Aye, there's the rub
"better training for local authorities in data protection law and information security"
It's not _training_ that's lacking, it's _education_. You can train a monkey but you can't educate him. Learning to use the word processor du jour is training, not education. Getting a tiger to sit on a stool or an elephant to dance in a circus act is training, not education. MCSE qualification is the result of training, not education.
Information security is a subject that demands intelligence and familiarity with a surprisingly broad range of matters. The practitioners have to be able to think, to devise new and novel solutions to unanticipated problems as they arise. You can't train people to do that stuff.
There is a pernicious meme floating around the intellectual landscape, much beloved of the military, the ISO, NuLabour, and other elements of the corporatist political system that now rules the world: that you can document complex processes and then anyone can carry them out simply by going by the book. Ain't so. Never has been, never will be.
"Captain, which button do I push to blow up Moscow?"
"Don't know; look in the manual."
One suspects this meme is viewed by ignorant corporate powers as a way of eliminating the expense of hiring intelligent, independently minded staff and substituting for them ignoramuses hired at the nearest bus stop.
ISO 9001, my ass!