Changes from report parliamentary committee draft to plenary report

2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION

▸6 unchanged paragraphs

with observations forming an integral part of the decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2022, Section IX – European Data Protection Supervisor

(2023/2138(DEC))

The European Parliament,

– having regard to its decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2022, Section IX – European Data Protection Supervisor,

– having regard to Rule 100 of and Annex V to its Rules of Procedure,

– having regard to the opinion of the Committee on Civil Liberties, Justice and Home Affairs,

Changed– having regard to the report of the Committee on Budgetary Control (A90000/2024),(A9-0086/2024),

▸6 unchanged paragraphs

A. whereas in the context of the discharge procedure, the discharge authority wishes to stress the particular importance of further strengthening the democratic legitimacy of the Union institutions by improving transparency and accountability, and implementing the concept of performance-based budgeting and good governance of human resources;

B. whereas data protection is a fundamental right, protected by European law and enshrined in Article 8 of the Charter of Fundamental Rights of the European Union;

C. whereas Article 16 of the Treaty on the Functioning of the European Union provides that compliance with the rules relating to the protection of individuals, with regard to the processing of personal data concerning them, shall be subject to control by an independent authority;

D. whereas Regulation (EU) 2018/1725 provides for the establishment of an independent authority, the European Data Protection Supervisor (the ‘EDPS’), responsible for protecting and guaranteeing the right to data protection and privacy, and tasked with ensuring that the institutions and bodies, offices and agencies of the Union embrace a strong data protection culture;

E. whereas the EDPS carries out its functions in close cooperation with fellow Data Protection Authorities (DPAs) as part of the European Data Protection Board (EDPB), and it serves the public interest while being guided by principles of impartiality, integrity, transparency and pragmatism;

F. whereas, until 13 November 2022, the EDPS delegated the powers of the Authorising Officer to the Director and to the Head of Administration thereafter, in accordance with the charter of tasks and responsibilities concerning the budget and administration of the EDPS provided in accordance with Article 72(2) of Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council, while the function of the Accounting Officer of the EDPS shall be performed by the Accounting Officer of the Commission in accordance with the Decision of the European Data Protection Supervisor of 1 March 2017;

Change 2

Changed1. Notes that the budget of EDPS falls under MFF heading 7 ’European public administration’, which amounted to a total of EUR 11,6 billion, i.e. 5.9%5,9 % of Union budget spending, in 2022; notes that the budget of the EDPS represented 0.17%0,17% of MFF heading 7 appropriations;

2. Notes that the Court of Auditors (the “Court”), in its annual report for the financial year 2022 examined a sample of 60 transactions under Administration, the same number as for 2021; further notes that the Court writes that administrative expenditure comprises expenditure on human resources including pensions, which in 2022 accounted for about 70 % of the total administrative expenditure, and on buildings, equipment, energy, communications and information technology and that its work over many years indicates that, overall, this spending is low risk;

Change 3

Changed3. Notes that the Court,asCourt, as part of the audit for 2022, examined the supervisory and control systems of the EDPS, in particular the implementation of internal control standards, risk management, and the functioning of key controls defined in the Financial Regulation, including ex ante and ex post controls on payments;

4. Notes that 14 (23 %) of the 60 transactions contained errors but that the Court, based on the five errors which were quantified, estimates the level of error to be below the materiality threshold;

5. Notes with satisfaction that the Court in its annual report for the financial year 2022 states that it did not identify any specific issues concerning the EDPS;

Budgetary and financial management

Change 4

Changed6. Notes that the final adopted budget for the EDPS was EUR 20 266 000 in 2022, which represented an increase of 4.12%4,12% compared to 2021; notes that the EDPS received EUR 50 000 of assigned revenue related to services provided to the EFTA Supervisory Authority by means of a Service Level Agreement; notes that the budget of the EDPS also covers the work of the independent Secretariat of the European Data Protection Board (the ‘Board’);

Change 5

Changed7. Notes with satisfaction that the budget implementation rate was 98%98 % in 2022, which is higher than the previous year, when the budget implementation rate was 86%;86 %;

8. Notes that Russia’s war of aggression against Ukraine created budgetary pressure for the EDPS, including through rising inflation and salary adjustments, strongly increasing energy costs and the cost of goods and services through public procurement and service-level agreements with other institutions; welcomes the internal reallocations within budget chapters performed in the course of 2022 in order to optimise the budget implementation;

