 15 U.S.C. § 46(j)(3). 15 E.g., Canada (see at https://www.priv.gc.ca/en/about - the - opc/what - we - do/memorandums - of - understanding/ ), the UK ( https://ico.org.uk/about - the - ico/our - information/working - with - other - bodies/ ), the U.S. (see at https://www.ftc.gov/policy/international/international - cooperation - agreements ), Germany (see, e.g. at https://www.bfdi.bund.de/SharedDocs/Downloads/DE/AnlagenPM/20240610_Memorandum - of - Understanding.pdf?_blob=publicationFile&v=2 ), Guernsey (see at https://www.odpa.gg/about/international - cooperation/ ), Netherlands (see at https://www.autoriteitpersoonsgegevens.nl/en/documents?topic%5B0%5D=91 ), New Zealand (see at https://ico.org.uk/media2/about - the - ico/mou/2619766/ico - opc - mou.pdf and https://www.privacy.org.nz/assets/New - order/About - us/Transparency - and - accountability - /2023 - 08 - 18 - FINAL - Information - Sharing - MOU - Between - the - OPC - and - the - OAIC - Signed - by - Liz - and - Libby - A889432.pdf ) etc. 12 sharing best practices and general information regarding legal doctrine), 16 collaboration plans and terms of reference (for joint investigations; case - specific, more detailed), 17 and a “ privatim ” network, a platform dedicated to data privacy exchanges of information and assistance. 18 (3) Global Cooperation Fora (a) Global Privacy Assembly (GPA) GPA 19 is an international forum of DPAs from around the world that provides a platform to collaborate, share best practices, and promote strong privacy standards globally. 20 GPA’s Global Cross Border Enforcement Cooperation Arrangement 21 and International Enforcement Cooperation Working Group ( IEWG ) are focused specifically on facilitating enforcement cooperation. Several respondents mentioned sharing high - level general information and writing joint open letters through the GPA’s IEWG. (b) Global Privacy Enforcement Network (GPEN) GPEN 22 is an informal network of DPAs focused on privacy law enforcement cooperation. The main tasks are exchange of general information, sharing best practices in addressing cross - border challenges and supporting joint enforcement initiatives and awareness campaigns. The activities include workshops, videoconferences, research projects , or the maintenance of a contact point directory for enforcement purposes. There is a GPEN restricted - access website that enables participating authorities to share information, materials, and documents. However, non - public documents, and materials associated with specific bilateral cross - border investigations or enforcement matters, are generally not intended be shared through this website. 23 GPEN also coordinates Global Privacy Sweeps of industry practice and compliance on specific privacy issues. Participation in these annual sweeps (e.g. on deceptive design patterns and on children’s privacy) was mentioned by several DPAs in the Questionnaire. 16 E.g., French DPA with Korean DPA, see at https://www.cnil.fr/en/declaration - cooperation - between - south - korean - data - protection - authority - pipc - and - french - data , and French DPA with California’s CCPA, see at https://www.cnil.fr/en/cppa - announces - cooperation - french - data - protection - authority - cnil . 17 The UK uses them in addition to the more general bilateral MoUs. 18 Switzerland and Liechtenstein cooperate through this platform. 19 https://globalprivacyassembly.org/ . GPA has over 130 accredited members in 2025. 20 For example, the Enforcement Cooperation Handbook provides practical guidance to DPAs on how to effectively engage in international cooperation on enforcement matters , available at https://globalprivacyassembly.com/wp - content/uploads/2022/11/Enforcement - Cooperation - Handbook - EN - Final.pdf . 21 Participants in the Global Cross Border Enforcement Cooperation Arrangement (2017) from the EEA DPAs and DPAs from countries with an EU adequacy decision: Estonia, Germany, Hungary, Ireland, Malta, Netherlands, Norway, Canada, Isle of Man, Jersey, UK. 22 Members from the EEA DPAs and DPAs from countries with an EU adequacy decision in 2025: Belgium, Bulgaria, Czech Republic, EDPS, Estonia, France, Germany, Hungary, Ireland, Italy, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Slovenia, Spain, Argentina, Canada, Guernsey, Isle of Man, Israel, Japan, Jersey, Korea, New Zealand, Switzerland, UK, the U.S. https://www.privacyenforcement.net/content/home - public . 23 https://www.privacyenforcement.net/content/action - plan - global - privacy - enforcement - network - gpen . 13 (c) Global Cooperation Arrangement for Privacy Enforcement (Global CAPE) The Global CAPE 24 is a multilateral cooperation mechanism developed under the auspices of the Global CBPR Forum, but it is open to DPAs worldwide — participation is not limited to Global CBPR Forum members. It is a framework that functions as an MoU under which DPAs may (on voluntary basis) share information and request and render assistance (through the Requests for Assistance not expressly limited to violations that are prohibited in both countries), conduct joint investigations, or engage in staff exchanges. (d) G7 Enforcement Cooperation Working Group (ECWG) The ECWG serves as a platform for G7 DPAs to exchange enforcement practices, priorities, and experiences. (4) Ad - hoc cooperation - Informal information exchanges are taking place without any formal instruments. - Ad hoc information sharing agreements – where necessary for compliance with legislative requirements of some jurisdictions. 2. Nature and Extent of Enforcement Cooperation with Other DPAs in Practice Unlike the structured and frequent cooperation that takes place daily among EEA DPAs under the GDPR, international enforcement cooperation remains limited. In summary, the enforcement cooperation between the DPAs appears to be rather infrequent and mostly consists of soft forms of cooperation, such as informal exchanges of best practices and general information on trends and past enforcement actions, or participation in conferences and workshops within global cooperation networks. Among the jurisdictions surveyed, the UK 25 and Canada stood out for their active participation in both multilateral and bilateral enforcement cooperation. They have a number of MoUs with other DPAs, participate in several international fora and have experience in conducting joint investigations, f or instance in relation to personal data breaches. 26 In contrast, half of the 24 Members from the DPAs from countries with an EU adequacy decision in 2025 : Canada, Japan, Korea, UK and the U.S. See at https://www.globalcbpr.org/privacy - enforcement/ . 25 The UK DPA noted that the cooperation led to several successful outcomes including the withdrawal of privacy - invasive products from the market, improved privacy protections for individuals and greater regulatory certainty for businesses. 26 E.g., Joint investigation between the UK and Canadian DPAs into 23andMe (2024 - 25) . The joint investigation was conducted in accordance with the national data privacy laws, under the bilateral MoU and case - specific ToR. The DPAs worked together on the evidence - gathering stage of the investigation, issued a preliminary report and wrote a joint letter to the trustees in the company’s bankruptcy proceedings. Both regulators praised leveraging the combined resources and expertise. 14 respondents reported either no instances or only one instance of formal enforcement cooperation with a third - country DPA in the past five years. Several surveyed DPAs mentioned engagement in some specific form of soft law cooperation, such as sharing legal analysis regarding an ongoing investigation with other DPAs that were conducting similar investigation, 27 participating in GPEN’s global privacy sweeps 28 or cooperating within GPA’s IEWG through capacity building, sharing information about ongoing investigations and writing joint letters. 29 Assessment The findings in this section highlight a notable discrepancy between the legal possibilities for international cooperation and the extent to which these legal bases are actually used in practice. Some respondents — particularly those from smaller countries — face operational constraints, while others are limited by legal barriers , especially as regards more enhanced form s of cooperation . In several cases, the surveyed DPAs appear not to fully utilize the potential offered by their national legal frameworks. Add itionally, the need for international enforcement cooperation may vary, with some DPAs experiencing a greater demand than others. 3. Key Challenges and Limitations to Effective International Enforcement Cooperation This section of the Report summarizes the challenges identified by the surveyed DPAs. The types of challenges are listed below in order of how frequently they were mentioned in the responses. (1) Legal barriers - especially relating to confidential information sharing, sharing of personal data or materials, limitations to use of investigatory powers on behalf of DPAs from other countries, enforcement of DPAs’ decisions in third countries etc. Many surveyed DPAs indicated that implementation of clear and more flexible legal provisions allowing for more enhanced cooperation is needed. The absence of a legal mechanism to enforce DPAs’ decisions against controllers based in third countries was repeatedly cited by the respondents as a significant gap. 30 (2) Resources - a lack of human and material resources. 31 27 Reported by EDPS . EDPS also indicated soft law cooperation with Canada, Korea, Israel, Japan, Uganda and G7 countries based on Art. 51 of the EUDPR . 28 Reported by Guernsey, Italy, Canada, the UK. 29 Reported e.g. by Canada and Norway; however, IEWG has over 35 members, many of which are either EEA DPAs or DPAs from countries with an EU adequacy decision. 30 About one third of the surveyed DPAs (almost all of the E EA DPAs) reported that they would benefit from assistance in enforcing a decision on controllers not established within their jurisdiction (incl uding notifying of the decision). 31 This constraint was specifically mentioned by five respondents. 15 (3) Reciprocity and “ dual unlawfulness ” . Ensuring reciprocity in the possibility of rendering mutual assistance is a key challenge for some DPAs, while some others can only provide assistance if the investigated conduct is substantially similar to what would constitute a contravention under thei r respective laws. 32 (4) Structural and operational issues - absence of a dedicated operational structure, especially at the smaller countries DPAs. 33 4. Specific Forms of Cooperation and Their Legal and Other Limitations A. Sharing of Personal Data None of the EEA respondents reported any specific legal restrictions — beyond those set out in the GDPR — on sharing of personal data with DPAs outside the EEA. Among the countries with an EU adequacy decision, a few countries have no restrictive provisions in their laws, some countries referred to general duties of confidentiality and several countries reported common requirements, such as: purpose limitation, contribution to the fulfillment of DPAs’ duties, confidentiality, and, in some cases, reciprocity, dual unlawfulness, or the existence of a written arrangement. 34 One DPA indicated that it is prohibited from sharing any documents or materials submitted or collected during investigations with third parties. 35 Although it appears that, in most cases, there are no significant barriers to the purposeful sharing of personal data with foreign DPAs — provided that all relevant safeguards and legal conditions are complied with — none of the surveyed DPAs , with one except ion — reported that they would, in practice, share personal data . Notably, the UK DPA does not consider sharing personal data contained in complaints to be necessary. On the other hand, several respondents 36 listed sharing of complaints, including personal data, as beneficial. 32 Switzerland can only cooperate if reciprocity is guaranteed . The FTC can provide assistance only if the investigated practices are substantially similar to practices prohibited by laws administered by the FTC . Similarly, Canadian DPA can only share information on conduct that is substantially similar to what would constitute a contravention under Canadian data protection law. 33 For example, one country reported that it has only one inspector, no international affairs department . That country also reported that administrative procedures and institutional oversight mechanism (external fiscal control of expenditures ) further restrict its operational flexibility. 34 For example, Japan and Canada impose restrictions for information sharing in general. In Canada, it is purpose limitation, confidentiality , necessity, relevancy to an ongoing or potential investigation, dual unlawfulness of the investigated conduct , and a written arrangement must be in place . In Japan, strict purpose limitations apply, as well as requirements related to contributing to the fulfillment of foreign DPAs’ duties, along with additional limitations for use in criminal investigations and adjudications. The FTC reported that only their encrypted equipment may be used to store and maintain personally identifiable information or other non - public information, and transmitting such data to a foreign partner requires certain technical and other safeguards. 35 The Korean DPA. 36 Andorra, Argentina, EDPS, Liechtenstein. 