Address https://gelex.eu/eli/EU/act/oj/L/2021/1559@2021-04-29/en

Contents

1. Preamble
2. A.

THE EUROPEAN PARLIAMENT,

having regard to its decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2019, Section IX – European Data Protection Supervisor,

having regard to Rule 100 of and Annex V to its Rules of Procedure,

having regard to the opinion of the Committee on Civil Liberties, Justice and Home Affairs,

having regard to the report of the Committee on Budgetary Control (A9-0067/2021),

A.

whereas in the context of the discharge procedure, the discharge authority wishes to stress the particular importance of further strengthening the democratic legitimacy of the Union institutions by improving transparency and accountability, and implementing the concept of performance-based budgeting and good governance of human resources;

Welcomes the conclusion of the Court of Auditors (the Court), according to which the payments as a whole for the year ended on 31 December 2019 for administrative and other expenditure of the European Data Protection Supervisor (the EDPS) were free from material error and that the examined supervisory and control systems for administrative and other expenditure were effective; Notes with satisfaction that in its annual report for 2019, the Court observed no serious weaknesses in respect of the audited topics related to the EDPS’ human resources and procurement activities; Regrets, as an overall observation, that chapter 9 Administration of the Annual Report of the Court has a rather limited scope and conclusions, notwithstanding the fact that the Multiannual Financial Framework Heading 5 Administration of the is considered low risk; requests that the audit work for the chapter on Administration be more focused on issues of high or even critical relevance for the EDPS; States that in 2019, the EDPS had a total allocated budget of EUR 16638572 (compared to EUR 14449068 in 2018 and EUR 11324735 in 2017), which represented a 15,15 % increase compared to the 2018 budget; notes that the budget implementation rate in terms of commitments was 91,97 % (compared to 93,7 % in 2018 and 89 % in 2017); recognizes the positive trend in terms of the payment implementation rate which was 80,69 % (compared to 75,2 % in 2018 and 77 % in 2017) with a payment appropriation carry-over rate of 12,18 %; calls however on the EDPS to continue its efforts in terms of prudent budget estimates; Notes that the overall budget increase was mainly due to the impact of the new tasks resulting from Regulation (EU) 2018/1725, which lays down the data protection obligations for the Union institutions and bodies in relation to the processing of personal data and the development of new policies, and the necessary growth of the European Data Protection Board (EDPB) that was created on 25 May 2018 and for which the EDPS was entrusted to provide an independent secretariat; recognises that 2019 was the first full year of operation of the EDPB Secretariat and of the implementation of Regulation (EU) 2018/1725, which justifies the increase; the related allocated budget increase amounted to 51 % (from 3594746 EUR in 2018 to 5413838 EUR in 2019); Welcomes the EDPS’s follow-up to the 2018 discharge resolution, for example the additional information provided in relation to the payment appropriation rate of 75 % for 2018, which resulted finally in an execution rate of 90,79 % of the whole 2018 budget (including payments from carry-over); Appreciates the diligent and proactive action of the EDPS in monitoring the Union institutions’ respect for data protection; notes in particular the EDPS’ investigation into the use of NationBuilder, a US-based political campaigning company, for the processing of personal data as part of the Parliament’s activities relating to the 2019 European election, as well as for the guidelines issued on the use of body temperature checks by Union institutions in the context of the COVID-19 crisis; Notes that at the end of 2014, the EDPS comprised 55 members of staff (compared to 96 at the end of 2019), which signifies almost a doubling in the number of staff; is aware that the EDPS's budget is mostly administrative, with a large proportion being used for expenditure relating to persons, buildings, furniture, equipment and miscellaneous running costs; notes that a substantial number of staff are contract staff employed for a temporary period, such as the replacement of staff on parental leave or for the implementation of specific actions; Notes a substantial increase in the number of contract agents from 2013 to 2019 (from 12 to 31) compared to the number of officials in the same period (from 45 to 58); acknowledges the advantages of using contract agents in terms of cost-efficiency and flexibility but asks the EDPS to reflect on the need to offer prospects of professional progression to its staff and to retain specialised knowledge in the institution; Notes that the EDPS acknowledges the stronger burden on senior and middle management and, subsequently, on case officers due to the absence of an assistant supervisor while the new Regulation (EU) 2018/1725 was entering into force; calls on the institution to re-examine its organisational chart and report back to the budgetary authority; Underlines efforts made relating to wellbeing; notes that the EDPS has adhered to the Fit@work programme of the Commission; observes that the EDPS plans to enlarge the premises in 2021, following the relocation of the European Ombudsman, and will use this opportunity to install a well-being room and a library; notes that the EDPS provides staff with contacts and information concerning psychosocial as well as medical support, and that this was