Eight countries to miss EU data protection deadline

The legislation is needed to ensure national authorities will have the necessary resources to impose sanctions for a law known as the general data protection regulation (GDPR).

"Inevitably there will be some kind of legal uncertainty and the commission doesn't like to see that," Vera Jourova, the European commissioner for justice, told reporters on Thursday (17 May).

Jourova said she would not hesitate to take the EU capitals to court in serious cases, noting that member states have had more than enough time to get their acts together. She blamed negligence and domestic debates for the delays.

"I think there was enough time," she said, noting that the draft final version of the regulation agreed by EU states had been sorted in December 2015.

The regulation gives people living in the EU control over how companies exploit their personal data anywhere in the world in an effort to uphold their privacy rights.

It has also rattled big Internet firms like Facebook and caused panic among smaller companies given violations could amount to either four percent of their annual global turnover or up to €20m in fines.

But some data authorities say they will still be able to impose sanctions and fines regardless of the missing national legislation.

"Our understanding is that there is no doubt that the information commissioner has authority to act as inspection body also under GDPR and issue fines as regulated by current Slovene legislation," Slovenia's data authority told EUobserver, in an email.

Only Austria, Germany, France, Croatia, the Netherlands, Sweden and Slovakia are ready with everyone else set to have their national acts passed by 25 May.

Others like Spain, Italy, Portugal, Romania and Latvia are expected to be ready either end of May or beginning of June.