See Full Document Text
Official Journal EN
of the European Union L series
2025/1609 8.10.2025
RESOLUTION(EU) 2025/1609 OF THE EUROPEAN PARLIAMENT
of 7 May 2025
with observations forming an integral part of the decision on discharge in respect of the
implementation of the general budget of the European Union for the financial year 2023,
Section IX – European Data Protection Supervisor
THE EUROPEAN PARLIAMENT,
— having regard to its decision on discharge in respect of the implementation of the general budget of the European
Union for the financial year 2023, Section IX – European Data Protection Supervisor,
— having regard to Rule 102 of and Annex V to its Rules of Procedure,
— having regard to the opinion of the Committee on Civil Liberties, Justice and Home Affairs,
— having regard to the report of the Committee on Budgetary Control (A10-0053/2025),
A. whereas, in the context of the discharge procedure, the discharge authority wishes to stress the particular importance
of further strengthening the democratic legitimacy of the Union institutions by improving transparency and
accountability, and implementing the concept of performance-based budgeting and good governance of human
resources (HR);
B. whereas data protection is a fundamental right, protected by Union law and enshrined in Article 8 of the Charter of
Fundamental Rights of the European Union;
C. whereas Article 16 of the Treaty on the Functioning of the European Union provides that compliance with the rules
relating to the protection of individuals, with regard to the processing of personal data concerning them, is to be
subject to control by an independent authority;
D. whereas Regulation (EU) 2018/1725 of the European Parliament and of the Council(1)provides for the establishment
of an independent authority, the European Data Protection Supervisor (the ‘EDPS’), responsible for protecting and
guaranteeing the right to data protection and privacy, and tasked with ensuring that the institutions and bodies,
offices and agencies of the Union embrace a strong data protection culture;
E. whereas the EDPS carries out its functions in close cooperation with fellow Data Protection Authorities (DPAs) as part
of the European Data Protection Board (EDPB), and it serves the public interest while being guided by principles of
impartiality, integrity, transparency, pragmatism and respects Union legislation;
1. Notes that the budget of the EDPS falls under MFF Heading 7 ‘European public administration’, which amounted to a
total of EUR 12,3 billion, i.e. 6,4 % of Union budget spending, in 2023; notes that the budget of the EDPS represented
0,18 % of MFF Heading 7 appropriations;
2. Notes that the Court of Auditors (the ‘Court’), in its Annual Report (the ‘Court’s report’) for the financial year 2023,
examined a sample of 70 transactions under MFF Heading 7, of which 21 (30 %) contained errors; further notes that
for five of those errors, which were quantified by the Court, the Court estimated a level of error below the materiality
threshold;
3. Notes from the Court’s report its observation that administrative expenditure comprises expenditure on HR
including pensions, which in 2023 accounted for about 70 % of the total administrative expenditure, and on
buildings, equipment, energy, communications and information technology; welcomes the Court’s renewed opinion
that, overall, administrative spending is low risk;
4. Notes from the Court’s report that in 2023 it audited a salary payment of an official who had last made a declaration
concerning rights to family and child allowance in 2020; echoes the Court’s concern that delays in receiving and
verifying such declarations increase the risk of ineligible payments;
(1) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons
with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of
such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.
europa.eu/eli/reg/2018/1725/oj).