strongly implemented in the period of the COVID-19 crisis; notes the informal mid-term appraisals with staff (on top of the official annual appraisal), which give them the opportunity to voice concerns and give feedback in an informal way; encourages the Supervisor to complete the existing flexible working arrangements with a protection of the staff members’ right to disconnect; Observes that the EDPS staff comprises 19 Union nationalities and had a gender representation of 39 % male staff and 61 % female staff in 2019; notes that the most important actions in support of gender equality were the nominations at middle management level (one male and three female heads of unit); notes further the introduction of greater flexibility as regards remote working; highlights the fact that women use the flexible working arrangement much more often than men; appreciates the inclusion of an equal opportunity clause, both in recruitment materials and vacancy notices, stating that the EDPS is an equal opportunities employer and welcomes applications from those with disabilities; believes that such a clause shall be maintained and included by default in all future vacancy notices; Underlines the EDPS' initiatives aimed at using office space more sustainably and optimising it as well as reducing the energy level in the building, such as the promotion of structural and occasional teleworking, and the reimbursement of 50 % of the cost of public transport tickets to staff who cease to use office parking spaces and return their parking vignette; Notes that the EDPS is a small organisation with a need for highly specialised staff, however, there is a slight geographical imbalance in staff, in that only 19 Union nationalities are represented in the EDPS, of which Belgian citizens hold 28 % of the positions; invites the EDPS to consider further measures to ensure a more balanced representation of Union nationalities; Appreciates that the ethics framework of the EDPS was revised on 12 November 2019 pursuant to the new legal framework, notably Regulation (EU) 2018/1725; highlights the formal establishment of the position of ethics officer with a clear mandate, including reporting to the management board at least once per year on the implementation of the ethics framework; Calls on the EDPS to envisage the preparation of a code of conduct for the EDPB senior management (chair, vice chairs, etc); highlights that the two revised codes of conduct (for staff and for the EDPS) were adopted on 6 December 2019; notes that the revised code of conduct for staff has paid particular attention to whistleblower protection; welcomes the fact that all newcomers are provided with an awareness-raising session on the EDPS’ ethical framework and the new code of conduct for staff; Welcomes the fact that the EDPS has also adopted a revised decision concerning the terms and conditions for internal investigations in relation to the prevention of fraud, corruption and any illegal activity detrimental to Union interests in September 2019; notes that the importance of this topic has been underlined in staff meetings and will be flagged at the next awareness raising session to all staff; Considers the EDPS equal opportunities clause to be an excellent signal for the inclusion of those with disabilities and for ensuring equal opportunities as well as for strengthening work place diversity; Commends the EDPS for having put all guidelines and procedures related to the ethical framework on the intranet immediately after their adoption; calls on the EDPS to organise awareness-raising activities for the staff, including members of staff other than newcomers, regarding the applicable ethical framework and to adopt a proactive system to avoid conflicts in the workplace; notes the revised decision on external activities adopted on 13 September 2019, and the fact that the related presentations with real life examples had to be postponed due to the pandemic; Notes that according to the original plans the EDPS should have occupied the whole MTS building as of September 2019; notes, however, that due to external factors the move of the Ombudsman was delayed and consequently the expansion didn’t happen, which affected the execution under Title 2 of the EDPS’ budget; Notes that the new telework decision allows staff to work at home, allowing the EDPS to make more use of shared offices and make savings on related expenditure; Recognises that due to the very small size of the office of EDPS, the concluding of service level agreements (SLA) such as with the Commission for training, for the medical service, for the use of Sysper, for the appraisal system, for the payment of salaries, for staff insurance and the organisation of missions, for accounting services and transportation services, is important for efficiency gains; encourages the inter-institutional activities of the EDPS, including the 60 framework contracts initiated by various Union institutions; notes that the EDPS has SLAs with the Parliament for IT and building-related expenditure; Invites the EDPS to explore the possibility of joining the transparency registry on the basis of a SLA; notes the inter-institutional cooperation through SLA between the EDPS and other Union institutions and bodies; calls on the EDPS to carry out comprehensive and realistic cost benefit analysis before entering in any agreement; Welcomes the enhanced cooperation between the EDPS and the national data protection authorities under the umbrella of the EDPB, as defined in the GDPR in respect of joint inspection e.g. by Europol; agrees that under the GDPR cooperation is no longer an option or an ancillary task, but a core and integral part of the tasks of every supervisory