Change 6

Changed9. Notes that the average time for payment was 21.5421,54 days in 2022, which represented an increase compared to 2021 when the average time was 19.9819,98 days; welcomes the introduction of a new electronic payment system to process invoices related to mission costs prepaid by the travel agency, which is expected to help reduce the time it takes to make payments once fully operational; calls on the EDPS to consider the possibility of extending this system to other types of payments;

Change 7

Changed10. Notes that the EDPS budget for staff missions increased from EUR 41 000 to EUR 251 000, i.e. an increase of 512%,512 %, between 2021 and 2022 following the resumption of travel after the COVID-19 pandemic; notes further that, within this overall budget, the EDPS had a dedicated mission budget for the Supervisor of EUR 33 000 in 2022 compared to EUR 5 000 in 2021, i.e. an increase of 560%;560 %; notes that the increase in inflation and the substantial increase in energy prices in 2022 linked to Russia’s war of aggression against Ukraine had an adverse effect on flight tickets and hotel costs, thus leading to an increase in mission costs;

Internal management, performance and internal control

11. Notes that, in 2022, the EDPS conducted a mid-term review of its 2020-2024 strategy focusing on three pillars ‘Foresight, Action and Solidarity’, setting out EDPS refocused vision and priorities for the period 2022-2024 with a view to ‘shaping a safer digital future’;

Change 8

Changed12. WelcomesAcknowledges the major organisational changes, and the corresponding revision of its rules of procedures, undertaken by the EDPS in 2022 to support the evolution of its tasks and improve the efficiency of its processes in light of the fast-changing international environment; notes inthat, particularin that,particular, as a result of these changes, the EDPS created a new function of Head of the EDPS Secretariat at the level of a Secretary General, a dedicated legal service function, a governance and internal compliance sector, two new operational sectors in the supervision and enforcement unit, a new finance sector in the HR, budget and administration Unit and an antenna in Strasbourg;

Change 9

Changed13. Notes that, with the entry into force, on 28 June 2022, of Regulation (EU) 2022/991 of the European Parliament and of the Council of 8 June 2022 amending Regulation (EU) 2016/794 of the European Parliament and of the Council establishing Europol, the oversight functions of the EDPS in relation to the operational personal data processed by Europol in the framework of its mandate were indeed strengthened; notes that the organisational changes introduced in 2022, in particular the creation of a new sub-sector in the supervision and enforcement unit with specialised staff, sought notably to reflect on the specific powers of the EDPS in relation to the supervision of the area of freedom, security and justice (‘AFSJ’) agencies, taking also into account the new supervisory powers of the EDPS in relation to Europol; calls on the EDPS to keep the discharge authority informed regarding any further extension of its mandate and the impact on resources;

Change 10

Changed14. Notes that, as part of the changes implemented in 2022, the EDPS has striven to streamline its internal procedures to deal more rigorously with investigations and to redeploy specialised staff; notes that the investigation of complaints in a law enforcement context, e.g. complaints against the replies from Europol, to data subject access requests of citizens, often entail a high degree of complexity and take, on average, longer to investigate than other complaints;complaints given the involvement of multiple stakeholders in the process;

Change 11

Changed15. Notes that the EDPS received 367 complaints in 2022, i.e.which 47 more than in 2021, out of which 65 were admissible and 302 were inadmissible, in addition to the 129 admissible complaints ongoing in 2022; welcomes the efforts undertaken by the EDPS to reduce the high number of inadmissible complaints, which doubled since 2019, and therefore theincreased resourcesthe neededneed for handlingresources to handle them; notes that the EDPS issued a final decision/opinion/replydecision, opinion or reply in 23 out of 65 complaint cases received in 2022 within 42 days on average; notes further that complaints concerning replies from Europol to data subject access requests from citizens were dealt with, on average, within between 5 and 12 months; notes that the EDPS is continuously re-evaluating its procedures and implementing improvements where necessary based on past lessons learned in order to further streamline its complaint handling for swifter resolution of complaints despite constraints on resources;