ELI: http://data.europa.eu/eli/res/2025/1609/oj 1/9EN
OJ L, 8.10.2025
Budgetary and financial management
5. Notes that the final adopted budget for the EDPS was EUR 22 711 559 in 2023, which represents an increase of
12,06 % compared to 2022; notes that the budget of the EDPS also covers the work of the independent Secretariat
of the EDPB; notes from the Annual report of the EDPS for 2023 (the ‘Annual Report’) that the adopted budget of
the EDPB was EUR 7,67 million in 2023, including EUR 300 000 granted by means of an amending budget which
was needed due to an increase in litigation activities in 2023;
6. Acknowledges that the budget monitoring and planning efforts of the EDPS in the financial year 2023 resulted in a
budget implementation rate of current year commitment appropriations of 96 % in 2023 (slightly lower than
in 2022 when that rate was 98 %); further notes from the report on the EDPS annual accounts for 2023 that the
current year payment appropriations execution rate was 84 % (lower than 88 % in 2022); notes in addition, from
EDPS replies to the questionnaire submitted by the Committee on Budgetary Control for the 2023 budgetary
discharge (the ‘Questionnaire’), that the execution rate of payment appropriations overall was 91,33 % in 2023
(lower than 94,09 % in 2022);
7. Notes further that the amount of carry-overs (C8) from 2023 to 2024 was EUR 2 517 942,67 or 11,08 % of the total
budget for 2023, compared to EUR 1 827 354,23 or 9,01 % of the total budget for 2022; notes that the execution
rate of the C8 budget in 2023 was 76,65 % (higher than 73,77 % in 2022);
8. Welcomes an improvement in the average time to pay from 25 days in 2022 to 19 days in 2023, with 97,50 % of
payments processed on time; notes that that improvement is also due to the EDPS having solved an old bug with the
electronic payment system for invoices linked to mission costs; notes further a significant increase in the number of
payments from 799 in 2022 to 1 335 in 2023; observes in that context that the number of transactions is still lower
than pre-pandemic levels due to changes in the way of working (such as hybrid meetings or virtual events for
experts);
9. Notes that the effects of illegal Russia’s war of aggression against Ukraine continued to create budgetary pressure on
the EDPS in 2023, including through rising inflation and the consequent increase in energy costs, with the most
affected budget lines being staff salaries, building security and rental costs, mission costs and services provided by
external staff; commends in that context the EDPS for having re-adjusted its priorities and having implemented
internal reallocation within budget chapters; understands that budgetary optimisation was necessary in order to
successfully manage the indexation of staff salaries and rental costs, as well as an increase in the costs of external
lawyer support services due to an increased number of EDPS binding decisions which led to a bigger number of
cases to be defended before the Court of Justice of the European Union (CJEU) with the help of external legal
assistance; regrets in that context that the EDPS had to postpone some of its activities, such as a feasibility study on
artificial intelligence; calls on the EDPS to abide to the competences of its mandate with a collaborative approach
with the Union institutions and agencies and to avoid initiating any legal action, especially those which are
manifestly inadmissible, in order to avoid negative repercussions on the management of resources, which do not
allow the EDPS to carry out its activities as an institution;
10. Expresses concern about the significant increase in EDPS staff mission costs, from EUR 28 789 in 2021 and
EUR 176 903 in 2022, to EUR 284 580 in 2023; calls on the EDPS to assess whether the resources spent on
missions are being used appropriately and effectively; notes that the EDPS ceased making public the number of
missions funded by organisers, as well as information on which unit or sector participated in each mission, thus
reducing transparency regarding mission expenses; calls on the EDPS to reinstate this practice; encourages the EDPS
to promote the use of video-conferencing tools where suitable, as this could contribute to lowering the number of
missions and reducing costs; calls on the EDPS to assess whether the resources spent on missions are being used
appropriately and effectively;
2/9 ELI: http://data.europa.eu/eli/res/2025/1609/ojEN
OJ L, 8.10.2025
Internal management, performance and internal control
11. Notes that the EPDS used nine key performance indicators (KPIs) to monitor its performance in 2023, in alignment
with the main objectives of the EDPS Strategy 2020-2024 which is implemented through the Annual Management
Plan; notes from the Annual Report that the EDPS over-delivered in almost all areas, as indicated by the results of
KPIs for 2023, except for one KPI (the number of EDPS followers on some social media accounts); notes with
concern that the EDPS encountered considerable challenges due to a growing workload and intricate data protection
issues arising from the rapidly evolving digital landscape, as well as due to the extension of the EDPS mandate to
