Changes from report parliamentary committee draft to plenary report

2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION

▸6 unchanged paragraphs

with observations forming an integral part of the decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2024, Section IX – European Data Protection Supervisor

(2025/2154(DEC))

The European Parliament,

– having regard to its decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2024, Section IX – European Data Protection Supervisor,

– having regard to Rule 102 of and Annex V to its Rules of Procedure,

– having regard to the opinion of the Committee on Civil Liberties, Justice and Home Affairs,

Changed– having regard to the report of the Committee on Budgetary Control (A10-0000/2026),(A10-0057/2026),

▸12 unchanged paragraphs

A. whereas in the context of the discharge procedure, the discharge authority wishes to stress the particular importance of further strengthening the democratic legitimacy of the Union institutions by improving transparency and accountability, and implementing the concept of performance-based budgeting and good governance of human resources (HR);

B. whereas data protection is a fundamental right, protected by Union law and enshrined in Article 8 of the Charter of Fundamental Rights of the European Union;

C. whereas Article 16 of the Treaty on the Functioning of the European Union provides that compliance with the rules relating to the protection of individuals, with regard to the processing of personal data concerning them, shall be subject to control by an independent authority;

D. whereas Regulation (EU) 2018/1725 provides for the establishment of an independent authority, the European Data Protection Supervisor (the ‘EDPS’), responsible for protecting and guaranteeing the right to data protection and privacy, and tasked with ensuring that the institutions and bodies, offices and agencies of the Union embrace a strong data protection culture;

E. whereas the EDPS carries out its functions in close cooperation with fellow Data Protection Authorities (DPAs) as part of the European Data Protection Board (EDPB), and it serves the public interest while being guided by principles of impartiality, integrity, transparency and pragmatism and respects Union legislation;

F. whereas Union citizens need a digital environment that is not controlled by opaque interests, and initiatives that promote digital sovereignty ensuring that individuals, not companies or unaccountable systems, are at the centre of data governance in the Union;

1. Notes that the budget of EDPS falls under MFF Heading 7 ’European public administration’, which amounted to a total of EUR 13,3 billion, i.e. 6,9 % of EU budget spending, in 2024; notes that the budget of the EDPS represented 0,18 % of MFF Heading 7 appropriations;

2. Notes that the Court of Auditors (the ‘Court’), in its Annual Report for the financial year 2024 (the ‘Court’s report’) examined a sample of 70 transactions under the heading ‘Administration’, the same number as in 2023; whereas the Court further states that administrative expenditure comprises expenditure on HR, including expenditure on pensions, which in 2024 accounted for approximately 69 % of the total administrative expenditure, and expenditure on buildings, equipment, energy, communications and information technology (IT), and that its work over many years indicates that, overall, that administrative expenditure is low risk;

3. Notes that 16 (23 %) of the 70 transactions contained errors but that the Court, based on the three errors which were quantified, estimates the level of error to be below the materiality threshold; notes that the Court’s report did not identify any specific issues concerning the EDPS;

Budgetary and financial management

4. Notes that the final adopted budget for the EDPS was EUR 24 329 460 in 2024, which represents an increase of 7,12 % compared to 2023 (EUR 22 711 559); notes that the budget of the EDPS also covers the work of the independent Secretariat of the EDPB; notes from the Annual Report of the EDPS for 2024 (the ‘Annual Report’) that the adopted budget of the EDPB was EUR 8,36 million in 2024 (compared to EUR 7,67 million in 2023);

5. Notes with satisfaction that the budget monitoring and planning efforts of the EDPS in the financial year 2024 resulted in a budget implementation rate of current year commitment appropriations of 96 % in 2024 (the same as in 2023); further notes from the report on the EDPS annual accounts for 2024 that the current year payment appropriations execution rate was 84 % (the same as in 2023); notes in addition, from EDPS replies to the questionnaire submitted by the Committee on Budgetary Control for the 2023 budgetary discharge (the ‘Questionnaire’), that the execution rate of payment appropriations overall was 91,88 % in 2024, higher than 91,33 % in 2023;