16 B. Sharing of Confidential Information In summary, al though some legal frameworks are more restrictive, there are generally no significant barriers to the sharing of confidential information among almost all of the surveyed DPAs under the following circumstances: sharing contributes to the fulfilment of DPAs’ functions, there is a written agreement clearly outlining the type of information to be shared , its permitted uses, purpose limitation, necessity, and confidentiality. A few countries also require reciprocity — either in terms of the type of conduct being investigated or the mutual provision of assistance. The EEA respondents mostly reported no barriers to sharing confidential information , aside from professional secrecy obligations set out in the GDPR (Art. 54(2)) and in some of the national laws as well. Similar to sharing of personal data, a few countries with an EU adequacy decision have no legal barriers to sharing confidential information. Some surveyed DPAs referred only to general confidentiality obligations, while others reported specific legal requirements such as: purpose limitation, necessity, contribution to the fulfillment of DPAs’ duties, confidentiality, and, in some cases, reciprocity. In Canada, Japan, and Korea, the same general restrictions on information sharing apply as outlined in Section I.4.A. above . The sharing of information regarding ongoing investigations was the most frequently cited beneficial form of international cooperation among the surveyed DPAs. Some DPAs specifically mentioned the sharing of confidential information, while others emphasize d the benefits of notifications regarding the commencement of investigations, the sharing of investigatory findings and evidence, case facts, timelines, progress reports, and anticipated measures. Assessment: There appear to be two major issues related to the sharing of confidential information: 1) Defining the scope of what constitutes “confidential information” — there is no uniform definition across jurisdictions — not even within the GDPR — and in many cases, national laws also lack a clear definition. As a result, DPAs must often rely on their own interpretation of “confidential information.” In practice, the survey shows that some DPAs adopt a broad approach, treating virtually all information that comes to their attention as confidential, even when such classification is not explicitly required by their national legislation. 2) The duty of professional secrecy , frequently mentioned by the EEA respondents as a barrier to sharing of confidential information, should not be the impediment to sharing information with other DPAs for enforcement purposes if the proper safeguards are put in place. The GDPR contains provisions addressing both professional secrecy and international cooperatio n; therefore, any contrary interpretation would effectively preclude international cooperation, which is clearly not the intent of the legislator. It is recommended that DPAs adopt less restrictive interpret ations of the applicable laws — while still remaining compliant — to allow for sharing more information. For instance, it could be useful to provide guidance with regard to the specifics of the confidential information (trade 17 secrets, personal information, national security, information clearly considered confidential under national laws etc.) and to develop a template “agreement on sharing of confidential information” between the DPAs. C. Investigative Assistance The majority of the surveyed DPAs can theoretically use their investigatory powers on behalf of foreign DPAs, 37 although mostly with certain legal limitations. However , none of the surveyed DPAs have ever utilized th ese powers on behalf of another DPA in practice. 38 Several EEA respondents indicated that they could provide assistance to the DPAs outside of the EEA only if some additional legal authorization is in place; 39 a few EEA DPAs reported not having had the opportunity to examine this issue. As previously noted (Section I.1.A.(1) above), Article 50 of the GDPR enables EEA DPAs to provide international mutual assistance to DPAs outside the EEA, including investigative assistance. Rendering of such assistance is subject to appropriate safeguards for the protection of personal data a nd other fundamental rights and freedoms, and necessarily depends on available resources and the specific circumstances of each case. Article 50 is directly applicable, and nothing in its wording suggests that addition al authorization in national laws is required. Nonetheless, entering into more detailed arrangements at the DPA level is certainly practical. About one half of the surveyed DPAs from countries with an EU adequacy decision indicated that they cannot use their investigatory powers on behalf of foreign DPA s . The UK DPA reported that they are able to provide investigative assistance within confines of Article 50 UK GDPR, but that they would always consider circumstances of the request. Canadian DPA can offer formal assistance if a written agreement with foreign DPA is put in place, but they noted that in practice, using investigatory powers on behalf of a requesting DPA is generally limited to instances of joint investigations. Switzerland is able to provide assistance , provided that reciprocity is ensured . Guernsey DPA is even specifically required by national law to take steps to provide such assistance. The FTC can provide investigative assistance as long as the investigated practices are substantially similar to the practices prohibited by U.S. laws administered by the FTC , and if certain criteria are met: reciprocity, no prejudice the U.S. public interest and a potential of injury to a significant number of persons. 40 37 Reported by EDPS, France, Germany, Italy, Netherlands, Canada, Guernsey, Switzerland, the UK and the U.S. In addition, note that Article 50 of the GDPR provides a general authorization for all EEA DPAs to provide such assistance. 38 To avoid confusion, it should be remined that these findings do not include intra - EEA cooperation carried out under the GDPR. 39 E.g., I nternational intergovernmental agreement in the case of French and German DPAs and formal legal cooperation request through the Dep artment of Justice in the case of Liechtenstein. Netherlands needs a separate agreement, but it is not clear whether it needs to be an intergovernmental agreement. 40 15 U.S. Code § 46(j) 1 - 3. 18 Assessment There is a significant disconnect between the legal capabilities of the DPAs and utilization of their investigatory powers on behalf of the foreign DPAs in practice . The reasons generally likely fall into one or more of the following categories: 1) certain DPAs appear to underutilize the capacities afforded by their national legal frameworks ; 2) legal barriers out of the DPAs’ hands; 3) operational and resource constraints; and 4) some DPAs may have a greater need for international investigative assistance than others . Nonetheless, more than half of the respondents considered some type of investigative assistance beneficial — such as the collection of evidence, service of documents, or facilitating contact. D. Cross - regulatory Cooperation Intra - state cross - regulatory cooperation is generally well - supported by national legal frameworks. This cooperation is mostly based on national laws or MoUs and typically involves information sharing, as well as the exchange of best practices and opinions. The majority of the surveyed DPAs collaborate with regulators from other sectors within their respective countries , such as competition, consumer protection, telecommunications and finance. 41 For example, the French DPA has concluded an enforcement cooperation Convention with the French communications regulator and the Directorate General for Competition Policy, Consumer Affairs and Fraud Control to implement the Digital Services Act (for information sharing and processing of complaints). New Zealand DPA conducts joint inquiries with other regulators and develops joint submissions and guidance materials. The Canadian DPA is a member of the Canadian Digital Regulators Forum, alongside competitio n, telecommunications, and copyright regulators. The regulators cooperate based on ToR, in practice mostly by coordinating their policies. Domestically, the UK DPA cooperates with other regulators through multilateral platforms such as the Digital Regulati on Cooperation Forum and the UK Regulators’ Network and through numerous bilateral MoUs. These regulators share information and develop guidance, regulations and joint statements. A few DPAs also engage in cooperation with digital regulators in other countries based on MoUs, such as Canada and the UK. EDPS recently proposed establishment of Digital Clearinghouse 2.0 that would provide the EU regulators in the digital economy with a forum to exchange information, experiences and coordinate on issues of common interest. 42 It should succeed the past initiative — Digital Clearinghouse 1.0 (2017 - 20) — that involved exchange of information and best practices between DPAs and consumer and competition regulators. 41 Only four DPAs reported that they do not cooperate with other regulators. 42 See at https://www.edps.europa.eu/data - protection/our - work/publications/other - documents/2025 - 01 - 15 - towards - digital - clearinghouse - 20_en . 19 II. INTERNATIONAL ENFORCMENT COOPERATION IN OTHER REGULATORY FIELDS II.1 CONSUMER PROTECTION 1. Existing Legal Instruments Available for International Enforcement Cooperation among Consumer Protection Regulators International cooperation among consumer protection authorities ( CPAs ) is becoming increasingly vital in the field of consumer law due to the growing impact of globalization and digitalization of the economy. Online commerce exposes a great number of consumers to fraud and scams and the enforcement authorities are exploring ways to work together to protect consumers from unfair commercial practices. Same as in the data protection field, there are various platforms, initiatives and legal arrangements in place, however, the extent to which participation in such arrangements res ults in actual enforcement cooperation cases is rather un clear. Also, many of these efforts seem to have occurred only among a few countries and not to have been widespread. 43 This section of the Report focuses primarily on cooperation mechanisms involving the enforcement authorities of EEA countries and countries with an EU adequacy decision, or some of them. It does not address regional mechanisms, intra - EU cooperation instrum ents, or potential enforcement cooperation mechanisms that may be included in free trade agreements. The scope is limited to cooperation between enforcement authorities and does not extend to other forms of cooperation, such as those involving consumer org anizations. A. Global Cooperation Fora There is to date no binding multilateral international instrument for cross - border enforcement cooperation. The international system thus relies on soft law and goodwill of the enforcers to cooperate and assist each other. At the multilateral level, there are three main platforms: The International Consumer Protection and Enforcement Network (ICPEN) , the Organization for Economic Cooperation and Development (OECD) and the United Nations Trade and Development (UNCTAD) . (1) International Consumer Protection and Enforcement Network ICPEN 44 is a global network of CPAs that serves as a platform for fostering and maintaining regular contact among its members, primarily to facilitate cross - border enforcement 43 See OECD (2018), “Consumer protection enforcement in a global digital marketplace”, OECD Digital Economy Papers, No. 266, OECD Publishing, Paris, https://doi.org/10.1787/f041eead - en . 44 See at https://icpen.org/ . Over 70 countries currently participate in ICPEN, including all EU countries, Norway and 9 countries with an EU adequacy decision (Argentina, Canada, Israel, Japan, Korea, New Zealand, Switzerland, UK, the U.S.). 20 cooperation. 45 Any type of cooperation is on informal and voluntary basis, subject to national laws and practice and availability of resources. ICPEN’s mandate is to facilitate information sharing on cross - border commercial activities affecting consumer interests and to encourage international cooperation among CPAs. 46 Its core strategies include coordinating enforcement actions, sharing intelligence on consumer protection trends and risks, and exchanging best practices. 47 The Strategy Plan also outlines more specific cooperation forms, such as identifying and focusing on priority issues or thematic areas, joint or coordinated actions on problematic traders, 48 regular risk reporting, 49 and other soft law cooperation tools. 50 ICPEN Initiatives: • Econsumer.gov Econsumer.gov 51 began in 2001 as ICPEN’s initiative to gather and share cross - border e - commerce complaints. 52 The project has two components: 1 ) A public website that allows consumers to make cross - border fraud complaints; and 2 ) A secure econsumer.gov website that allows regulators around the world to share and access consumer complaint data and other investigative information. The secure website is hosted through the Consumer Sentinel Network platform by the U.S. FTC. The data that are shared between the agencies consist of data entered directly by the consumers in their complaints through the econsumer.gov website (incl uding personal data) or provided by data contributors who indicate their intention to make such data available to agencies participating in the econsumer.gov project. Every agency must sign a confidentiality agreement and use the information only in connection with law enforcement purposes. 53 45 See Memorandum on the Establishment and Operation of International Consumer Protection and Enforcement Network, at https://icpen.org/sites/default/files/2017 - 08/Memorandum_on_the_Establishment_and_Operation_of_ICPEN_2016.pdf . 46 From a technological standpoint, members can communicate and exchange intelligence and other information via a secure intranet portal designated for members only . 47 ICPEN Strategy Plan 2021 - 2024 available at https://icpen.org/sites/default/files/2021 - 08/2021 - 2024%20ICPEN%20Strategy%20Plan%20FINAL.pdf . 48 Undertaking project - based work where CPAs either work on the same issue/sector within their jurisdiction or on the same case at the same time or coordinate their actions against traders whose conduct causes significant harm to consumers; cooperating and de veloping common projects with other intergovernmental organizations. 49 Members report current consumer protection risks/matters, incl uding identification of matters that require a cross - border enforcement or regulatory response, on a regular basis and through the annual intelligence report. 50 E.g., conferences, webinars, best practices training events, production of best practice materials (e.g. reports, guidelines, survey results) on key consumer protection enforcement and compliance methodologies, approaches or laws. 51 See https://econsumer.gov/?lang=en - US . 52 Memorandum of Understanding from 2001, available at https://www.ftc.gov/legal - library/browse/cooperation - agreements/memorandum - understanding - econsumergov - pilot - project . 