supervisory activities (such as audits and investigations) and replies to consultations and prior consultations, all in
the context of a limited budget; notes from the EDPS’ follow-up report to Parliament’s resolution on the
implementation of the EDPS’ budget for 2022 (the ‘Follow-up Report’) that several legislative developments in the
last two years have impacted the work and resources of the EDPS, due to the extension of Eurojust’s mandate, new
information to be received by Europol under the Digital Services Act, the roll out of the new Union’s large-scale
databases and interoperability framework in the justice and home affairs field and the entry into force of the
Artificial Intelligence Act (the ‘AI Act’); calls on the Commission and on the budgetary authority to take those
matters into consideration during the annual budgetary procedure;
12. Welcomes the fact that, in 2023, the EDPS strengthened its ability to assess and prepare for emerging technological
trends and their potential impact on privacy and data protection; notes that this was achieved through a foresight-
based approach, with a focus on monitoring developments in areas such as large language models, digital identity
wallets, the internet of behaviours, extended reality, and deep fake detection; welcomes in that context the
publication by the EDPS of its third TechSonar initiative on emerging technologies; congratulates moreover the
EDPS for having been awarded the GPA Global Privacy and Data Protection Awards 2023 in the category of
innovation;
13. Notes that 2023 was marked by several organisational changes or updates that were needed in order to respond and
adapt to the evolving data protection challenges; welcomes in this context the appointment of a Secretary-General
from 1 July 2023; notes in addition the transition of two sectors into units such as ‘Information and
Communication’ and ‘Governance and Internal Control’ and the creation of three new specialised sectors under the
‘Technology and Privacy’ (T&P) unit: ‘Systems Oversight and Audit’, ‘Technology Monitoring and Foresight’ and
‘Digital Transformation’;
14. Emphasises the role of the EDPS in supervising the processing of personal data by Union institutions, bodies, offices
and agencies; notes with concern the length of proceedings before the EDPS, as the EDPS did not close a single
investigation in 2023, but in comparison to the previous year, in 2023, the number of notifications beyond the 72
hours significantly decreased;
15. Notes that the EDPS received 420 complaints, i.e. 53 more than in 2022, out of which 73 were admissible and 347
inadmissible in 2023; notes that the EDPS issued a final decision, opinion or reply in 31 out of 73 complaint cases
received in 2023 within 44 days on average and responded to all 347 inadmissible complaints received; notes that,
out of all admissible complaints (ongoing and received in 2023), 55 cases were finalised in 2023, which represents
an increase of 17 % compared to 2022; acknowledges the efforts made by the EDPS to reduce the high number of
complaints by developing a dynamic tool on the EPDS’ website, although the volume of complaints remained
challenging due to limited resources in 2023; notes with satisfaction that the EDPS developed various procedural
tools and policies to enhance its investigatory processes in 2023; commends in that context the EDPS for having
amended its Rules of Procedure, whereby the ‘review procedure’ is replaced by a ‘preliminary assessment’ in order to
safeguard the right to be heard of all the involved parties, thus contributing to a fair and timely handling of
complaints and investigations;
16. Underlines the important role of consultation and advice of EDPS in the legislative process; notes that, pursuant to
Article 42(1) of Regulation (EU) 2018/1725, the EDPS responded to 80 formal legislative consultations and its
advice took the form of 54 opinions (27 in 2022), 26 formal comments (49 in 2022) and 34 informal comments
(30 in 2022) to the Commission and to the co-legislators in response to legislative consultation requests in 2023;
commends the EDPS for its input with regard to the AI Act, in particular EDPS’ own-initiative opinion on the AI Act
and advice on the AI liability rules, as well as for EDPS’ input to the GPA resolution on generative AI systems;
acknowledges a significant increase (+ 93 %) of consultation requests over the last five years;
ELI: http://data.europa.eu/eli/res/2025/1609/oj 3/9EN
OJ L, 8.10.2025
17. Notes that, in 2023, the EDPS carried out eight investigations and five pre-investigations, marking a significant
increase compared to previous years; notes that in 2023 the EDPS was actively involved in a total of 13
investigations and seven pre-investigations, either launched in 2023 or carried over from prior years; notes that the
EPDS continued two complex and resource-intensive formal investigations from 2021 into the use by European
Union Institutions, Bodies and Agencies (EUIBAs) of cloud services from non-EU/EEA entities, including a focus on
the Commission’s use of Microsoft 365; urges the finalisation of those investigations on time because of their
significant impact on the working of institutions; notes further that the EDPS also launched five investigations based
