Resolution (EU) 2024/2246 of the European Parliament of 11 April 2024 with observations forming an integral part of the decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2022, Section IX – European Data Protection Supervisor

Official Journal EN of the European Union L series 2024/2246 10.10.2024 RESOLUTION (EU) 2024/2246 OF THE EUROPEAN PARLIAMENT of 11 April 2024 with observations forming an integral part of the decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2022, Section IX – European Data Protection Supervisor THE EUROPEAN PARLIAMENT, — having regard to its decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2022, Section IX – European Data Protection Supervisor, — having regard to Rule 100 of and Annex V to its Rules of Procedure, — having regard to the opinion of the Committee on Civil Liberties, Justice and Home Affairs, — having regard to the report of the Committee on Budgetary Control (A9-0086/2024), A. whereas in the context of the discharge procedure, the discharge authority wishes to stress the particular importance of further strengthening the democratic legitimacy of the Union institutions by improving transparency and accountability, and implementing the concept of performance-based budgeting and good governance of human resources; B. whereas data protection is a fundamental right, protected by European law and enshrined in Article 8 of the Charter of Fundamental Rights of the European Union; C. whereas Article 16 of the Treaty on the Functioning of the European Union provides that compliance with the rules relating to the protection of individuals, with re+gard to the processing of personal data concerning them, shall be subject to control by an independent authority; D. whereas Regulation (EU) 2018/1725 of the European Parliament and of the Council(1) provides for the establishment of an independent authority, the European Data Protection Supervisor (the ‘EDPS’), responsible for protecting and guaranteeing the right to data protection and privacy, and tasked with ensuring that the institutions and bodies, offices and agencies of the Union embrace a strong data protection culture; E. whereas the EDPS carries out its functions in close cooperation with fellow Data Protection Authorities (DPAs) as part of the European Data Protection Board (EDPB), and it serves the public interest while being guided by principles of impartiality, integrity, transparency and pragmatism; F. whereas, until 13 November 2022, the EDPS delegated the powers of the Authorising Officer to the Director and to the Head of Administration thereafter, in accordance with the charter of tasks and responsibilities concerning the budget and administration of the EDPS provided in accordance with Article 72(2) of Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council(2), while the function of the Accounting Officer of the EDPS shall be performed by the Accounting Officer of the Commission in accordance with the Decision of the European Data Protection Supervisor of 1 March 2017; (1) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39). (2) Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012 (OJ L 193, 30.7.2018, p. 1). ELI: http://data.europa.eu/eli/res/2024/2246/oj 1/7EN OJ L, 10.10.2024 1. Notes that the budget of EDPS falls under MFF 7 ‘European public administration’, which amounted to a total of EUR 11,6 billion, i.e. 5,9 % of Union budget spending, in 2022; notes that the budget of the EDPS represented 0,17 % of MFF 7 appropriations; 2. Notes that the Court of Auditors (the ‘Court’), in its annual report for the financial year 2022 examined a sample of 60 transactions under Administration, the same number as for 2021; further notes that the Court writes that administrative expenditure comprises expenditure on human resources including pensions, which in 2022 accounted for about 70 % of the total administrative expenditure, and on buildings, equipment, energy, communications and information technology and that its work over many years indicates that, overall, this spending is low risk; 3. Notes that the Court, as part of the audit for 2022, examined the supervisory and control systems of the EDPS, in particular the implementation of internal control standards, risk management, and the functioning of key controls defined in the Financial Regulation, including ex ante and ex post controls on payments; 4. Notes that 14 (23 %) of the 60 transactions contained errors but that the Court, based on the five errors which were quantified, estimates the level of error to be below the materiality threshold; 5. Notes with satisfaction that the Court in its annual report for the financial year 2022 states that it did not identify any specific issues concerning the EDPS; Budgetary and financial management 6. Notes that the final adopted budget for the EDPS was EUR 20 266 000in 2022, which represented an increase of 4,12 % compared to 2021; notes that the EDPS received EUR 50 000 of assigned revenue related to services provided to the EFTA Supervisory Authority by means of a Service Level Agreement; notes that the budget of the EDPS also covers the work of the independent Secretariat of the European Data Protection Board (the ‘Board’); 7. Notes with satisfaction that the budget implementation rate was 98 % in 2022, which is higher than the previous year, when the budget implementation rate was 86 %; 8. Notes that Russia’s war of aggression against