What changed

1. Grants the European Data Protection Supervisor discharge in respect of the implementation of the budget of the European Data Protection Supervisor for the financial year 2023 / Postpones its decision on granting the European Data Protection Supervisor discharge in respect of the implementation of the budget of the European Data Protection Supervisor for the financial year 2023;

1. Grants the European Data Protection Supervisor discharge in respect of the implementation of the budget of the European Data Protection Supervisor for the financial year 2023;

9. Notes that the effects of illegal Russia’s war of aggression against Ukraine continued to create budgetary pressure on the EDPS in 2023, including through rising inflation and the consequent increase in energy costs, with the most affected budget lines being staff salaries, building security and rental costs, mission costs and services provided by external staff; commends in that context the EDPS for having re-adjusted its priorities and having implemented internal reallocation within budget chapters; understands that that budgetary optimisation was necessary in order to successfully manage the indexation of staff salaries and rental costs, as well as an increase in the costs of external lawyer support services due to an increased number of EDPS binding decisions which led to a bigger number of cases to be defended before the Court of Justice of the European Union (CJEU) with the help of external legal assistance; regrets in that context that the EDPS had to postpone some of its activities, such as a feasibility study on artificial intelligence; calls on the EDPS to abide to the competences of its mandate with a collaborative approach with the Union institutions and agencies and to avoid initiating any legal action, especially those which are manifestly inadmissible, in order to avoid negative repercussions on the management of resources, which do not allow the EDPS to carry out its activities as an Institution;

10. Notes from the Questionnaire that the EDPS budget for staff missions increased by 28,90 % from EUR 251 000 in 2022 to EUR 323 421 in 2023 due to an increase in prices for flight tickets and hotel costs; notes that, as part of that budget, an amount of EUR 33 000 was dedicated for missions of the Supervisor in 2023; also notes, from the Annual Report, that the number of staff missions increased from 171 in 2022 to 246 in 2023;

10. Expresses concern about the significant increase in EDPS staff mission costs, from EUR 28 789 in 2021 and EUR 176 903 in 2022, to EUR 284 580 in 2023; calls on the EDPS to assess whether the resources spent on missions are being used appropriately and effectively; notes that the EDPS ceased making public the number of missions funded by organisers, as well as information on which unit or sector participated in each mission, thus reducing transparency regarding mission expenses; calls on the EDPS to reinstate this practice; encourages the EDPS to promote the use of video-conferencing tools where suitable, as this could contribute to lowering the number of missions and reducing costs; calls on the EDPS to assess whether the resources spent on missions are being used appropriately and effectively.

14. Emphasises the role of the EDPS in supervising the processing of personal data by Union institutions, bodies, offices and agencies; notes with concern the length of proceedings before the EDPS, as the EDPS did not close a single investigation in 2023, but in comparison to the previous year, in 2023, the number of notifications beyond the 72 hours significantly decreased;

16.17. Notes that, in 2023, the EDPS carried out eight investigations and five pre-investigations, marking a significant increase compared to previous years; notes that in 2023 the EDPS was actively involved in a total of 13 investigations and seven pre-investigations, either launched in 2023 or carried over from prior years; notes that the EPDS continued two complex and resource-intensive formal investigations from 2021 into the use by European Union Institutions, Bodies and Agencies (EUIBAs) of cloud services from non-EU/EEA entities, including a focus on the Commission's use of Microsoft 365; urges the finalisation of those investigations on time because of their significant impact on the working of institutions; notes further that the EDPS also launched five investigations based on complaints about EUIBAs' websites, focusing in a broad way on privacy and data protection issues, with preliminary assessments expected in 2024;

18. Urges the EDPS to prioritise and enhance procedures for handling the personal data of minors under 15, particularly in the context of Europol’s systems, where such individuals may be marked as suspects; recognises the heightened vulnerability of that group and the need for robust safeguards;

18.20. Recalls that in 2022 the EDPS brought an action for the annulment of two provisions of the amended Europol Regulation before the CJEU,General Court, which was later rejected by the CJEU;rejected; notes that meanwhile the EDPS decided to appeal the order of the General Court ruling in case T-578/22, believing the issues raised should be addressed at the highest level; acknowledgesregrets that the EDPS did not realise the manifest inadmissibility of its appeal, even if the institution did not intend to challenge an act by Europol, but a retroactive change in the legal framework aimed at neutralising the effects of the EDPS’ enforcement actions; notescalls on the institution to cooperate with Union institutions and agencies, before initiating legal proceedings that Europolprevent didthe notfulfilment supportof its mandate and the defendantuse co-legislatorsof inits thatresources case;for purposes for which they were intended; notes further that the EDPS also followed up on the implementation of its Order of 3 January 2022, including checks on Europol’s reporting,reporting; whereasregrets athat the final report on that matter was communicated by the EDPS only on 22 July 2024;

