On discharge in respect of the implementation of the general budget of the European Union for the financial year 2024, Section IX – European Data Protection Supervisor

1. PROPOSAL FOR A EUROPEAN PARLIAMENT DECISION

on discharge in respect of the implementation of the general budget of the European Union for the financial year 2024, Section IX – European Data Protection Supervisor

(2025/2154(DEC))

The European Parliament,

– having regard to the general budget of the European Union for the financial year 2024,

– having regard to the consolidated annual accounts of the European Union for the financial year 2024 (COM(2025)0359 – C100154/2025),

– having regard to the European Data Protection Supervisor’s annual report for 2024,

– having regard to the Court of Auditors’ annual report on the implementation of the budget concerning the financial year 2024, together with the institutions’ replies,

– having regard to the statement of assurance as to the reliability of the accounts and the legality and regularity of the underlying transactions provided by the Court of Auditors for the financial year 2024, pursuant to Article 287 of the Treaty on the Functioning of the European Union,

– having regard to Article 314(10) and Articles 317, 318 and 319 of the Treaty on the Functioning of the European Union,

– having regard to Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012, and in particular Articles 59, 118, 260, 261 and 262 thereof,

– having regard to Regulation (EU, Euratom) 2024/2509 of the European Parliament and of the Council of 23 September 2024 on the financial rules applicable to the general budget of the Union, and in particular Articles 59, 118, 266, 267 and 268 thereof,

– having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, and in particular Article 54 thereof,

– having regard to Rule 102 of and Annex V to its Rules of Procedure,

– having regard to the opinion of the Committee on Civil Liberties, Justice and Home Affairs,

– having regard to the report of the Committee on Budgetary Control (A100000/2026),

1. Grants the European Data Protection Supervisor discharge in respect of the implementation of the budget for the financial year 2024 / Postpones its decision on granting the European Data Protection Supervisor discharge in respect of the implementation of the budget for the financial year 2024;

2. Sets out its observations in the resolution below;

3. Instructs its President to forward this decision and the resolution forming an integral part of it to the European Data Protection Supervisor, the European Council, the Council, the Commission, the Court of Auditors, the Court of Justice of the European Union, the European Ombudsman and the European External Action Service, and to arrange for their publication in the Official Journal of the European Union (L series);

2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION

with observations forming an integral part of the decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2024, Section IX – European Data Protection Supervisor

(2025/2154(DEC))

The European Parliament,

– having regard to its decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2024, Section IX – European Data Protection Supervisor,

– having regard to Rule 102 of and Annex V to its Rules of Procedure,

– having regard to the opinion of the Committee on Civil Liberties, Justice and Home Affairs,

– having regard to the report of the Committee on Budgetary Control (A10-0000/2026),

A. whereas in the context of the discharge procedure, the discharge authority wishes to stress the particular importance of further strengthening the democratic legitimacy of the Union institutions by improving transparency and accountability, and implementing the concept of performance-based budgeting and good governance of human resources (HR);

B. whereas data protection is a fundamental right, protected by Union law and enshrined in Article 8 of the Charter of Fundamental Rights of the European Union;

C. whereas Article 16 of the Treaty on the Functioning of the European Union provides that compliance with the rules relating to the protection of individuals, with regard to the processing of personal data concerning them, shall be subject to control by an independent authority;

D. whereas Regulation (EU) 2018/1725 provides for the establishment of an independent authority, the European Data Protection Supervisor (the ‘EDPS’), responsible for protecting and guaranteeing the right to data protection and privacy, and tasked with ensuring that the institutions and bodies, offices and agencies of the Union embrace a strong data protection culture;

E. whereas the EDPS carries out its functions in close cooperation with fellow Data Protection Authorities (DPAs) as part of the European Data Protection Board (EDPB), and it serves the public interest while being guided by principles of impartiality, integrity, transparency and pragmatism and respects Union legislation;

F. whereas Union citizens need a digital environment that is not controlled by opaque interests, and initiatives that promote digital sovereignty ensuring that individuals, not companies or unaccountable systems, are at the centre of data governance in the Union;

1. Notes that the budget of EDPS falls under MFF Heading 7 ’European public administration’, which amounted to a total of EUR 13,3 billion, i.e. 6,9 % of EU budget spending, in 2024; notes that the budget of the EDPS represented 0,18 % of MFF Heading 7 appropriations;

