Source: European Parliament

2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION

with observations forming an integral part of the decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2023, Section IX – European Data Protection Supervisor

(2024/2028(DEC))

The European Parliament,

– having regard to its decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2023, Section IX – European Data Protection Supervisor,

– having regard to Rule 102 of and Annex V to its Rules of Procedure,

– having regard to the opinion of the Committee on Civil Liberties, Justice and Home Affairs,

– having regard to the report of the Committee on Budgetary Control (A10-0053/2025),

A. whereas, in the context of the discharge procedure, the discharge authority wishes to stress the particular importance of further strengthening the democratic legitimacy of the Union institutions by improving transparency and accountability, and implementing the concept of performance-based budgeting and good governance of human resources (HR);

B. whereas data protection is a fundamental right, protected by Union law and enshrined in Article 8 of the Charter of Fundamental Rights of the European Union;

C. whereas Article 16 of the Treaty on the Functioning of the European Union provides that compliance with the rules relating to the protection of individuals, with regard to the processing of personal data concerning them, is to be subject to control by an independent authority;

D. whereas Regulation (EU) 2018/1725 provides for the establishment of an independent authority, the European Data Protection Supervisor (the ‘EDPS’), responsible for protecting and guaranteeing the right to data protection and privacy, and tasked with ensuring that the institutions and bodies, offices and agencies of the Union embrace a strong data protection culture;

E. whereas the EDPS carries out its functions in close cooperation with fellow Data Protection Authorities (DPAs) as part of the European Data Protection Board (EDPB), and it serves the public interest while being guided by principles of impartiality, integrity, transparency, pragmatism and respects Union legislation;

1. Notes that the budget of the EDPS falls under MFF Heading 7 ’European public administration’, which amounted to a total of EUR 12,3 billion, i.e. 6,4 % of Union budget spending, in 2023; notes that the budget of the EDPS represented 0,18 % of MFF Heading 7 appropriations;

2. Notes that the Court of Auditors (the ‘Court’), in its Annual Report (the ‘Court’s report’) for the financial year 2023, examined a sample of 70 transactions under MFF Heading 7, of which 21 (30 %) contained errors; further notes that for five of those errors, which were quantified by the Court, the Court estimated a level of error below the materiality threshold;

3. Notes from the Court’s report its observation that administrative expenditure comprises expenditure on HR including pensions, which in 2023 accounted for about 70 % of the total administrative expenditure, and on buildings, equipment, energy, communications and information technology; welcomes the Court’s renewed opinion that, overall, administrative spending is low risk;

4. Notes from the Court’s report that in 2023 it audited a salary payment of an official who had last made a declaration concerning rights to family and child allowance in 2020; echoes the Court’s concern that delays in receiving and verifying such declarations increase the risk of ineligible payments;

Budgetary and financial management

5. Notes that the final adopted budget for the EDPS was EUR 22 711 559 in 2023, which represents an increase of 12,06 % compared to 2022; notes that the budget of the EDPS also covers the work of the independent Secretariat of the EDPB; notes from the Annual report of the EDPS for 2023 (the ‘Annual Report’) that the adopted budget of the EDPB was EUR 7,67 million in 2023, including EUR 300 000 granted by means of an amending budget which was needed due to an increase in litigation activities in 2023;

6. Acknowledges that the budget monitoring and planning efforts of the EDPS in the financial year 2023 resulted in a budget implementation rate of current year commitment appropriations of 96 % in 2023 (slightly lower than in 2022 when that rate was 98 %); further notes from the report on the EDPS annual accounts for 2023 that the current year payment appropriations execution rate was 84 % (lower than 88 % in 2022); notes in addition, from EDPS replies to the questionnaire submitted by the Committee on Budgetary Control for the 2023 budgetary discharge (the ‘Questionnaire’), that the execution rate of payment appropriations overall was 91,33 % in 2023 (lower than 94,09 % in 2022);

