Who Bears the Burden? The Digital Omnibus and the Redistribution of Supervisory Costs

Abstract The Digital Omnibus package is presented as a technical simplification of the digital rulebook, with significant estimated savings for both businesses and public administrations. Its accompanying analysis, however, measures only the cost lifted from regulated entities: owing to the methodology of the Standard Cost Model, on which the cost–benefit analysis of the Digital Omnibus’ impact relies, supervisory authorities and courts mostly remain outside the calculus. The article suggests – examining the amendments to Articles 4(1) and 22 GDPR – that the reform does not eliminate the burden currently arising from data protection law but, rather, re-allocates it away from controllers and toward authorities, courts and data subjects, in the form of violations left undetected and remedies delayed in time. As a result – and absent countermeasures such as a corresponding strengthening of authorities’ resources – the reform entails the risk of undermining the effectiveness of supervision and, in turn, the protection of fundamental rights in the digital environment.