Change 12

Changed16. Notes that, in 2022, the EDPS carried out two pre-investigations where there were concerns about possible infringements of data protection rules by a Union institution and pursued three ongoing formal investigations in the form of data protection audits, one of which was concluded in April 2022; notes further that the EDPS also launched four investigations in the form of data protection audits based on complaints concerning websites of certain Union institutions, bodies, offices and agencies (EUIs) and one enquiry in the AFSJ sector, and pursued ongoing investigations launched in previous years; understandsnotes that the protracted timeline of the EDPS audit of Europol’s processing of personal data of minors under the age of 15 years old marked as suspects,,suspects, provided to the Agency by third countries and international organisations, was concluded in NovemberSeptember 20222023 after aan 15-monthalmost investigation,10-month wasinvestigation attributableand toafter challengesthe relatedtopic had already been initially raised by the EDPS with recommendations addressed to workEuropol andin resourceDecember prioritisation;2018 concerning the processing of sensitive data;

Change 13

Added17. Calls upon the EDPS to enhance the procedure and prioritise the handling of personal data pertaining to minors under the age of 15, given that this represents vulnerable groups requiring heightened protection, and therefore warrants priority status;

18. Notes that, on 16 September 2022, the EDPS brought an action for the annulment of two provisions of the amended Europol Regulation before the Court of Justice of the European Union (CJEU), which was later rejected by the CJEU; underlines that the fact that important legal matters are brought before the CJEU by the EDPS in its supervisory role should not be seen as affecting the loyal cooperation and good relations between the EDPS and the entities it supervises;

Change 14

Changed18.19. Notes with satisfaction that the EDPS developed a new risk management framework at the end of 2022, thus reinforcing its internal control framework and embedding risk analysis in its annual planning;planning, which should determine the input for the priorities of the EDPS on an annual basis;

Change 15

Changed19.20. UnderlinesAppreciates the important role of consultation and advice of the EDPS in the legislative process; notes that the EDPS’ advice took the form of 27 opinions (12 in 2021), 49 formal comments (76 in 2021) and 30 informal comments (29 in 2021) to the Commission and to the co-legislators in response to legislative consultation requests in 2022;

Change 16

Added21. Calls on the EDPS to review its rules of procedure of ensuring and timely review of complaints by citizens, taking into account all relevant information and to inform the discharge authority on the progress made in this area;

Human resources, equality and staff well-being

22. Notes that, at the end of 2022, the EDPS had 127 staff members, compared to 124 at the end of 2021 and 114 at the end of 2020; notes that the EDPS employed 52 contract staff under Article 3(b) of the Staff Regulations of Officials and the Conditions of Employment of Other Servants and 6 temporary agents under Article 2(b) and 2(c); further notes that the EDPS employed 8 external service providers working on-site in 2022; calls on the EDPS to inform the discharge authority on the measures put in place to ensure that access to information by external services providers was managed in accordance with the level of confidentiality required by the matters at stake;

Change 17

Removed21. Notes that the occupancy rate of the establishment plan was at 86.9% at the end of 2022; notes that, in 2022, the EDPS organised an external selection procedure to set up a reserve list of specialised candidates in view of recruitment needs as of 2022;

Added23. Believes that given the increase in workload due to new tasks and responsibilities allocated to the EDPS, as well as many more legislative consultations and data sets to monitor, the EDPS would need a proportionate increase in staff to maintain efficient workflows with reasonable response times; encourages the EDPS to provide permanent contracts to its employees to guarantee business continuity and work security;

Removed22. Notes that, taking account of the lessons learned from the COVID-19 pandemic, the EDPS adopted a new decision on working time and hybrid working in May 2022, under which staff may notably vary their working time according to a flexitime regime and telework up to three per week; welcomes the results of the staff survey carried out in the aftermath of the adoption of that decision, which indicated that a majority of staff were satisfied with the new working arrangements;

Added24. Notes that the occupancy rate of the establishment plan was at 86,9% at the end of 2022; regrets that the occupancy rate of the establishment plan was lower than the target for 2022; acknowledges the shortage of skilled professionals; encourages the EDPS to examine useful strategies to increase visibility of its vacancies; notes that, in 2022, the EDPS organised an external selection procedure to set up a reserve list of specialised candidates in view of recruitment needs as of 2022;

Removed23. Congratulates the EDPS for having 22 nationalities represented among its staff in 2022, which is, despite the over-representation of 5 nationalities, an excellent score for such a small institution;

Added25. Notes that, taking account of the lessons learned from the COVID-19 pandemic, the EDPS adopted a new decision on working time and hybrid working in May 2022, under which staff may notably vary their working time according to a flexitime regime and telework up to three days per week; welcomes the results of the staff survey carried out in the aftermath of the adoption of that decision, which indicated that a majority of staff were satisfied with the new working arrangements;