on complaints about EUIBAs’ websites, focusing in a broad way on privacy and data protection issues, with
preliminary assessments expected in 2024;
18. Urges the EDPS to prioritise and enhance procedures for handling the personal data of minors under 15, particularly
in the context of Europol’s systems, where such individuals may be marked as suspects; recognises the heightened
vulnerability of that group and the need for robust safeguards;
19. Notes that the EDPS investigated the Commission’s alleged use of micro-targeting on platform X and continued two
pre-investigations: one case concerning EUIBAs’ use of Trello cloud service, which was closed in 2023 and another
one on EUIBAs’ use of profiling, which was carried out in 2024; notes that a total of six investigations and four pre-
investigations (one pre-investigation in 2022) were launched in the Area of Freedom, Security, and Justice (FSJ),
reflecting a significant increase from 2022; notes the EDPS’ concerns with regard to the challenges that may arise in
the case of investigations where joint action between national authorities and EUIBAs is needed; notes in addition
that, as part of its audit plan for 2023, the EDPS audited the following bodies: the European Personnel Selection
Office, the European Investment Bank, the European Central Bank, the European Centre for Disease Prevention and
Control and the European Medicines Agency;
20. Recalls that in 2022 the EDPS brought an action for annulment of two provisions of the amended Europol
Regulation before the General Court, which was later rejected; notes that meanwhile the EDPS decided to appeal the
order of the General Court in Case T-578/22(2), believing the issues raised should be addressed at the highest level;
regrets that the EDPS did not realise the manifest inadmissibility of its appeal, even if the institution did not intend to
challenge an act by Europol, but a retroactive change in the legal framework aimed at neutralising the effects of the
EDPS’ enforcement actions; calls on the institution to cooperate with Union institutions and agencies, before
initiating legal proceedings that prevent the fulfilment of its mandate and the use of its resources for purposes for
which they were intended; notes further that the EDPS also followed up on the implementation of its Order of
3 January 2022, including checks on Europol’s reporting; regrets that the final report on that matter was
communicated by the EDPS only on 22 July 2024;
21. Notes that, after the pilot implementation of the new risk management framework at the EDPS in late 2022, an
anonymous satisfaction survey was conducted in May 2023 to assess its effectiveness and gather additional
suggestions; notes further that the survey results were positive, leading to the formal adoption of the framework on
26 June 2023;
22. Notes that the internal audit service (IAS) carried out an audit on the methodology for the planning of EDPS audits in
the EDPS in 2023; notes that the audit was concluded with two recommendations for which the EDPS submitted an
action plan to the IAS; calls on the EDPS to keep the discharge authority informed on a regular basis on the progress
made in that matter;
23. Recalls the Treaty on European Union that the EU and its institutions shall promote solidarity and equality between
women and men;
(2) Order of the General Court of 6 September 2023, EDPSv Parliament and Council, T-578/22, ECLI:EU:T:2023:522.
4/9 ELI: http://data.europa.eu/eli/res/2025/1609/ojEN
OJ L, 8.10.2025
HR, equality and staff well-being
24. Notes that, at the end of 2023, the EDPS had 129 members of staff, compared to 127 in 2022; notes that the EDPS
employed 50 contract staff (CA) under Article 3(b) of the Staff Regulations of Officials and the Conditions of
Employment of Other Servants (52 CA in 2022), 7 temporary agents (TA) under Article 2(b) and 2(c) (6 TA in 2022)
and used the services of 12 external services providers (EXT) working intra muros in 2023 (8 EXT in 2022);
encourages the EDPS to continue its efforts towards a more balanced geographical representation among all Member
States specifically at managerial level; welcomes the increased diversity of nationalities represented, but notes with
regret the continued underrepresentation of women in senior management positions; calls for the adoption of a
gender parity roadmap, including proactive recruitment measures and leadership training programs for female staff
members;
25. Notes that the EDPS had 23 nationalities (from the Member States) represented among its staff in 2023, which is an
improvement in comparison with 22 nationalities in 2022; notes with dissatisfaction the over-representation of five
nationalities and an underrepresentation of other nationalities; urges the EDPS to continue its efforts to achieve a
balanced geographical distribution of nationals from all Member States within its staff, by improving
communication, fostering visibility, and enhancing job conditions to attract underrepresented nationalities;
26. Observes that, in 2023, the EDPS maintained a workforce comprising 65 % women and 35 % men, consistent with
trends from previous years; regrets the absence of women in senior management roles, despite achieving gender