2. Notes that the Court of Auditors (the ‘Court’), in its Annual Report for the financial year 2024 (the ‘Court’s report’) examined a sample of 70 transactions under the heading ‘Administration’, the same number as in 2023; whereas the Court further states that administrative expenditure comprises expenditure on HR, including expenditure on pensions, which in 2024 accounted for approximately 69 % of the total administrative expenditure, and expenditure on buildings, equipment, energy, communications and information technology (IT), and that its work over many years indicates that, overall, that administrative expenditure is low risk;

3. Notes that 16 (23 %) of the 70 transactions contained errors but that the Court, based on the three errors which were quantified, estimates the level of error to be below the materiality threshold; notes that the Court’s report did not identify any specific issues concerning the EDPS;

Budgetary and financial management

4. Notes that the final adopted budget for the EDPS was EUR 24 329 460 in 2024, which represents an increase of 7,12 % compared to 2023 (EUR 22 711 559); notes that the budget of the EDPS also covers the work of the independent Secretariat of the EDPB; notes from the Annual Report of the EDPS for 2024 (the ‘Annual Report’) that the adopted budget of the EDPB was EUR 8,36 million in 2024 (compared to EUR 7,67 million in 2023);

5. Notes with satisfaction that the budget monitoring and planning efforts of the EDPS in the financial year 2024 resulted in a budget implementation rate of current year commitment appropriations of 96 % in 2024 (the same as in 2023); further notes from the report on the EDPS annual accounts for 2024 that the current year payment appropriations execution rate was 84 % (the same as in 2023); notes in addition, from EDPS replies to the questionnaire submitted by the Committee on Budgetary Control for the 2023 budgetary discharge (the ‘Questionnaire’), that the execution rate of payment appropriations overall was 91,88 % in 2024, higher than 91,33 % in 2023;

6. Notes further that the amount of carry-overs (C8) from 2024 to 2025 was EUR 2 649 943 (i.e. 10,89 % of the total budget for 2024) compared to EUR 2 517 942 in 2023 (i.e. 11,08 % of the total budget for 20234); notes that the execution rate of the C8 budget in 2024 was 77,37 % (compared to 76,65 % in 2023);

7. Notes that the average time to pay was 20 days in 2024 compared to 19 days in 2023, with 96,87 % of payments processed on time (up from 92,73 % in 2023); notes further that there was an increase in the number of payments from 1 335 in 2023 to 1 440 in 2024; notes that the EDPS encountered some technical difficulties in 2024 due to running two different IT systems in parallel (Commission’s SUMMA and EDPS’ ABAC systems) which required the manual re-encoding and other manual interventions; notes that SUMMA is expected to be introduced at the EDPS in 2026;

8. Notes from the Questionnaire that the EDPS’ overall missions budget decreased by 17,86 % from EUR 323 421 in 2023 to EUR 265 630 in 2024 due to a decrease in travel and related costs as a result of increased participation in remote/hybrid meetings; notes, from the Annual Report, that the number of staff missions also decreased, from 246 in 2023 to 218 in 2024; notes that, as part of that budget, an amount of EUR 38 418 was dedicated for 23 missions of the Supervisor in 2024 which increased from EUR 33 000 for 24 missions in 2023, mainly due to the location of important meetings and events that the Supervisor was required to attend, including several missions in the United States and Mexico in 2024; notes that, concerning missions to the country of origin of high ranking officials, the Supervisor took only 3 missions to Poland in 2024 (out of the total of 23), while the EDPS’ Secretary-General (SG) conducted 15 missions, nine of which were to Spain, in 2024;

9. Notes from the Questionnaire that, in the context of Russia’s war of aggression against Ukraine, inflationary pressures on contracts and services were addressed by the EDPS by revising cost estimates during the year and reallocating resources through transfers made in accordance with Article 29(1) and (4) of the Financial Regulation, providing for contingency margins and reassessing priorities to ensure servicing EDPS core processes; invites the EDPS to continue carrying out regular reviews to identify areas of under-execution and reallocate funds where needed during the year; acknowledges the need for all Union institutions to improve their budget management by also taking into account price volatility, especially in the energy sector, when concluding contracts with service providers;

10. Notes that the EDPS launched and awarded 66 procurement procedures, of which 45 were of a very low value, two were negotiated procedures without prior publication, nine were specific contracts for the establishment of a list of individual experts and one was a framework contract of EUR 200 000 with PricewaterhouseCoopers; notes that the majority of contracts are signed by the EDPS with small and medium sized-enterprises through very low-value or low-value procedures;