7. Notes further that the amount of carry-overs (C8) from 2023 to 2024 was EUR 2 517 942,67 or 11,08 % of the total budget for 2023, compared to EUR 1 827 354,23 or 9,01 % of the total budget for 2022; notes that the execution rate of the C8 budget in 2023 was 76,65 % (higher than 73,77 % in 2022);

8. Welcomes an improvement in the average time to pay from 25 days in 2022 to 19 days in 2023, with 97,50 % of payments processed on time; notes that that improvement is also due to the EDPS having solved an old bug with the electronic payment system for invoices linked to mission costs; notes further a significant increase in the number of payments from 799 in 2022 to 1335 in 2023; observes in that context that the number of transactions is still lower than pre-pandemic levels due to changes in the way of working (such as hybrid meetings or virtual events for experts);

9. Notes that the effects of illegal Russia’s war of aggression against Ukraine continued to create budgetary pressure on the EDPS in 2023, including through rising inflation and the consequent increase in energy costs, with the most affected budget lines being staff salaries, building security and rental costs, mission costs and services provided by external staff; commends in that context the EDPS for having re-adjusted its priorities and having implemented internal reallocation within budget chapters; understands that budgetary optimisation was necessary in order to successfully manage the indexation of staff salaries and rental costs, as well as an increase in the costs of external lawyer support services due to an increased number of EDPS binding decisions which led to a bigger number of cases to be defended before the Court of Justice of the European Union (CJEU) with the help of external legal assistance; regrets in that context that the EDPS had to postpone some of its activities, such as a feasibility study on artificial intelligence; calls on the EDPS to abide to the competences of its mandate with a collaborative approach with the Union institutions and agencies and to avoid initiating any legal action, especially those which are manifestly inadmissible, in order to avoid negative repercussions on the management of resources, which do not allow the EDPS to carry out its activities as an Institution;

10. Expresses concern about the significant increase in EDPS staff mission costs, from EUR 28 789 in 2021 and EUR 176 903 in 2022, to EUR 284 580 in 2023; calls on the EDPS to assess whether the resources spent on missions are being used appropriately and effectively; notes that the EDPS ceased making public the number of missions funded by organisers, as well as information on which unit or sector participated in each mission, thus reducing transparency regarding mission expenses; calls on the EDPS to reinstate this practice; encourages the EDPS to promote the use of video-conferencing tools where suitable, as this could contribute to lowering the number of missions and reducing costs; calls on the EDPS to assess whether the resources spent on missions are being used appropriately and effectively.

Internal management, performance and internal control

11. Notes that the EPDS used nine key performance indicators (KPIs) to monitor its performance in 2023, in alignment with the main objectives of the EDPS Strategy 2020-2024 which is implemented through the Annual Management Plan; notes from the Annual Report that the EDPS over-delivered in almost all areas, as indicated by the results of KPIs for 2023, except for one KPI (the number of EDPS followers on some social media accounts); notes with concern that the EDPS encountered considerable challenges due to a growing workload and intricate data protection issues arising from the rapidly evolving digital landscape, as well as due to the extension of the EDPS mandate to supervisory activities (such as audits and investigations) and replies to consultations and prior consultations, all in the context of a limited budget; notes from the EDPS’ follow-up report to Parliament’s resolution on the implementation of the EDPS’ budget for 2022 (the ‘Follow-up Report’) that several legislative developments in the last two years have impacted the work and resources of the EDPS, due to the extension of Eurojust’s mandate, new information to be received by Europol under the Digital Services Act, the roll out of the new Union’s large-scale databases and interoperability framework in the justice and home affairs field and the entry into force of the Artificial Intelligence Act (the “AI Act”); calls on the Commission and on the budgetary authority to take those matters into consideration during the annual budgetary procedure;

12. Welcomes the fact that, in 2023, the EDPS strengthened its ability to assess and prepare for emerging technological trends and their potential impact on privacy and data protection; notes that this was achieved through a foresight-based approach, with a focus on monitoring developments in areas such as large language models, digital identity wallets, the internet of behaviours, extended reality, and deep fake detection; welcomes in that context the publication by the EDPS of its third TechSonar initiative on emerging technologies; congratulates moreover the EDPS for having been awarded the GPA Global Privacy and Data Protection Awards 2023 in the category of innovation;

