Changes from report parliamentary committee draft to plenary report

Change 9 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Changed13. Notes that, with the entry into force, on 28 June 2022, of Regulation (EU) 2022/991 of the European Parliament and of the Council of 8 June 2022 amending Regulation (EU) 2016/794 of the European Parliament and of the Council establishing Europol, the oversight functions of the EDPS in relation to the operational personal data processed by Europol in the framework of its mandate were indeed strengthened; notes that the organisational changes introduced in 2022, in particular the creation of a new sub-sector in the supervision and enforcement unit with specialised staff, sought notably to reflect on the specific powers of the EDPS in relation to the supervision of the area of freedom, security and justice (‘AFSJ’) agencies, taking also into account the new supervisory powers of the EDPS in relation to Europol; calls on the EDPS to keep the discharge authority informed regarding any further extension of its mandate and the impact on resources;

Change 10 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Changed14. Notes that, as part of the changes implemented in 2022, the EDPS has striven to streamline its internal procedures to deal more rigorously with investigations and to redeploy specialised staff; notes that the investigation of complaints in a law enforcement context, e.g. complaints against the replies from Europol, to data subject access requests of citizens, often entail a high degree of complexity and take, on average, longer to investigate than other complaints;complaints given the involvement of multiple stakeholders in the process;

Change 11 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Changed15. Notes that the EDPS received 367 complaints in 2022, i.e.which 47 more than in 2021, out of which 65 were admissible and 302 were inadmissible, in addition to the 129 admissible complaints ongoing in 2022; welcomes the efforts undertaken by the EDPS to reduce the high number of inadmissible complaints, which doubled since 2019, and therefore theincreased resourcesthe neededneed for handlingresources to handle them; notes that the EDPS issued a final decision/opinion/replydecision, opinion or reply in 23 out of 65 complaint cases received in 2022 within 42 days on average; notes further that complaints concerning replies from Europol to data subject access requests from citizens were dealt with, on average, within between 5 and 12 months; notes that the EDPS is continuously re-evaluating its procedures and implementing improvements where necessary based on past lessons learned in order to further streamline its complaint handling for swifter resolution of complaints despite constraints on resources;

Change 12 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Changed16. Notes that, in 2022, the EDPS carried out two pre-investigations where there were concerns about possible infringements of data protection rules by a Union institution and pursued three ongoing formal investigations in the form of data protection audits, one of which was concluded in April 2022; notes further that the EDPS also launched four investigations in the form of data protection audits based on complaints concerning websites of certain Union institutions, bodies, offices and agencies (EUIs) and one enquiry in the AFSJ sector, and pursued ongoing investigations launched in previous years; understandsnotes that the protracted timeline of the EDPS audit of Europol’s processing of personal data of minors under the age of 15 years old marked as suspects,,suspects, provided to the Agency by third countries and international organisations, was concluded in NovemberSeptember 20222023 after aan 15-monthalmost investigation,10-month wasinvestigation attributableand toafter challengesthe relatedtopic had already been initially raised by the EDPS with recommendations addressed to workEuropol andin resourceDecember prioritisation;2018 concerning the processing of sensitive data;

Change 13 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Added17. Calls upon the EDPS to enhance the procedure and prioritise the handling of personal data pertaining to minors under the age of 15, given that this represents vulnerable groups requiring heightened protection, and therefore warrants priority status;

Change 14 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Changed18.19. Notes with satisfaction that the EDPS developed a new risk management framework at the end of 2022, thus reinforcing its internal control framework and embedding risk analysis in its annual planning;planning, which should determine the input for the priorities of the EDPS on an annual basis;

Change 15 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Changed19.20. UnderlinesAppreciates the important role of consultation and advice of the EDPS in the legislative process; notes that the EDPS’ advice took the form of 27 opinions (12 in 2021), 49 formal comments (76 in 2021) and 30 informal comments (29 in 2021) to the Commission and to the co-legislators in response to legislative consultation requests in 2022;

Change 16 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Added21. Calls on the EDPS to review its rules of procedure of ensuring and timely review of complaints by citizens, taking into account all relevant information and to inform the discharge authority on the progress made in this area;

Change 17 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Removed21. Notes that the occupancy rate of the establishment plan was at 86.9% at the end of 2022; notes that, in 2022, the EDPS organised an external selection procedure to set up a reserve list of specialised candidates in view of recruitment needs as of 2022;