parity among the six middle management positions; urges the EDPS to intensify its efforts to ensure gender-balanced
representation across all staff levels, and invites the EDPS to promote the application of women also with a view to
the next election of the Supervisor by Parliament;
27. Notes a high occupancy rate of the establishment plan of 95,65 % but also a high turnover rate of 13 % in 2023;
notes that most of the unfilled positions were a result of candidates being unsuitable, given the EDPS’ need for highly
specialised profiles and the small pool of eligible candidates; welcomes the addressing of those challenges through
republication with a wider or more targeted dissemination of the vacancy or by redrafting the requirements;
welcomes the steps taken by the EDPS regarding the hiring process; calls on the EDPS to continue to address the
challenges in finding suitable candidates and to keep the discharge authority informed about improvements on staff
recruitment and turnover;
28. Notes that, in the second half of 2023, the EDPS’ HR team launched a pilot for a new on-boarding process for
newcomers, with sessions that cover, inter alia, presentations of core units’ work, ethics, procurement procedures
and information security, whereas three on-boarding sessions were offered in 2023; invites the EDPS to continue
offering to newcomers ‘on-boarding’ and to all members of staff mandatory sessions that remind the importance of
principles such as ethics, conflicts of interest, transparency, internal control and anti-fraud, as they have become the
standard in the Union institutions; notes moreover that 12 individual sessions were offered for EDPS and EDPB staff,
six sessions of group coaching in which participants (manager level) learned from each other, as well as a one-year
team coaching with a designer for leadership development at the European School of Administration in 2023;
29. Notes, from the Questionnaire, that the EDPS offers flexible and hybrid working arrangements, that are well-received
by members of staff who can benefit, inter alia, from parental leave, time credits, part-time work or working from
abroad for a limited number of days per year; notes that, in 2023, the majority of staff made use of those working
conditions, whereas 86,30 % of staff made use of teleworking arrangements in 2023; considers that the building
infrastructure should be optimised to reflect that high rate of teleworking, which could contribute to reducing
operational costs and ensuring more efficient use of office space; welcomes the EDPS’ continued efforts to actively
improve physical and mental well-being of its staff;
30. Commends the EDPS for carrying out several awareness-raising actions during the year 2023 with information
sharing on elimination of racial discrimination, International Women’s Day, EU diversity month and learning about
neurodiversity; notes that currently the EDPS does not employ staff with disabilities but has an equal opportunities
clause included in all EDPS vacancy notices and actively encourages applications from candidates with disabilities;
ELI: http://data.europa.eu/eli/res/2025/1609/oj 5/9EN
OJ L, 8.10.2025
31. Notes from the Questionnaire that the EDPS considers confidential any information on burnout cases, including the
number thereof; disagrees with that opinion and calls the EDPS to provide the discharge authority with the number
of burnout cases on a yearly basis; notes with satisfaction that, in 2023, there were no harassment cases reported at
the EDPS; welcomes the fact that, in 2023, the EDPS continued to provide an anti-harassment presentation delivered
by one of the EDPS’ confidential counsellors, as part of the induction training called the ‘EDPS Welcome Day’;
commends the publication of the decision on anti-harassment and the role of the confidential counsellors on the
EDPS’ intranet;
Ethical framework and transparency
32. Notes that, in 2023, the EDPS focused its efforts on increasing staff awareness of the EDPS/EDPB ethical framework
by organising mandatory dedicated training sessions for all staff and induction trainings for EDPS/EDPB newcomers,
appointing a new ethics officer and participating in the ‘Comité Paritaire des Questions Statuaries’ working group on
ethics; welcomes the establishment of a mailbox by the EPDS, where members of staff can submit their requests
regarding any ethics related inquiries, as well as the use of Commission’s Ethics module in SYSPER; encourages the
EDPS to continue raising awareness and organising surveys to assess the level of staff awareness of the EDPS/EDPB
ethical framework;
33. Welcomes the overall high level of transparency achieved by the EDPS concerning its activities, in particular as
regards the publication of the agenda and the declaration of interests of the Supervisor and of the Head of EDPS
Administration, in line with the Supervisor’s code of conduct of 2019; notes from the Follow-up Report that the
EDPS has adopted two codes of conduct, whereas one of them applies to the Supervisor and the other one applies to
the EDPS staff; understands that in cases when the Secretary-General is called to replace the Supervisor, the latter’s
code of conduct also applies to the Secretary-General;