13. Notes that 2023 was marked by several organisational changes or updates that were needed in order to respond and adapt to the evolving data protection challenges; welcomes in this context the appointment of a Secretary-General from 1 July 2023; notes in addition the transition of two sectors into units such as ‘Information and Communication’ and ‘Governance and Internal Control’ and the creation of three new specialised sectors under the ‘Technology and Privacy’ (T&P) unit: ‘Systems Oversight and Audit’, ‘Technology Monitoring and Foresight’ and ‘Digital Transformation’;

14. Emphasises the role of the EDPS in supervising the processing of personal data by Union institutions, bodies, offices and agencies; notes with concern the length of proceedings before the EDPS, as the EDPS did not close a single investigation in 2023, but in comparison to the previous year, in 2023, the number of notifications beyond the 72 hours significantly decreased;

15. Notes that the EDPS received 420 complaints, i.e. 53 more than in 2022, out of which 73 were admissible and 347 inadmissible in 2023; notes that the EDPS issued a final decision, opinion or reply in 31 out of 73 complaint cases received in 2023 within 44 days on average and responded to all 347 inadmissible complaints received; notes that, out of all admissible complaints (ongoing and received in 2023), 55 cases were finalised in 2023, which represents an increase of 17 % compared to 2022; acknowledges the efforts made by the EDPS to reduce the high number of complaints by developing a dynamic tool on the EPDS’ website, although the volume of complaints remained challenging due to limited resources in 2023; notes with satisfaction that the EDPS developed various procedural tools and policies to enhance its investigatory processes in 2023; commends in that context the EDPS for having amended its Rules of Procedure, whereby the “review procedure” is replaced by a “preliminary assessment” in order to safeguard the right to be heard of all the involved parties, thus contributing to a fair and timely handling of complaints and investigations;

16. Underlines the important role of consultation and advice of EDPS in the legislative process; notes that, pursuant to Article 42(1) of Regulation (EU) 2018/1725, the EDPS responded to 80 formal legislative consultations and its advice took the form of 54 opinions (27 in 2022), 26 formal comments (49 in 2022) and 34 informal comments (30 in 2022) to the Commission and to the co-legislators in response to legislative consultation requests in 2023; commends the EDPS for its input with regard to the AI Act, in particular EDPS’ own-initiative opinion on the AI Act and advice on the AI liability rules, as well as for EDPS’ input to the GPA resolution on generative AI systems; acknowledges a significant increase (+93 %) of consultation requests over the last five years;

17. Notes that, in 2023, the EDPS carried out eight investigations and five pre-investigations, marking a significant increase compared to previous years; notes that in 2023 the EDPS was actively involved in a total of 13 investigations and seven pre-investigations, either launched in 2023 or carried over from prior years; notes that the EPDS continued two complex and resource-intensive formal investigations from 2021 into the use by European Union Institutions, Bodies and Agencies (EUIBAs) of cloud services from non-EU/EEA entities, including a focus on the Commission’s use of Microsoft 365; urges the finalisation of those investigations on time because of their significant impact on the working of institutions; notes further that the EDPS also launched five investigations based on complaints about EUIBAs’ websites, focusing in a broad way on privacy and data protection issues, with preliminary assessments expected in 2024;

18. Urges the EDPS to prioritise and enhance procedures for handling the personal data of minors under 15, particularly in the context of Europol’s systems, where such individuals may be marked as suspects; recognises the heightened vulnerability of that group and the need for robust safeguards;