Change 2

Changed6. Notes further that the amount of carry-overs (C8) from 2024 to 2025 was EUR 2 649 943 (i.e. 10,89 % of the total budget for 2024) compared to EUR 2 517 942 in 2023 (i.e. 11,08 % of the total budget for 20234);2023); notes that the execution rate of the C8 budget in 2024 was 77,37 % (compared to 76,65 % in 2023);

7. Notes that the average time to pay was 20 days in 2024 compared to 19 days in 2023, with 96,87 % of payments processed on time (up from 92,73 % in 2023); notes further that there was an increase in the number of payments from 1 335 in 2023 to 1 440 in 2024; notes that the EDPS encountered some technical difficulties in 2024 due to running two different IT systems in parallel (Commission’s SUMMA and EDPS’ ABAC systems) which required the manual re-encoding and other manual interventions; notes that SUMMA is expected to be introduced at the EDPS in 2026;

Change 3

Changed8. Notes from the Questionnaire that the EDPS’ overall missions budget decreased by 17,86 % from EUR 323 421 in 2023 to EUR 265 630 in 2024 due to a decrease in travel and related costs as a result of increased participation in remote/hybrid meetings; notes, from the Annual Report, that the number of staff missions also decreased, from 246 in 2023 to 218 in 2024; notes that, as part of that budget, an amount of EUR 38 418 was dedicated for 23 missions of the Supervisor in 2024 which increased from EUR 33 000 for 24 missions in 2023, mainly due to the location of important meetings and events that the Supervisor was required to attend, including several missions in the United States and Mexico in 2024; notes with concern that, concerningregarding missions to the country of origin of high ranking officials, in 2024 the Supervisor took only 3 missions to Poland in 2024 (out of the total of 23), while the EDPS’ Secretary-General (SG) conducted 159 missions,missions nineto Spain (out of whichthe weretotal toof Spain,15); instresses 2024;that the EDPS still does not provide information about the number of missions funded by organisers or other third parties, thus reducing transparency regarding EDPS mission expenses;

Change 4

Changed9. Notes from the Questionnaire that, in the context of the illegal Russia’s war of aggression against Ukraine, inflationary pressures on contracts and services were addressed by the EDPS by revising cost estimates during the year and reallocating resources through transfers made in accordance with Article 29(1) and (4) of the Financial Regulation, providing for contingency margins and reassessing priorities to ensure servicing EDPS core processes; invites the EDPS to continue carrying out regular reviews to identify areas of under-execution and reallocate funds where needed during the year; acknowledges the need for all Union institutions to improve their budget management by also taking into account price volatility, especially in the energy sector, when concluding contracts with service providers;

▸4 unchanged paragraphs

10. Notes that the EDPS launched and awarded 66 procurement procedures, of which 45 were of a very low value, two were negotiated procedures without prior publication, nine were specific contracts for the establishment of a list of individual experts and one was a framework contract of EUR 200 000 with PricewaterhouseCoopers; notes that the majority of contracts are signed by the EDPS with small and medium sized-enterprises through very low-value or low-value procedures;

Internal management, performance and internal control

11. Notes that the EPDS used nine key performance indicators (KPIs) to monitor its performance in 2024, in alignment with the main objectives of the EDPS Strategy 2020-2024 implemented through the Annual Management Plan; notes from the Annual Report that the EDPS met or surpassed the targets sets in all KPIs, except for one KPI (the number of followers of the EDPS on some social media accounts);

12. Notes the EDPS’ various roles such as DPA and, as of 1 August 2024, as Notified Body, Notified Authority and Market Surveillance Authority (MSA) in charge of supervising and enforcing Regulation (EU) 2024/1689 of the European Parliament and of the Council onto the Union institutions, bodies and agencies (EUIBAs), whereas for the latter role the EDPS will have enforcement powers from 2 August 2026 only; notes with appreciation that, in that context, the EDPS has been working on the governance structures and procedural frameworks necessary to exercise its new tasks and powers as MSA under Regulation (EU) 2024/1689, including by launching AI Act Correspondents Network in 2024 which attracted the participation, despite voluntary, of all EUIBAs;

