On discharge in respect of the implementation of the general budget of the European Union for the financial year 2023, Section IX – European Data Protection Supervisor

PR_DEC_Other

1. PROPOSAL FOR A EUROPEAN PARLIAMENT DECISION

on discharge in respect of the implementation of the general budget of the European Union for the financial year 2023, Section IX – European Data Protection Supervisor

(2024/2028(DEC))

– having regard to the general budget of the European Union for the financial year 2023,

– having regard to the consolidated annual accounts of the European Union for the financial year 2023 (COM(2024)0272 – C100076/2024),

– having regard to the European Data Protection Supervisor’s annual report for 2023,

– having regard to the Court of Auditors’ annual report on the implementation of the budget concerning the financial year 2023, together with the institutions’ replies,

– having regard to the statement of assurance as to the reliability of the accounts and the legality and regularity of the underlying transactions provided by the Court of Auditors for the financial year 2023, pursuant to Article 287 of the Treaty on the Functioning of the European Union,

– having regard to Article 314(10) and Articles 317, 318 and 319 of the Treaty on the Functioning of the European Union,

– having regard to Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012, and in particular Articles 59, 118, 260, 261 and 262 thereof,

– having regard to Regulation (EU, Euratom) 2024/2509 of the European Parliament and of the Council of 23 September 2024 on the financial rules applicable to the general budget of the Union, and in particular Articles 59, 118, 266, 267 and 268 thereof,

– having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, and in particular Article 55 thereof,

– having regard to the opinion of the Committee on Civil Liberties, Justice and Home Affairs,

– having regard to Rule 102 of and Annex V to its Rules of Procedure,

– having regard to the report of the Committee on Budgetary Control (A100000/2025),

1. Grants the European Data Protection Supervisor discharge in respect of the implementation of the budget of the European Data Protection Supervisor for the financial year 2023 / Postpones its decision on granting the European Data Protection Supervisor discharge in respect of the implementation of the budget of the European Data Protection Supervisor for the financial year 2023;

2. Sets out its observations in the resolution below;

3. Instructs its President to forward this decision and the resolution forming an integral part of it to the European Data Protection Supervisor, the European Council, the Council, the Commission, the Court of Auditors, the Court of Justice of the European Union, the European Ombudsman and the European External Action Service, and to arrange for their publication in the Official Journal of the European Union (L series).

2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION

with observations forming an integral part of the decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2023, Section IX – European Data Protection Supervisor

(2024/2028(DEC))

– having regard to its decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2023, Section IX – European Data Protection Supervisor,

– having regard to Rule 102 of and Annex V to its Rules of Procedure,

– having regard to the opinion of the Committee on Civil Liberties, Justice and Home Affairs,

– having regard to the report of the Committee on Budgetary Control (A10-0000/2025),

A. whereas, in the context of the discharge procedure, the discharge authority wishes to stress the particular importance of further strengthening the democratic legitimacy of the Union institutions by improving transparency and accountability, and implementing the concept of performance-based budgeting and good governance of human resources;

B. whereas data protection is a fundamental right, protected by Union law and enshrined in Article 8 of the Charter of Fundamental Rights of the European Union;

C. whereas Article 16 of the Treaty on the Functioning of the European Union provides that compliance with the rules relating to the protection of individuals, with regard to the processing of personal data concerning them, is to be subject to control by an independent authority;

D. whereas Regulation (EU) 2018/1725 provides for the establishment of an independent authority, the European Data Protection Supervisor (the ‘EDPS’), responsible for protecting and guaranteeing the right to data protection and privacy, and tasked with ensuring that the institutions and bodies, offices and agencies of the Union embrace a strong data protection culture;

E. whereas the EDPS carries out its functions in close cooperation with fellow Data Protection Authorities (DPAs) as part of the European Data Protection Board (EDPB), and it serves the public interest while being guided by principles of impartiality, integrity, transparency and pragmatism;

1. Notes that the budget of EDPS falls under MFF heading 7 ’European public administration’, which amounted to a total of EUR 12,3 billion, i.e. 6,4 % of Union budget spending, in 2023; notes that the budget of the EDPS represented 0,18 % of MFF heading 7 appropriations;