19. Notes that the EDPS investigated the Commission’s alleged use of micro-targeting on platform X and continued two pre-investigations: one case concerning EUIBAs’ use of Trello cloud service, which was closed in 2023 and another one on EUIBAs’ use of profiling, which was carried out in 2024; notes that a total of six investigations and four pre-investigations (one pre-investigation in 2022) were launched in the Area of Freedom, Security, and Justice (FSJ), reflecting a significant increase from 2022; notes the EDPS’ concerns with regard to the challenges that may arise in the case of investigations where joint action between national authorities and EUIBA’s is needed; notes in addition that, as part of its audit plan for 2023, the EDPS audited the following bodies: the European Personnel Selection Office, the European Investment Bank, the European Central Bank, the European Centre for Disease Prevention and Control and the European Medicines Agency;

20. Recalls that in 2022 the EDPS brought an action for annulment of two provisions of the amended Europol Regulation before the General Court, which was later rejected; notes that meanwhile the EDPS decided to appeal the order of the General Court in case T-578/22[8], believing the issues raised should be addressed at the highest level; regrets that the EDPS did not realise the manifest inadmissibility of its appeal, even if the institution did not intend to challenge an act by Europol, but a retroactive change in the legal framework aimed at neutralising the effects of the EDPS’ enforcement actions; calls on the institution to cooperate with Union institutions and agencies, before initiating legal proceedings that prevent the fulfilment of its mandate and the use of its resources for purposes for which they were intended; notes further that the EDPS also followed up on the implementation of its Order of 3 January 2022, including checks on Europol’s reporting; regrets that the final report on that matter was communicated by the EDPS only on 22 July 2024;

21. Notes that, after the pilot implementation of the new risk management framework at the EDPS in late 2022, an anonymous satisfaction survey was conducted in May 2023 to assess its effectiveness and gather additional suggestions; notes further that the survey results were positive, leading to the formal adoption of the framework on 26 June 2023;

22. Notes that the internal audit service (IAS) carried out an audit on the methodology for the planning of EDPS audits in the EDPS in 2023; notes that the audit was concluded with two recommendations for which the EDPS submitted an action plan to the IAS; calls on the EDPS to keep the discharge authority informed on a regular basis on the progress made in that matter;

23. Recalls the Treaty on the European Union that the EU and its institutions shall promote solidarity and equality between women and men;

HR, equality and staff well-being

24. Notes that, at the end of 2023, the EDPS had 129 members of staff, compared to 127 in 2022; notes that the EDPS employed 50 contract staff (CA) under Article 3(b) of the Staff Regulations of Officials and the Conditions of Employment of Other Servants (52 CA in 2022), 7 temporary agents (TA) under Article 2(b) and 2(c) (6 TA in 2022) and used the services of 12 external services providers (EXT) working intra-muros in 2023 (8 EXT in 2022); encourages the EDPS to continue its efforts towards a more balanced geographical representation among all Member States specifically at managerial level; welcomes the increased diversity of nationalities represented, but notes with regret the continued underrepresentation of women in senior management positions; calls for the adoption of a gender parity roadmap, including proactive recruitment measures and leadership training programs for female staff members;

25. Notes that the EDPS had 23 nationalities (from the Member States) represented among its staff in 2023, which is an improvement in comparison with 22 nationalities in 2022; notes with dissatisfaction the over-representation of five nationalities and an underrepresentation of other nationalities; urges the EDPS to continue its efforts to achieve a balanced geographical distribution of nationals from all Member States within its staff, by improving communication, fostering visibility, and enhancing job conditions to attract underrepresented nationalities;

26. Observes that, in 2023, the EDPS maintained a workforce comprising 65 % women and 35 % men, consistent with trends from previous years; regrets the absence of women in senior management roles, despite achieving gender parity among the six middle management positions; urges the EDPS to intensify its efforts to ensure gender-balanced representation across all staff levels, and invites the EDPS to promote the application of women also with a view to the next election of the Supervisor by Parliament;

27. Notes a high occupancy rate of the establishment plan of 95,65 % but also a high turnover rate of 13 % in 2023; notes that most of the unfilled positions were a result of candidates being unsuitable, given the EDPS’ need for highly specialised profiles and the small pool of eligible candidates; welcomes the addressing of those challenges through republication with a wider or more targeted dissemination of the vacancy or by redrafting the requirements; welcomes the steps taken by the EDPS regarding the hiring process; calls on the EDPS to continue to address the challenges in finding suitable candidates and to keep the discharge authority informed about improvements on staff recruitment and turnover;