53 A Model Consumer Sentinel Network Confidentiality Agreement is annexed to the Memorandum of Understanding from 2001, available at https://www.ftc.gov/legal - library/browse/cooperation - agreements/memorandum - understanding - econsumergov - pilot - project . 21 • International Internet Sweep Day The International Internet Sweep Day is an enforcement initiative targeting fraudulent and deceptive online practices; it is a day dedicated to intensive searching by the agencies to provide a list of suspicious sites for later enforcement action. • Fraud Prevention Month The Fraud Prevention Month initiative is a series of education campaigns run every year by ICPEN members under a common theme but focusing on an issue relevant to each individual participating agency. The campaigns may target particular audiences and they may partner with non - government or private sector organizations. • Joint Open Letters to Industry and Industry Guidance Occasionally, ICPEN members write open letters to specific sectors of industry to highlight the importance of complying with consumer protection law. The letters emphasize the same basic principles that apply to businesses across different countries, despi te the differences in national laws. ICPEN may also develop industry guidance materials reflecting the basic common principles of fair - trading practices in ICPEN member countries. (2) Organization for Economic Cooperation and Development The OECD’s 54 Committee on Consumer Policy (CCP) addresses different matters in the field of consumer law and policy and has a longstanding focus on improving cross - border enforcement cooperation. The CCP carries out research and analysis, exchanges of information on trends and emerging issues and most importantly develops influential policy guidelines and recommendations. 55 - Consumer Protection Enforcement in a Global Digital Marketplace - OECD Policy Paper (2018) 54 The OECD is an international organization that works to improving public policies, establishing evidence - based international best practices and finding solutions to a range of social, economic and environmental issues by providing a forum and knowledge hub for data and analysis, exchange of experiences, best practice sh aring, and advice on public policies and international standard setting. There are currently 38 OECD member countries: Australia, Austria, Belgium, Canada, Chile, Colombia, Costa Rica, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Israel, Italy, Japan, Korea, Latvia, Lithuania, Luxembourg, Mexico, the Netherlands, New Zealand, Norway, Poland, Portugal, the Slovak Republic, Slovenia, Spain, Sweden, Switzerland, Turkey, the U K and the U .S . 55 OECD, Recommendation of the Council concerning Guidelines for Protecting Consumers from Fraudulent and Deceptive Commercial Practices across Borders, OECD/LEGAL/0317 , available at https://legalinstruments.oecd.org/en/instruments/OECD - LEGAL - 0317 ; O ECD, Recommendation of the Council on Consumer Protection in E - commerce, OECD/LEGAL/0422 , available at https://legalinstruments.oecd.org/en/instruments/OECD - LEGAL - 0422 ; OECD Policy Guidance on Consumer Dispute Resolution and Redress , available at https://legalinstruments.oecd.org/public/doc/185/185.en.pdf ; OECD Recommendation on Cross - Border Co - Operation in the Enforcement of Laws against Spam, available at https://legalinstruments.oecd.org/en/instruments/OECD - LEGAL - 0344 . 22 This report 56 (hereinafter the “OECD Report”) examines, among other issues, the ability of CPAs to co - operate across borders and identifies key factors that hinder efforts to enhance international cooperation in the field of consumer protection. 57 It is based on questionnaire responses from 31 countries, supplemented by additional research. - Implementation Toolkit on Legislative Actions for Consumer Enforcement Co - operation (2021) Building on the OECD Report and the previous OECD recommendations and guidelines, the CCP in partnership with ICPEN developed this Toolkit 58 directed at helping countries reduce the legal barriers to cross - border enforcement cooperation and supporting the implementation of the principles on cross - border enforcement cooperation contained in the OECD recommendations. - OECD’s Global Recalls Portal Another OECD’s useful cooperation initiative is the Global Recalls Portal 59 which, among others, provides the possibility for governments to share information about product recalls. (3) United Nations Trade and Development The Intergovernmental Group of Experts on Consumer Protection Law and Policy is a standing body established under the United Nations Guidelines for Consumer Protection 60 to monitor the application and implementation of the guidelines, provide a forum for consultations, produce research and studies, provide technical assistance and undertake voluntary peer reviews. The guidelines set out key principles for effective consum er protection laws, enforcement, and redress systems , inc luding principles of international enforcement cooperation. They ask the member states to improve their ability to cooperate, but recognize that cooperation remains in discretion of the consumer law enforcement agencies. UNCTAD also co - organized a Conference on Cross - border Enforcement of Consumer Law in 2022, where, among others, the challenges of cross - border enforcement were discussed. The main challenges mentioned were: the lack of investigative powers to address cross - border situations, insufficient resources and the difficulty to share confidential evidence across countries. UNCTAD has a working group devoted to consumer protection in electronic commerce that has a subgroup on cross - border enforcement cooperation. It holds regular meetings and workshops and facilitates exchange of information and best practices. 56 OECD (2018), “Consumer protection enforcement in a global digital marketplace”, OECD Digital Economy Papers, No. 266, OECD Publishing, Paris, https://doi.org/10.1787/f041eead - en . 57 See infra section II 1. 2.B. of this Report. 58 OECD (2021), “Implementation toolkit on legislative actions for consumer protection enforcement co - operation”, OECD Digital Economy Papers, No. 310, OECD Publishing, Paris, available at https://www.oecd.org/en/publications/implementation - toolkit - on - legislative - actions - for - consumer - protection - enforcement - co - operation_eddcdc57 - en.html . 59 See at https://globalrecalls.oecd.org/#/ . The portal has been developed in the ambit of the OECD’s Working Party on Consumer Product Safety. 60 Available at https://unctad.org/system/files/official - document/ditccplpmisc2016d1_en.pdf . 23 There are two very relevant pieces of research in the area of cross - border enforcement: Research Paper No. 54 on International Cooperation in Consumer Protection (2020) 61 and Report to UNCTAD on cross - border enforcement cooperation. 62 Th is report investigates among others the reasons behind the difficulties in cross - border enforcement and advocates for the technological approach to consumer law enforcement and pursuit of international standards. B. EU - level International Cooperation The EEA CPAs collaborate within the formal enforcement framework — the Consumer Protection Cooperation Network (established under EU Regulation (EU) 2017/2394). It empowers authorities to exchange information, carry out joint investigations, request enforcement actions from each other, and undertake coordinated market swe eps and alerts. This is, however, a regional platform and there is no formal cooperation with other countries. At the EU - level, the only existing cooperation instruments with third countries are the Informal Dialogues between the E C and the U.S. consumer protection authorities, which primarily aim to improve policy and regulatory cooperation through the exchange of experiences and insights on consumer - related issues. 63 C. Bilateral Cooperation (1) Memoranda of Understanding As in the field of data protection, bilateral enforcement cooperation in consumer protection is primarily based on MoUs. However, such agreements appear to be even less common than in the data protection domain and are limited to a small number of countries . 64 For example, the U.S. FTC has MoUs (general or in limited contexts) in place with 15 countries (from the EEA countries and countries with an EU adequacy decision only with the UK, Ireland, and , in limited contexts , with Spain and some Canadian provinces). Canada has MoUs or similar arrangements in consumer protection area with Singapore, Korea, New Zealand and Australia. New Zealand has MoUs with Australia, Canada and UK. 61 UNCTAD research Paper No. 54 , International Cooperation in Consumer Protection (December 2020) , available at https://unctad.org/system/files/official - document/ser - rp - 2020d13_en.pdf . 62 Cross - border enforcement of consumer law: Looking to the future, Christine Riefa, July 19, 2022, available at https://unctad.org/system/files/information - document/ccpb_WG_e - commerce_cross - Border_Riefa_en.pdf . 63 Informal Dialogue between the EC and the U.S. Consumer Financial Protection Bureau (CFPB) on Financial Consumer Protection - Joint Statement of 11 April 2024 available at https://commission.europa.eu/document/download/ca04ea43 - 303f - 471e - 84ba - ea0b3b7f6b45_en?filename=CFPB%20EC%20Joint%20Statement%204.11.24.pdf ; Informal Dialogue between the EC and the U.S. FTC on Consumer Protection - Joint press statement from 30 March 2022 available at https://commission.europa.eu/document/download/cd27b361 - 8ae3 - 4e02 - b9a6 - 7be7542df55a_en?filename=joint_ftc - ec_statement_informal_dialogue_consumer_protection_issues.pdf . 64 The research was conducted primarily through a review of the websites of CPAs in countries with an EU adequacy decision (where available in English). The OECD Report does not provide any exact number of MoUs in place, or even any good indication — and the same applies to other available secondary sources. 24 Example: The U.S. – the UK MoU (2019) 65 This MoU provides for voluntary, reciprocal, and confidential cooperation in the consumer protection area focusing on serious cross - border violations. It is a “best efforts” agreement, not legally binding and does not change existing law in either country. The mutual assistance is principally limited to investigations of violations that are substantially similar in both jurisdictions (i.e. practices prohibited in both countries). The enforcement cooperation tools under the MoU include: (a) information sharing (sharing complaints and investigation - relevant information, incl uding personally identifiable information where legally permitted; testimony, documents, metadata, recordings, and other materials as part of ongoing or anticipated investigations); (b) investigative assistance in the form of obtaining evidence (testimonies, do cuments, locating individuals, assets or items) and assisting in service of process; (c) coordinated enforcement actions in appropriate cross - border cases; (d) coordinate enforcement against priority violations causing substantial harm or affecting many co nsumers (joint law enforcement investigations). 66 Shared information should be only used for law enforcement purposes, protected through encryption, limited access, redactions, and secure handling and may be disclosed to others only with prior consent. (2) National Legal Frameworks Enabling Enforcement Cooperation: The Example of the United Kingdom The UK recently enacted the Digital Markets, Competition and Consumers (DMCC) Act 67 - a comprehensive legislation that aims to regulate digital markets, strengthen competition law, and enhance consumer protection. DMCC also addresses provision of investigate assistance to overseas authorities and information sharing. Consequently, the UK competition regulator (the Competition and Markets Authority) and the consumer protection regulator (the Department for Business and Trade) agreed on MoU on international cooperation on competition and consumer law enforcement that establishes a framework for international cooperation in competition and consumer law enforcement. 68 The MoU covers (a) the disclosure of relevant information for use 65 Memorandum of Understanding b etween the Federal Trade Commission of the United States of America and the Competition and Markets Authority of the United Kingdom , available at https://www.ftc.gov/system/files/documents/cooperation_agreements/mou_us_federal_trade_commission - uk_competition_and_markets_authority - _march_2019.pdf . 66 Additional cooperation measures include: sharing best practices, staff exchanges, webinars, training, joint studies on consumer markets and enforcement models, join t develop ment and disseminat ion of educational materials etc. 67 Available at https://www.legislation.gov.uk/ukpga/2024/13/contents?view=plain . 68 Memorandum of Understanding between the Competition and Markets Authority and the Department for Business and Trade from January 6, 2025, available at https://www.gov.uk/government/publications/dbt - and - cma - memorandum - of - understanding - international - cooperation/international - cooperation - on - competition - and - consumer - law - enforcement . 25 in civil and criminal investigations and proceedings; (b) the provision of investigative assistance to overseas regulators and (c) international cooperation arrangements (a) Overseas disclosures There are general restriction on the disclosure of (non - public) information relating to the affairs of an individual or the business of an undertaking which the UK authority has obtained during the exercise of any of its functions. 69 The disclosure is only allowed in certain circumstances (such as for the purpose of facilitating the exercise of the domestic or overseas public authority’s functions) and subject to the considerations and safeguards set out in the law, such as the suffici ent seriousness of the matter, sufficient safeguards or reciprocity. 70 In some cases, notification to the Secretary of State or other regulators is necessary before disclosure. A more streamlined process is envisaged for routine disclosures and if certain cooperation arrangements are in place. (b) Investigative assistance The UK regulators can provide investigative assistance to overseas regulators who have functions corresponding to those of the UK regulators in relation to competition, consumer protection and digital markets. 