Internal management, performance and internal control

11. Notes that the EPDS used nine key performance indicators (KPIs) to monitor its performance in 2024, in alignment with the main objectives of the EDPS Strategy 2020-2024 implemented through the Annual Management Plan; notes from the Annual Report that the EDPS met or surpassed the targets sets in all KPIs, except for one KPI (the number of followers of the EDPS on some social media accounts);

12. Notes the EDPS’ various roles such as DPA and, as of 1 August 2024, as Notified Body, Notified Authority and Market Surveillance Authority (MSA) in charge of supervising and enforcing Regulation (EU) 2024/1689 of the European Parliament and of the Council onto the Union institutions, bodies and agencies (EUIBAs), whereas for the latter role the EDPS will have enforcement powers from 2 August 2026 only; notes with appreciation that, in that context, the EDPS has been working on the governance structures and procedural frameworks necessary to exercise its new tasks and powers as MSA under Regulation (EU) 2024/1689, including by launching AI Act Correspondents Network in 2024 which attracted the participation, despite voluntary, of all EUIBAs;

13. Notes that on 1 October 2024, to address its new supervisory tasks, the EDPS established an AI unit which in 2024 was composed of two staff reassigned internally; notes from the Questionnaire that, as of 2025, for that unit the EDPS has a budget that covers two permanent posts and five contract agents for which recruitment procedures have taken place; notes however from the Questionnaire the EDPS’ view that those resources remain insufficient to cover those new tasks, in particular the supervision of AI systems in the area of border control, migration, justice and law enforcement or the establishment of an AI regulatory sandbox for EUIBAs, as provided for in Article 57(3) of Regulation (EU) 2024/1689; further notes from the EDPS’ follow-up report to Parliament’s resolution on the implementation of the EDPS’ budget for 2022 (the ‘Follow-up Report’) that, also due to budgetary constraints, the EDPS could not launch the feasibility study on artificial intelligence in 2024;

14. Notes with regard to technology monitoring and foresight, that the EDPS, through its Technological and Privacy unit, focused on artificial intelligence in 2024; notes in this context some of the topics addressed by the EDPS such as: - the processing of neurodata by neurotechnologies, covered by the ‘TechDispatch on neurodata’ issued by the EDPS together with the Spanish DPA in June 2024 and; - the automated decision-making and its human oversight, addressed at a thematic seminar jointly organised with European Union Agency for Cybersecurity (ENISA) and Karlstad University in September 2024; notes with appreciation that in November 2024 the EDPS published the 4th edition of its Techsonar initiative which was focused on six AI trends such as: retrieval-augmented generation, on-device AI, machine unlearning, multimodal AI, scalable oversight and neuro-symbolic AI; underlines that it is important for the EDPS to accumulate the knowledge necessary to enforce its powers under Regulation (EU) 2024/1689once the EUIBAs will start using emerging technologies to process personal data; notes, moreover, that in 2024 the EDPS issued first guidelines for EUIBAs to ensure data protection compliance when using generative AI systems, as well as three Supervisory Opinions on the use of AI tools by Europol and Eurojust;

15. Acknowledges an ever increasing number of complaints from one year to the other, whereas most of the complaints relate to the Commission and are submitted by staff of the EUIBAs; notes that the EDPS received 663 complaints, i.e. 202 more than in 2023, out of which 108 were admissible, and 555 inadmissible in 2024; notes that the EDPS issued a final decision, opinion or reply in 77 (i.e. an increase of 33 % compared to 2023) out of 108 complaint cases received in 2024 and responded to all inadmissible complaints received; notes that, out of all admissible complaints received in 2024, 48 cases were finalised in 2024, which is a decrease from 55 cases in 2023; notes that 104 admissible complaints (an increase from 71 cases in 2023), including those submitted before 2024, were ongoing at the end of 2024; acknowledges the efforts made by the EDPS to reduce the high number of complaints and encourages it to further streamline its complaint handling by seeking e.g. a common understanding of the complaint handling procedure with the national DPAs, in particular in the area of Freedom, Security and Justice where investigations are complex and lengthy; notes that the EDPS received 125 personal data breach notifications in 2024, up from 77 notifications in 2023;