Ukraine created budgetary pressure for the EDPS, including through rising inflation and salary adjustments, strongly increasing energy costs and the cost of goods and services through public procurement and service-level agreements with other institutions; welcomes the internal reallocations within budget chapters performed in the course of 2022 in order to optimise the budget implementation; 9. Notes that the average time for payment was 21,54 days in 2022, which represented an increase compared to 2021 when the average time was 19,98 days; welcomes the introduction of a new electronic payment system to process invoices related to mission costs prepaid by the travel agency, which is expected to help reduce the time it takes to make payments once fully operational; calls on the EDPS to consider the possibility of extending this system to other types of payments; 10. Notes that the EDPS budget for staff missions increased from EUR 41 000to EUR 251 000, i.e. an increase of 512 %, between 2021 and 2022 following the resumption of travel after the COVID-19 pandemic; notes further that, within this overall budget, the EDPS had a dedicated mission budget for the Supervisor of EUR 33 000 in 2022 compared to EUR 5 000in 2021, i.e. an increase of 560 %; notes that the increase in inflation and the substantial increase in energy prices in 2022 linked to Russia’s war of aggression against Ukraine had an adverse effect on flight tickets and hotel costs, thus leading to an increase in mission costs; Internal management, performance and internal control 11. Notes that, in 2022, the EDPS conducted a mid-term review of its 2020-2024 strategy focusing on three pillars ‘Foresight, Action and Solidarity’, setting out EDPS refocused vision and priorities for the period 2022-2024 with a view to ‘shaping a safer digital future’; 2/7 ELI: http://data.europa.eu/eli/res/2024/2246/ojEN OJ L, 10.10.2024 12. Acknowledges the major organisational changes, and the corresponding revision of its rules of procedures, undertaken by the EDPS in 2022 to support the evolution of its tasks and improve the efficiency of its processes in light of the fast-changing international environment; notes that, in particular, as a result of these changes, the EDPS created a new function of Head of the EDPS Secretariat at the level of a Secretary General, a dedicated legal service function, a governance and internal compliance sector, two new operational sectors in the supervision and enforcement unit, a new finance sector in the HR, budget and administration Unit and an antenna in Strasbourg; 13. Notes that, with the entry into force, on 28 June 2022, of Regulation (EU) 2022/991 of the European Parliament and of the Council(3) amending Regulation (EU) 2016/794 of the European Parliament and of the Council(4) establishing Europol, the oversight functions of the EDPS in relation to the operational personal data processed by Europol in the framework of its mandate were indeed strengthened; notes that the organisational changes introduced in 2022, in particular the creation of a new sub-sector in the supervision and enforcement unit with specialised staff, sought notably to reflect on the specific powers of the EDPS in relation to the supervision of the area of freedom, security and justice (‘AFSJ’) agencies, taking also into account the new supervisory powers of the EDPS in relation to Europol; calls on the EDPS to keep the discharge authority informed regarding any further extension of its mandate and the impact on resources; 14. Notes that, as part of the changes implemented in 2022, the EDPS has striven to streamline its internal procedures to deal more rigorously with investigations and to redeploy specialised staff; notes that the investigation of complaints in a law enforcement context, e.g. complaints against the replies from Europol, to data subject access requests of citizens, often entail a high degree of complexity and take, on average, longer to investigate than other complaints given the involvement of multiple stakeholders in the process; 15. Notes that the EDPS received 367 complaints in 2022, which 47 more than in 2021, out of which 65 were admissible and 302 were inadmissible, in addition to the 129 admissible complaints ongoing in 2022; welcomes the efforts undertaken by the EDPS to reduce the high number of inadmissible complaints, which doubled since 2019, and therefore increased the need for resources to handle them; notes that the EDPS issued a final decision, opinion or reply in 23 out of 65 complaint cases received in 2022 within 42 days on average; notes further that complaints concerning replies from Europol to data subject access requests from citizens were dealt with, on average, within between 5 and 12 months; notes that the EDPS is continuously re-evaluating its procedures and implementing improvements where necessary based on past lessons learned in order to further streamline its complaint handling for swifter resolution of complaints despite constraints on resources; 16. Notes that, in 2022, the EDPS carried out two pre-investigations where there were concerns about possible infringements of data protection rules by a Union institution and pursued three ongoing formal investigations in the form of data protection audits, one of which was concluded in April 2022; notes further that the EDPS also launched four investigations in the form of data protection audits based