71 The investigative assistance is subject to authorization by the Secretary of State unless it is provided under or in accordance with a qualifying cooperation arrangement (which can be an international treaty, MoU etc.). 72 (c) International cooperation arrangements The MoU encourages entering into international cooperation arrangements that can include arrangements for sharing confidential information with or without consent of the person or business the information relates to , or even arrangements on investigative assistance. 2. Comparing Data Protection and Consumer Protection: Regulatory Approaches, Enforcement Challenges, and Cooperation Instruments A. Regulatory and Enforcement Differences Data protection a nd consumer protection fields have different objectives and regulatory focus es (data protection: preventing the misuse of personal information, safeguarding individual autonomy , and empowering individuals through rights vs. consumer protection: ensuring fairness in the marketplace, preventing exploitation and harm from unsafe and deceptive products and practices ), but they increasingly intersect in digital markets (e - commerce, online services etc.). 69 Part 9 of the Enterprise Act 2002, available at https://www.legislation.gov.uk/ukpga/2002/40/part/9 . 70 Sect. 241, 243A, 243B and 243C of the Enterprise Act 2002. 71 Section 319 of Digital Markets, Competition and Consumers Act 2024 , available at https://www.legislation.gov.uk/ukpga/2024/13/section/319 . 72 Sec. 322 of Digital Markets, Competition and Consumers Act 2024 , available at https://www.legislation.gov.uk/ukpga/2024/13/section/322 . 26 In terms of enforcement, independent supervisory authorities play key roles in both fields, but in the consumer protection area civil enforcement is much more common, incl uding class actions and alternative dispute resolution. This is not only due to longer - standing traditions, but mainly because of the difference s in the nature of the harm and the ease of establishing damages. In consumer protection , harm is typically economic loss, that is more easily quantifi able , whereas, data protection litigation remains in flux , particularly regarding non - material harm , causation , and monetary valuation of privacy loss. Class actions are emerging, but often challenged on standing and harm quantification (especially in the U.S.). Given that civil enforcement is much more important part of the enforcement scheme in the consumer protection area, the need for the “ hard law ” cross - border enforcement cooperation between CPAs may be somewhat less urgent than in the data protection area, where regulatory enforcement by DPAs is central. B. Key Challenges to Cross - border Enforcement Cooperation in the Consumer Protection Area According to the OECD Report 73 and the Report to UNCTAD, 74 the primary obstacles to cross - border enforcement include: • Insufficient resources - the most significant constraint • A lack of legal power • Privacy and data protection • Information confidentiality • Language barriers I t is apparent that the obstacles faced by the CPAs are quite similar to those that the DPAs are experiencing. C. Instruments for International Cooperation The legal bases for international enforcement cooperation in the area of data protection appear to be more harmonized — likely due in part to the GDPR and the so - called “ Brussels effect ” — and more formalized, than those in the field of consumer protection , as evidenced by the existence of some binding multilateral instruments. Nevertheless , both fields rely heavily on administrative goodwill and shared objectives rather than enforceable legal obligations. The multilateral “ soft law ” enforcement cooperation in the data protection area seems to suffer from fragmentation into many different platforms and initiatives with varied membership, mandates and level of activity. In the field of consumer protection, ICPEN serves as the primary f orum for practical multilateral enforcement cooperation, with participation from most CPAs in EEA countries and countries with an EU adequacy decision . In practice, this framework appears to be significantly more active than those established in the data protection domain. 73 OECD (2018), “Consumer protection enforcement in a global digital marketplace”, OECD Digital Economy Papers, No. 266, OECD Publishing, Paris, https://doi.org/10.1787/f041eead - en . 74 Cross - border enforcement of consumer law: Looking to the future, Christine Riefa, July 19, 2022, available at https://unctad.org/system/files/information - document/ccpb_WG_e - commerce_cross - Border_Riefa_en.pdf . 27 The most valuable ICPEN initiative is likely the econsumer.gov secure website for sharing consumer complaints and other documents. 75 The data are shared directly by the data subjects or other data contributor s, therefore the obstacles related to confidentiality or data privacy are largely removed. It is advisable to look into the possibilities of replication of this tool in the data protection area. Cooperation within ICPEN and use of the econsumer.gov had bee n frequently mentioned by the CPAs in the relevant surveys, therefore, it seems that this tool is useful in practice. For the sake of completeness, GPEN also has a restricted - access website that enables participating authorities to share information, materials and documents. However, non - public documents, and materials associated with specific bilateral cross - border investigations or enforcement matters, are generally not intended be shared through this website. 76 Another instrument that may be worth looking at for inspiration is the OECD Implementation Toolkit on Legislative Actions for Consumer Enforcement Co - operation 77 aimed at helping countries reduce the legal barriers to cross - border enforcement co - operation. II.2 COMPETITION 1. Existing Legal Instruments Available for International Enforcement Cooperation among Competition Regulators International cooperation among competition authorities (CAs) has become an essential component of effective competition law enforcement in an increasingly globalized and digitalized economy. Cross - border mergers, global cartels, and anti - competitive condu ct by digital platforms often affect multiple jurisdictions simultaneously, requiring coordinated approaches. Compared both to data protection and consumer protection, competition law benefits from a more mature, formalized and practice - oriented cooperativ e framework. This relative maturity of the international enforcement cooperation can be attributed to several interrelated factors, including early development (particularly in response to global cartel cases and cross - border mergers in the 1990s and 2000s ), complexity of competition cases, a relatively convergent set of substantive norms (e.g., the prohibition of hardcore cartels), and clearer legal mandates for cross - border cooperation resulting in greater likelihood of entering into formal agreements tha t permit information sharing. As with the preceding section of the Report on consumer protection, this section focuses on cooperation mechanisms involving the CAs from EEA countries and countries with an EU adequacy decision, or a subset thereof. It does not address regional frameworks, intra - EU cooperation instruments, or potential enforcement cooperation mechanisms embedded in free trade agreements, mutual legal assis tance treaties, diplomatic channels, or letters rogatory. A. Legally Binding Instruments (1) National Law Provisions 75 See supra section IIA.1.A.1) of this Report. 76 See https://www.privacyenforcement.net/content/action - plan - global - privacy - enforcement - network - gpen . 77 See supra section IIA.1.A.2) of this Report. 28 Some national competition laws provide a direct legal bas es for cooperation between authorities or jurisdictions, while others provide a mandate to enter into cooperation agreements with other jurisdictions. 78 As regards sharing of confidential information, according to the OECD/ICN Report 79 a number of countries do not actually use these legal bases in practice very often, especially if an exchange of information could be arranged based on a waiver. 80 (2) Confidentiality Waivers Confidentiality waivers are permissions granted by a party under investigation or a third party in an investigation that enables investigating agencies in different jurisdictions to share information protected by confidentiality rules of the jurisdiction(s ) involved. Waivers are the primary way in which CAs share confidential information. 81 Both the International Competition Network (ICN) and several CAs — particularly from jurisdictions with significant experience in cross - border cooperation, such as Canada, the U.S., EU — have developed model waivers of confidentiality. The waiver is a voluntary tool that sets out the terms on which the information is shared and confirms the provider of the information gave permission for the information to be shared on those terms. The granting of waivers helps to avoid the need to use o fficial channels in formal cooperation procedures. Waivers are most commonly used in cross - border merger matters, where the parties are incentivized to ensure their matter is considered as quickly as possible by the authorities, but also in cartel and unil ateral conduct matters. (3) Intergovernmental Agreements There is a growing network of so called “ second generation agreements ” that provide for more enhanced forms of cooperation and contain provisions enabling CAs to exchange confidential information in clearly prescribed circumstances, without the requirement to seek prior consent from the source of the information, and in some instances provide mutual assistance in investigations. 82 Although these are binding international intergovernmental agreements, they do not amend domestic laws that prohibit sharing of confidential business information without the provider’s consent. Moreover, the agreements expressly allow the requested party t o consider its own national interests when determining whether, and to what extent, to provide the requested cooperation. There are 12 bilateral and EU - level agreements relevant to the scope of this Report. 83 These agreements are naturally more prevalent between countries with large multinationals likely to 78 See OECD/ICN (2021), OECD/ICN Report on International Co - operation in Competition Enforcement, OECD Publishing, Paris, https://doi.org/10.1787/86f9eb12 - en , p. 102ff . 79 For details refer to section II.2 1. B.1) infra . 80 OECD/ICN Report, p. 109. 81 OECD/ICN Report, p. 108. 82 OECD/ICN Report, p. 64 and Annex F. 83 I.e. at least one party is a count ry with an EU adequacy decision and the other party is either the EU, the EEA country or the count ry with an EU adequacy decision : EU - Switzerland Agreement concerning cooperation on the application of their competition laws (17 May 2013) ; EU - Korea Agreement concerning cooperation on anti - 29 operate in each other’s territory. There is, arguably, not the same level of willingness for large developed countries to sign agreements with smaller or developing countries. The bilateral agreements concluded since the 1991 EU - U.S. Agreement typically co ntain the same structure as that agreement and contain more or less the same provisions. 84 Common provisions of the “ second generation ” agreements: 85 • Transparency provisions which require the parties to inform each other of changes in their national legal and enforcement systems. • Provisions on notifications of competition investigations and proceedings with possible effect on the other party’s important interests – they define the notification requirements, the circumstances requiring notifications, its timing, content and modalities. • Provisions on investigative assistance – most of the agreements contain provisions on general information exchange; some agreements (e.g. Israel - U.S., Canada - U.S.), provide for further investigative assistance, such as obtaining testimony/statements or conducting searches on behalf of another authority (on voluntary basis). • Provisions on information exchange – most agreements allow only for exchange of non - confidential information. Some agreements contain “ information gateway provisions ” that include confidentiality safeguards, limitations on use or further disclosure of the information , and that allow for exchange of confidential information without the need for prior consent from the source of the information. • Provisions on coordination of investigations or proceedings . Coordination of CAs’ actions in parallel international cartel investigations and in cross - border merger investigations is today a standard practice. For example, agencies may coordinate with each other before opening formal investigations, to discuss the initial theory of the case, in the course of the proceedings, to discuss the theory of harm or the likely anti - competitive effects of the investigated conduct , or when the investigation is complet ed to discuss possible remedies or sanctions. competitive activities (23 May 2009) ; Canada - Japan Agreement concerning Cooperation on Anticompetitive Activities (6 September 2005) ; EU - Japan Agreement concerning cooperation on anti - competitive activities (10 July 2003) ; Japan - U.S. Agreement concerning Cooperation on Anticompetitive Activities (7 October 1999) ; Canada - EU Agreement regarding the application of their competition laws (17 June 1999) ; Israel - U.S. Agreement Regarding the Application of Their Competition Laws (15 March 1999) ; Canada - U.S. Agreement Regarding the Application of Their Competition and Deceptive Marketing Practices Laws (August 1995) ; EU - U.S. Agreement regarding the Application of their Competition Laws (23 September 1991) ; Germany - U.S. Agreement Relating to Mutual Cooperation Regarding Restrictive Business Practices (23 June 1976) ; Canada - U.S. Agreement on the Application of Positive Comity Principles to the Enforcement of their Competition Laws (5 October, 2004) ; EU - U.S. Agreement on the Application of Positive Comity Principles in the Enforcement of their Competition Laws (4 June, 1998) . 