2. Notes that the Court of Auditors (the ‘Court’), in its Annual Report (the ‘Court’s report’) for the financial year 2023, examined a sample of 70 transactions under Heading 7, of which 21 (30 %) contained errors; further notes that for five of those errors, which were quantified by the Court, the Court estimated a level of error below the materiality threshold;

3. Notes from the Court’s report its observation that administrative expenditure comprises expenditure on human resources including pensions, which in 2023 accounted for about 70 % of the total administrative expenditure, and on buildings, equipment, energy, communications and information technology; welcomes the Court’s renewed opinion that, overall, administrative spending is low risk;

4. Notes from the Court’s report that in 2023 it audited a salary payment of an official who had last made a declaration concerning rights to family and child allowance in 2020; echoes the Court’s concern that delays in receiving and verifying such declarations increase the risk of ineligible payments;

Budgetary and financial management

5. Notes that the final adopted budget for the EDPS was EUR 22 711 559 in 2023, which represents an increase of 12,06 % compared to 2022; notes that the budget of the EDPS also covers the work of the independent Secretariat of the European Data Protection Board (the ‘Board’); notes from the Annual report of the EDPS for 2023 (the ‘Annual Report’) that the adopted budget of the Board was EUR 7,67 million in 2023, including EUR 300 000 granted by means of an amending budget which was needed due to an increase in litigation activities in 2023;

6. Notes with satisfaction that the budget monitoring and planning efforts of the EDPS in the financial year 2023 resulted in a budget implementation rate of current year commitment appropriations of 96 % in 2023 (slightly lower than in 2022 when that rate was 98 %); further notes from the report on the EDPS annual accounts for 2023 that the current year payment appropriations execution rate was 84 % (lower than 88 % in 2022); notes in addition, from EDPS replies to the questionnaire submitted by the Committee on Budgetary Control for the 2023 budgetary discharge (the ‘Questionnaire’), that the execution rate of payment appropriations overall was 91,33 % in 2023, lower than 94,09 % in 2022;

7. Notes further that the amount of carry-overs (C8) from 2023 to 2024 was EUR 2 517 942,67 or 11,08 % of the total budget for 2023, compared to EUR 1 827 354,23 or 9,01 % of the total budget for 2022; notes that the execution rate of the C8 budget in 2023 was 76,65 % (higher than 73,77 % in 2022);

8. Welcomes an improvement in the average time to pay from 25 days in 2022 to 19 days in 2023, with 97,50 % of payments processed on time; notes that that improvement is also due to the EDPS having solved an old bug with the electronic payment system for invoices linked to mission costs; notes further a significant increase in the number of payments from 799 in 2022 to 1335 in 2023; observes in that context that the number of transactions is still lower than pre-pandemic levels due to changes in the way of working (such as hybrid meetings or virtual events for experts);

9. Notes that the effects of Russia’s war of aggression against Ukraine continued to create budgetary pressure on the EDPS in 2023, including through rising inflation and the consequent increase in energy costs, with the most affected budget lines being staff salaries, building security and rental costs, mission costs and services provided by external staff; commends in that context the EDPS for having re-adjusted its priorities and having implemented internal reallocation within budget chapters; understands that that budgetary optimisation was necessary in order to successfully manage the indexation of staff salaries and rental costs, as well as an increase in the costs of external lawyer support services due to an increased number of EDPS binding decisions which led to a bigger number of cases to be defended before the Court of Justice of the European Union (CJEU) with the help of external legal assistance; regrets in that context that the EDPS had to postpone some of its activities, such as a feasibility study on artificial intelligence;

10. Notes from the Questionnaire that the EDPS budget for staff missions increased by 28,90 % from EUR 251 000 in 2022 to EUR 323 421 in 2023 due to an increase in prices for flight tickets and hotel costs; notes that, as part of that budget, an amount of EUR 33 000 was dedicated for missions of the Supervisor in 2023; also notes, from the Annual Report, that the number of staff missions increased from 171 in 2022 to 246 in 2023;