on complaints concerning websites of certain Union institutions, bodies, offices and agencies (EUIs) and one enquiry in the AFSJ sector, and pursued ongoing investigations launched in previous years; notes that the EDPS audit of Europol’s processing of personal data of minors under the age of 15 years marked as suspects, provided to the Agency by third countries and international organisations, was concluded in September 2023 after an almost 10-month investigation and after the topic had already been initially raised by the EDPS with recommendations addressed to Europol in December 2018 concerning the processing of sensitive data; 17. Calls upon the EDPS to enhance the procedure and prioritise the handling of personal data pertaining to minors under the age of 15, given that this represents vulnerable groups requiring heightened protection, and therefore warrants priority status; 18. Notes that, on 16 September 2022, the EDPS brought an action for the annulment of two provisions of the amended Europol Regulation before the Court of Justice of the European Union (CJEU), which was later rejected by the CJEU; underlines that the fact that important legal matters are brought before the CJEU by the EDPS in its supervisory role should not be seen as affecting the loyal cooperation and good relations between the EDPS and the entities it supervises; (3) Regulation (EU) 2022/991 of the European Parliament and of the Council of 8 June 2022 amending Regulation (EU) 2016/794, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role in research and innovation (OJ L 169, 27.6.2022, p. 1). (4) Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ L 135, 24.5.2016, p. 53). ELI: http://data.europa.eu/eli/res/2024/2246/oj 3/7EN OJ L, 10.10.2024 19. Notes with satisfaction that the EDPS developed a new risk management framework at the end of 2022, thus reinforcing its internal control framework and embedding risk analysis in its annual planning, which should determine the input for the priorities of the EDPS on an annual basis; 20. Appreciates the important role of consultation and advice of the EDPS in the legislative process; notes that the EDPS’ advice took the form of 27 opinions (12 in 2021), 49 formal comments (76 in 2021) and 30 informal comments (29 in 2021) to the Commission and to the co-legislators in response to legislative consultation requests in 2022; 21. Calls on the EDPS to review its rules of procedure of ensuring and timely review of complaints by citizens, taking into account all relevant information and to inform the discharge authority on the progress made in this area; Human resources, equality and staff well-being 22. Notes that, at the end of 2022, the EDPS had 127 staff members, compared to 124 at the end of 2021 and 114 at the end of 2020; notes that the EDPS employed 52 contract staff under Article 3(b) of the Staff Regulations of Officials and the Conditions of Employment of Other Servants and 6 temporary agents under Article 2(b) and 2(c); further notes that the EDPS employed 8 external service providers working on-site in 2022; calls on the EDPS to inform the discharge authority on the measures put in place to ensure that access to information by external services providers was managed in accordance with the level of confidentiality required by the matters at stake; 23. Believes that given the increase in workload due to new tasks and responsibilities allocated to the EDPS, as well as many more legislative consultations and data sets to monitor, the EDPS would need a proportionate increase in staff to maintain efficient workflows with reasonable response times; encourages the EDPS to provide permanent contracts to its employees to guarantee business continuity and work security; 24. Notes that the occupancy rate of the establishment plan was at 86,9 % at the end of 2022; regrets that the occupancy rate of the establishment plan was lower than the target for 2022; acknowledges the shortage of skilled professionals; encourages the EDPS to examine useful strategies to increase visibility of its vacancies; notes that, in 2022, the EDPS organised an external selection procedure to set up a reserve list of specialised candidates in view of recruitment needs as of 2022; 25. Notes that, taking account of the lessons learned from the COVID-19 pandemic, the EDPS adopted a new decision on working time and hybrid working in May 2022, under which staff may notably vary their working time according to a flexitime regime and telework up to three days per week; welcomes the results of the staff survey carried out in the aftermath of the adoption of that decision, which indicated that a majority of staff were satisfied with the new working arrangements; 26. Congratulates the EDPS for having 22 nationalities represented among its staff in 2022, which represents an improvement in comparison with 21 in 2021 and is, despite the over-representation of 5 nationalities, a good score for such a small institution; calls on EDPS to endeavour to achieve a more equitable geographical representation among all Member States, with particular attention being paid to addressing the underrepresentation of certain countries; 27. Notes that, in 2022, the EDPS employed a total of 64 % women and 36 % men, along the same trend as in previous years, when the distribution between women and men was 63 % and 37 % respectively; regrets that there were no women in senior management