What changed

1. Notes that the Court of Auditors’ report on the implementation of the budget concerning the financial year 2022 does not contain any remarks about the European Data Protection Supervisor (EDPS); reiterates its call on the Court to include the annual accounts of the EDPS in its yearly audit and issue a report, considering the importance of transparency for the proper functioning of all Union bodies;

2. Notes with satisfaction the 2022 annual report published by the EDPS; emphasises the role of EDPS with supervising and advising the data processing operations of European institutions, offices and bodies (EUIs); welcomes the conference “The Future of Data Protection: Effective Enforcement in the Digital World”, organised by EDPS, bringing over 2 000 participants, discussing how to safeguard effectively individuals’ rights to privacy and data protection; recalls that this conference contributed to the Commission proposal for a Regulation laying down additional procedural rules relating to the enforcement of the General Data Protection Regulation;

3. Acknowledges the follow up actions by EDPS on the Schrems II judgement, especially focusing in 2022 on the EUIs’ contracts with private entities, in particular large ICT providers, and on arrangements between EUIs and non-EU/EEA public bodies or international organisations;

3. Regrets that the occupancy rate of establishment plan is lower than the target 2022; acknowledges the shortage of skilled professionals; encourages the Supervisor to examine useful strategies to increase visibility of its vacancies;

4. Welcomes the training provided to EUIs, the Memorandum of Understanding signed by EDPS and the European Union Agency for Cybersecurity (ENISA) in December 2022; welcomes specifically the EDPS’s participation in the Coordinated Supervision Committee (CSC) ensuring the coordinated supervision of Europol, Eurojust and EPPO;

4. Welcomes the follow up actions by EDPS on the Schrems II judgement, especially focusing in 2022 on the EUIs’ contracts with private entities, in particular large ICT providers, and on arrangements between EUIs and non-EU/EEA public bodies or international organisations;

5. Notes the order of the General Court of the Court of Justice of the European Union in Action brought on 16 September 2022 - EDPS v Parliament and Council (Case T-578/22) by which the action against the amended Europol regulation was deemed inadmissible; further recalls, as regards any effects of the contested provisions on the EDPS’s decision of 3 January 2022, the EDPS cannot rely on them, since an administrative decision cannot affect legislative acts, or affect the content thereof; welcomes the efforts by Europol to address EDPS recommendations which substantially increased in 2022;

5. Welcomes the training provided to EUIs, the Memorandum of Understanding signed by EDPS and the European Union Agency for Cybersecurity (ENISA) in December 2022; welcomes specifically the EDPS’s participation in the Coordinated Supervision Committee (CSC) ensuring the coordinated supervision of Europol, Eurojust and EPPO; underlines the importance of EDPS supervision and enforcement work to ensure that EUIs operating in the police and justice area fully comply with the applicable EU data protection acquis;

6. NotesWelcomes the follow-up done by the EDPS regarding the citizen’s data access request; highlightsnotes that EDPS issued a decision in the case before all facts had been checked and established; notes with concern that the EDPS decision has been challenged by both the complainant and Europol; acknowledges that the EDPS review is currently suspended due to the matter being heard by a national Court; urgesstresses the importance to adapt human and financial resources to the increasing EDPS workload accordingly; recognises the need for additional technical qualified employees to reviewensure itsthe rulesproper follow-up of procedurethe ofEDPS ensuringtasks; andrecommends timelyEDPS to review its working process in light of the case particularly for the complaints by citizens, taking into account all relevant information and to inform the discharge authority on the progress made in this area;

7. Welcomes that, as a response to the COVID-19 pandemic, EDPS established an internal task force to monitor and assess the EU’s and EUIs’; welcomes that EDPS has been involved in activities relating to the assessment of actions, initiatives and proposals by EUIs as controllers, together with the evaluation of proposed technological solutions to fight the COVID-19 pandemic and the issuance of guidance for EUIs in order to assist the EUIs to adequately fight the pandemic, while ensuring compliance with data protection law;

8. Notes the European Ombudsman’s inquiry in case 1995/2022/OAM against the EDPS closed in 2022, which referred to access to documents; concluding that there was no maladministration by the EDPS in refusing full public access to documents 8-10 and that the EDPS has settled the second aspect of the complaint in relation to the documents falling within the scope of the request by giving further partial access to one document wrongly redacted at initial stage; invites EDPS to consider establishing a policy of ‘transparency by design’ and publish documents linked to EDPS activities in a proactive manner, within a reasonable time frame and in a user-friendly and accessible way;

INFORMATION ON ADOPTION IN COMMITTEE ASKED FOR OPINION

Date adopted

23.1.2024

Result of final vote

+:

–:

0:

52

0

4

Members present for the final vote

Magdalena Adamowicz, Abir Al-Sahlani, Katarina Barley, Pietro Bartolo, Theresa Bielowski, Patrick Breyer, Saskia Bricmont, Jorge Buxadé Villalba, Damien Carême, Patricia Chagnon, Lena Düpont, Lucia Ďuriš Nicholsonová, Cornelia Ernst, Laura Ferrara, Nicolaus Fest, Maria Grapini, Sylvie Guillaume, Andrzej Halicki, Evin Incir, Sophia in ‘t Veld, Patryk Jaki, Marina Kaljurand, Assita Kanko, Łukasz Kohut, Moritz Körner, Alice Kuhnke, Jeroen Lenaers, Juan Fernando López Aguilar, Erik Marquardt, Javier Moreno Sánchez, Maite Pagazaurtundúa, Diana Riba i Giner, Isabel Santos, Birgit Sippel, Vincenzo Sofo, Tineke Strik, Jana Toom, Milan Uhrík, Tom Vandendriessche, Elissavet Vozemberg-Vrionidi, Javier Zarzalejos

Substitutes present for the final vote

Cyrus Engerer, José Gusmão, Beata Kempa, Janina Ochojska, Anne-Sophie Pelletier, Bergur Løkke Rasmussen, Róża Thun und Hohenstein, Maria Walsh, Tomáš Zdechovský

Substitutes under Rule 209(7) present for the final vote

Andrus Ansip, Hildegard Bentele, Maria da Graça Carvalho, Leopoldo López Gil, Marisa Matias, Caroline Nagtegaal

ANNEX: ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR HAS RECEIVED INPUT

The rapporteur declares under his exclusive responsibility that he did not receive input from any entity or person to be mentioned in this Annex pursuant to Article 8 of Annex I to the Rules of Procedure.

FINAL VOTE BY ROLL CALL IN COMMITTEE ASKED FOR OPINION

Key to symbols:

+: in favour

-: against

0: abstention