16. Underlines the important role of consultation and advice of the EDPS in the Union’s legislative process, not only at the early stage of preparation of the Commission’s legislative proposals, but also by providing comments or opinions on compromise amendments on trilogue negotiations upon requests from Parliament and its Committees; notes that, pursuant to Article 42(1) of Regulation (EU) 2018/1725, the EDPS responded to 97 formal legislative consultations (80 in 2023) and its advice took the form of 25 opinions (54 in 2023), 45 formal comments (26 in 2023) and 27 informal comments (34 in 2023) to the Commission and to the co-legislators in response to legislative consultation requests in 2024;

17. Notes the EDPB’s key role in harmonising guidance, procedure, enforcement processes and practice of Supervisory Authorities (SAs) across Member States; notes in this context that EDPB in 2024 took no binding decision, issued 28 consistency opinions, adopted two new guidelines, issued four statements on legislative developments, implemented and coordinated several programmes as regards enforcement cooperation; notes further that EDPB provides the secretariat of the Coordinated Supervision Committee (CSC), which is a group of national SAs and the EDPS) that ensures coordinated supervision of the Union’s large-scale IT systems, whereas in 2024 such supervision was extended to the Visa Information System, on top of the preparation work carried out for the supervision of European Travel Information and Authorisation System (ETIAS);

18. Notes with satisfaction that the EDPS developed various procedural tools and policies to enhance its investigatory processes in 2024; commends in this context the EDPS for having amended its Rules of Procedure in 2024, whereby the “review procedure” was replaced by a “preliminary assessment” in order to safeguard the right to be heard of all the involved parties; notes that as of July 2024, EUIBAs can share their views on the preliminary assessment before the EDPS takes a decision that could adversely affect them; notes that these procedural safeguards contribute to a fair and timely handling of complaints and investigations; notes that in 2024 the EDPS also reviewed investigation methodologies, developed a manual on access to the file, enhanced litigation preparedness, updated the internal complaints case manual and improved hearing recordings and transcription processes;

19. Notes from the Annual Report and the Follow-up Report the EDPS’ special attention regarding processing of children’s data, in particular in law enforcement contexts; notes that one of the audits carried out by the EDPS in 2024 was on the processing of children’s personal data in research projects managed by the Commission’s Joint Research Centre in Spain, in particular with regard to child-robot interaction; notes with satisfaction that in October 2024, the EDPS attended the G7 DPAs Roundtable in Rome, on the occasion of which the DPAs issued a “Statement on AI and Children” urging action to safeguard children’s privacy and ensure AI fosters trust while protecting the most vulnerable; recalls that the EDPS carried out the annual inspection on Europol’s processing of data about minors under 15 marked as suspects; notes that the EDPS inspection report asks Europol to conduct its own assessment on the lawfulness of data received and raises concerns on whether Europol meets the threshold of ‘strict proportionality’ for the processing of data on minors suspected of minor infractions;

20. Notes that EUIBAs may consult the EDPS for guidance on planned processing operations and data protection; notes that the EDPS issued advice in 26 consultation and 26 supervisory opinions on various topics; notes in particular that in December 2024 the EDPS published a supervisory opinion regarding Parliament’s plan to use biometrics to attest Members’ attendance for daily allowances payments;

21. Notes that, in 2024, the EDPS carried out four investigations and two pre-investigations, which is a decrease compared to 2023; notes among the most notable cases a pre-investigation on automated decision-making in trainee selection, an investigation on the Commission’s use of Microsoft 365 and one pre-investigation on profiling in public access applications; notes with regard to the Commission’s use of Microsoft 365 that the investigation found multiple violations of the Regulation (EU) 2018/1725 which prompted the EDPS to order the Commission to suspend all data flows to Microsoft and its affiliates outside the Union/European Economic Area (EEA) by 9 December 2024; calls on the EDPS to keep the discharge authority informed of the outcome of the follow-up regarding the Commission’s compliance with the EDPS’ recommendations in this case; notes further that the EDPS continued five investigations into EUIBAs’ website practices focusing on third-party components and consent requests in 2024; notes that the EDPS conducted three audits in 2024, with on-site visits, on topics such as health data processing, retention periods and research involving minors;