positions in 2022, whereas the gender ratio of four middle managers reached a balance during the year; calls on the EDPS to continue its efforts to achieve a gender-balanced representation of staff; 28. Notes with satisfaction that no cases of burnout or harassment were reported among the EDPS staff in 2022; welcomes that the EDPS set up a working group to discuss issues related to the distribution and allocation of work following the results of the biennial staff satisfaction survey conducted in June 2022, according to which some EDPS staff felt that the workload was not equally shared or well distributed across teams and colleagues; asks the EDPS to keep the discharge authority informed of the outcome of the working group discussions and the details of the action plan under preparation; 29. Welcomes the EDPS’ continued efforts to actively improve physical and mental well-being of its staff; 4/7 ELI: http://data.europa.eu/eli/res/2024/2246/ojEN OJ L, 10.10.2024 30. Notes with satisfaction that the EDPS recruited 18 trainees in 2022, who were remunerated and enjoyed the same working arrangements as the rest of the staff; Ethical framework and transparency 31. Notes that, in 2022, the EDPS focused its efforts on increasing staff awareness about the EDPS/EDPB ethical framework by organising mandatory dedicated training sessions for all staff and induction trainings for EDPS/EDPB newcomers; encourages the EDPS to continue raising awareness and organising surveys to assess the level of staff awareness of the EDPS/EDPB ethical framework; 32. Welcomes the overall high level of transparency achieved by the EDPS concerning its activities, in particular regarding the publication of the agenda and the declaration of interests of the Supervisor and of the Head of EDPS Administration, in line with the Supervisor’s code of conduct of 2019; regrets that the EDPS decided to apply the Supervisor’s code of conduct to the Head of the EDPS Administration instead of adopting a dedicated code of conduct for senior management positions; 33. Notes with satisfaction that the EDPS has never been involved in any investigations by the European Anti-Fraud Office (OLAF) since its establishment; 34. Notes with satisfaction that two inquiries opened by the Ombudsman in 2022 concerning the EDPS were closed with no findings of maladministration; 35. Regrets that the EDPS has still not formally joined the transparency register; welcomes nevertheless the alignment of the EDPS transparency rules to the principles of the transparency register as regards mandatory prior checks in the transparency register for third party meetings with the Supervisor and the Head of the EDPS Administration; highlights that transparency could be better upheld by actively enrolling in the transparency register; reiterates the calls on the EDPS to join the EU Transparency Register; 36. Notes that the EDPS has set up a framework to prevent conflicts of interest at the level of senior management and staff through codes of conduct, awareness raising and declarations; notes with satisfaction that no conflicts of interest were detected in 2022; 37. Notes that the EDPS has internal rules on whistle-blowing, which define safe routes and channels through which staff may raise concerns about fraud, corruption or any other serious wrongdoings without prejudice to the confidentiality of the identity of the whistle-blower and of the information reported; notes that no cases of whistle- blowing were reported in 2022; Digitalisation, cybersecurity and data protection 38. Notes that the 2022 budget for IT equipment and projects was 21 % higher compared to 2021; notes that this information has to be assessed against the background that the 2021 budget for IT was itself 20 % higher compared to the 2020 budget; 39. Notes that, in 2022, the EDPS surveyed the IT strategies of several EUIs in the framework of a large IT feasibility study, which served as a basis for defining the EDPS IT strategy for the coming years; calls on the EDPS to keep the discharge authority informed of the outcome of this analysis and its impact on resources; 40. Notes that Parliament provides IT equipment and services to the EDPS, as its corporate services provider; welcomes the EDPS’ efforts to continuously improve its digital workspace in terms of effectiveness and security beyond what is provided by Parliament; notes that this has involved improving the quality and performance of the computers provided to the EDPS staff, in collaboration with Parliament, in view of the generalisation of hybrid work; ELI: http://data.europa.eu/eli/res/2024/2246/oj 5/7EN OJ L, 10.10.2024 41. Acknowledges the leading role of the EDPS in enhancing the cybersecurity preparedness of the EUIs; notes that, in 2022, the EDPS continued to improve its readiness to protect personal data and sensitive information against cyber-attacks in view of the fast changing cybersecurity threat landscape; congratulates the EDPS for reviewing its security policies and methodologies and adapting its cybersecurity contractual requirements in line with the CERT-EU guidance, ahead of the entry into force of the EU cybersecurity act, to the benefit of all institutions; notes that the EDPS did not encounter any cyber-attack in 2022; 42. Notes that EDPS is piloting and developing innovative and privacy-friendly open source IT solutions; believes that the EDPS should share those experiences with