Change 5

Changed13. Notes the increased role of the EDPS in new legislative acts, including Regulation (EU) 2024/1689, under which EDPS becomes the competent authority for the Union institutions, agencies, offices and bodies, and under which the EDPS has been delegated further tasks; notes that on 1 October 2024, to address its new supervisory tasks, the EDPS established an AI unit which in 2024 was composed of two staff reassigned internally; notes from the Questionnaire that, as of 2025, for that unit the EDPS has a budget that covers two permanent posts and five contract agentsagents, for which recruitment procedures have taken place; notes however from the Questionnaire the EDPS’ view that those resources remain insufficient to cover those new tasks, in particular the supervision of AI systems in the area of border control, migration, justice and law enforcement or the establishment of an AI regulatory sandbox for EUIBAs, as provided for in Article 57(3) of Regulation (EU) 2024/1689; further notes from the EDPS’ follow-up report to Parliament’s resolution on the implementation of the EDPS’ budget for 20222023 (the ‘Follow-up Report’) that, also due to budgetary constraints, the EDPS could not launch the feasibility study on artificial intelligence in 2024; reminds that the EDPS should abide by the competences of its mandate with a collaborative approach with the Union institutions and agencies in order to avoid costly legal procedures; recalls that, in its 2023 discharge resolution, Parliament already warned that the progressive expansion of the EDPS’ mandate risked outpacing its available resources; underlines the importance of providing the EDPS with adequate financial and human resources to effectively supervise AI systems in high-stakes areas;

Change 6

Changed14. Notes with regard to technology monitoring and foresight, that the EDPS, through its Technological and Privacy unit, focused on artificial intelligence in 2024; notes in this context some of the topics addressed by the EDPS such as: - the processing of neurodata by neurotechnologies, covered by the ‘TechDispatch on neurodata’ issued by the EDPS together with the Spanish DPA in June 2024 and; - the automated decision-making and its human oversight, addressed at a thematic seminar jointly organised with European Union Agency for Cybersecurity (ENISA) and Karlstad University in September 2024; notes with appreciation that in November 2024 the EDPS published the 4th edition of its Techsonar initiative which was focused on six AI trends such as: retrieval-augmented generation, on-device AI, machine unlearning, multimodal AI, scalable oversight and neuro-symbolic AI; underlines that it is important for the EDPS to accumulate the knowledge necessary to enforce its powers under Regulation (EU) 2024/1689once2024/1689 once the EUIBAs will start using emerging technologies to process personal data; notes, moreover, that in 2024 the EDPS issued first guidelines for EUIBAs to ensure data protection compliance when using generative AI systems, as well as three Supervisory Opinions on the use of AI tools by Europol and Eurojust;

15. Acknowledges an ever increasing number of complaints from one year to the other, whereas most of the complaints relate to the Commission and are submitted by staff of the EUIBAs; notes that the EDPS received 663 complaints, i.e. 202 more than in 2023, out of which 108 were admissible, and 555 inadmissible in 2024; notes that the EDPS issued a final decision, opinion or reply in 77 (i.e. an increase of 33 % compared to 2023) out of 108 complaint cases received in 2024 and responded to all inadmissible complaints received; notes that, out of all admissible complaints received in 2024, 48 cases were finalised in 2024, which is a decrease from 55 cases in 2023; notes that 104 admissible complaints (an increase from 71 cases in 2023), including those submitted before 2024, were ongoing at the end of 2024; acknowledges the efforts made by the EDPS to reduce the high number of complaints and encourages it to further streamline its complaint handling by seeking e.g. a common understanding of the complaint handling procedure with the national DPAs, in particular in the area of Freedom, Security and Justice where investigations are complex and lengthy; notes that the EDPS received 125 personal data breach notifications in 2024, up from 77 notifications in 2023;