22. Recalls that in 2022 the EDPS brought an action for the annulment of two provisions of the amended Regulation (EU) 2016/794 of the European Parliament and of the Councilbefore the Court of Justice of the European Union (CJEU), which was later rejected by the CJEU, but then appealed by the EDPS at the General Court ruling in case T-578/22, believing the issues raised should be addressed at the highest level; notes from the Follow-up Report that the EDPS is refraining from commenting on that appeal, as it is ongoing; recalls that bringing legal matters before the CJEU by the EDPS in its supervisory role should not be seen as affecting the loyal cooperation and good relations between the EDPS and the entities it supervises;

23. Notes that the 2024 exercise for the assessment of the EDPS’ Internal Control Standards confirmed a satisfactory level of internal control with all 14 standards present and functioning; notes that a working group was formed to analyse results and propose improvements, such enhancements in training and development and knowledge and document management; notes from the Questionnaire that the EDPS’ updated risk management framework introduced a structured follow-up which has enabled the organisation to ensure mitigation efforts remain effective and consistently monitored; notes further that the EDPS updated its procedure on ex-post controls which are now risk-based and reinforced business continuity and the audit trail through integration of ARES system, training, and improved knowledge management processes;

24. Notes from the Questionnaire that the Commission’s Internal Audit Service (IAS) launched one audit in 2024, on governance for IT services provided by Parliament to the EDPS, which resulted in two recommendations currently being implemented by the EDPS; notes with regard to an audit from 2023 on the ‘methodology for the planning of EDPS audits’ that one of the two recommendations issued by the IAS has been addressed while implementation of the other recommendation (on the design of methodology to establish the EDPS audit plan) has been postponed for when the new Supervisor will be appointed; calls on the EDPS to keep the discharge authority informed on the progress made in this matter;

Human resources, equality and staff well-being

25. Notes that, at the end of 2024, the EDPS had 137 members of staff, compared to 129 in 2023; notes that the EDPS employed 55 contract staff (CAs) under Article 3(b) of the Staff Regulations of Officials and the Conditions of Employment of Other Servants (50 CA in 2023), 9 temporary agents (TA) under Article 2(b) and 2(c) (7 TAs in 2023) and used the services of 10 external services providers (EXT) working intra-muros in 2023 (12 EXT in 2022); invites the EDPS to reflect on the way to reduce the number of CAs in favour of permanent contracts to guarantee talent retention and business continuity; notes that the EDPS had 23 nationalities from the Member States in 2024 (the same as in 2023) represented among its staff, which is, despite the over-representation of 5 nationalities, an excellent score for such a small institution;

26. Notes a high occupancy rate of the establishment plan of 98,80 % (compared to 95,65 % in 2023) but also a high turnover rate of 12 % in 2024 (compared to 13 % in 2023); notes that most of the unfilled positions were a result of candidates being unsuitable; notes with satisfaction from the Follow-up Report that the EDPS addressed these challenges by developing a comprehensive staff retention and talent attraction strategy which was adopted in the beginning of 2025, with short, medium and long-terms actions for retention of experienced staff, mitigation of turnover risks and improvement of the EDPS’ attractiveness as an employer;

27. Notes with regard to gender breakdown of EDPS staff, that 63 % were women and 37 % were men in 2024, along the same trend as in previous year, when the distribution between women and men was respectively to 65 % and 35 %; notes a gender balance among middle managers, with three men and three women, but regrets a continued underrepresentation of women in senior management positions; calls on the EDPS to continue its efforts to achieve a gender balanced representation of staff;

28. Notes that the EDPS hired 20 trainees from the Commission’s Blue Book Traineeship programme which were paid a monthly allowance of around EUR 1 500 and one unpaid trainee on the basis of an academic internship agreement; renews its emphasis that traineeships should be remunerated in compliance with European Parliament resolution of 14 June 2023 with recommendations to the Commission on quality traineeships in the Union (2020/2005(INL)), which calls for all internships in the Union to be paid;

29. Notes the activities carried out by the EDPS for the development of its HR in 2024; notes that it adopted a new policy on online learning platforms, joined the new inter-institutional job shadowing programme with five EDPS staff shadowing Commission’s staff, organised an away day for staff dedicated to AI preparedness and other cohesion building activities; notes the launching of a cross-unit working group to develop initiatives in favour of equality, inclusion and diversity;

30. Notes, from the Questionnaire, that the EDPS offers flexible and hybrid working arrangements, that are well-received by members of staff who can benefit inter alia from parental leave, time credits, part-time work or working from abroad for a limited number of days per year; notes that the next staff satisfaction survey, covering teleworking, was planned for 2025;