Human resources, equality and staff well-being

23. Recalls the Treaty on the European Union that the EU and its institutions shall promote solidarity and equality between women and men;

21. Notes that, at the end of 2023, the EDPS had 129 members of staff, compared to 127 in 2022; notes that the EDPS employed 50 contract staff (CA) under Article 3(b) of the Staff Regulations of Officials and the Conditions of Employment of Other Servants (52 CA in 2022), 7 temporary agents (TA) under Article 2(b) and 2(c) (6 TA in 2022) and used the services of 12 external services providers (EXT) working intra-muros in 2023 (8 EXT in 2022); notes that the EDPS had 23 nationalities (from the Member States) represented among its staff in 2023, which is, despite the over-representation of five nationalities, an excellent score for such a small institution and an improvement in comparison with 22 nationalities in 2022;

HR, equality and staff well-being

22. Notes a high occupancy rate of the establishment plan of 95,65 % but also a high turnover rate of 13 % in 2023; notes that most of the unfilled positions were a result of candidates being unsuitable, given the EDPS’ need for highly specialised profiles and the small pool of eligible candidates; welcomes the addressing of those challenges through republication with a wider or more targeted dissemination of the vacancy or by redrafting the requirements; calls on the EDPS to continue to address the challenges in finding suitable candidates and to keep the discharge authority informed about improvements on staff recruitment and turnover;

24. Notes that, at the end of 2023, the EDPS had 129 members of staff, compared to 127 in 2022; notes that the EDPS employed 50 contract staff (CA) under Article 3(b) of the Staff Regulations of Officials and the Conditions of Employment of Other Servants (52 CA in 2022), 7 temporary agents (TA) under Article 2(b) and 2(c) (6 TA in 2022) and used the services of 12 external services providers (EXT) working intra-muros in 2023 (8 EXT in 2022); encourages the EDPS to continue its efforts towards a more balanced geographical representation among all Member States specifically at managerial level; welcomes the increased diversity of nationalities represented, but notes with regret the continued underrepresentation of women in senior management positions; calls for the adoption of a gender parity roadmap, including proactive recruitment measures and leadership training programs for female staff members;

23. Notes that, in the second half of 2023, the EDPS’ human resources (HR) team launched a pilot for a new on-boarding process for newcomers, with sessions that cover, inter alia, presentations of core units’ work, ethics, procurement procedures and information security, whereas three on-boarding sessions were offered in 2023; invites the EDPS to continue offering to newcomers “on-boarding” sessions that include ethics training, as they have become the standard in the European institutions; notes moreover that 12 individual sessions were offered for EDPS and EDPB staff, six sessions of group coaching in which participants (manager level) learned from each other, as well as a one-year team coaching with a designer for leadership development at the European School of Administration in 2023;

25. Notes that the EDPS had 23 nationalities (from the Member States) represented among its staff in 2023, which is an improvement in comparison with 22 nationalities in 2022; notes with dissatisfaction the over-representation of five nationalities and an underrepresentation of other nationalities; urges the EDPS to continue its efforts to achieve a balanced geographical distribution of nationals from all Member States within its staff, by improving communication, fostering visibility, and enhancing job conditions to attract underrepresented nationalities;

24. Notes, from the Questionnaire, that the EDPS offers flexible and hybrid working arrangements, that are well-received by members of staff who can benefit, inter alia, from parental leave, time credits, part-time work or working from abroad for a limited number of days per year; notes that, in 2023, the majority of staff made use of those working conditions, whereas 86,30 % of staff were on teleworking in 2023;

26. Observes that, in 2023, the EDPS maintained a workforce comprising 65 % women and 35 % men, consistent with trends from previous years; regrets the absence of women in senior management roles, despite achieving gender parity among the six middle management positions; urges the EDPS to intensify its efforts to ensure gender-balanced representation across all staff levels, and invites the EDPS to promote the application of women also with a view to the next election of the Supervisor by Parliament;

27. Notes a high occupancy rate of the establishment plan of 95,65 % but also a high turnover rate of 13 % in 2023; notes that most of the unfilled positions were a result of candidates being unsuitable, given the EDPS’ need for highly specialised profiles and the small pool of eligible candidates; welcomes the addressing of those challenges through republication with a wider or more targeted dissemination of the vacancy or by redrafting the requirements; welcomes the steps taken by the EDPS regarding the hiring process; calls on the EDPS to continue to address the challenges in finding suitable candidates and to keep the discharge authority informed about improvements on staff recruitment and turnover;