Internal management, performance and internal control

11. Notes that the EPDS used nine key performance indicators (KPIs) to monitor its performance in 2023, in alignment with the main objectives of the EDPS Strategy 2020-2024 which is implemented through the Annual Management Plan; notes from the Annual Report that the EDPS over-delivered in almost all areas, as indicated by the results of KPIs for 2023, except for one KPI (the number of EDPS followers on some social media accounts); notes with concern that the EDPS encountered considerable challenges due to a growing workload and intricate data protection issues arising from the rapidly evolving digital landscape, as well as due to the extension of the EDPS mandate to supervisory activities (such as audits and investigations) and replies to consultations and prior consultations, all in the context of a limited budget; notes from the EDPS’ follow-up report to Parliament’s resolution on the implementation of the EDPS’ budget for 2022 (the ‘Follow-up Report’) that several legislative developments in the last two years have impacted the work and resources of the EDPS, due to the extension of Eurojust’s mandate, new information to be received by Europol under the Digital Services Act, the roll out of the new Union’s large-scale databases and interoperability framework in the justice and home affairs field and the entry into force of the Artificial Intelligence Act (the “AI Act”); calls on the Commission and on the budgetary authority to take those matters into consideration during the annual budgetary procedure;

12. Welcomes the fact that, in 2023, the EDPS strengthened its ability to assess and prepare for emerging technological trends and their potential impact on privacy and data protection; notes that this was achieved through a foresight-based approach, with a focus on monitoring developments in areas such as large language models, digital identity wallets, the internet of behaviours, extended reality, and deep fake detection; welcomes in that context the publication by the EDPS of its third TechSonar initiative on emerging technologies; congratulates moreover the EDPS for having been awarded the GPA Global Privacy and Data Protection Awards 2023 in the category of innovation;

13. Notes that 2023 was marked by several organisational changes or updates that were needed in order to respond and adapt to the evolving data protection challenges; welcomes in this context the appointment of a Secretary-General from 1 July 2023; notes in addition the transition of two sectors into units such as ‘Information and Communication’ and ‘Governance and Internal Control’ and the creation of three new specialised sectors under the ‘Technology and Privacy’ (T&P) unit: ‘Systems Oversight and Audit’, ‘Technology Monitoring and Foresight’ and ‘Digital Transformation’;

14. Notes that the EDPS received 420 complaints, i.e. 53 more than in 2022, out of which 73 were admissible and 347 inadmissible in 2023; notes that the EDPS issued a final decision, opinion or reply in 31 out of 73 complaint cases received in 2023 within 44 days on average and responded to all 347 inadmissible complaints received; notes that, out of all admissible complaints (ongoing and received in 2023), 55 cases were finalised in 2023, which represents an increase of 17 % compared to 2022; acknowledges the efforts made by the EDPS to reduce the high number of complaints by developing a dynamic tool on the EPDS’ website, although the volume of complaints remained challenging due to limited resources in 2023; notes with satisfaction that the EDPS developed various procedural tools and policies to enhance its investigatory processes in 2023; commends in that context the EDPS for having amended its Rules of Procedure, whereby the “review procedure” is replaced by a “preliminary assessment” in order to safeguard the right to be heard of all the involved parties, thus contributing to a fair and timely handling of complaints and investigations;

15. Underlines the important role of consultation and advice of EDPS in the legislative process; notes that, pursuant to Article 42(1) of Regulation (EU) 2018/1725, the EDPS responded to 80 formal legislative consultations and its advice took the form of 54 opinions (27 in 2022), 26 formal comments (49 in 2022) and 34 informal comments (30 in 2022) to the Commission and to the co-legislators in response to legislative consultation requests in 2023; commends the EDPS for its input with regard to the AI Act, in particular EDPS’ own-initiative opinion on the AI Act and advice on the AI liability rules, as well as for EDPS’ input to the GPA resolution on generative AI systems; acknowledges a significant increase (+93 %) of consultation requests over the last five years;

16. Notes that, in 2023, the EDPS carried out eight investigations and five pre-investigations, marking a significant increase compared to previous years; notes that in 2023 the EDPS was actively involved in a total of 13 investigations and seven pre-investigations, either launched in 2023 or carried over from prior years; notes that the EPDS continued two complex and resource-intensive formal investigations from 2021 into the use by European Union Institutions, Bodies and Agencies (EUIBAs) of cloud services from non-EU/EEA entities, including a focus on the Commission's use of Microsoft 365; notes further that the EDPS also launched five investigations based on complaints about EUIBAs' websites, focusing in a broad way on privacy and data protection issues, with preliminary assessments expected in 2024;