34. Notes with satisfaction that the EDPS has never been involved in any investigations by the European Anti-Fraud
Office (OLAF) since its establishment;
35. Notes that, out of five inquiries opened by the Ombudsman in 2023 concerning the EDPS, four were closed without
any further inquiry; notes that, for one enquiry, the decision was still pending and expected for Q4 2024; calls on the
EDPS to keep the discharge authority informed as to the outcome of this enquiry;
36. Regrets that the EDPS has still not formally joined the Union’s Transparency Register (TR); nevertheless notes from
the Follow-up Report that, with a view to formally joining the TR, the EDPS has launched an internal assessment on
transparency measures, whereas, in 2023, exploratory meetings and exchanges of the EDPS with secretariat of the TR
took place; calls on the EDPS to inform the discharge authority of the outcome of that assessment exercise; reiterates
its call on the EDPS to join and use the TR, including for the proactive disclosure of meetings with any third parties,
to ensure transparency in EDPS’ regulatory and advisory functions;
37. Notes with satisfaction that, in 2023, the EPDS established internal rules applicable to the hearing of persons that
could be affected by an EDPS final decision adopted in own-initiative investigations and inquiries in order to ensure
the proper exercise of their fundamental right to be heard in such proceedings; commends the EPDS for publishing a
new factsheet on EDPS Investigations and a new EDPS Investigation Policy as well as for ensuring that all financial
reports, including annual budgets, accounting and audit reports, are made publicly accessible through a Union
institution website and other official channels, as the EPDS takes a leading role in enhancing the cybersecurity
preparedness of the Union institutions;
38. Notes with satisfaction from the Questionnaire that no cases of conflicts of interest, whistleblowing or fraud were
reported in the EDPS in 2023; notes that the EDPS has set up a framework to prevent conflicts of interest at the level
of senior management and staff through codes of conduct, awareness raising and declarations of absence of conflicts
of interest and confidentiality; notes that, in addition to the mandatory introduction to the ethical framework of the
EDPS for all new members of staff, new members of staff are also introduced to the EDPS’ anti-fraud strategy;
6/9 ELI: http://data.europa.eu/eli/res/2025/1609/ojEN
OJ L, 8.10.2025
39. Notes from the Questionnaire that the EDPS has internal rules on whistleblowing, which define safe routes and
channels through which staff may raise concerns about fraud, corruption or any other serious wrongdoing, without
prejudice to the confidentiality of the identity of the whistleblower and of the information reported; notes that, so
far, there has never been a whistleblowing case reported to the EDPS;
40. Urges the EDPS to publicly disclose any recusals due to conflicts of interest in its enforcement decisions, ensuring full
transparency in regulatory oversight and decision-making;
Digitalisation, cybersecurity and data protection
41. Notes from the Questionnaire that the 2023 budget for IT equipment and projects was 9,5 % lower compared to
2022; notes that that decrease was primarily because no new IT feasibility studies were being commissioned
in 2023, as opposed to 2022 where such studies represented a substantial portion of the IT budget; notes further
that other cost elements remain relatively stable between the two years, including general IT services and
maintenance;
42. Notes from the Follow-up Report and the Questionnaire the conclusions of the IT feasibility study carried out
in 2022, whereby there are gaps between what the IT tools and services provided by the Commission and Parliament
can offer and the specific needs of the EDPS; notes that those gaps should be addressed by developing in-house
capabilities and applications for which a minimum of five IT staff and partial outsourcing EDPS was deemed
necessary; regrets that, due to budgetary constraints, implementation of the recommendations of the study remained
on hold; calls on the EDPS to consider a step-by-step approach by starting with those recommendations and projects
that would require fewer resources;
43. Commends the progress made in 2023 by the EDPS in digitalising its workflows and processes, with the introduction
of ARES, the qualified digital signature (e-IDAS) and a collaborative platform (Nextcloud) for drafting documents and
video-conferencing, as well as updates to the tool (Website Evidence Collector) that automates the collection of
personal data processing on websites of data controllers and processors, the adoption of the acceptance
environment of EU Send Web, a service/channel to exchange sensitive non-classified information with other EUIBAs
and further progress made towards implementing services that cannot be outsourced, such as the form and the
electronic workflow to manage data breach notifications; notes nevertheless issues with regard to the use and
maintenance of the e-procurement system;
44. Welcomes the EDPS’s focus on ensuring that external contractors meet the necessary moral and ethical standards
expected of all Union institutions, bodies, offices and agencies, particularly in light of the previous use of external