31. Notes that currently the EDPS does not employ staff with disabilities but has an equal opportunities clause included in all EDPS vacancy notices and actively encourages applications from candidates with disabilities; notes that the EDPS corporate website is built on a content management system that is aligned with essential standards for accessible web design and any additional functionalities developed for that website are created with accessibility as a key requirement;

32. Notes from the Questionnaire the EDPS’ reply whereby the EDPS has no access to medical files of its staff and is not in the position to know the root cause of absences, as they are validated by the Medical Service of the Commission; notes that the EDPS only has access to aggregated data such as the number of sick-leave days and whether they are accompanied by a medical certificate; notes that the increase from 2023 to 2024 in the number of sick leave days, i.e. from 1 680,50 to 1 946 (+15,80 %) outpaced the increase in the number of staff from 129 to 137 (i.e. +6,20 %); notes that the average duration of sickness per person also increased, from 14,7 days in 2023 to 18,30 in 2024, and that the sick leave rate increased from 3,60 % in 2023 to 3,9 % in 2024; is worried by the current situation and continues to request a clearer evaluation of staff wellbeing to identify possible recurrent causes of burnout, cases of which should be reported yearly to the discharge authority as every other institution;

33. Notes from the Questionnaire that there were no harassment cases reported at the EDPS in 2024; appreciates that, in 2024, the EDPS continued to provide an anti-harassment presentation delivered by one of the EDPS’ Confidential Counsellors, during the onboarding for newcomers’ session; commends the publication of the decision on anti-harassment and the role of the confidential counsellors on the EDPS’ intranet;

Ethical framework and transparency

34. Notes that the EDPS has set up a framework to prevent conflicts of interest at the level of senior management and staff through codes of conduct, awareness raising and declarations of absence of conflicts of interest and confidentiality (DOICs); notes that all staff joining the EDPS have to sign a DOIC; notes that in 2024 no cases of conflicts of interest or whistleblowing were registered at the EDPS; notes with concern that one case of alleged fraud was reported in the EDPS in 2024, which the Commission’s disciplinary office (IDOC) investigated; notes in this case that IDOC closed the inquiry in 2025 with the recommendation made to the EDPS to initiate disciplinary proceedings in accordance with the Staff Regulations; invites the EDPS to keep the discharge authority informed on final outcome of that matter;

35. Notes that, in 2024, the EDPS continued organising induction trainings covering its ethical framework (on harassment, whistleblowing, conflicts of interest) and anti-fraud strategy for EDPS/EDPB newcomers; notes that the EDPS’s ethics officer submits every year an ethics report to the EDPS/EDPB management and participates in the ‘Comité Paritaire des Questions Statuaries’ working group on ethics; notes with satisfaction that the EDPS has put in place a mailbox where members of staff can submit their requests regarding any ethics related inquiries; encourages the EDPS to continue raising awareness and organising surveys to assess the level of staff awareness to the EDPS/EDPB ethical framework;

36. Welcomes the overall high level of transparency achieved by the EDPS concerning its activities, including as regards the publication of the agenda and the declaration of interests of the Supervisor and of the SG; notes with satisfaction from the Questionnaire that, following an internal assessment on transparency measures performed in 2023-2024, the EDPS adopted a decision in 2025 whereby the Supervisor, the SG and the EDPS staff holding managerial responsibilities will meet interest representatives only if registered in the Union’s Transparency Register; welcomes that with that decision the EDPS is part of the Union’s Transparency Register, whose Management Board was duly notified;

37. Notes that the EDPS was subject to an enquiry by the European Ombudsman on a case initiated in 2023 which was closed in 2024 with a finding of maladministration; notes that the finding concerned the time taken by the EDPS to complete its assessment of a complaint within a reasonable timeframe and for not having proactively informed the complainant about the case’s progress; appreciates, as a result, that the EDPS took action to improve its procedures, whereby staff are now required to proactively update complaints and suspend investigations when awaiting court rulings or decisions from other bodies on the same matter; notes from the Questionnaire that the EDPS was involved in three European Anti-Fraud Office (OLAF) investigations in 2024 which are ongoing; invites the EDPS to keep the discharge authority informed on these matters;