17. Notes that the EDPS investigated the Commission's alleged use of micro-targeting on platform X and continued two pre-investigations: one case concerning EUIBAs’ use of Trello cloud service, which was closed in 2023 and another one on EUIBAs’ use of profiling, which was carried out in 2024; notes that a total of six investigations and four pre-investigations (one pre-investigation in 2022) were launched in the Area of Freedom, Security, and Justice (FSJ), reflecting a significant increase from 2022; notes the EDPS’ concerns with regard to the challenges that may arise in the case of investigations where joint action between national authorities and EUIBA’s is needed; notes in addition that, as part of its audit plan for 2023, the EDPS audited the following bodies: the European Personnel Selection Office, the European Investment Bank, the European Central Bank, the European Centre for Disease Prevention and Control and the European Medicines Agency;

18. Recalls that in 2022 the EDPS brought an action for the annulment of two provisions of the amended Europol Regulation before the CJEU, which was later rejected by the CJEU; notes that meanwhile the EDPS decided to appeal the General Court ruling in case T-578/22, believing the issues raised should be addressed at the highest level; acknowledges that the EDPS did not challenge an act by Europol, but a retroactive change in the legal framework aimed at neutralising the effects of the EDPS’ enforcement actions; notes that Europol did not support the defendant co-legislators in that case; notes further that the EDPS also followed up on the implementation of its Order of 3 January 2022, including checks on Europol’s reporting, whereas a final report on that matter was communicated by the EDPS on 22 July 2024;

19. Notes that, after the pilot implementation of the new risk management framework at the EDPS in late 2022, an anonymous satisfaction survey was conducted in May 2023 to assess its effectiveness and gather additional suggestions; notes further that the survey results were positive, leading to the formal adoption of the framework on 26 June 2023;

20. Notes that the internal audit service (IAS) carried out an audit on the methodology for the planning of EDPS audits in the EDPS in 2023; notes that the audit was concluded with two recommendations for which the EDPS submitted an action plan to the IAS; calls on the EDPS to keep the discharge authority informed on the progress made in that matter;

Human resources, equality and staff well-being

21. Notes that, at the end of 2023, the EDPS had 129 members of staff, compared to 127 in 2022; notes that the EDPS employed 50 contract staff (CA) under Article 3(b) of the Staff Regulations of Officials and the Conditions of Employment of Other Servants (52 CA in 2022), 7 temporary agents (TA) under Article 2(b) and 2(c) (6 TA in 2022) and used the services of 12 external services providers (EXT) working intra-muros in 2023 (8 EXT in 2022); notes that the EDPS had 23 nationalities (from the Member States) represented among its staff in 2023, which is, despite the over-representation of five nationalities, an excellent score for such a small institution and an improvement in comparison with 22 nationalities in 2022;

22. Notes a high occupancy rate of the establishment plan of 95,65 % but also a high turnover rate of 13 % in 2023; notes that most of the unfilled positions were a result of candidates being unsuitable, given the EDPS’ need for highly specialised profiles and the small pool of eligible candidates; welcomes the addressing of those challenges through republication with a wider or more targeted dissemination of the vacancy or by redrafting the requirements; calls on the EDPS to continue to address the challenges in finding suitable candidates and to keep the discharge authority informed about improvements on staff recruitment and turnover;

23. Notes that, in the second half of 2023, the EDPS’ human resources (HR) team launched a pilot for a new on-boarding process for newcomers, with sessions that cover, inter alia, presentations of core units’ work, ethics, procurement procedures and information security, whereas three on-boarding sessions were offered in 2023; invites the EDPS to continue offering to newcomers “on-boarding” sessions that include ethics training, as they have become the standard in the European institutions; notes moreover that 12 individual sessions were offered for EDPS and EDPB staff, six sessions of group coaching in which participants (manager level) learned from each other, as well as a one-year team coaching with a designer for leadership development at the European School of Administration in 2023;

24. Notes, from the Questionnaire, that the EDPS offers flexible and hybrid working arrangements, that are well-received by members of staff who can benefit, inter alia, from parental leave, time credits, part-time work or working from abroad for a limited number of days per year; notes that, in 2023, the majority of staff made use of those working conditions, whereas 86,30 % of staff were on teleworking in 2023;