companies by EDPS that, according to Yale University’s ranking, continue to operate in Russia;
45. Acknowledges that the EDPS successfully relies on many of the administrative systems used by the Commission,
particularly in the field of HR and business administration processes, as well as on some of Parliament’s services,
including the provision of laptops, network infrastructure and video-conferencing; commends the fact that the
project to improve the quality and performance of the computers provided to EDPS staff, in collaboration with
Parliament, with a view to the generalisation of hybrid work, has been completed;
46. Acknowledges the leading role of EDPS in enhancing the cybersecurity preparedness of the Union institutions, while
working closely with bodies such as European Union Agency for Cybersecurity (ENISA) and cybersecurity hubs such
as CERT-EU; urges it to develop a structured audit framework for cybersecurity risks within Union bodies; notes that,
in 2023, the EDPS continued to improve its readiness to protect personal data and sensitive information against
cyber-attacks in view of the rapidly changing cybersecurity threat landscape; commends in that context the EDPS for
reviewing its security policies and methodologies in preparation for the impact of the Cybersecurity Regulation
(Regulation (EU, Euratom) 2023/2841 of the European Parliament and of the Council(3)); notes from the
Questionnaire that the EDPS introduced a request for two additional full-time equivalents to cover cybersecurity
(3) Regulation (EU, Euratom) 2023/2841 of the European Parliament and of the Council of 13 December 2023 laying down measures for
a high common level of cybersecurity at the institutions, bodies, offices and agencies of the Union (OJ L, 2023/2841, 18.12.2023, ELI:
http://data.europa.eu/eli/reg/2023/2841/oj).
ELI: http://data.europa.eu/eli/res/2025/1609/oj 7/9EN
OJ L, 8.10.2025
infrastructure in connection with EDPS’s obligations under that Regulation as well as the EDPS’ role as a member of
the Interinstitutional Cybersecurity Board (IICB); notes further with appreciation that the EPDS upgraded its
Information Security Policy and the EDPS Acceptable Use Policy to address specific cybersecurity threats in relation
to teleworking, use of personal mobile devices and banning of dangerous applications (TikTok); notes that the EDPS
did not encounter any cyber-attacks in 2023; calls for annual public reporting on detected threats, response
measures, and institutional cyber resilience;
47. Commends the EDPS for updating cybersecurity training for all staff and revamping the security training model for
newcomers; appreciates that the EPDS has been proactive in raising awareness about cyber security risks, for
instance by preparing fact sheets, conducting surveys with EUIBAs and running awareness campaigns; encourages
the EDPS to ensure that staff receives compulsory training on the safe and ethical use of AI tools to enhance their
understanding and mitigate potential risks;
Buildings
48. Notes that in 2023, as in 2022, the EDPS and EDPB were the sole tenants of Parliament’s building where they were
located, following the move of the Ombudsman at the end of 2021 and that by renting their premises from the
Parliament rather than the private market the EDPS intends to keep the rental and maintenance costs at a reasonable
level; notes that the EDPS had to request an additional EUR 81 856,84 for paying rental costs to Parliament, given
that the indexation rate was 8,82 % and thus higher than the 2 % ceiling for administrative expenditures;
49. Notes that, in terms of accessibility of its building, the EDPS relies on the decisions taken and implemented by
Parliament, as part of their building policy; notes from the Follow-up Report that the EDPS employs staff with
physical impairments due to serious illness; welcomes the commitment of the EDPS to explore the possibilities of
hiring trainees with reduced mobility or disabilities;
Environment and sustainability
50. Notes that the EDPS has not joined the Eco-Management and Audit Scheme (EMAS) but has implemented several
measures to reduce its environmental footprint, such as regulating the temperature automatically and centrally,
turning lights off automatically when there is no movement in the room, purchasing eco-friendly products and
services and automating the workflows with the introduction of ARES; notes from the Follow-up Report that
according to the information received by Parliament’s Directorate-General for Infrastructure and Logistics,
responsible for the management of the building rented by the EDPS, solar panels are installed on that building; asks
the EDPS to inform the discharge authority to report on the share (%) of the solar-panel produced electricity in the
EDPS’ total energy consumption needs per year; calls further on the EDPS to inform the discharge authority of any
new developments regarding the EMAS certification process;
51. Notes that the EPDS has not assessed its carbon footprint in 2023; welcomes, however, that the EDPS continues to
apply measures that reduce the carbon footprint by reducing the travel of journey to the office through teleworking