84 See OECD (2012), “Improving International Co - operation in Cartel Investigations: Key findings, summary and notes”, OECD Roundtables on Competition Policy Papers, No. 133, OECD Publishing, Paris, https://doi.org/10.1787/6bef709b - en , p. 34ff . 85 Source mainly OECD Inventory of International Co - operation Agreements on Competition (last updated March 2025), available at https://www.oecd.org/content/dam/oecd/en/topics/policy - sub - issues/competition - and - international - co - operation/2025 - inventory - of - international - cooperation - agreements - on - competition.pdf/_jcr_content/renditions/original./2025 - inventory - of - international - coopera tion - agreements - on - competition.pdf . 30 • Provisions on negative comity . Negative comity (aka “traditional comity”), involves a country’s consideration of how to prevent its law enforcement actions from harming another country’s important interests. Most of the co - operation agreements have negative comity provisions as a mech anism for avoidance of conflicts. • Provisions on positive comity. “Positive comity” allows one party to request the other party to take appropriate enforcement actions with respect to activities occurring in the territory of the requested party that adversely affect important interests of the requesting party. It is aim ed at effective allocation of enforcement resources by allowing the better - placed party to deal with the problem (for example, it avoids difficulties of obtaining evidence in a foreign jurisdiction) and minimizes conflicts bet ween jurisdictions that may be caused by enforcement actions against activities occurring in another jurisdiction. However, the response to a positive comity request is voluntary. The anticompetitive activities affecting the interests of the requesting par ty need to be illegal under the competition laws of the requested party. • Most cooperation agreements have provisions on confidentiality of the provided information, consultations and periodic meetings . It is generally agreed that these bilateral agreements have largely been a success and the respective CAs routinely notify each other of investigations, share non - confidential information, and coordinate investigations. 86 EU - U.K. Competition Cooperation Agreement proposal was adopted by the EC in May 2025. 87 It is a supplement to the EU - U.K. Trade and Cooperation Agreement, signed in 2020. It is expected to help when it comes to work on similar or parallel cases, but under the terms of this Agreement any information that the CAs want to share on the businesses they investigate requires consent from the respective companies. B. Soft Law Cooperation (1) Global Cooperation Fora (a) International Competition Network The International Competition Network ( ICN ) is a specialized informal network currently constituted of CAs from 129 jurisdictions (enriched by the participation of NGOs) that serves as a venue for maintaining regular contacts and addressing practical aspects of competition policy and law enforcemen t. 88 The ICN has focused working groups such as on Cartels, Mergers, or Unilateral Conduct. The working group projects and their implications for enforcement are discussed at annual conferences and workshops. The ICN is a virtual network and does not have any Secretariat or offices. It is guided by a Steering Group composed of representatives of ICN member agencies. 86 OECD (2012), “Improving International Co - operation in Cartel Investigations: Key findings, summary and notes”, OECD Roundtables on Competition Policy Papers, No. 133, OECD Publishing, Paris, https://doi.org/10.1787/6bef709b - en , p. 34. 87 https://www.gov.uk/government/news/new - uk - eu - competition - cooperation - agreement . 88 https://www.internationalcompetitionnetwork.org/ . 31 - ICN Recommendations and Practical Cooperation Tools : The ICN has no formal rule - making functions, but the members have developed a substantial body of resources designed to improve enforcement cooperation including comparative reports, non - binding recommendations and frameworks, enforcement manuals, roundtab le discussions, and practical tools (such as model waivers , merger notification templates , charts on ICN m embers’ ability to share information related to cartel investigations etc.). 89 These work products are not legally binding and their implementation is voluntary. The responses to the 2019 s urvey 90 indicate that ICN members value and use the ICN’s work relating to international enforcement cooperation. The most useful outputs were the Frameworks for Mergers and Cartels, 91 the Recommended Practices for Merger Notification and Review Procedures, 92 and the Model Merger Confidentiality Waiver. 93 - OECD/ICN Report on International Co - operation in Competition Enforcement (2021) In 2019, the OECD and ICN conducted a joint project on international enforcement cooperation. They surveyed 62 ICN CAs on their experiences with international cooperation in enforcement activities, and produced this joint report. 94 The Report summarizes the current state of cooperation, key obstacles and puts forward the future areas of focus to improve the international enforcement cooperation. It may serve as the source of inspiration for the data protection field. Compared to GPEN and ICPEN, ICN appears to be much more structured, active and useful in practice mainly due to the extensive body of resources developed under its auspices. (b) Organization for Economic Cooperation and Development The OECD’s Competition Committee is responsible for competition law and policy and it serves as a forum for exchanges on international enforcement cooperation. The Competition Committee carries out research and analysis and produces recommendations, reports and studies. The Competition Committee also collaborates regularly with the ICN and UNCTAD; dedicated OECD liaison officers have been appointed for both organizations. The OECD Secretariat participates in UNCTAD and ICN meetings and conferences, and vice versa. 89 See at https://www.internationalcompetitionnetwork.org/working - groups/icn - operations/cooperation/ . 90 The survey of 62 CAs conducted by the OECD and ICN in 2019. See later in this section of the Report. 91 Available at https://www.internationalcompetitionnetwork.org/portfolio/icn - framework - for - merger - review - cooperation/ and at https://www.internationalcompetitionnetwork.org/portfolio/non - confidential - information - sharing/ . 92 Available at https://www.internationalcompetitionnetwork.org/working - groups/merger/templates/ . 93 Available at https://www.internationalcompetitionnetwork.org/portfolio/model - confidentiality - waiver - for - mergers/ . 94 OECD/ICN (2021), OECD/ICN Report on International Co - operation in Competition Enforcement, OECD Publishing, Paris, https://doi.org/10.1787/86f9eb12 - en . 32 - Recommendation of the Council Concerning International Co - operation on Competition Investigations and Proceedings (2014) (“Recommendation”) 95 Many of the EEA countries and countries with an EU adequacy decision adhere to this Recommendation. The Recommendation calls to take steps to minimize obstacles or restrictions to effective enforcement cooperation between CAs and provides a high - level fram ework of existing aspects of international cooperation, such as exchange of confidential information, investigative assistance, and consultation, notifications and coordination of competition investigations or proceedings. It has been mandated by the OECD Council to report back on implementation of the Recommendation every five years. In 2022 the Competition Committee produced a report 96 that acknowledged improvement, but also demonstrated persistent legal limitations, differences in legal standards, and lack of precedent and models for enhanced cooperation. - OECD Best Practices for the Formal Exchange of Information between Competition Authorities in Hard Core Cartel Investigations (2005) 97 In light of the laws in many countries preventing CAs from exchanging confidential information in cartel investigations, or severely restricting their ability to do so, the Competition Committee developed Best Practices for the formal exchange of information in cartel investigations that aim to identify safeguards that countries can consider applying when they authorize CAs to exchange confidential information in cartel investigations. Based on t hese guidelines several jurisdictions have amended their competition laws to enable the sharing of confidential information with foreign CAs. - Inventories and list of contacts OECD prepared and updates an inventory of intergovernmental cooperation agreements related to competition enforcement 98 and an inventory of international cooperation MoUs between CAs. 99 OECD Secretariat has also established and periodically updates the list of contact points. 95 Available at https://legalinstruments.oecd.org/en/instruments/OECD - LEGAL - 0408 . In addition to the 2014 Recommendation, two enforcement - area specific Recommendations also deal with international co - operation: 2019 Recommendation Concerning Effective Action against Hard Core Cartels and 2005 Recommendation on Merger Review. 96 OECD (2022), International Co - operation on Competition Investigations and Proceedings: Progress in Implementing the 2014 OECD Recommendation , available at https://one.oecd.org/document/C(2022)23/en/pdf . 97 OECD Best Practices for the Formal Exchange of Information Between Competition Authorities in Hard Core Cartel Investigations, DAF/COMP(2005)25/FINAL , available at https://e - bp.inp.pan.pl/server/api/core/bitstreams/474859a4 - 2f28 - 4a08 - 9777 - d4da2e3f0f9c/content . 98 Available at https://www.oecd.org/content/dam/oecd/en/topics/policy - sub - issues/competition - and - international - co - operation/2025 - inventory - of - international - cooperation - agreements - on - competition.pdf/_jcr_content/renditions/original./2025 - inventory - of - international - coopera tion - agreements - on - competition.pdf . The list was last updated in March 2025 . 99 Available at https://www.oecd.org/content/dam/oecd/en/topics/policy - sub - issues/competition - and - international - co - operation/2022 - inventory - of - international - cooperation - agreements - between - competition - agencies - MOUs.pdf/_jcr_content/renditions/original./2022 - inventory - of - in ternational - cooperation - agreements - between - competition - agencies - MOUs.pdf . 33 (c) United Nations Trade and Development Through its Intergovernmental Group of Experts on Competition Law and Policy and its annual meetings, UNCTAD facilitates dialogue and the exchange of best practices among CAs. It also undertakes research and policy analysis, and provides technical assistan ce to developing countries. There is also a Working Group on International Cooperation on Competition Law Enforcement whose main output are Guiding Policies and Procedures under Section F of the Set of Multilaterally Agreed Equitable Principles and Rules f or the Control of Restrictive Business Practices , 100 that include, among others, a toolkit for international cooperation. (2) EU - level International Cooperation The EEA CAs cooperate within the formal enforcement framework – the European Competition Network (ECN) — established under EU Regulation (EC) 1/2003. This network facilitates the exchange of case - related information, coordination of investigative and enforcement actions, and effective allocation of cases among authorities. The ECN enables, among others, mutua l assistance in evidence gathering or exchange of confidential information. The ECN stands as one of the most advanced examples of enforcement cooperatio n globally. However , it is a regional platform and there is no formal cooperation with other countries. On the EU - level, there are several intergovernmental cooperation agreements between the EC and third countries, including some of the countries with an EU adequacy decision. 101 (3) Memoranda of Understanding Bilateral MoUs between the CAs are widely used. These agreements are non - binding and they vary in scope and specificity. Some of the MoUs focus on establishing a basic framework to allow for a dialogue between the CAs (for example, they have provisions on transparency, communication and technical assistance), and some of them go further and are more in line with the bilateral intergovernmental cooperation agreements described above (they contain common clauses on transparency, notifications, enforcement coo peration and investigative assistance, exchange of information, coordination of investigations, negative and positive comity etc.). 102 There is also one multilateral MoU relevant to the scope of this Report – Multi - lateral Mutual Assistance and Cooperation Framework for Competition Authorities between Australia, Canada, New Zealand, UK and U . S . (2020) . It is a framework MoU, which attaches a model bilateral/multilateral “ second generation ” agreement as an annexure. All parties have agreed to implement the model agreement between themselves bilaterally (or multilaterally). The model agreement creates a mechanism for formal requests for investigative assistance between the CAs. The types of i nvestigative assistance contemplated by the model agreement include taking 100 Available at https://unctad.org/system/files/official - document/ditccplpmisc2021d2_en.pdf . 101 See supra section II2.1.A.3) for details. 102 See OECD Inventory of International Co - operation Agreements between Competition Agencies (MoUs) , available at https://www.oecd.org/content/dam/oecd/en/topics/policy - sub - issues/competition - and - international - co - operation/2022 - inventory - of - international - cooperation - agreements - between - competition - agencies - MOUs.pdf/_jcr_content/renditions/original./2022 - inventory - of - in ternational - cooperation - agreements - between - competition - agencies - MOUs.pdf . 