Change 7

Added16. Urges the EDPS to reflect on its KPIs and to ensure that they cover complaint handling as well as setting targets for handling complaints and inquiries, which would be similar to the practice of the European Ombudsman;

17. Underlines the important role of consultation and advice of the EDPS in the Union’s legislative process, not only at the early stage of preparation of the Commission’s legislative proposals, but also by providing comments or opinions on compromise amendments on trilogue negotiations upon requests from Parliament and its Committees; notes that, pursuant to Article 42(1) of Regulation (EU) 2018/1725, the EDPS responded to 97 formal legislative consultations (80 in 2023) and its advice took the form of 25 opinions (54 in 2023), 45 formal comments (26 in 2023) and 27 informal comments (34 in 2023) to the Commission and to the co-legislators in response to legislative consultation requests in 2024;

Change 8

Changed17.18. Notes the EDPB’s key role in harmonising guidance, procedure, enforcement processes and practice of Supervisory Authorities (SAs) across Member States; notes in this context that EDPB in 2024 took no binding decision, issued 28 consistency opinions, adopted two new guidelines, issued four statements on legislative developments, implemented and coordinated several programmes as regards enforcement cooperation; notes further that EDPB provides the secretariat of the Coordinated Supervision Committee (CSC), which is a group of national SAs and the EDPS)EDPS that ensures coordinated supervision of the Union’s large-scale IT systems, whereas in 2024 such supervision was extended to the Visa Information System, on top of the preparation work carried out for the supervision of European Travel Information and Authorisation System (ETIAS);

Change 9

Changed18.19. Notes with satisfaction that the EDPS developed various procedural tools and policies to enhance its investigatory processes in 2024; commends in this context the EDPS for having amended its Rules of Procedure in 2024, whereby the “review‘review procedure”procedure’ was replaced by a “preliminary‘preliminary assessment”assessment’ in order to safeguard the right to be heard of all the involved parties; notes that as of July 2024, EUIBAs can share their views on the preliminary assessment before the EDPS takes a decision that could adversely affect them; notes that these procedural safeguards contribute to a fair and timely handling of complaints and investigations; notes that in 2024 the EDPS also reviewed investigation methodologies, developed a manual on access to the file, enhanced litigation preparedness, updated the internal complaints case manual and improved hearing recordings and transcription processes;

Change 10

Changed19.20. Notes from the Annual Report and the Follow-up Report the EDPS’ special attention regarding processing of children’s data, in particular in law enforcement contexts; notes that one of the audits carried out by the EDPS in 2024 was on the processing of children’s personal data in research projects managed by the Commission’s Joint Research Centre in Spain, in particular with regard to child-robot interaction; notes with satisfaction that in October 2024, the EDPS attended the G7 DPAs Roundtable in Rome, on the occasion of which the DPAs issued a “Statement‘Statement on AI and Children”Children’ urging action to safeguard children’s privacy and ensure AI fosters trust while protecting the most vulnerable; recalls that the EDPS carried out thea annualdedicated inspection on Europol’s processing of data about minors under 15 marked as suspects; appreciates that the EDPS found that the general process for the assessment of information provided by partners on minors (including minors under 15 years old) is clear and well developed; notes that the EDPS inspection report asks Europol to conductcontinue conducting its own assessment on the lawfulness of data received and raises concerns onunderlined whetherthat Europol meets theneeds thresholdto ofassess ‘strict proportionality’necessity’ for the processing of data on minors suspected of minor infractions;crimes;

21. Notes that EUIBAs may consult the EDPS for guidance on planned processing operations and data protection; notes that the EDPS issued advice in 26 consultation and 26 supervisory opinions on various topics; notes in particular that in December 2024 the EDPS published a supervisory opinion regarding Parliament’s plan to use biometrics to attest Members’ attendance for daily allowances payments;