28. Notes that, in the second half of 2023, the EDPS’ HR team launched a pilot for a new on-boarding process for newcomers, with sessions that cover, inter alia, presentations of core units’ work, ethics, procurement procedures and information security, whereas three on-boarding sessions were offered in 2023; invites the EDPS to continue offering to newcomers “on-boarding” and to all members of staff mandatory sessions that remind the importance of principles such as ethics, conflicts of interest, transparency, internal control and anti-fraud, as they have become the standard in the Union institutions; notes moreover that 12 individual sessions were offered for EDPS and EDPB staff, six sessions of group coaching in which participants (manager level) learned from each other, as well as a one-year team coaching with a designer for leadership development at the European School of Administration in 2023;

29. Notes, from the Questionnaire, that the EDPS offers flexible and hybrid working arrangements, that are well-received by members of staff who can benefit, inter alia, from parental leave, time credits, part-time work or working from abroad for a limited number of days per year; notes that, in 2023, the majority of staff made use of those working conditions, whereas 86,30 % of staff made use of teleworking arrangements in 2023; considers that the building infrastructure should be optimised to reflect that high rate of teleworking, which could contribute to reducing operational costs and ensuring more efficient use of office space; welcomes the EDPS’ continued efforts to actively improve physical and mental well-being of its staff;

34. Notes with satisfaction that the EDPS has never been involved in any investigations by the European Anti-Fraud Office (OLAF) since its establishment;

30.36. NotesRegrets that the EDPS has still not formally joined the Union’s Transparency Register (TR); nevertheless notes from the Follow-up Report that, with a view to formally joining the Union’s Transparency Register (TR),TR, the EDPS has launched an internal assessment on transparency measures, whereaswhereas, in 20232023, exploratory meetings and exchanges of the EDPS with secretariat of the TR took place; calls on the EDPS to inform the discharge authority of the outcome of that assessment exercise; reiterates its call on the EDPS to join and use the TR;TR, including for the proactive disclosure of meetings with any third parties, to ensure transparency in EDPS’ regulatory and advisory functions;

40. Urges the EDPS to publicly disclose any recusals due to conflicts of interest in its enforcement decisions, ensuring full transparency in regulatory oversight and decision-making;

44. Welcomes the EDPS's focus on ensuring that external contractors meet the necessary moral and ethical standards expected of all Union institutions, bodies, offices and agencies, particularly in light of the previous use of external companies by EDPS that, according to Yale University's ranking, continue to operate in Russia;

38.46. Acknowledges the leading role of EDPS in enhancing the cybersecurity preparedness of the Union institutions, while working closely with bodies such as European Union Agency for Cybersecurity (ENISA) and cybersecurity hubs such as CERT-EU; urges it to develop a structured audit framework for cybersecurity risks within Union bodies; notes that, in 2023, the EDPS continued to improve its readiness to protect personal data and sensitive information against cyber-attacks in view of the rapidly changing cybersecurity threat landscape; commends in that context the EDPS for reviewing its security policies and methodologies in preparation for the impact of the Cybersecurity Regulation (Regulation (EU, Euratom) 2023/2841); notes from the Questionnaire that the EDPS introduced a request for two additional full-time equivalents to cover cybersecurity infrastructure in connection with EDPS’s obligations under that Regulation as well as the EDPS’ role as a member of the Interinstitutional Cybersecurity Board (IICB); notes further with appreciation that the EPDS upgraded its Information Security Policy and the EDPS Acceptable Use Policy to address specific cybersecurity threats in relation to teleworking, use of personal mobile devices and banning of dangerous applications (TikTok); notes that the EDPS did not encounter any cyber-attacks in 2023; calls for annual public reporting on detected threats, response measures, and institutional cyber resilience;

39.47. Commends the EDPS for updating cybersecurity training for all staff and revamping the security training model for newcomers; appreciates that the EPDS has been proactive in raising awareness about cyber security risks, for instance by preparing fact sheets, conducting surveys with EUIBAs and running awareness campaigns; encourages the EDPS to ensure that staff receives compulsory training on the safe and ethical use of AI tools to enhance their understanding and mitigate potential risks;

52. Urges the EDPS to adopt the EMAS to systematically monitor and improve its environmental footprint, particularly in terms of energy consumption, waste reduction, and sustainable office policies;

56. Calls for closer cooperation between the EDPS, the Court of Auditors, OLAF, and the European Public Prosecutor’s Office (EPPO) to develop common protocols for fraud detection in digital data and financial transactions within EU institutions; stresses the need for joint audits on AI-based fraud risks;