28. Notes that, in the second half of 2023, the EDPS’ HR team launched a pilot for a new on-boarding process for newcomers, with sessions that cover, inter alia, presentations of core units’ work, ethics, procurement procedures and information security, whereas three on-boarding sessions were offered in 2023; invites the EDPS to continue offering to newcomers “on-boarding” and to all members of staff mandatory sessions that remind the importance of principles such as ethics, conflicts of interest, transparency, internal control and anti-fraud, as they have become the standard in the Union institutions; notes moreover that 12 individual sessions were offered for EDPS and EDPB staff, six sessions of group coaching in which participants (manager level) learned from each other, as well as a one-year team coaching with a designer for leadership development at the European School of Administration in 2023;

29. Notes, from the Questionnaire, that the EDPS offers flexible and hybrid working arrangements, that are well-received by members of staff who can benefit, inter alia, from parental leave, time credits, part-time work or working from abroad for a limited number of days per year; notes that, in 2023, the majority of staff made use of those working conditions, whereas 86,30 % of staff made use of teleworking arrangements in 2023; considers that the building infrastructure should be optimised to reflect that high rate of teleworking, which could contribute to reducing operational costs and ensuring more efficient use of office space; welcomes the EDPS’ continued efforts to actively improve physical and mental well-being of its staff;

30. Commends the EDPS for carrying out several awareness-raising actions during the year 2023 with information sharing on elimination of racial discrimination, International Women’s Day, EU diversity month and learning about neurodiversity; notes that currently the EDPS does not employ staff with disabilities but has an equal opportunities clause included in all EDPS vacancy notices and actively encourages applications from candidates with disabilities;

31. Notes from the Questionnaire that the EDPS considers confidential any information on burnout cases, including the number thereof; disagrees with that opinion and calls the EDPS to provide the discharge authority with the number of burnout cases on a yearly basis; notes with satisfaction that, in 2023, there were no harassment cases reported at the EDPS; welcomes the fact that, in 2023, the EDPS continued to provide an anti-harassment presentation delivered by one of the EDPS’ confidential counsellors, as part of the induction training called the ‘EDPS Welcome Day’; commends the publication of the decision on anti-harassment and the role of the confidential counsellors on the EDPS’ intranet;

Ethical framework and transparency

32. Notes that, in 2023, the EDPS focused its efforts on increasing staff awareness of the EDPS/EDPB ethical framework by organising mandatory dedicated training sessions for all staff and induction trainings for EDPS/EDPB newcomers, appointing a new ethics officer and participating in the ‘Comité Paritaire des Questions Statuaries’ working group on ethics; welcomes the establishment of a mailbox by the EPDS, where members of staff can submit their requests regarding any ethics related inquiries, as well as the use of Commission’s Ethics module in Sysper; encourages the EDPS to continue raising awareness and organising surveys to assess the level of staff awareness of the EDPS/EDPB ethical framework;

33. Welcomes the overall high level of transparency achieved by the EDPS concerning its activities, in particular as regards the publication of the agenda and the declaration of interests of the Supervisor and of the Head of EDPS Administration, in line with the Supervisor’s code of conduct of 2019; notes from the Follow-up Report that the EDPS has adopted two codes of conduct, whereas one of them applies to the Supervisor and the other one applies to the EDPS staff; understands that in cases when the Secretary-General is called to replace the Supervisor, the latter’s code of conduct also applies to the Secretary-General;

34. Notes with satisfaction that the EDPS has never been involved in any investigations by the European Anti-Fraud Office (OLAF) since its establishment;

35. Notes that, out of five inquiries opened by the Ombudsman in 2023 concerning the EDPS, four were closed without any further inquiry; notes that, for one enquiry, the decision was still pending and expected for Q4 2024; calls on the EDPS to keep the discharge authority informed as to the outcome of this enquiry;

