Ah no. The EU countries have agreed, that the home country of the organization (not the country of the data subject) will take the lead in any GDPR enforcement.

Facebook in EU is registered in Ireland.

Ireland is making a mockery of GDPR, slow walking investigations while paying lip service to GDPR.

Ireland is a leech. They've figured out that they can attract global companies through very lenient tax auditing and (now) GDPR enforcement. A little tax is better than none. As such they are undermining the rest of EU when it comes to actions against companies like Facebook, Google, Microsoft.

This is wrong, in every country there is national data protection authority who you should contact.

"EU countries have set up national bodies responsible for protecting personal data in accordance with Article 8(3) of the Charter of Fundamental Rights of the EU." Source: https://ec.europa.eu/info/law/law-topic/data-protection/data... https://edpb.europa.eu/about-edpb/board/members_en

It is correct that as a data subject you should file any complaints about GDPR with the data protection agency of your country of residence. However, that agency will refer the complaint/case to the data protection agency of the company in question.

You may lodge a complaint with the designated data protection agency in Germany, but when they establish that the complaint is against Facebook residing in Ireland, they will refer the complaint to Ireland. Ireland clearly sees slow walking complaints as a competitive advantage.

Thank you for detailed explanation I get it now.

> Ireland is a leech.

Eh, a leech that took the brunt of the real estate crunch for the EU? A leech would have let the German banks fold instead of paying bond holders.

> Ireland is making a mockery of GDPR, slow walking investigations while paying lip service to GDPR.

Slow walking is pushing it - the agreement to allow home countries be the enforcement authority put a massive burden on a really small country and its civil service. Ireland's population is 4.7 (about 1/2 that of London on its own). Our DPC offices are overwhelmed by the number of requests, and hiring people to deal with the uptick is taking time. We also have a lot of the majorly complex GDPR cases, as we have FB, GOOG, MSFT, etc, along with a ... interesting ... relationship with the Catholic Church, which has ... views ... on what the GDPR means for them.

Isn't Ireland is home to these business because they have lower corporate taxes than the rest of the EU? Lower taxes likely make it harder to fund the regulatory agencies that should oversee these companies, which were intentionally courted to Ireland with lower taxes.

I don't disagree with you, but it seems to be largely a problem of Ireland's own making.

Sure, that is definitely part of it, but without those companies, our income tax take would be lower, so we are probably in a net positive.

Thanks for this information. I was unaware.

As this is the process though, I'm still going to say that this is the logical next step.

Likely the only way to get any movement on this is with public outcry, and if this issue gets enough attention, would be good to show not only the flaws in Facebook's system, but also any flaws in GDPR enforcement.

That's all well and good, until you realise the actual resources the DPA's are working under. Here in Finland it's a tiny organisation [1] and it was reported that they are completely overwhelmed with all the problems post-GDPR.

[1] https://tietosuoja.fi/etusivu

Same in my country. Here the DPA is providing summaries of cases + reasoning to the public, so that it can be refered to when making GDPR requests to companies in similar cases, making it more likely to get compliance.

Exactly.