34 testimony or statements of persons, locating or identifying persons or things, executing searches and seizures etc. However , no bilateral agreements have yet been publicly reported as having been concluded specifically on the basis of this multilateral MoU. 2. Comparing Data Protection and Competition Fields: Regulatory Approaches, Enforcement Challenges, and Cooperation Instruments A. Regulatory and Enforcement Differences While both these legal domains may be implicated in digital markets, they diverge in their regulatory frameworks and enforcement mechanisms. In contrast to data protection that is aimed more at protecting individual autonomy, competition law is focused on maintaining market efficiency, competition and consumer welfare. Enforcement in the field of competition law is characterized by a combination of administrative, civil, and criminal mechanisms aimed at deterring anti - competitive conduct and preserving market integrity. CAs play a central role by investigating and sanctioning the abusive behavior using economic an alysis to assess harm and impose appropriate remedies. T he dynamics and frequency of international enforcement cooperation differ considerably between competition and data protection fields , with such cooperation being naturally more prevalent in the compe tition domain — particularly in the context of merger control. For example, the OECD/ICN Report showed that there was a significantly higher number of cooperation incidents in merger matters than cartel or unilateral conduct matters. C ross - border mergers are more likely to trigger cross - border investigations , plus the merging parties proactively notify the authorities of their planned mergers (rather than being detected or subject to a complaint) , and they often have an incentive to cooperate in order to expe dite the merger review. N one of these structural drivers are present in the data protection field — though different incentives may exist — making international enforcement cooperation likely less frequent in practice . As noted at the outset of this section , competition law benefits from a relatively mature and formalized international cooperation framework, owing in part to its early development, the convergence of the substantive law, and clearer legal mandates for cross - border collaboration. B . Key Challenges to Cross - border Enforcement Cooperation in the Competition Area According to the OECD/ICN Report, the key categories of obstacles faced by CAs when working together across borders are: 103 • Legal limitations – especially relating to confidential information sharing (in the absence of waivers), investigative assistance and more sophisticated or joint enforcement efforts, that are often restricted by laws; other differences between legal systems and legal standards • Resources – lack of staff, time or financial resources 103 Listed according to the level of importance identified by the surveyed CAs. See OECD/ICN Report, Chapter 15. 35 • Coordination/timing – differences in case timelines and procedures complicate synchronizing enforcement actions • Trust and reciprocity – lack of established relationships, uncertainty about how shared information will be used, and the absence of reciprocal arrangements reduce willingness to cooperate. • Practical issues (e.g. language, time differences etc.) CAs and DPAs face a number of comparable challenges when cooperating across borders, though the nature and intensity of these obstacles may vary. In both areas, legal barriers — particularly those concerning the sharing of confidential information — pose a sig nificant impediment. However, the competition field benefits from the use of waivers and a greater number of formal legal cooperation arrangements. DPAs face additional constraints stemming from strict data protection rules and the absence of mechanisms to enforce decisions against entities based in third countries — issues that are generally less pronounced in the competition context. Timing and procedural differences complicate synchronization efforts in both areas, though CAs typically operate within more established frameworks for coordination. C. Instruments for International Cooperation The competition field demonstrates a significantly more advanced and operationally effective framework for international enforcement cooperation than the data protection field. The legal foundations for international cooperation are more mature and structu red — this includes: • Numerous bilateral “ second - generation ” agreements with detailed provisions for investigative assistance, confidentiality safeguards, positive and negative comity, and information exchange. • Widespread use of waivers, particularly in merger investigations, allowing authorities to bypass legal barriers to confidential information sharing. • A relatively standardized and convergent legal culture (e.g., prohibition of hardcore cartels), enabling clearer mandates and easier coordination across jurisdictions. The maturity gap is also reflected in practice: CAs routinely coordinate merger reviews and investigations; DPAs rarely engage in joint investigations or share substantive information. At the soft law level, the CAs benefit from a well - developed body of re sources produced within global cooperation fora, such as templates, standards, and best practice guidelines. While substantive legal and policy differences exist, certain tools — especially the “ second - generation ” agreements, the practical cooperation tools developed by ICN and OECD and possibly even confidentiality waivers in some situations — could be adapted and reused in the data protection area. Although the principles of negative and positive comity are heavily associated with competition law, it might be worth looking into the ways of implementing these principles into the international cooperation in the data protection field. 36 III. RECOMMENDATIONS FOR IMPROVING INTERNATIONAL ENFORCEMENT COOPERATION BETWEEN DATA PROTECTION AUTHORITIES The analysis of international enforcement cooperation across data protection, consumer protection, and competition fields reveals significant gaps between legal capabilities and practical implementation in data protection. While DPAs generally possess theo retical frameworks for cooperation, their utilization remains limited compared to the more mature and operationally effective frameworks in competition law. This section presents comprehensive recommendations to bridge this gap and to remove other identifi ed obstacles, drawing insights from successful practices in related regulatory domains while addressing the unique challenges the DPAs are facing. The solutions proposed by the surveyed DPAs are also considered. The recommendations are organized into functional categories, with each one specifying the intended addressee, unless this is already clear from the context. Some recommendations propose improvements that can be implemented across jurisdictions by either n ational governments or their respective DPAs, while others outline specific actions for the EDPB and DPAs from countries with an EU adequacy decision. A. Enhanced Legal Framework Development (1) Maximizing Use of Existing Legal Frameworks DPAs should fully leverage the potential of existing legal frameworks and adopt less narrow interpretations of their provisions, 104 while maintaining compliance with fundamental rights protections and other legal obligations. To this end, DPAs should review and analyze their national legal frameworks and develop interpretive guidance that clearly defines the scope of permissible coope ration under the existing provisions. 105 They should establish presumptions in favor of cooperation where appropriate safeguards exist, and implement streamlined procedures for routine cooperation activities. (2) Adoption of “Second Generation” Cooperation Agreements Where national legal frameworks lack sufficient legal bases, governments should take the lead, where necessary , in negotiating and concluding comprehensive bilateral/multilateral cooperation agreements. While DPAs may also pursue MoUs at their level , government involvement may be essential to establish robust and legally binding frameworks for effective international cooperation. These agreements could be modeled on established competition law frameworks and incorporate specific provisions addressing : • Information exchange mechanisms with detailed confidentiality safeguards and permitted use limitations. 104 For example, Article 50 of the GDPR; general confidentiality provisions; provisions implementing obligations under Chapter 4 of the Convention 108; Art. 172 of the Japanese Act on the Protection of Personal Information ; Article 14 of the Korean Personal Information Protection Act ; or Section s 206 and 207 of the New Zealand Privacy Act etc. 105 Including clear understanding of legal terms such as “confidential information” etc. 37 • Investigative assistance provisions enabling DPAs to exercise powers on behalf of foreign counterparts. 106 More than half of the respondents to the Questionnaire considered some type of investigative assistance beneficial. • Coordination procedures for joint or parallel investigations and enforcement actions. • Notification requirements for investigations affecting other jurisdictions’ interests. • Negative and positive comity principles 107 adapted to data protection contexts. • Enforcement assistance mechanisms for cross - border decision implementation. 108 • Data protection compliance , such as compliance with the applicable rules on transfers of personal data. In this context, the practical use of the Toolbox on essential data protection safeguards for enforcement cooperation between EEA data protection authorities and competent data protection authorities of third countries, adopted by the ED P B on 14 March 2022 , 109 should be considered . 110 These agreements should move beyond general cooperation frameworks to include operational details, standardized procedures, and clear legal pathways for enhanced cooperation forms. Case - specific ToRs may be concluded as supplementary instruments to these f ramework agreements where circumstances require, particularly for joint investigations. (3) Development of Data Protection - Specific Waivers Competition authorities frequently employ waivers to overcome legal barriers to the sharing of confidential information of businesses. These waivers represent a party’s consent to waive, within the limits set out in the consent, the confidentiality protect ions afforded under the applicable laws of the investigating authority’s jurisdiction. While the data protection context is different — and data controllers are generally less likely to have an incentive to grant such waivers — it is worth exploring contexts i n which analogous mechanisms could be implemented. To facilitate such practices, model waiver templates could be developed for specific scenarios, 106 Including, for example, direct service of documents between the DPAs . 107 “Negative comity” refers to the expectation that one country will consider the interests of another country and refrain from actions that would interfere with the latter’s important interests , especially in cross - border enforcement or regulatory matters. “ Positive comity ” is a principle of international under which one country actively assists to another country’s enforcement efforts, especially when the conduct at issue primarily affects the other country’s interests. It thus allows one party to request the other party to take appropriate enforcement actions with respect to activities occurring in the territory of the requested party that adversely affect important interests of the requesting party . 108 T o the maximum extent permitted under respective national laws, for example, at a minimum, notifications of decisions. 109 Available at https://www.edpb.europa.eu/system/files/2022 - 03/toolbox_on_essential_data_protection_safeguards_for_enforcement_cooperation_with_third_country_sas_en .pdf . 110 None of the surveyed DPAs e ver utilized this instrument in practice . 38 alongside standardized criteria to determine when and how such waivers may be appropriately sought. Additionally, in the context of personal data sharing by data subjects, DPAs could conduct a legal analysis and consider whether, under their legal frameworks, complaint templates including an informed consent option could be developed — allowing individuals to explicitly authorize the cross - border sharing of their complaints and associated personal data . B. Technical, Structural and Operational Improvements (1) Secure Information Sharing Platform It is strongly recommended to develop an encrypted communication platform to enable timely and secure information exchange, including communication and the sharing of case - related materials, supported by robust access controls. The need for such a portal w as highlighted by several respondents to the Questionnaire , and sharing of information between DPAs was the single most frequently mentioned beneficial type of international cooperation . Experience from the consumer protection field demonstrates that techn ological solutions incorporating appropriate consent mechanisms can effectively address some confidentiality constraints. In this regard, the ICPEN’s econsumer.gov platform may serve as a valuable reference model. Such a platform could be established within existing global cooperation fora 111 or under the auspices of the EDPB and DPAs from countries with an EU adequacy decision. 112 The platform should include the following features: • Mechanism for submitting complaints or other submissions and documents directly by individuals and businesses, with clear indication of the authorities that will have access to the materials. • Mechanism for sharing confidential information by DPAs and case related documents, including case specific or more general confidentiality agreements. • Mechanism for easy sharing general non - confidential information , best practices, trends etc. • Routine notification mechanism for notifications about commencement of investigation and inviting other DPAs to cooperate. • Centralized system for tracking and coordinating international enforcement cooperation activities. • Mechanisms for rapid information exchange in urgent matters. • Transparency page making publicly available information on national substantive and procedural rules, including those relating to confidentiality, and updated as necessary. • Language support features or automatic translations to overcome the language barriers. (2) Joint Investigations Frameworks 111 E.g., GPEN is already employing a web platform for limited information exchange. 