36. Regrets that the EDPS has still not formally joined the Union’s Transparency Register (TR); nevertheless notes from the Follow-up Report that, with a view to formally joining the TR, the EDPS has launched an internal assessment on transparency measures, whereas, in 2023, exploratory meetings and exchanges of the EDPS with secretariat of the TR took place; calls on the EDPS to inform the discharge authority of the outcome of that assessment exercise; reiterates its call on the EDPS to join and use the TR, including for the proactive disclosure of meetings with any third parties, to ensure transparency in EDPS’ regulatory and advisory functions;

37. Notes with satisfaction that, in 2023, the EPDS established internal rules applicable to the hearing of persons that could be affected by an EDPS final decision adopted in own-initiative investigations and inquiries in order to ensure the proper exercise of their fundamental right to be heard in such proceedings; commends the EPDS for publishing a new factsheet on EDPS Investigations and a new EDPS Investigation Policy as well as for ensuring that all financial reports, including annual budgets, accounting and audit reports, are made publicly accessible through a Union institution website and other official channels, as the EPDS takes a leading role in enhancing the cybersecurity preparedness of the Union institutions;

38. Notes with satisfaction from the Questionnaire that no cases of conflicts of interest, whistleblowing or fraud were reported in the EDPS in 2023; notes that the EDPS has set up a framework to prevent conflicts of interest at the level of senior management and staff through codes of conduct, awareness raising and declarations of absence of conflicts of interest and confidentiality; notes that, in addition to the mandatory introduction to the ethical framework of the EDPS for all new members of staff, new members of staff are also introduced to the EDPS’ anti-fraud strategy;

39. Notes from the Questionnaire that the EDPS has internal rules on whistleblowing, which define safe routes and channels through which staff may raise concerns about fraud, corruption or any other serious wrongdoing, without prejudice to the confidentiality of the identity of the whistleblower and of the information reported; notes that, so far, there has never been a whistleblowing case reported to the EDPS;

40. Urges the EDPS to publicly disclose any recusals due to conflicts of interest in its enforcement decisions, ensuring full transparency in regulatory oversight and decision-making;

Digitalisation, cybersecurity and data protection

41. Notes from the Questionnaire that the 2023 budget for IT equipment and projects was 9,5 % lower compared to 2022; notes that that decrease was primarily because no new IT feasibility studies were being commissioned in 2023, as opposed to 2022 where such studies represented a substantial portion of the IT budget; notes further that other cost elements remain relatively stable between the two years, including general IT services and maintenance;

42. Notes from the Follow-up Report and the Questionnaire the conclusions of the IT feasibility study carried out in 2022, whereby there are gaps between what the IT tools and services provided by the Commission and Parliament can offer and the specific needs of the EDPS; notes that those gaps should be addressed by developing in-house capabilities and applications for which a minimum of five IT staff and partial outsourcing EDPS was deemed necessary; regrets that, due to budgetary constraints, implementation of the recommendations of the study remained on hold; calls on the EDPS to consider a step-by-step approach by starting with those recommendations and projects that would require fewer resources;

43. Commends the progress made in 2023 by the EDPS in digitalising its workflows and processes, with the introduction of ARES, the qualified digital signature (e-IDAS) and a collaborative platform (Nextcloud) for drafting documents and video-conferencing, as well as updates to the tool (Website Evidence Collector) that automates the collection of personal data processing on websites of data controllers and processors, the adoption of the acceptance environment of EU Send Web, a service/channel to exchange sensitive non-classified information with other EUIBAs and further progress made towards implementing services that cannot be outsourced, such as the form and the electronic workflow to manage data breach notifications; notes nevertheless issues with regard to the use and maintenance of the e-procurement system;

44. Welcomes the EDPS’s focus on ensuring that external contractors meet the necessary moral and ethical standards expected of all Union institutions, bodies, offices and agencies, particularly in light of the previous use of external companies by EDPS that, according to Yale University’s ranking, continue to operate in Russia;