25. Commends the EDPS for carrying out several awareness-raising actions during the year 2023 with information sharing on elimination of racial discrimination, International Women’s Day, EU diversity month and learning about neurodiversity; notes that currently the EDPS does not employ staff with disabilities but has an equal opportunities clause included in all EDPS vacancy notices and actively encourages applications from candidates with disabilities;

26. Notes from the Questionnaire that the EDPS considers confidential any information on burnout cases, including the number thereof; disagrees with that opinion and asks the EDPS to provide the discharge authority with the number of burnout cases on a yearly basis; notes with satisfaction that, in 2023, there were no harassment cases reported at the EDPS; welcomes the fact that, in 2023, the EDPS continued to provide an anti-harassment presentation delivered by one of the EDPS’ confidential counsellors, as part of the induction training called the ‘EDPS Welcome Day’; commends the publication of the decision on anti-harassment and the role of the confidential counsellors on the EDPS’ intranet;

Ethical framework and transparency

27. Notes that, in 2023, the EDPS focused its efforts on increasing staff awareness of the EDPS/EDPB ethical framework by organising mandatory dedicated training sessions for all staff and induction trainings for EDPS/EDPB newcomers, appointing a new ethics officer and participating in the ‘Comité Paritaire des Questions Statuaries’ working group on ethics; welcomes the establishment of a mailbox by the EPDS, where members of staff can submit their requests regarding any ethics related inquiries, as well as the use of Commission’s Ethics module in Sysper; encourages the EDPS to continue raising awareness and organising surveys to assess the level of staff awareness of the EDPS/EDPB ethical framework;

28. Welcomes the overall high level of transparency achieved by the EDPS concerning its activities, in particular as regards the publication of the agenda and the declaration of interests of the Supervisor and of the Head of EDPS Administration, in line with the Supervisor’s code of conduct of 2019; notes from the Follow-up Report that the EDPS has adopted two codes of conduct, whereas one of them applies to the Supervisor and the other one applies to the EDPS staff; understands that in cases when the Secretary-General is called to replace the Supervisor, the latter’s code of conduct also applies to the Secretary-General;

29. Notes that, out of five inquiries opened by the Ombudsman in 2023 concerning the EDPS, four were closed without any further inquiry; notes that, for one enquiry, the decision was still pending and expected for Q4 2024; calls on the EDPS to keep the discharge authority informed as to the outcome of this enquiry;

30. Notes from the Follow-up Report that, with a view to formally joining the Union’s Transparency Register (TR), the EDPS has launched an internal assessment on transparency measures, whereas in 2023 exploratory meetings and exchanges of the EDPS with secretariat of the TR took place; calls on the EDPS to inform the discharge authority of the outcome of that assessment exercise; reiterates its call on the EDPS to join the TR;

31. Notes with satisfaction that, in 2023, the EPDS established internal rules applicable to the hearing of persons that could be affected by an EDPS final decision adopted in own-initiative investigations and inquiries in order to ensure the proper exercise of their fundamental right to be heard in such proceedings; commends the EPDS for publishing a new factsheet on EDPS Investigations and a new EDPS Investigation Policy as well as for ensuring that all financial reports, including annual budgets, accounting and audit reports, are made publicly accessible through a Union institution website and other official channels, as the EPDS takes a leading role in enhancing the cybersecurity preparedness of the Union institutions;

32. Notes from the Questionnaire that no cases of conflicts of interest, whistleblowing or fraud were reported in the EDPS in 2023; notes that the EDPS has set up a framework to prevent conflicts of interest at the level of senior management and staff through codes of conduct, awareness raising and declarations of absence of conflicts of interest and confidentiality; notes that, in addition to the mandatory introduction to the ethical framework of the EDPS for all new members of staff, new members of staff are also introduced to the EDPS’ anti-fraud strategy;

33. Notes from the Questionnaire that the EDPS has internal rules on whistleblowing, which define safe routes and channels through which staff may raise concerns about fraud, corruption or any other serious wrongdoing, without prejudice to the confidentiality of the identity of the whistleblower and of the information reported; notes that, so far, there has never been a whistleblowing case reported to the EDPS;