38. Notes that, in accordance with Article 9 of the EDPS’ Code of Conduct, the Supervisor and the SG are bound by the duty of integrity, discretion and confidentiality for three years after they have ceased to hold office; notes that no senior official left or joined the EDPS in 2024;

Digitalisation, cybersecurity and data protection

39. Notes from the Questionnaire that the 2024 expenditure for IT equipment and projects was 10 % higher compared to 2023 due to additional cybersecurity consultancy; notes further that other cost elements remained relatively stable between the two years, including general IT services and maintenance;

40. Notes the advancements made by the EDPS on its journey towards digital transformation in 2024; notes in particular that the EDPS integrated EU Send (service/channel to exchange sensitive non-classified information with other EUIBAs), adopted ServiceNow for IT support (creating a unified helpdesk portal for staff), implemented SECABC (an inter-institutional framework for secure information exchange) and migrated to the Commission’s on-premises Container-as-a-Service; notes that one permanent official and one CA are dedicated to the EDPS’ digital transformation; acknowledges from the Questionnaire and the Follow-up Report the EDPS’ budgetary constraints that prevent the establishment of a team of at least five IT specialists covering 7 different IT domains that could cover specific applications associated to the business processes of the EDPS that go beyond the basic IT infrastructure and services offered by Parliament and the Commission under Service-Level-Agreements (SLAs);

41. Acknowledges that the EDPS successfully relies on many of the administrative systems used by the Commission, particularly in field of HR and business administration processes, as well as on some of Parliament’s services, including the provision of laptops, network infrastructure and video-conferencing, among other; notes that the EDPS uses the qualified electronic signature to sign electronic documents within and outside the ARES system for administrative and financial documents; commends the EDPS for the progress made towards adopting e-procurement tools, which is foreseen for 2026 when SUMMA, the new financial software, will also be introduced at the EDPS;

42. Notes from the Questionnaire that the EDPS approved in 2025 internal guidelines on the use of generative AI systems by its staff who are also offered mandatory AI trainings path; welcomes the EDPS preparatory work for potentially issuing guidelines to ensure AI tools are used in a responsible manner by EUIBAs which would complement the guidance already provided by the Commission by focusing on specificities of the Union’s public administration or use cases in specific areas such as HR/recruitment;

43. Acknowledges the leading role of the EDPS in enhancing the cybersecurity preparedness of the EUIBAs, while working closely with bodies such as ENISA and cybersecurity hubs such as CERT-EU;

44. Notes from the Questionnaire that the EDPS launched two key initiatives to strengthen personal data breach management across Union institutions, i.e. the Personal Data Breach Awareness Campaign, which targeted entities that had not previously reported breaches, providing self-assessment tools, bilateral consultations, and tailored recommendations, and a cybersecurity exercise (named PATRICIA), aimed at improving the handling of cybersecurity incidents involving personal data breaches and enhancing interinstitutional cooperation; notes with appreciation that both initiatives were awarded by the Global Privacy Assembly in 2025 for their contribution to accountability; observes that the EDPS strengthened its cybersecurity framework by introducing real-time vulnerability and threat detection for internet-facing assets, through enhanced cooperation under its SLA with CERT-EU; congratulates the EDPS for hosting a conference in Brussels in June 2024, bringing together data protection experts, policymakers, and technology specialists to reflect on the evolving role of data protection in modern democracies, in particular given the rise of disinformation and online manipulation, and the challenges posed by social media;

Buildings

45. Notes that, in 2024, a transfer of approximately EUR 55 000 was necessary to cover building security and rental costs, as the rental cost confirmed for 2024 by Parliament, the building of which the EDPS is using, was higher than the credits allocated for that year;

46. Notes that, in terms of accessibility of its building, the EDPS relies on the decisions taken and implemented by Parliament, as part of their building policy; invites the EDPS to inform the discharge authority whether it also plans to hire trainees with reduced mobility or disabilities;

Environment and sustainability

47. Notes that the EDPS rents a smart building of Parliament, the environmental footprint of which is reduced through several measures such as the regulation of the temperature made automatically and centrally, among other; notes that that building is also equipped with photovoltaic panels that generate approximately 20 kWh of electricity covering 6,04 % of the EDPS’ total consumption in 2024;

48. Notes that the EDPS has not joined the Eco-Management and Audit Scheme (EMAS); notes that, with a view to becoming EMAS certified, the EDPS established in 2024 a cross-unit working group whose objectives are to map existing measures already implemented by Parliament, develop carbon reducing strategies and propose innovative solutions; invites the EDPS to keep the discharge authority updated on the progress made in this matter;