the other EUIs; 43. Welcomes the follow-up actions by the EDPS on the Schrems II judgement, especially focusing on the EUIs’ contracts with private entities in 2022, in particular large ICT providers, and on arrangements between EUIs and non-EU/EEA public bodies or international organisations; Buildings 44. Notes that, in 2022, the EDPS and EDPB were the sole tenants of Parliament’s building where they were located, following the move of the Ombudsman at the end of 2021; notes that, following this move, three floors of the building were entirely refurbished in order to accommodate the EDPS and EDPB staff and adapt the premises to the new working conditions prevailing after the COVID-19 pandemic; 45. Notes that, in terms of accessibility to its building, the EDPS relies on the decisions taken and implemented by Parliament, as part of their building policy; calls on the EDPS to advocate for the need to focus on the needs of persons with reduced mobility or disabilities and to inform the discharge authority of any new decision taken in this respect; Environment and sustainability 46. Notes that the EDPS has not joined the Eco-Management and Audit Scheme (EMAS) but has implemented several measures to reduce its environmental footprint, such as the reduction of paper following the digitalisation of HR processes or waste recycling; notes that, in terms of environmental infrastructures, no solar panels were installed on the building rented by Parliament; calls on the EDPS to inform the discharge authority of any new decision to install solar panels on its building; 47. Welcomes that the EDPS continues to promote sustainable mobility of its staff by reimbursing 50 % of monthly/ annual subscriptions for the use of public transport and by allocating sufficient space in its garage facilities for staff to park their bikes; Interinstitutional cooperation 48. Welcomes the budgetary and administrative savings achieved through inter-institutional cooperation, notably the conclusion of service-level agreements with t Parliament for the rental of its premises and the use of its IT system applications, hardware supplies and maintenance, and with the Commission for ICT services; 49. Notes that the EDPS cooperates closely, albeit informally, with OLAF, the EPPO and the Court, to whom it provides advice on specific projects and questions, complementary to its supervisory role; welcomes, in particular, the regular dialogue with the EPPO, as a newly created institution, in 2022; welcomes that the EDPS has a more structured cooperation with the Ombudsman through a memorandum of understanding aiming to define the arrangements for their cooperation at the level of complaint handling; 50. Notes that interinstitutional cooperation with the EDPS, in its supervisory role, is key for the other EUIs to enhance their level of compliance with the data protection legal framework; congratulates the EDPS for taking the lead in awarding an inter-institutional contract for the provision of Nextcloud services to the signatory EUIs; 6/7 ELI: http://data.europa.eu/eli/res/2024/2246/ojEN OJ L, 10.10.2024 51. Welcomes the pivotal role played by the EDPS in 2022 in the coordination of the Data Protection Authorities (DPAs) of the Member States represented in the EDPB to promote consistent data protection across the Union; notes that EDPS participated in the 2022 coordinated enforcement action of the EDPB on the use of cloud services in the Union, the purpose of which was to share knowledge and good practices between the EDPS, EUIs and DPAs; Communication 52. Notes that the budget for public communication and promotional activities in 2022 amounted to EUR 304 665, which represented an increase of 19 % compared to 2021; welcomes the comprehensive communication strategy aiming to raise awareness about its role and the importance of respecting Union data protection rules, targeting the EUIs, EU data protection experts as well as the general public; 53. Notes with satisfaction that the EDPS organised several communication events in hybrid mode in 2022, notably a major international conference on ‘The future of data protection: effective enforcement in the digital world’ with the participation of more than 2 000participants, both in-person and remotely; 54. Notes that the EDPS communicates online via its website and its social media accounts on X (ex-twitter) (29 100 followers), LinkedIn (63 000 followers), YouTube (275 000 followers), EU-Voice (5 100 followers) and EU-Video (690 followers); notes that the EDPS launched several social media campaigns in 2022, targeted towards promoting particular initiatives or carried out in partnership with other EUIs in order to increase outreach and keep its audience well-informed about its activities; 55. Notes the leading role of EDPS in piloting and promoting social media channels contributing to the Union’s strategy for data and digital sovereignty in compliance with the data protection legal framework; 56. Reiterates its support for the EDPS efforts to monitor, and explain to the wider public, emerging developments in technology and their potential impact on data protection and privacy, through the TechDispatch and TechSonar reports for example; further encourages the EDPS to increase its capacities in the field of technology monitoring and launch information campaigns on its findings and recommendations. ELI: http://data.europa.eu/eli/res/2024/2246/oj 7/7