22. Notes that, in 2024, the EDPS carried out four investigations and two pre-investigations, which is a decrease compared to 2023; notes among the most notable cases a pre-investigation on automated decision-making in trainee selection, an investigation on the Commission’s use of Microsoft 365 and one pre-investigation on profiling in public access applications; notes with regard to the Commission’s use of Microsoft 365 that the investigation found multiple violations of the Regulation (EU) 2018/1725 which prompted the EDPS to order the Commission to suspend all data flows to Microsoft and its affiliates outside the Union/European Economic Area (EEA) by 9 December 2024; calls on the EDPS to keep the discharge authority informed of the outcome of the follow-up regarding the Commission’s compliance with the EDPS’ recommendations in this case; notes further that the EDPS continued five investigations into EUIBAs’ website practices focusing on third-party components and consent requests in 2024; notes that the EDPS conducted three audits in 2024, with on-site visits, on topics such as health data processing, retention periods and research involving minors;

Change 11

Changed22.23. Recalls that in 2022 the EDPS brought an action for the annulment of two provisions of the amended Regulation (EU) 2016/794 of the European Parliament and of the CouncilbeforeCouncil before the Court of Justice of the European Union (CJEU), which was later rejected by the CJEU, but then appealed by the EDPS at the General Court ruling in case T-578/22, believing the issues raised should be addressed at the highest level; notes from the Follow-up Report that the EDPS is refraining from commenting on that appeal, as it is ongoing; recalls that bringing legal matters before the CJEU by the EDPS in its supervisory role should not be seen as affecting the loyal cooperation and good relations between the EDPS and the entities it supervises;supervises, but notes that it casts doubts on the EDPS’ position towards the role of Parliament and the Council as legislator;

24. Notes that the 2024 exercise for the assessment of the EDPS’ Internal Control Standards confirmed a satisfactory level of internal control with all 14 standards present and functioning; notes that a working group was formed to analyse results and propose improvements, such enhancements in training and development and knowledge and document management; notes from the Questionnaire that the EDPS’ updated risk management framework introduced a structured follow-up which has enabled the organisation to ensure mitigation efforts remain effective and consistently monitored; notes further that the EDPS updated its procedure on ex-post controls which are now risk-based and reinforced business continuity and the audit trail through integration of ARES system, training, and improved knowledge management processes;

Change 12

Changed24.25. Notes from the Questionnaire that the Commission’s Internal Audit Service (IAS) launched one audit in 2024, on governance for IT services provided by Parliament to the EDPS, which resulted in two recommendations currently being implemented by the EDPS; notes with regard to an audit from 2023 on the ‘methodology for the planning of EDPS audits’ that one of the two recommendations issued by the IAS has been addressed while implementation of the other recommendation (on the design of methodology to establish the EDPS audit plan) has been postponed for when the new Supervisor will be appointed; calls on the EDPS to keep the discharge authority informed on the progress made in this matter;matter, noting that the EDPS should consult the entities audited by it regarding the feasibility and suitability of recommendations planned to be made, to ensure a swift, effective and resourceful implementation of the recommendations thereafter by the audited body;

Human resources, equality and staff well-being

Change 13

Changed25.26. Notes that, at the end of 2024, the EDPS had 137 members of staff, compared to 129 in 2023; notes that the EDPS employed 55 contract staff (CAs) under Article 3(b) of the Staff Regulations3b of Officials and the Conditions of Employment of Other Servants of the European Union (50 CA in 2023), 9 temporary agents (TA) under Article 2(b)2, points (b) and 2(c)(c), (7 TAs in 2023) and used the services of 10 external services providers (EXT) working intra-muros in 2023 (12 EXT in 2022); invites the EDPS to reflect on the way to reduce the number of CAs in favour of permanent contracts to guaranteeensure talent retention and business continuity; notes that the EDPS had 23 nationalities from the Member States in 2024 (the same as in 2023) represented among its staff, which is, despitedespite, the over-representation of 5 nationalities and the underrepresentation of other nationalities, an excellent score for such a small institution; calls on the EDPS to continue its efforts towards a balanced geographical distribution of nationals from all Member States, with particular regard to the managerial level, including through its recruitment policy;