112 Where the EDPB would define the parameters for information sharing, including which third countries may participate and the extent of their participation. 39 Nearly half of the surveyed DPAs reported that they would benefit from joint investigations and enforcement actions. The e stablishment of standardized frameworks, including clear ToR templates and resource - sharing agreements, would facilitate this form of cross - border cooperation. Such frameworks could be developed within existing global cooperation fora or, in a more tailore d manner, under the auspices of the EDPB and DPAs from countries with an EU adequacy decision. (3) Dedicated International Cooperation Units, Resource Pooling and Capacity Building Subject to the availability of sufficient resources (see Recommendation under C (1) below), DPAs should establish dedicated units or designate specific personnel responsible for international enforcement cooperation. Adequate resourcing is a necessary first step to ensuring that such structures can function effectively. It is also recommended to further develop systematic resource - sharing mechanisms between DPAs, particularly benefiting smaller DPAs with limited resources. This could be achieved by building on existing initiatives, such as staff exchange programs , or by creating shared expert pools for technical investigations and other forms of technical assistance, as well as developing joint training programs for DPA staff focused on international enforcement cooperation. Again, existing cooperation structures could be leveraged for this purpose, or these measures could be coordinated by EDPB and DPAs from countries with an EU adequacy decision. (4) Research and Analysis The EDPB and DPAs from countries with an EU adequacy decision could conduct regular assessments of international enforcement cooperation effectiveness, including annual reporting on cooperation activities and outcomes, comparative analysis with other regulatory fields, and identification of emerging cooperation challenges and opportunities. (5) Global Cooperation Fora Engagement The EDPB and DPAs from countries with an EU adequacy decision c ould enhance their engagement with global cooperation fora, such as GPEN and GPA, to address the current fragmentation in cross - border cooperation, help avoiding duplication, facilitate broader international collaboration and dialogue, and promote the sharing of experiences and best practices. (6) Integrating Cooperation Commitments into Adequacy Frameworks Furthermore, the EDPB , together with the DPAs from countries with an EU adequacy decision , could encourage the EC to develop specific cooperation frameworks tied to adequacy decisions, thereby creating incentives for enhanced cooperation. For example, cooperation commitments could accompany the adequacy assessment criteria, and regular review mechanisms could be introduced to evaluate the effectiveness of suc h cooperation. 40 C. Addressing Specific Cooperation Challenges Through Government - Level Interventions (1) Ensure Adequate Resourcing Governments should allocate sufficient and sustainable resources to DPAs to enable effective participation in international enforcement cooperation. This includes funding for dedicated personnel, technical expertise, training, and other operational infrast ructure necessary to support cross - border cooperation efforts. Without adequate resourcing, DPAs — particularly those with limited capacity — may be unable to engage meaningfully in international collaboration, regardless of existing legal frameworks or cooper ation mechanisms. (2) Cross - Border Enforcement Mechanisms One of the most frequently cited gaps in international enforcement cooperation is the absence of formal mechanisms for enforcing DPAs’ decisions against controllers based in third countries. The most effective way to address this issue would be for governm ents to negotiate mutual recognition agreements , enabling the enforcement of foreign DPAs’ decisions in the same manner as domestic ones. While such arrangements constitute a long - term measure requiring diplomatic engagement and governmental action, withou t them DPAs remain effectively powerless against controllers in third countries lacking an establishment in the DPA’s jurisdiction. As an initial step, procedures for the cross - border service of enforcement decisions could be introduced. (3) Reciprocity and Dual Unlawfulness Solutions The requirements of reciprocity and “dual unlawfulness” are unlikely to be resolved without corresponding amendments to national legal frameworks initiated by governments. As an initial step, DPAs in jurisdictions where such requirements apply c ould develop clear guidance on the criteria for establishing reciprocity or dual unlawfulness within their legal systems. Where feasible, governments should adopt more flexible standards; for example, a “substantial similarity” standard may be more appropr iate than d emanding perfect alignment. DPAs could also compile catalogues outlining both the resources they can offer and the resources they require. Reciprocity requirements could be addressed by emphasizing functional rather than strictly legal reciprocity, focusin g on what each DPA can contribute to shared objectives. For instance, one DPA might provide investigative support, while another contributes technical expertise or legal analysis. This approach would allow for differentiated levels of cooperation based on jurisdictional capacities, rather than insisting upon complete reciprocity. D. Guidance and Standard - Setting (1) Comprehensive Enforcement Cooperation Guidance 41 The EDPB could develop comprehensive guidance on international enforcement cooperation, 113 addressing, among others: • Detailed interpretation of Article 50 GDPR and its practical application. • Clarification of what constitutes “confidential information” under EU law and, possibly, relevant national law and appropriate sharing parameters. • Clarification of the relationship between professional secrecy obligations (Article 54(2) GDPR) and international cooperation requirements. This recommendation applies specifically to EDPB; however, DPAs from countries with an EU adequacy decision could consider implementing relevant aspects, where applicable, or develop their own internal guidance to clarify terms and relationships that remai n ambiguous under their respective legal frameworks. (2) Model Agreements and Templates EDPB and DPAs could cooperate in view of developing standardized templates for: • Bilateral cooperation agreements between DPAs • Information sharing agreements with specific confidentiality safeguards • Joint investigations ToRs • Confidentiality waiver forms adapted for data protection contexts • Standardized procedures for handling cooperation requests. (3) Toolkit of Legislative Actions The EDPB and DPAs from countries with an EU adequacy decision could draft a toolkit of legislative actions modeled largely on the OECD Implementation toolkit on legislative actions for consumer protection enforcement co - operation (2021). 114 The toolkit might help the DPAs that do not currently possess the domestic legal authority needed for enforcement cooperation to make the case for obtaining relevant legislative tools. E. Strengthening Institutional Framework Building upon the EDPB’s existing engagement with DPAs from countries with an EU adequacy decision, several areas could be further developed to strengthen coordination and operational effectiveness: • Enhancing the Role of the International Enforcement Cooperation Working Group : The existing group could expand its activities by further developing common standards and procedures for international enforcement cooperation, facilitating collaboration between the EEA DPAs and DPAs from countries with an EU adequacy decision (and other non - 113 Establishing presumptions in favor of cooperation and less restrictive interpretation of existing provisions is recommended to foster international enforcement cooperation. 114 OECD (2021), “Implementation toolkit on legislative actions for consumer protection enforcement co - operation”, OECD Digital Economy Papers , No. 310, OECD Publishing, Paris, https://doi.org/10.1787/eddcdc57 - en . 42 EEA DPAs) , organizing awareness - raising events to share good practices, or monitoring and reporting on cooperation activities . • Expanding the Contact Point Network : Continued development of a comprehensive and regularly updated directory of international cooperation contact points — specifying roles for different types of cooperation requests and including emergency procedures — could improve the speed and efficiency of cross - border enforcement collaboration. • Formalizing Engagement : Current engagement mechanisms between the EDPB and DPAs from countries with an EU adequacy decision could be further formalized through regular cooperation fora and workshops, joint training programs, and the development of streamlined procedures for handling cross - border requests. 43 ANNEX 1: ABBREVIATIONS CA Competition Authority CCP OECD’s Committee on Consumer Policy CPA Consumer Protection Authority DMCC UK Digital Markets, Competition and Consumers Act 2024 DoC U.S. Department of Commerce DoT U.S. Department of Transportation DPA Data Protection Authority DPF or EU - U.S. DPF EU - U.S. Data Privacy Framework ( COMMISSION IMPLEMENTING DECISION pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU - U.S. Data Privacy Framework from July 10 , 2023) EC European Commission ECN European Competition Network ECWG G7 Enforcement Cooperation Working Group EDPB European Data Protection Board EDPS European Data Protection Supervisor EEA European Economic Area EEA DPA Data Protection Authority in any EEA country EU European Union EU adequacy decision A formal determination by the EC that a non - EU country, territory, organization, or sector provides a level of protection for personal data that is “essentially equivalent” to the GDPR. EUDPR Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC 44 FTC U.S. Federal Trade Commission G7 An informal forum of seven advanced economies — Canada, France, Germany, Italy, Japan, the UK, and the U.S. GDPR Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Dat a Protection Regulation), OJ 2016 L 119/1 Global CAPE Global Cooperation Arrangement for Privacy Enforcement GPA Global Privacy Assembly GPEN Global Privacy Enforcement Network ICN International Competition Network ICPEN International Consumer Protection and Enforcement Network IEWG International Enforcement Cooperation Working Group MoU Memorandum of Understanding NGO Non - governmental organization OECD Organization for Economic Cooperation and Development OECD/ICN Report OECD/ICN (2021), OECD/ICN Report on International Co - operation in Competition Enforcement, OECD Publishing, Paris, https://doi.org/10.1787/86f9eb12 - en , p. 102ff. Questionnaire Questionnaire on data protection enforcement cooperation tools and related challenges faced by DPAs, prepared in April 2025 by the EDPB, circulated to EEA DPAs and DPAs from countries with an EU adequacy decision, attached as Annex 3 to this Report. For th e purposes of this Report, the term "Questionnaire" also includes the replies of DPAs from G7 countries to a questionnaire addressing similar topics provided to them as part of a parallel project of the G7 Data Protection and Privacy Authorities’ Roundtabl e. ToR Terms of Reference UK United Kingdom UK Data Protection Act UK Data Protection Act 2018 (c. 12) 45 UK GDPR United Kingdom General Data Protection Regulation, as incorporated into UK law by section 3 of the European Union (Withdrawal) Act 2018 and amended by the Data Protection, Privacy and Electronic Communications Regulations 2019 UN United Nations UNCTAD United Nations Trade and Development U.S. United States of America 46 EDPB Initiative with DPAs from countries with an EU adequacy decisions Questionnaire on data protection enforcement cooperation tools and related challenges faced by data protection authorities (‘DPAs’) ANNEX 2 : QUESTIONNAIRE Please note that the EDPB may request assistance of an external expert to support its analysis of the replies and to also conduct research on the existing tools and challenges faced in the context of international enforcement cooperation between regulators in other fields of law. Responses provided in the framework of this questionnaire may be shared under a non - disclosure agreement with the external expert hired by the EDPB. When providing your responses, please flag any answer that you deem should not be shared with the expert by including the relevant information in the “confidential” box. Name of the DPA: Introduction The aim of this questionnaire is to gather information about (i) the current status of data protection enforcement cooperation among DPAs, (ii) legal and practical considerations related to the sharing of information on investigations and enforcement cases , and (iii) possible solutions to foster enforcement cooperation among DPAs. Fork at the beginning - 2 different questionnaires: A - EDPB MEMBER B - DPA from countries with an EU adequacy decision A. IF YOU ARE AN EEA DPA Part I: Data protection international enforcement cooperation instruments and current status 1. In relation to investigations and enforcement cases, which types of international cooperation with DPAs outside the EEA would your DPA most benefit from (including in relation to sharing information)? With regard to the need to share information, please be as specific as possible (e.g., sharing general information about ongoing investigations, sharing detailed information about ongoing investigations, requesting assistance to collect evidence or analyse data, sharing of complaints including personal data, r eceiving assistance in notifying and enforcing a decision, etc.). 