authority and that this is an important step towards formalising and strengthening exchanges and cooperation among supervisory authorities within the Union; Appreciates the fact that the EDPS continued to work with its regional and international partners to mainstream data protection through international agreements and to ensure consistent protection of personal data worldwide over the past five years; welcomes the fact that the EDPS has dedicated significant time and effort to the development of greater data protection convergence globally, in view of the fact that data flows internationally, across borders, while data protection rules are still decided on a largely national, and even regional, basis; Notes that the EDPB Secretariat has developed IT solutions to enable effective and secure communication between EDPB members, including the internal market information system (IMI), in which 807 cases were registered from the entry into application of the GDPR up to the end of 2019; Recalls that the workload of the EDPS as a responsible body for monitoring data protection compliance in all JHA agencies has increased in the last years, and is expected to increase further due to increasing digitalisation in Union institutions, bodies and agencies; Welcomes the fact that the EDPS developed and made publicly available in 2019 an open source inspection software tool called website evidence collector, which has received international acclaim and won the 2019 prize for innovation; welcomes the fact that the EDPS continuously evaluates other open source software that can be used to increase transparency and avoid vendor lock-in effects; observes the successful webinars recently conducted in partnership with the Delft Technical University, which helped in the implementation of the open-source online learning platform big blue button in a privacy-friendly manner; Welcomes the EDPS’ efforts to improve digitalisation and cybersecurity in Union institutions through the inspection of their websites using an open source software tool, which revealed that several websites were not compliant with the EUDPR or with the ePrivacy Directive and did not follow the EDPS Guidelines on web services; invites the EDPS to report to the Parliament on any persisting issues regarding the non-compliance of institutions with EUDPR and the ePrivacy Directive; Notes with satisfaction also the EDPS’ focus on developing and sharing technological expertise in order to ensure effective data protection for example through the TechDispatch publication, launched in July 2019, which describes a different emerging technology in each issue, aiming to provide information on the technology itself, an assessment of its possible impact on privacy and data protection and links to further reading on the topic; Welcomes the setting up an internal Task Force on COVID-19, which produced a number of orientation papers and technology primers to improve the compliance of contact tracing apps with data protection, which provided feedback to the Commission on a solution for their interoperability and worked with the EDPB to combat the potential misuse of digital data in the context of the pandemic; encourages the EDPS to continue providing the institutions with detailed opinions regarding data protection issues that may arise from digital initiatives used to counter the pandemic, including contact tracing-apps and vaccination or test certificates; Welcomes the activities aimed at verification of compliance with data protection rules and its assessment of Union bodies in this regard; notes that the supervisory activities of EDPS are guided by the accountability principle and follow a risk-based approach; Welcomes the fact that the EDPB Secretariat set up a network of communication officers within the Supervisory Authorities, to ensure joint communication on EDPB news, joint information campaigns and joint development of communication tools; notes that this network met twice in 2019 and adopted a joint 2020 EDPB information and communication plan; Encourages the EDPS to continue fostering the global debate on digital ethics; highlights the launch of a series of webinars focusing on a specific area of concern and which were published in the form of a podcast on the EDPS’ website; welcomes the ongoing discussion on digital ethics further developed at the 2019 international conference, which continued through the workshop on artificial intelligence, ethics and data protection, and through the organisation of an event focusing on the environmental impact of digital technologies; Notes that a complex approach is needed in order to make the Union institutions’ homepages accessible to persons with all kind of disabilities, including the availability of national sign languages; suggests that disability-affected persons are involved in this process; Calls on the EDPS to report on the exact role and specific tasks of the Coordinated Supervision Committee, established in 2019 in the context of data processing by large information systems in use within the Union institutions bodies, offices and agencies; notes that this Committee functions autonomously with respect to the EDPB’s activities, adhering to its own rules of procedure and working methods and that the Secretariat of the Committee is provided by the EDPB Secretariat; Is aware that the EDPS uses a number of key performance indicators (KPIs) to assist in the monitoring of its performance; welcomes the fact that the EDPS met or exceeded - in some cases significantly - the targets set in six of the eight KPIs, e.g. the number of cases dealt with at international level (62 in 2019, exceeding a target of 10), and the number of opinions/comments