49. Notes from the Questionnaire that the EDPS conducts the vast majority of its procurement through Inter-Institutional Framework Contracts (IIFWCs), and, as a Participating Contracting Authority, applies the sustainability criteria established by the Lead Contracting Authority;

50. Notes from the Questionnaire that all business travel within the EDPS must comply with the rules set out in the Mission Guide; observes that the EDPS staff primarily travel in economy class and that most trips take place within the Union; welcomes the EDPS’ efforts to reduce its carbon footprint by encouraging staff to use videoconferencing, train travel for short distances, and public transport when traveling to or from the airport or at the mission location;

51. Notes from the Questionnaire that the EDPS is implementing a sustainable mobility strategy, which allows staff to request reimbursement of 50 % of their monthly or annual season tickets or multi-journey passes for public transport and provides facilities adapted to the needs of staff who use bicycles;

Interinstitutional cooperation

52. Welcomes the budgetary and administrative savings achieved by the EDPS through inter-institutional cooperation, particularly the conclusion of service-level agreements with Parliament for the rental of its premises and the use of IT system applications, hardware supplies and maintenance and with the Commission for HR and business administration processes, as well as through participating in large inter-institutional framework contracts in areas such as IT consultancy, interim services and office supplies, among others; commends in addition the EDPS for maintaining a structured cooperation with the European Ombudsman, the European Union Agency for Fundamental Rights and CERT-EU through memorandums of understanding; notes from the Questionnaire that the EDPS is also participating in the interinstitutional HR Transformation project, led by the Commission, which aims to digitalise HR processes, whereas the rollout of this project will be concluded by 2029;

53. Notes that the EDPS participates in meetings of various interinstitutional bodies; welcomes in this context the participation of the EPDS in meetings of the Heads of Administration meetings and the Interinstitutional Online Communication Committee, led by Parliament’s Directorate-General for Communication; acknowledges that interinstitutional cooperation with EDPS, in his supervisory role, is key for the other Union institutions to enhance their level of compliance with the data protection legal framework;

54. Notes from the Annual Report that the EDPB launched in 2024 its coordinated enforcement action on the individuals’ right of access to their personal data, with 30 participating DPAs across the Union and the EEA; notes from the Questionnaire that the EDPS took part in this enforcement action, but also continued its work on the coordinated enforcement action of the EDPB from 2023 on the role of the DPO; notes the continued active involvement of the EPDS in the CSC activities in 2024 by assuming the CSC coordination role for 2 years, drafting a guidance note on cooperation in handling Europol complaints and monitoring ETIAS development, among other; notes that the EDPS, as member of the EDPB, also coordinated a taskforce on the cooperation with competition and consumer protection authorities as regards the interplay between the Digital Markets Act and GDPR;

55. Notes from the Questionnaire and the Follow-up Report that joint activities with OLAF, the European Public Prosecutor’s Office (EPPO) and the Court, and taking initiative in the area of fraud detection fall outside the mandate of the EDPS;

Communication

56. Notes that the budget for public communication and promotional activities in 2023 amounted to EUR 425 000, which represented an increase of approximately 9,20 % compared to 2023;

57. Notes with satisfaction that the EDPS organised and participated in several communication events online as well as in presence in 2024, aimed at raising awareness to EDPS’ role and mission among a wider public and the importance of respecting Union data protection rules, such as Data Protection Day, the EDPS Trainees’ conference (twice a year), the EDPS Civil Society Summit and the Global Privacy Assembly;

58. Notes that the EDPS communicates online via its website and its social media accounts on X (ex-twitter) (28 800 followers), LinkedIn (82 800 followers), YouTube (3 400 followers) and Instagram (300 followers);

59. Notes that the pilot project of the platforms EU Voice and EU Video (free and open-source social media networks, privacy-oriented and based on Mastodon and PeerTube software) came to an end in 2024; notes that the EDPS facilitated the smooth migration of EUIBAs who wished to retain their accounts, ensuring continuity for users; notes that, building on the pilot’s success, preparations were made to resume Mastodon in 2025; welcomes in that context the EDPS’ contribution to the Union's strategy on data and digital sovereignty in order to promote Union's independence in the digital world and compliance with the data protection legal framework.