On discharge in respect of the implementation of the general budget for the financial year 2022, Section IX – European Data Protection Supervisor

The Committee on Civil Liberties, Justice and Home Affairs calls on the Committee on Budgetary Control, as the committee responsible, to incorporate the following suggestions into its motion for a resolution:

1.Notes that the Court of Auditors’ report on the implementation of the budget concerning the financial year 2022 does not contain any remarks about the European Data Protection Supervisor (EDPS); reiterates its call on the Court to include the annual accounts of the EDPS in its yearly audit and issue a report, considering the importance of transparency for the proper functioning of all Union bodies;

2.Notes with satisfaction the 2022 annual report published by the EDPS; emphasises the role of EDPS with supervising and advising the data processing operations of European institutions, offices and bodies (EUIs); welcomes the conference “The Future of Data Protection: Effective Enforcement in the Digital World”, organised by EDPS, bringing over 2 000 participants, discussing how to safeguard effectively individuals’ rights to privacy and data protection; recalls that this conference contributed to the Commission proposal for a Regulation laying down additional procedural rules relating to the enforcement of the General Data Protection Regulation;

3.Regrets that the occupancy rate of establishment plan is lower than the target 2022; acknowledges the shortage of skilled professionals; encourages the Supervisor to examine useful strategies to increase visibility of its vacancies;

4.Welcomes the follow up actions by EDPS on the Schrems II judgement, especially focusing in 2022 on the EUIs’ contracts with private entities, in particular large ICT providers, and on arrangements between EUIs and non-EU/EEA public bodies or international organisations;

5.Welcomes the training provided to EUIs, the Memorandum of Understanding signed by EDPS and the European Union Agency for Cybersecurity (ENISA) in December 2022; welcomes specifically the EDPS’s participation in the Coordinated Supervision Committee (CSC) ensuring the coordinated supervision of Europol, Eurojust and EPPO; underlines the importance of EDPS supervision and enforcement work to ensure that EUIs operating in the police and justice area fully comply with the applicable EU data protection acquis;

6.Welcomes the follow-up done by the EDPS regarding the citizen’s data access request; notes that EDPS issued a decision in the case before all facts had been checked and established; notes that the EDPS decision has been challenged by both the complainant and Europol; acknowledges that the EDPS review is currently suspended due to the matter being heard by a national Court; stresses the importance to adapt human and financial resources to the increasing EDPS workload accordingly; recognises the need for additional technical qualified employees to ensure the proper follow-up of the EDPS tasks; recommends EDPS to review its working process in light of the case particularly for the complaints by citizens, taking into account all relevant information and to inform the discharge authority on the progress made in this area;

7.Welcomes that, as a response to the COVID-19 pandemic, EDPS established an internal task force to monitor and assess the EU’s and EUIs’; welcomes that EDPS has been involved in activities relating to the assessment of actions, initiatives and proposals by EUIs as controllers, together with the evaluation of proposed technological solutions to fight the COVID-19 pandemic and the issuance of guidance for EUIs in order to assist the EUIs to adequately fight the pandemic, while ensuring compliance with data protection law;

8.Notes the European Ombudsman’s inquiry in case 1995/2022/OAM against the EDPS closed in 2022, which referred to access to documents; concluding that there was no maladministration by the EDPS in refusing full public access to documents 8-10 and that the EDPS has settled the second aspect of the complaint in relation to the documents falling within the scope of the request by giving further partial access to one document wrongly redacted at initial stage; invites EDPS to consider establishing a policy of ‘transparency by design’ and publish documents linked to EDPS activities in a proactive manner, within a reasonable time frame and in a user-friendly and accessible way;