Change 14

Changed26.27. Notes a high occupancy rate of the establishment plan of 98,80 % (compared to 95,65 % in 2023) but also a high turnover rate of 12 % in 2024 (compared to 13 % in 2023); notes that most of the unfilled positions were a result of candidates being unsuitable; acknowledges the challenges identified in recruitment and selection procedures; notes with satisfaction from the Follow-up Report that the EDPS addressed these challenges by developing a comprehensive staff retention and talent attraction strategy which was adopted in the beginning of 2025, with short, medium and long-terms actions for retention of experienced staff, mitigation of turnover risks and improvement of the EDPS’ attractiveness as an employer; encourages the EDPS to continue improving recruitment procedures, while fully respecting the principles of merit, transparency and equal treatment;

28. Notes with regard to gender breakdown of EDPS staff, that 63 % were women and 37 % were men in 2024, along the same trend as in previous year, when the distribution between women and men was respectively to 65 % and 35 %; notes a gender balance among middle managers, with three men and three women, but regrets a continued underrepresentation of women in senior management positions; calls on the EDPS to continue its efforts to achieve a gender balanced representation of staff;

29. Notes that the EDPS hired 20 trainees from the Commission’s Blue Book Traineeship programme which were paid a monthly allowance of around EUR 1 500 and one unpaid trainee on the basis of an academic internship agreement; renews its emphasis that traineeships should be remunerated in compliance with European Parliament resolution of 14 June 2023 with recommendations to the Commission on quality traineeships in the Union (2020/2005(INL)), which calls for all internships in the Union to be paid;

30. Notes the activities carried out by the EDPS for the development of its HR in 2024; notes that it adopted a new policy on online learning platforms, joined the new inter-institutional job shadowing programme with five EDPS staff shadowing Commission’s staff, organised an away day for staff dedicated to AI preparedness and other cohesion building activities; notes the launching of a cross-unit working group to develop initiatives in favour of equality, inclusion and diversity;

Change 15

Changed30.31. Notes, from the Questionnaire, that the EDPS offers flexible and hybrid working arrangements, that are well-received by members of staff who can benefit inter alia from parental leave, time credits, part-time work or working from abroad for a limited number of days per year; notes that the next staff satisfaction survey, covering teleworking, was planned for 2025; considers that building infrastructure could be optimised, where appropriate, in order to reflect teleworking and hybrid working arrangements, with a view to reducing operational costs and ensuring a more efficient use of office space;

32. Notes that currently the EDPS does not employ staff with disabilities but has an equal opportunities clause included in all EDPS vacancy notices and actively encourages applications from candidates with disabilities; notes that the EDPS corporate website is built on a content management system that is aligned with essential standards for accessible web design and any additional functionalities developed for that website are created with accessibility as a key requirement;

Change 16

Changed32.33. Notes from the Questionnaire the EDPS’ reply whereby the EDPS has no access to medical files of its staff and is not in the position to know the root cause of absences, as they are validated by the Medical Service of the Commission; notes that the EDPS only has access to aggregated data such as the number of sick-leave days and whether they are accompanied by a medical certificate; notes that the increase from 2023 to 2024 in the number of sick leave days, i.e. from 1 680,50 to 1 946 (+15,80 %) outpaced the increase in the number of staff from 129 to 137 (i.e. +6,20 %); notes that the average duration of sickness per person also increased, from 14,7 days in 2023 to 18,30 in 2024, and that the sick leave rate increased from 3,60 % in 2023 to 3,9 % in 2024; is worried by the current situation and continues to request a clearer evaluation of staff wellbeing to identify possible recurrent causes of burnout, cases of which should be reported yearly to the discharge authority as every other institution; requests that the EDPS, in cooperation with the Commission’s Medical Service, perform a targeted assessment of the root causes of this increase, with a specific focus on preventing burnout;

34. Notes from the Questionnaire that there were no harassment cases reported at the EDPS in 2024; appreciates that, in 2024, the EDPS continued to provide an anti-harassment presentation delivered by one of the EDPS’ Confidential Counsellors, during the onboarding for newcomers’ session; commends the publication of the decision on anti-harassment and the role of the confidential counsellors on the EDPS’ intranet;