Added23. Believes that given the increase in workload due to new tasks and responsibilities allocated to the EDPS, as well as many more legislative consultations and data sets to monitor, the EDPS would need a proportionate increase in staff to maintain efficient workflows with reasonable response times; encourages the EDPS to provide permanent contracts to its employees to guarantee business continuity and work security;

Removed22. Notes that, taking account of the lessons learned from the COVID-19 pandemic, the EDPS adopted a new decision on working time and hybrid working in May 2022, under which staff may notably vary their working time according to a flexitime regime and telework up to three per week; welcomes the results of the staff survey carried out in the aftermath of the adoption of that decision, which indicated that a majority of staff were satisfied with the new working arrangements;

Added24. Notes that the occupancy rate of the establishment plan was at 86,9% at the end of 2022; regrets that the occupancy rate of the establishment plan was lower than the target for 2022; acknowledges the shortage of skilled professionals; encourages the EDPS to examine useful strategies to increase visibility of its vacancies; notes that, in 2022, the EDPS organised an external selection procedure to set up a reserve list of specialised candidates in view of recruitment needs as of 2022;

Removed23. Congratulates the EDPS for having 22 nationalities represented among its staff in 2022, which is, despite the over-representation of 5 nationalities, an excellent score for such a small institution;

Added25. Notes that, taking account of the lessons learned from the COVID-19 pandemic, the EDPS adopted a new decision on working time and hybrid working in May 2022, under which staff may notably vary their working time according to a flexitime regime and telework up to three days per week; welcomes the results of the staff survey carried out in the aftermath of the adoption of that decision, which indicated that a majority of staff were satisfied with the new working arrangements;

Change 18 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Added33. Notes with satisfaction that the EDPS has never been involved in any investigations by the European Anti-Fraud Office (OLAF) since its establishment;

Change 19 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Changed30.35. Regrets that the EDPS has still not formally joined the transparency register; welcomes nevertheless the alignment of the EDPS transparency rules to the principles of the transparency register as regards mandatory prior checks in the transparency register for third party meetings with the Supervisor and the Head of the EDPS Administration; highlights that transparency could be better upheld by actively enrolling in the transparency register; reiterates the calls on the EDPS to join the EU Transparency Register;

Change 20 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Changed33.38. Notes that the 2022 budget for IT equipment and projects was 21%21 % higher compared to 2021; notes that this information has to be assessed against the background that the 2021 budget for IT was itself 20%20 % higher compared to the 2020 budget;

Change 21 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Changed37.42. CongratulatesNotes thethat EDPS foris piloting and developing innovative and privacy-friendly open source IT solutions, such as the Pilot Nextcloud software or its new video conferencing facilities aiming to cope with the generalisation of hybrid meetings while enhancingsolutions; collaboration;believes encouragesthat the EDPS toshould share those experiences with the other EUIs;

Change 22 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Added43. Welcomes the follow-up actions by the EDPS on the Schrems II judgement, especially focusing on the EUIs’ contracts with private entities in 2022, in particular large ICT providers, and on arrangements between EUIs and non-EU/EEA public bodies or international organisations;

Change 23 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Changed41.47. Welcomes that the EDPS continues to promote sustainable mobility of its staff by reimbursing 50%50 % of monthly/annual subscriptions for the use of public transport and by allocating sufficient space in its garage facilities for staff to park their bikes;

Change 24 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Changed46.52. Notes that the budget for public communication and promotional activities in 2022 amounted to EUR 304 665, which represented an increase of 19%19 % compared to 2021; welcomes the comprehensive communication strategy aiming to raise awareness about its role and the importance of respecting Union data protection rules, targeting the EUIs, EU data protection experts as well as the general public;

Change 25 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Changed49.55. AcknowledgesNotes the leading role of EDPS in piloting and promoting social media channels contributing to the Union’s strategy for data and digital sovereignty in compliance with the data protection legal framework; congratulates the EDPS for launching a pilot project aiming to bring EUIs on EU-Voice and EU-Video, which are two free, open-source social media networks, based on Mastodon software, allowing EUIs to interact with the public by sharing texts, images, videos and podcasts; congratulates the EDPS for organising, in 2022, training courses for EUIs on the use of social media in compliance with EU data protection rules and best practices.

Change 26 under “2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION”

Added56. Reiterates its support for the EDPS efforts to monitor, and explain to the wider public, emerging developments in technology and their potential impact on data protection and privacy, through the TechDispatch and TechSonar reports for example; further encourages the EDPS to increase its capacities in the field of technology monitoring and launch information campaigns on its findings and recommendations.