45. Acknowledges that the EDPS successfully relies on many of the administrative systems used by the Commission, particularly in the field of HR and business administration processes, as well as on some of Parliament’s services, including the provision of laptops, network infrastructure and video-conferencing; commends the fact that the project to improve the quality and performance of the computers provided to EDPS staff, in collaboration with Parliament, with a view to the generalisation of hybrid work, has been completed;

46. Acknowledges the leading role of EDPS in enhancing the cybersecurity preparedness of the Union institutions, while working closely with bodies such as European Union Agency for Cybersecurity (ENISA) and cybersecurity hubs such as CERT-EU; urges it to develop a structured audit framework for cybersecurity risks within Union bodies; notes that, in 2023, the EDPS continued to improve its readiness to protect personal data and sensitive information against cyber-attacks in view of the rapidly changing cybersecurity threat landscape; commends in that context the EDPS for reviewing its security policies and methodologies in preparation for the impact of the Cybersecurity Regulation (Regulation (EU, Euratom) 2023/2841); notes from the Questionnaire that the EDPS introduced a request for two additional full-time equivalents to cover cybersecurity infrastructure in connection with EDPS’s obligations under that Regulation as well as the EDPS’ role as a member of the Interinstitutional Cybersecurity Board (IICB); notes further with appreciation that the EPDS upgraded its Information Security Policy and the EDPS Acceptable Use Policy to address specific cybersecurity threats in relation to teleworking, use of personal mobile devices and banning of dangerous applications (TikTok); notes that the EDPS did not encounter any cyber-attacks in 2023; calls for annual public reporting on detected threats, response measures, and institutional cyber resilience;

47. Commends the EDPS for updating cybersecurity training for all staff and revamping the security training model for newcomers; appreciates that the EPDS has been proactive in raising awareness about cyber security risks, for instance by preparing fact sheets, conducting surveys with EUIBAs and running awareness campaigns; encourages the EDPS to ensure that staff receives compulsory training on the safe and ethical use of AI tools to enhance their understanding and mitigate potential risks;

Buildings

48. Notes that in 2023, as in 2022, the EDPS and EDPB were the sole tenants of Parliament’s building where they were located, following the move of the Ombudsman at the end of 2021 and that by renting their premises from the Parliament rather than the private market the EDPS intends to keep the rental and maintenance costs at a reasonable level; notes that the EDPS had to request an additional EUR 81 856,84 for paying rental costs to Parliament, given that the indexation rate was 8,82 % and thus higher than the 2 % ceiling for administrative expenditures;

49. Notes that, in terms of accessibility of its building, the EDPS relies on the decisions taken and implemented by Parliament, as part of their building policy; notes from the Follow-up Report that the EDPS employs staff with physical impairments due to serious illness; welcomes the commitment of the EDPS to explore the possibilities of hiring trainees with reduced mobility or disabilities;

Environment and sustainability

50. Notes that the EDPS has not joined the Eco-Management and Audit Scheme (EMAS) but has implemented several measures to reduce its environmental footprint, such as regulating the temperature automatically and centrally, turning lights off automatically when there is no movement in the room, purchasing eco-friendly products and services and automating the workflows with the introduction of ARES; notes from the Follow-up Report that according to the information received by Parliament’s Directorate-General for Infrastructure and Logistics, responsible for the management of the building rented by the EDPS, solar panels are installed on that building; asks the EDPS to inform the discharge authority to report on the share (%) of the solar-panel produced electricity in the EDPS’ total energy consumption needs per year; calls further on the EDPS to inform the discharge authority of any new developments regarding the EMAS certification process;

51. Notes that the EPDS has not assessed its carbon footprint in 2023; welcomes, however, that the EDPS continues to apply measures that reduce the carbon footprint by reducing the travel of journey to the office through teleworking possibilities, reimbursing 50 % of staff’s monthly/annual subscriptions for the use of public transport, encouraging the staff to favour videoconferencing and train travel for short distances, managing the cycle for invoices electronically and achieving an entirely paperless selection procedure and appraisal exercise as regards HR;

