The European Commission recently released its first review of two years of application of the General Data Protection Regulation (GDPR). René Mahieu and Jef Ausloos do not agree with the largely positive self-assessment and explain their main points of contention by summarising their own submission to the Commission.