Digitalisation, cybersecurity and data protection

34. Notes from the Questionnaire that the 2023 budget for IT equipment and projects was 9,5 % lower compared to 2022; notes that that decrease was primarily because no new IT feasibility studies were being commissioned in 2023, as opposed to 2022 where such studies represented a substantial portion of the IT budget; notes further that other cost elements remain relatively stable between the two years, including general IT services and maintenance;

35. Notes from the Follow-up Report and the Questionnaire the conclusions of the IT feasibility study carried out in 2022, whereby there are gaps between what the IT tools and services provided by the Commission and Parliament can offer and the specific needs of the EDPS; notes that those gaps should be addressed by developing in-house capabilities and applications for which a minimum of five IT staff and partial outsourcing EDPS was deemed necessary; regrets that, due to budgetary constraints, implementation of the recommendations of the study remained on hold; calls on the EDPS to consider a step-by-step approach by starting with those recommendations and projects that would require fewer resources;

36. Commends the progress made in 2023 by the EDPS in digitalising its workflows and processes, with the introduction of ARES, the qualified digital signature (e-IDAS) and a collaborative platform (Nextcloud) for drafting documents and video-conferencing, as well as updates to the tool (Website Evidence Collector) that automates the collection of personal data processing on websites of data controllers and processors, the adoption of the acceptance environment of EU Send Web, a service/channel to exchange sensitive non-classified information with other EUIBAs and further progress made towards implementing services that cannot be outsourced, such as the form and the electronic workflow to manage data breach notifications; notes nevertheless issues with regard to the use and maintenance of the e-procurement system;

37. Acknowledges that the EDPS successfully relies on many of the administrative systems used by the Commission, particularly in the field of HR and business administration processes, as well as on some of Parliament’s services, including the provision of laptops, network infrastructure and video-conferencing; commends the fact that the project to improve the quality and performance of the computers provided to EDPS staff, in collaboration with Parliament, with a view to the generalisation of hybrid work, has been completed;

38. Acknowledges the leading role of EDPS in enhancing the cybersecurity preparedness of the Union institutions, while working closely with bodies such as European Union Agency for Cybersecurity (ENISA) and cybersecurity hubs such as CERT-EU; notes that, in 2023, the EDPS continued to improve its readiness to protect personal data and sensitive information against cyber-attacks in view of the rapidly changing cybersecurity threat landscape; commends in that context the EDPS for reviewing its security policies and methodologies in preparation for the impact of the Cybersecurity Regulation (Regulation (EU, Euratom) 2023/2841); notes from the Questionnaire that the EDPS introduced a request for two additional full-time equivalents to cover cybersecurity infrastructure in connection with EDPS’s obligations under that Regulation as well as the EDPS’ role as a member of the Interinstitutional Cybersecurity Board (IICB); notes further with appreciation that the EPDS upgraded its Information Security Policy and the EDPS Acceptable Use Policy to address specific cybersecurity threats in relation to teleworking, use of personal mobile devices and banning of dangerous applications (TikTok); notes that the EDPS did not encounter any cyber-attacks in 2023;

39. Commends the EDPS for updating cybersecurity training for all staff and revamping the security training model for newcomers; appreciates that the EPDS has been proactive in raising awareness about cyber security risks, for instance by preparing fact sheets, conducting surveys with EUIBAs and running awareness campaigns;

Buildings

40. Notes that, in 2023, as in 2022, the EDPS and EDPB were the sole tenants of Parliament’s building where they were located, following the move of the Ombudsman at the end of 2021 to keep the rental and maintenance costs at a reasonable level; notes that the EDPS had to request an additional EUR 81 856,84 for paying rental costs to Parliament, given that the indexation rate was 8,82 % and thus higher than the 2 % ceiling for administrative expenditures;

41. Notes that, in terms of accessibility of its building, the EDPS relies on the decisions taken and implemented by Parliament, as part of their building policy; notes from the Follow-up Report that the EDPS employs staff with physical impairments due to serious illness; welcomes the commitment of the EDPS to explore the possibilities of hiring trainees with reduced mobility or disabilities;

Environment and sustainability

42. Notes that the EDPS has not joined the Eco-Management and Audit Scheme (EMAS) but has implemented several measures to reduce its environmental footprint, such as regulating the temperature automatically and centrally, turning lights off automatically when there is no movement in the room, purchasing eco-friendly products and services and automating the workflows with the introduction of ARES; notes from the Follow-up Report that according to the information received by Parliament’s Directorate-General for Infrastructure and Logistics, responsible for the management of the building rented by the EDPS, solar panels are installed on that building; asks the EDPS to inform the discharge authority to report on the share (%) of the solar-panel produced electricity in EDPS’ total energy consumption needs per year; calls further on the EDPS to inform the discharge authority of any new developments regarding the EMAS certification process;