52. Urges the EDPS to adopt the EMAS to systematically monitor and improve its environmental footprint, particularly in terms of energy consumption, waste reduction, and sustainable office policies;

53. Notes that the EDPS addresses sustainability-related risks (such as environmental, social and governance risks) in a comprehensive way through an annual risk assessment exercise; welcomes in that context that the EDPS adopted its new risk management process in 2023, which should help the EDPS to target and better analyse those risks and consequently better calibrate mitigating actions;

Interinstitutional cooperation

54. Welcomes the budgetary and administrative savings achieved by the EDPS through inter-institutional cooperation, particularly the conclusion of service-level agreements with Parliament for the rental of its premises and the use of IT system applications, hardware supplies and maintenance and with the Commission for HR and business administration processes, as well as through participation in large interinstitutional framework contracts in areas such as IT consultancy, interim services and office supplies; commends in addition the EDPS for maintaining a structured cooperation with the Ombudsman, the Agency for Fundamental Rights and CERT-EU through memorandums of understanding;

55. Notes that the EDPS participates in meetings of various interinstitutional bodies; welcomes in this context the participation of the EPDS in meetings of the Heads of Administration and the Interinstitutional Online Communication Committee, led by Parliament’s Directorate-General for Communication; acknowledges that interinstitutional cooperation with EDPS, in his supervisory role, is of key importance for the other Union institutions to enhance their level of compliance with the data protection legal framework;

56. Calls for closer cooperation between the EDPS, the Court of Auditors, OLAF, and the European Public Prosecutor’s Office (EPPO) to develop common protocols for fraud detection in digital data and financial transactions within EU institutions; stresses the need for joint audits on AI-based fraud risks;

57. Welcomes the pivotal role played by the EDPS in 2023 in the coordination of the Data Protection Authorities of the Member States (DPAs) to promote consistent data protection across the Union; notes that the EDPS joined 26 DPAs in a coordinated enforcement action on the role and tasks of data protection officers (DPOs), assessing their compliance with Regulation (EU) 2018/1725; notes the continued active involvement of the EPDS in the Coordinated Supervision Committee (CSC) within the area of FSJ addressing issues such as handling complaints against Europol and enhancing cooperation processes; appreciates furthermore all the other steps taken to improve cooperation between the EDPS and the DPAs such as the conduction of a joint Europol inspection with national authorities (Poland and Lithuania) and the participation in the coordinated supervisory action on processing minors’ data in Europol systems, the participation in an operational visit to the European Delegated Prosecutor’s office in Lisbon under a Working Arrangement with Portugal’s DPA and the coordination of an onsite inspection in Lesvos with Greece’s DPA to verify data collection practices during Joint Operations by Frontex; acknowledges that those interinstitutional engagements help the EDPS align with best practices of Union institutions and benefit from the exchange of information with peer departments;

Communication

58. Notes that the budget for public communication and promotional activities in 2023 amounted to EUR 468 000, which represented an increase of 54 % compared to 2022;

59. Notes with satisfaction that the EDPS organised several communication events online as well as in person in 2023, aimed at raising awareness of EDPS’ role and mission among a wider public and the importance of respecting Union data protection rules, such as Data Protection Day, the EDPS Trainees’ conference (twice a year), the EDPS Seminar on the essence of the fundamental rights to privacy and data protection, and other international events;

60. Notes that the EDPS communicates online via its website and its social media accounts on X (ex-twitter) (29 400 followers), LinkedIn (71 000 followers), YouTube (2 900 followers), EU-Voice (5 900 followers) and EU-Video (750 followers);

61. Notes that the pilot project of the platforms EU Voice and EU Video (free and open-source social media networks, privacy-oriented and based on Mastodon and PeerTube software) continued in 2023; welcomes in that context the EDPS’ contribution to the Union’s strategy on data and digital sovereignty in order to promote the Union’s independence in the digital world and compliance with the data protection legal framework.