2. What instruments for bilateral or multilateral cooperation (such as Memorandums of Understanding) exist under your jurisdictions’ legal framework for your DPA to cooperate with DPAs outside the EEA, including those from a country with an EU adequacy decisi on? 47 3. With regard to the instruments identified under question (2) above, what is the legal value of these instruments and to which extent do they guarantee the protection of personal data? 4. What kind of cooperation do these instruments support (please refer to your answers under question (2) above)? Please tick the box: 󠇖 sharing best practices 󠇖 conducting joint enforcement awareness campaigns/coordinated compliance actions (e.g., joint actions to raise awareness about specific issues and encourage compliance, issuing joint statements on a common topic of concern) 󠇖 participating in joint compliance sweeps 󠇖 conducting joint investigations 󠇖 informing about the launch of an enforcement action 󠇖 exchanging general information regarding an ongoing enforcement action, such as relating to its scope, topics addressed or resources required 󠇖 exchanging information on your DPA’s legal analysis relating to identified possible infringements during an ongoing enforcement action 󠇖 sharing internal documents relating to an ongoing enforcement action 󠇖 sharing documents produced by third parties relating to an ongoing enforcement action (e.g., investigated organization’s representations/submissions) 󠇖 requesting assistance to collect evidence or analyse data relating to an ongoing enforcement action 󠇖 informing about the existence of a past enforcement action, particularly if these are not publicly available 󠇖 informing about the legal findings of a past enforcement action, particularly if these are not publicly available 󠇖 requesting assistance for enforcing a decision 󠇖 any other [please specify] 5. Does your DPA cooperate on enforcement activities with DPAs from countries with an EU adequacy decision or other DPAs outside the EEA? If so, please reply to the following questions: a. With which DPA(s) do you cooperate? b. Which legal instrument(s) did you use to frame such cooperation? c. On how many enforcement cases did you cooperate in the last 5 years? d. How did/do you cooperate with them (please specify relating to the categories listed in question 4) e. Please provide the link to any related documents, if publicly available. 6. Does your DPA cooperate with regulators (in your country or outside your country) in areas other than data protection (e.g., competition law or consumer law)? 󠇖 Yes, only with regulators in my own country 󠇖 Yes, only with regulators in other countries 48 󠇖 Yes, with both regulators in my own country and with regulators in other countries 󠇖 No. If you replied yes, please specify with which regulators (e.g. competition law, consumer law), what type of legal instruments you use and what types of cooperation they enable in practice: Part II: Legal and Practical Considerations 7. Does your jurisdiction’s legal framework (data protection legal framework or other legal framework) include any provisions that require/encourage/enable international enforcement cooperation with DPAs outside the EEA? If this is the case, please provide a short description of the provision(s) in question. 8. Do you have national legal requirements which act as a barrier or which prevent your DPA from sharing personal data (e.g. when included in complaints or evidence gathered) when cooperating on enforcement activities with DPAs outside the EEA? 9. Does your DPA share personal data with DPAs outside of the EEA in the context of enforcement cooperation? If so, under which legal basis/bases? 10. Do you have national legal requirements which act as a barrier or prevent your DPA from sharing confidential information related to investigations (e.g. in a state of play, in evidence collected during an inspection, in questions asked, or in an investigat ed party’s representations) in order to cooperate on enforcement activities with DPA outside the EEA? 11. Has your DPA used the EDPB Toolbox on essential data protection safeguards for enforcement cooperation between EEA data protection authorities and competent data protection authorities of third countries 115 ? If so, please provide examples of the context in which you used it, as well as if and how it helped you cooperate internationally. 12. Is your DPA able to provide assistance to DPAs outside of the EEA and use its investigatory powers on behalf of a requesting DPA (e.g. conducting an inspection following the request of another DPA)? If so, are there limitations to this and what are they? 115 It was adopted by the EDPB in the context of Article 50 GDPR and it is meant to list data protection safeguards in relation to data protection international cooperation which can be concluded in addition to or inserted in an enforcement cooperation agreement between EEA DPAs and DPA s outside the EEA. The document is available here: https://www.edpb.europa.eu/system/files/2022 - 03/toolbox_on_essential_data_protection_safeguards_for_enforcement_cooperation_with_third_country_sas_en .pdf 49 13. If the answer to the first part of question 12 is yes, please set out which investigative powers your DPA has used to support the investigation conducted by a DPA outside the EEA (e.g. conducting an inspection following the request of another DPA). 14. At a high level, what is limiting your DPA’s ability to share information or undertake enforcement cooperation with DPAs outside the EEA (especially if those limits are not already covered by the questions above)? Part III: Identifying best practices 15. Please provide good examples of past enforcement cooperation and practices which demonstrate the additional efficiency and benefits gained from international cooperation on data protection matters. Please provide additional information to understand the context of the co operation, the legal and technical instruments used, the level of cooperation achieved and the outcome. Part IV: Identifying solutions 16. Based on the answers you provided above, what technical and legal solutions could be identified to foster international enforcement cooperation between DPAs in the EEA and outside the EEA? 17. Are there other additional comments or remarks, which your DPA wishes to make towards the topic, which are not covered by the questionnaire? B. IF YOU ARE A DPA FROM A COUNTRY WITH AN EU ADEQUACY DECISION Part I: Data protection international enforcement cooperation instruments and current status 1. In relation to investigations and enforcement cases, which types of international cooperation with DPAs outside of your country would your DPA most benefit from (including in relation to sharing information)? With regard to the need to share information, p lease be as specific as possible (e.g., sharing general information about ongoing investigations, sharing detailed information about ongoing investigations, requesting assistance to collect evidence or analyse data, sharing of complaints including personal data, receiving assistance in notifying and enforcing a decision, etc.). 2. What instruments for bilateral or multilateral cooperation (such as Memorandums of Understanding) exist under your jurisdiction’s legal framework for your DPA to cooperate with DPAs outside of your country, including EEA - DPAs or DPAs from other countries w ith an EU adequacy decision? 3. With regard to the instruments identified under question (2) above, what is the legal value of these instruments and to which extent do they guarantee the protection of personal data? 50 4. What kind of cooperation do these instruments support (please refer to your answers under question (2) above)? Please tick the box: 󠇖 sharing best practices 󠇖 conducting joint enforcement awareness campaigns/coordinated compliance actions (e.g., joint actions to raise awareness about specific issues and encourage compliance, issuing joint statements on a common topic of concern) 󠇖 participating in joint compliance sweeps 󠇖 conducting joint investigations 󠇖 informing about the launch of an enforcement action 󠇖 exchanging general information regarding an ongoing enforcement action, such as relating to its scope, topics addressed or resources required 󠇖 exchanging information on your DPA’s legal analysis relating to identified possible infringements during an ongoing enforcement action 󠇖 sharing internal documents relating to an ongoing enforcement action 󠇖 sharing documents produced by third parties relating to an ongoing enforcement action (e.g., investigated organization’s representations/submissions) 󠇖 requesting assistance to collect evidence or analyse data relating to an ongoing enforcement action 󠇖 informing about the existence of a past enforcement action, particularly if these are not publicly available 󠇖 informing about the legal findings of a past enforcement action, particularly if these are not publicly available 󠇖 requesting assistance for enforcing a decision 󠇖 any other [please specify] 5. Does your DPA cooperate on enforcement activities with DPAs outside of your country, including EEA - DPAs or DPAs from other countries with an EU adequacy decision? If so, please reply to the following questions: a. With which DPA(s) do you cooperate? b. Which legal instrument(s) did you use to frame such cooperation? c. On how many enforcement cases did you cooperate in the last 5 years? d. How did/do you cooperate with them (please specify relating to the categories listed in question 4)? e. Please provide the link to any related documents, if publicly available. 6. Does your DPA cooperate with regulators (in your country or outside your country) in areas other than data protection (e.g., competition law or consumer law)? 󠇖 Yes, only with regulators in my own country 󠇖 Yes, only with regulators in other countries 󠇖 Yes, with both regulators in my own country and with regulators in other countries 󠇖 No. 51 If you replied yes, please specify with which regulators (e.g. competition law, consumer law), what type of legal instruments you use and what types of cooperation they enable in practice: Part II: Legal and Practical considerations 7. Does your jurisdiction’s legal framework (data protection legal framework or other legal framework) include any provisions that require/encourage/enable international enforcement cooperation with other DPAs? If this is the case, please provide a short desc ription of the provision(s) in question. 8. Do you have national legal requirements which act as a barrier or which prevent your DPA from sharing personal data (e.g. when included in complaints or evidence gathered) when cooperating with DPAs from outside your country (such as EEA - DPAs or other DPAs from countries with an EU adequacy decision)? 9. Does your DPA share personal data with DPAs from outside of your country in the context of enforcement cooperation? If so, under which legal basis/bases? 10. Do you have national legal requirements that act as a barrier or prevent your DPA from sharing confidential information related to investigations (e.g. in a state of play, in evidence collected during an inspection, in questions asked, or in an investigate d party’s representations) in order to cooperate on enforcement activities with DPAs from outside your country (such as EEA - DPAs or a DPA from another country with an EU adequacy decision)? 11. Is your DPA aware of the EDPB Toolbox on essential data protection safeguards for enforcement cooperation between EEA data protection authorities and competent data protection authorities of third countries 116 ? If so, has your DPA used the EDPB Toolbox in practice? If so, please provide examples of the context in which you used it, as well as if and how it helped you cooperate internationally. 12. Is your DPA able to provide assistance to DPAs from outside of your country and use its investigatory powers on behalf of the requesting DPA (e.g. conducting an inspection following the request of another DPA)? If so, are there limitations to this and what are they? 116 It was adopted by the EDPB in the context of Article 50 GDPR and it is meant to list data protection safeguards in relation to data protection international cooperation. These safeguards can be concluded in addition to or inserted in an enforcement cooperation agreement between EEA DPAs and DPAs outside the EEA. The document is available here: https://www.edpb.europa.eu/system/files/2022 - 03/toolbox_on_essential_data_protection_safeguards_for_enforcement_cooperation_with_third_country_sas_en .pdf 52 13. If the answer to the first part of question 12 is yes, please set out which investigative powers your DPA has used to support investigations conducted by DPAs from outside your country (e.g. conducting an inspection following the request of another DPA). 14. At a high level, what is limiting your DPA’s ability to share information or undertake enforcement cooperation with DPAs from outside your country (especially if those limits are not already covered by the questions above)? Part III: Identifying best practices 15. Please provide good examples of past enforcement cooperation and practices which demonstrate the additional efficiency and benefits gained from international cooperation on data protection matters. Please provide additional information to understand the context of the co operation, the legal and technical instruments used, the level of cooperation achieved and the outcome. Part IV: Identifying solutions 16. Based on the answers you provided above, what technical and legal solutions could be identified to foster international enforcement cooperation among DPAs internationally? 17. Are there any other additional comments, which your DPA wishes to make towards the topic, which are not covered by the questionnaire? 53 AUTHOR’S DISCLAIMER This Report was prepared for the exclusive use and benefit of the EDPB and for no other person or purpose. EDPB may disclose this Report to the DPAs. This Report may be disclosed to any other third party only with the prior written permission of the author . This Report represents the views of the author, prepared using best efforts, and does not necessarily reflect the official position of the EDPB. The author makes no warranty or representation whatsoever concerning the accuracy or completeness of the info rmation or analyses contained in this Report, and shall not have any liability with respect thereto. This Report does not constitute a legal opinion, and nothing in this Report shall be construed as legal advice with respect to any particular matters cover ed herein; the contents of this Report are for general informational purposes only. An attorney in the relevant jurisdiction should always be consulted with respect to any particular legal matter. All liability with respect to actions taken or not taken ba sed on the contents of this Report are hereby expressly disclaimed. 54