possibilities, reimbursing 50 % of staff’s monthly/annual subscriptions for the use of public transport, encouraging
the staff to favour videoconferencing and train travel for short distances, managing the cycle for invoices
electronically and achieving an entirely paperless selection procedure and appraisal exercise as regards HR;
52. Urges the EDPS to adopt the EMAS to systematically monitor and improve its environmental footprint, particularly in
terms of energy consumption, waste reduction, and sustainable office policies;
53. Notes that the EDPS addresses sustainability-related risks (such as environmental, social and governance risks) in a
comprehensive way through an annual risk assessment exercise; welcomes in that context that the EDPS adopted its
new risk management process in 2023, which should help the EDPS to target and better analyse those risks and
consequently better calibrate mitigating actions;
8/9 ELI: http://data.europa.eu/eli/res/2025/1609/ojEN
OJ L, 8.10.2025
Interinstitutional cooperation
54. Welcomes the budgetary and administrative savings achieved by the EDPS through inter-institutional cooperation,
particularly the conclusion of service-level agreements with Parliament for the rental of its premises and the use of
IT system applications, hardware supplies and maintenance and with the Commission for HR and business
administration processes, as well as through participation in large interinstitutional framework contracts in areas
such as IT consultancy, interim services and office supplies; commends in addition the EDPS for maintaining a
structured cooperation with the Ombudsman, the Agency for Fundamental Rights and CERT-EU through
memorandums of understanding;
55. Notes that the EDPS participates in meetings of various interinstitutional bodies; welcomes in this context the
participation of the EPDS in meetings of the Heads of Administration and the Interinstitutional Online
Communication Committee, led by Parliament’s Directorate-General for Communication; acknowledges that
interinstitutional cooperation with EDPS, in his supervisory role, is of key importance for the other Union
institutions to enhance their level of compliance with the data protection legal framework;
56. Calls for closer cooperation between the EDPS, the Court of Auditors, OLAF, and the European Public Prosecutor’s
Office (EPPO) to develop common protocols for fraud detection in digital data and financial transactions within EU
institutions; stresses the need for joint audits on AI-based fraud risks;
57. Welcomes the pivotal role played by the EDPS in 2023 in the coordination of the Data Protection Authorities of the
Member States (DPAs) to promote consistent data protection across the Union; notes that the EDPS joined 26 DPAs in
a coordinated enforcement action on the role and tasks of data protection officers (DPOs), assessing their compliance
with Regulation (EU) 2018/1725; notes the continued active involvement of the EPDS in the Coordinated
Supervision Committee (CSC) within the area of FSJ addressing issues such as handling complaints against Europol
and enhancing cooperation processes; appreciates furthermore all the other steps taken to improve cooperation
between the EDPS and the DPAs such as the conduction of a joint Europol inspection with national authorities
(Poland and Lithuania) and the participation in the coordinated supervisory action on processing minors’ data in
Europol systems, the participation in an operational visit to the European Delegated Prosecutor’s office in Lisbon
under a Working Arrangement with Portugal’s DPA and the coordination of an onsite inspection in Lesvos with
Greece’s DPA to verify data collection practices during Joint Operations by Frontex; acknowledges that those
interinstitutional engagements help the EDPS align with best practices of Union institutions and benefit from the
exchange of information with peer departments;
Communication
58. Notes that the budget for public communication and promotional activities in 2023 amounted to EUR 468 000,
which represented an increase of 54 % compared to 2022;
59. Notes with satisfaction that the EDPS organised several communication events online as well as in person in 2023,
aimed at raising awareness of EDPS’ role and mission among a wider public and the importance of respecting Union
data protection rules, such as Data Protection Day, the EDPS Trainees’ conference (twice a year), the EDPS Seminar on
the essence of the fundamental rights to privacy and data protection, and other international events;
60. Notes that the EDPS communicates online via its website and its social media accounts on X (ex-twitter) (29 400
followers), LinkedIn (71 000 followers), YouTube (2 900 followers), EU-Voice (5 900 followers) and EU-Video (750
followers);
61. Notes that the pilot project of the platforms EU Voice and EU Video (free and open-source social media networks,
privacy-oriented and based on Mastodon and PeerTube software) continued in 2023; welcomes in that context the
EDPS’ contribution to the Union’s strategy on data and digital sovereignty in order to promote the Union’s
independence in the digital world and compliance with the data protection legal framework.
ELI: http://data.europa.eu/eli/res/2025/1609/oj 9/9