43. Notes that the EPDS has not assessed its carbon footprint in 2023; welcomes, however, that the EDPS continues to apply measures that reduce the carbon footprint by reducing the travel of journey to the office through teleworking possibilities, reimbursing 50 % of staff’s monthly/annual subscriptions for the use of public transport, encouraging the staff to favour videoconferencing and train travel for short distances, managing the cycle for invoices electronically and achieving an entirely paperless selection procedure and appraisal exercise as regards HR;

44. Notes that the EDPS addresses sustainability-related risks (such as environmental, social and governance risks) in a comprehensive way through an annual risk assessment exercise; welcomes in that context that the EDPS adopted its new risk management process in 2023, which should help the EDPS to target and better analyse those risks and consequently better calibrate mitigating actions;

Interinstitutional cooperation

45. Welcomes the budgetary and administrative savings achieved by the EDPS through inter-institutional cooperation, particularly the conclusion of service-level agreements with Parliament for the rental of its premises and the use of IT system applications, hardware supplies and maintenance and with the Commission for HR and business administration processes, as well as through participation in large interinstitutional framework contracts in areas such as IT consultancy, interim services and office supplies; commends in addition the EDPS for maintaining a structured cooperation with the Ombudsman, the Agency for Fundamental Rights and CERT-EU through memorandums of understanding;

46. Notes that the EDPS participates in meetings of various interinstitutional bodies; welcomes in this context the participation of the EPDS in meetings of the Heads of Administration and the Interinstitutional Online Communication Committee, led by Parliament’s Directorate-General for Communication; acknowledges that interinstitutional cooperation with EDPS, in his supervisory role, is of key importance for the other Union institutions to enhance their level of compliance with the data protection legal framework;

47. Welcomes the pivotal role played by the EDPS in 2023 in the coordination of the Data Protection Authorities of the Member States (DPAs) to promote consistent data protection across the Union; notes that the EDPS joined 26 DPAs in a coordinated enforcement action on the role and tasks of data protection officers (DPOs), assessing their compliance with Regulation (EU) 2018/1725; notes the continued active involvement of the EPDS in the Coordinated Supervision Committee (CSC) within the area of FSJ addressing issues such as handling complaints against Europol and enhancing cooperation processes; appreciates furthermore all the other steps taken to improve cooperation between the EDPS and the DPAs such as the conduction of a joint Europol inspection with national authorities (Poland and Lithuania) and the participation in the coordinated supervisory action on processing minors' data in Europol systems, the participation in an operational visit to the European Delegated Prosecutor’s office in Lisbon under a Working Arrangement with Portugal's DPA and the coordination of an onsite inspection in Lesvos with Greece’s DPA to verify data collection practices during Joint Operations by Frontex; acknowledges that those interinstitutional engagements help the EDPS align with best practices of Union institutions and benefit from the exchange of information with peer departments;

Communication

48. Notes that the budget for public communication and promotional activities in 2023 amounted to EUR 468 000, which represented an increase of 54 % compared to 2022;

49. Notes with satisfaction that the EDPS organised several communication events online as well as in person in 2023, aimed at raising awareness of EDPS’ role and mission among a wider public and the importance of respecting Union data protection rules, such as Data Protection Day, the EDPS Trainees’ conference (twice a year), the EDPS Seminar on the essence of the fundamental rights to privacy and data protection, and other international events;

50. Notes that the EDPS communicates online via its website and its social media accounts on X (ex-twitter) (29 400 followers), LinkedIn (71 000 followers), YouTube (2 900 followers), EU-Voice (5 900 followers) and EU-Video (750 followers);

51. Notes that the pilot project of the platforms EU Voice and EU Video (free and open-source social media networks, privacy-oriented and based on Mastodon and PeerTube software) continued in 2023; welcomes in that context the EDPS’ contribution to the Union's strategy on data and digital sovereignty in order to promote the Union's independence in the digital world and compliance with the data protection legal framework.