Changes from report parliamentary committee draft to plenary report

45. Acknowledges that the EDPS successfully relies on many of the administrative systems used by the Commission, particularly in field of HR and business administration processes, as well as on some of Parliament’s services, including the provision of laptops, network infrastructure and video-conferencing, among other; notes that the EDPS uses the qualified electronic signature to sign electronic documents within and outside the ARES system for administrative and financial documents; commends the EDPS for the progress made towards adopting e-procurement tools, which is foreseen for 2026 when SUMMA, the new financial software, will also be introduced at the EDPS;

46. Notes from the Questionnaire that the EDPS approved in 2025 internal guidelines on the use of generative AI systems by its staff who are also offered mandatory AI trainings path; welcomes the EDPS preparatory work for potentially issuing guidelines to ensure AI tools are used in a responsible manner by EUIBAs which would complement the guidance already provided by the Commission by focusing on specificities of the Union’s public administration or use cases in specific areas such as HR/recruitment;

47. Acknowledges the leading role of the EDPS in enhancing the cybersecurity preparedness of the EUIBAs, while working closely with bodies such as ENISA and cybersecurity hubs such as CERT-EU;

48. Notes from the Questionnaire that the EDPS launched two key initiatives to strengthen personal data breach management across Union institutions, i.e. the Personal Data Breach Awareness Campaign, which targeted entities that had not previously reported breaches, providing self-assessment tools, bilateral consultations, and tailored recommendations, and a cybersecurity exercise (named PATRICIA), aimed at improving the handling of cybersecurity incidents involving personal data breaches and enhancing interinstitutional cooperation; notes with appreciation that both initiatives were awarded by the Global Privacy Assembly in 2025 for their contribution to accountability; observes that the EDPS strengthened its cybersecurity framework by introducing real-time vulnerability and threat detection for internet-facing assets, through enhanced cooperation under its SLA with CERT-EU; congratulates the EDPS for hosting a conference in Brussels in June 2024, bringing together data protection experts, policymakers, and technology specialists to reflect on the evolving role of data protection in modern democracies, in particular given the rise of disinformation and online manipulation, and the challenges posed by social media;

Buildings

49. Notes that, in 2024, a transfer of approximately EUR 55 000 was necessary to cover building security and rental costs, as the rental cost confirmed for 2024 by Parliament, the building of which the EDPS is using, was higher than the credits allocated for that year;

50. Notes that, in terms of accessibility of its building, the EDPS relies on the decisions taken and implemented by Parliament, as part of their building policy; invites the EDPS to inform the discharge authority whether it also plans to hire trainees with reduced mobility or disabilities;

Environment and sustainability

51. Notes that the EDPS rents a smart building of Parliament, the environmental footprint of which is reduced through several measures such as the regulation of the temperature made automatically and centrally, among other; notes that that building is also equipped with photovoltaic panels that generate approximately 20 kWh of electricity covering 6,04 % of the EDPS’ total consumption in 2024;

53. Notes from the Questionnaire that the EDPS conducts the vast majority of its procurement through Inter-Institutional Framework Contracts (IIFWCs), and, as a Participating Contracting Authority, applies the sustainability criteria established by the Lead Contracting Authority;

54. Notes from the Questionnaire that all business travel within the EDPS must comply with the rules set out in the Mission Guide; observes that the EDPS staff primarily travel in economy class and that most trips take place within the Union; welcomes the EDPS’ efforts to reduce its carbon footprint by encouraging staff to use videoconferencing, train travel for short distances, and public transport when traveling to or from the airport or at the mission location;

55. Notes from the Questionnaire that the EDPS is implementing a sustainable mobility strategy, which allows staff to request reimbursement of 50 % of their monthly or annual season tickets or multi-journey passes for public transport and provides facilities adapted to the needs of staff who use bicycles;

Interinstitutional cooperation

57. Notes that the EDPS participates in meetings of various interinstitutional bodies; welcomes in this context the participation of the EPDS in meetings of the Heads of Administration meetings and the Interinstitutional Online Communication Committee, led by Parliament’s Directorate-General for Communication; acknowledges that interinstitutional cooperation with EDPS, in his supervisory role, is key for the other Union institutions to enhance their level of compliance with the data protection legal framework;

58. Notes from the Annual Report that the EDPB launched in 2024 its coordinated enforcement action on the individuals’ right of access to their personal data, with 30 participating DPAs across the Union and the EEA; notes from the Questionnaire that the EDPS took part in this enforcement action, but also continued its work on the coordinated enforcement action of the EDPB from 2023 on the role of the DPO; notes the continued active involvement of the EPDS in the CSC activities in 2024 by assuming the CSC coordination role for 2 years, drafting a guidance note on cooperation in handling Europol complaints and monitoring ETIAS development, among other; notes that the EDPS, as member of the EDPB, also coordinated a taskforce on the cooperation with competition and consumer protection authorities as regards the interplay between the Digital Markets Act and GDPR;

59. Notes from the Questionnaire and the Follow-up Report that joint activities with OLAF, the European Public Prosecutor’s Office (EPPO) and the Court, and taking initiative in the area of fraud detection fall outside the mandate of the EDPS;

Communication

60. Notes that the budget for public communication and promotional activities in 2023 amounted to EUR 425 000, which represented an increase of approximately 9,20 % compared to 2023;

61. Notes with satisfaction that the EDPS organised and participated in several communication events online as well as in presence in 2024, aimed at raising awareness to EDPS’ role and mission among a wider public and the importance of respecting Union data protection rules, such as Data Protection Day, the EDPS Trainees’ conference (twice a year), the EDPS Civil Society Summit and the Global Privacy Assembly;

62. Notes that the EDPS communicates online via its website and its social media accounts on X (ex-twitter) (28 800 followers), LinkedIn (82 800 followers), YouTube (3 400 followers) and Instagram (300 followers);

63. Notes that the pilot project of the platforms EU Voice and EU Video (free and open-source social media networks, privacy-oriented and based on Mastodon and PeerTube software) came to an end in 2024; notes that the EDPS facilitated the smooth migration of EUIBAs who wished to retain their accounts, ensuring continuity for users; notes that, building on the pilot’s success, preparations were made to resume Mastodon in 2025; welcomes in that context the EDPS’ contribution to the Union's strategy on data and digital sovereignty in order to promote Union's independence in the digital world and compliance with the data protection legal framework.