Ethical framework and transparency

Change 17

Changed34.35. Notes that the EDPS has set up a framework to prevent conflicts of interest at the level of senior management and staff through codes of conduct, awareness raising and declarations of absence of conflicts of interest and confidentiality (DOICs); notes that all staff joining the EDPS have to sign a DOIC; notes that in 2024 no cases of conflicts of interest or whistleblowing were registered at the EDPS; notes with concern that one case of alleged fraud was reported in the EDPS in 2024, which the Commission’s disciplinary office (IDOC) investigated; notes in this case that IDOC closed the inquiry in 2025 with the recommendation made to the EDPS to initiate disciplinary proceedings in accordance with the Staff Regulations; invites the EDPS to keep the discharge authority informed on final outcome of that matter;matter, as well as related to any potential measures taken to strengthen internal anti-fraud controls;

36. Notes that, in 2024, the EDPS continued organising induction trainings covering its ethical framework (on harassment, whistleblowing, conflicts of interest) and anti-fraud strategy for EDPS/EDPB newcomers; notes that the EDPS’s ethics officer submits every year an ethics report to the EDPS/EDPB management and participates in the ‘Comité Paritaire des Questions Statuaries’ working group on ethics; notes with satisfaction that the EDPS has put in place a mailbox where members of staff can submit their requests regarding any ethics related inquiries; encourages the EDPS to continue raising awareness and organising surveys to assess the level of staff awareness to the EDPS/EDPB ethical framework;

Change 18

Changed36.37. Welcomes the overall high level of transparency achieved by the EDPS concerning its activities, including as regards the publication of the agenda and the declaration of interests of the Supervisor and of the SG; notes with satisfaction from the Questionnaire that, following an internal assessment on transparency measures performed in 2023-2024, the EDPS adopted a decision in 2025 whereby the Supervisor, the SG and the EDPS staff holding managerial responsibilities will meet interest representatives only if registered in the Union’s Transparency Register; welcomes that with that decision the EDPS is part of the Union’s Transparency Register, whose Management Board was duly notified; recommends that the EDPS publish a list of all meetings held with interest representatives on its website to further enhance public accountability and transparency;

38. Notes that the EDPS was subject to an enquiry by the European Ombudsman on a case initiated in 2023 which was closed in 2024 with a finding of maladministration; notes that the finding concerned the time taken by the EDPS to complete its assessment of a complaint within a reasonable timeframe and for not having proactively informed the complainant about the case’s progress; appreciates, as a result, that the EDPS took action to improve its procedures, whereby staff are now required to proactively update complaints and suspend investigations when awaiting court rulings or decisions from other bodies on the same matter; notes from the Questionnaire that the EDPS was involved in three European Anti-Fraud Office (OLAF) investigations in 2024 which are ongoing; invites the EDPS to keep the discharge authority informed on these matters;

Change 19

Added39. Emphasises the role of the EDPS in supervising the personal data processing operations of EUIBAs; expresses concern about the time it takes the EDPS to handle complaints; recalls the European Ombudsman’s Decision of 7 November 2024 in case 1888/2023/TM, in which the European Ombudsman found that six years for the EDPS to complete its assessment of a complaint does not constitute a reasonable timeframe and that the EDPS’s approach constituted maladministration; notes that the European Ombudsman found that the EDPS also failed to keep the complainant informed on the progress of the case;

40. Notes that, in accordance with Article 9 of the EDPS’ Code of Conduct, the Supervisor and the SG are bound by the duty of integrity, discretion and confidentiality for three years after they have ceased to hold office; notes that no senior official left or joined the EDPS in 2024;

Digitalisation, cybersecurity and data protection

41. Notes from the Questionnaire that the 2024 expenditure for IT equipment and projects was 10 % higher compared to 2023 due to additional cybersecurity consultancy; notes further that other cost elements remained relatively stable between the two years, including general IT services and maintenance;