Removed24. Notes that, in 2022, the EDPS employed a total of 64% women and 36% men, along the same trend as in previous years, when the distribution between women and men was 63% and 37% respectively; regrets that there were no women in senior management positions in 2022, whereas the gender ratio of four middle managers reached a balance during the year; calls on the EDPS to continue its efforts to achieve a gender-balanced representation of staff;

Added26. Congratulates the EDPS for having 22 nationalities represented among its staff in 2022, which represents an improvement in comparison with 21 in 2021 and is, despite the over-representation of 5 nationalities, a good score for such a small institution; calls on EDPS to endeavour to achieve a more equitable geographical representation among all Member States, with particular attention being paid to addressing the underrepresentation of certain countries;

Removed25. Notes with satisfaction that no cases of burnout or harassment were reported among the EDPS staff in 2022; welcomes that the EDPS set up a working group to discuss issues related to the distribution and allocation of work following the results of the biennial staff satisfaction survey conducted in June 2022, according to which some EDPS staff felt that the workload was not equally shared or well distributed across teams and colleagues; asks the EDPS to keep the discharge authority informed of the outcome of the working group discussions;

Added27. Notes that, in 2022, the EDPS employed a total of 64 % women and 36 % men, along the same trend as in previous years, when the distribution between women and men was 63 % and 37 % respectively; regrets that there were no women in senior management positions in 2022, whereas the gender ratio of four middle managers reached a balance during the year; calls on the EDPS to continue its efforts to achieve a gender-balanced representation of staff;

Added28. Notes with satisfaction that no cases of burnout or harassment were reported among the EDPS staff in 2022; welcomes that the EDPS set up a working group to discuss issues related to the distribution and allocation of work following the results of the biennial staff satisfaction survey conducted in June 2022, according to which some EDPS staff felt that the workload was not equally shared or well distributed across teams and colleagues; asks the EDPS to keep the discharge authority informed of the outcome of the working group discussions and the details of the action plan under preparation;

Added29. Welcomes the EDPS’ continued efforts to actively improve physical and mental well-being of its staff;

▸4 unchanged paragraphs

30. Notes with satisfaction that the EDPS recruited 18 trainees in 2022, who were remunerated and enjoyed the same working arrangements as the rest of the staff;

Ethical framework and transparency

31. Notes that, in 2022, the EDPS focused its efforts on increasing staff awareness about the EDPS/EDPB ethical framework by organising mandatory dedicated training sessions for all staff and induction trainings for EDPS/EDPB newcomers; encourages the EDPS to continue raising awareness and organising surveys to assess the level of staff awareness of the EDPS/EDPB ethical framework;

32. Welcomes the overall high level of transparency achieved by the EDPS concerning its activities, in particular regarding the publication of the agenda and the declaration of interests of the Supervisor and of the Head of EDPS Administration, in line with the Supervisor’s code of conduct of 2019; regrets that the EDPS decided to apply the Supervisor’s code of conduct to the Head of the EDPS Administration instead of adopting a dedicated code of conduct for senior management positions;

Change 18

Added33. Notes with satisfaction that the EDPS has never been involved in any investigations by the European Anti-Fraud Office (OLAF) since its establishment;

34. Notes with satisfaction that two inquiries opened by the Ombudsman in 2022 concerning the EDPS were closed with no findings of maladministration;

Change 19

Changed30.35. Regrets that the EDPS has still not formally joined the transparency register; welcomes nevertheless the alignment of the EDPS transparency rules to the principles of the transparency register as regards mandatory prior checks in the transparency register for third party meetings with the Supervisor and the Head of the EDPS Administration; highlights that transparency could be better upheld by actively enrolling in the transparency register; reiterates the calls on the EDPS to join the EU Transparency Register;

36. Notes that the EDPS has set up a framework to prevent conflicts of interest at the level of senior management and staff through codes of conduct, awareness raising and declarations; notes with satisfaction that no conflicts of interest were detected in 2022;

37. Notes that the EDPS has internal rules on whistle-blowing, which define safe routes and channels through which staff may raise concerns about fraud, corruption or any other serious wrongdoings without prejudice to the confidentiality of the identity of the whistle-blower and of the information reported; notes that no cases of whistle-blowing were reported in 2022;