issued in response to consultation requests (26 consultations in 2019, exceeding a target of 10 consultations); invites the EDPS to closely monitor and adapt where necessary objectives which are performing poorly; Notes that the EDPS revised the Internal Control Standards (ICS) decision in November 2019 in order to update the legal framework applicable to the EDPS; notes that following a suggestion from the Court, the ICS monitoring report will be issued annually instead of biannually and is now presented to the management board; notes that the monitoring of the implementation of the ICS is the responsibility of the internal control coordinator, who reports directly to the director; Is aware that the Commission’s internal auditor (IA) is also the internal auditor for the Supervisor; regrets that during 2019, the IA did not perform any audit, but rather issued its annual internal audit report for 2019 with only two statements and there are no open recommendations; asks the EDPS to facilitate closer cooperation with the IA and to ensure proper annual auditing; Welcomes the publication of the cost of internal control activities representing 3,77 % of the EDPS’ expenditure; notes that the calculation model consists of a single global indicator, which is calculated by dividing the approximate overall cost of control by all expenditure made during the year (budget implementation in terms of payments); Notes that, due to the increased budget, payment requests increased substantially, from 1777 transactions in 2018 to 2653 transactions in 2019; agrees that this increased workload requires solutions in order to render the institution more efficient in terms of processing of financial operations, and welcomes the introduction of a paperless workflow system from 1 January 2020; Asks the EDPS to report on any improvements made on the efficiency of administrative processes, which seem to be essential due to an ever-increasing workload and the continuing increase in size of the institution; recalls furthermore the necessity of ongoing reforms to ensure that the EDPS is well equipped to respond to future challenges in data protection; Welcomes the efforts of the EDPS to improve its working methods and thereby make savings; calls on the EDPS to report to the budgetary authority on the new systems and applications developed in this area, namely the Speedwell workflow system for the payment of invoices and Bluebell to improve the contribution of the units to the establishment of the budget; Observes that the Secretariat of the EDPB organised 11 plenary meetings and 90 expert subgroup meetings; notes that nearly 70 % of the official documents adopted by the EDPB since May 2018 were drafted by the EDPB Secretariat’s legal team; notes that the EDPB adopted five new guidelines aiming at clarifying the range of provisions under the GDPR; underlines that the EDPB Secretariat is the main drafter for opinions and decisions on consistency and that it organises stakeholder events to gather input and opinions on issues with a view to developing guidance; notes that another task of the EDPB is to issue advice to the legislator; Welcomes the fact that the new supervisory framework came into force for the processing of personal data at the European Union Agency for Criminal Justice Cooperation (Eurojust), as well as the fact that the EDPS is taking over responsibility for monitoring Eurojust’s compliance with the applicable Union rules on data protection; Concludes that in 2019, the EDPS received 59 admissible complaints seeking an in-depth inquiry, and that the EDPS issued 48 complaint decisions; notes that the EDPS also received 151 inadmissible complaints, the majority relating to data processing at national level as opposed to processing by a Union institution or body; notes that the EDPS replied to all inadmissible complaints, directing the complainant to the relevant authority; Welcomes the completion of the Supervisor’s Strategy 2015-2019, which focused on digitisation, global partnerships and the modernisation of data protection, bringing the concepts of ethics and accountability to the forefront of data protection discourse and application; Appreciates that the EDPS is closely following EMAS initiatives and has started to convert human resources processes (selections, appraisal) and financial and administrative processes (payments, MiPS) into paperless procedures; notes the initiatives carried out by the EDPS to reduce the use of plastic bottles by its staff; agrees to the EDPS’ strategy in providing more flexible ways of working for its staff (occasional and structural teleworking); notes that those flexible working arrangements help to reduce energy for the EDPS as well as to use office space in a more optimal way; invites the EDPS to consider actions to further reduce the carbon footprint, such as choosing clean and renewable sources of energy; Agrees that data controllers and processors within the Union now benefit from a single set of rules bringing interlocutors through the one-stop-shop mechanism to an increasing extent; agrees that the GDPR also contributes to increased global visibility of the Union legal framework; Appreciates that the Supervisor has greatly contributed to creating a culture of data protection in the Union institutions and has helped elevate the status of data protection as a fundamental right under Article 8 of the Charter of Fundamental Rights of the European Union; Emphasises the important role of the EDPS, namely, to ensure the protection of personal data and privacy of individuals by monitoring personal data processing by the Union institutions, bodies and agencies, by advising them on all matters related to personal data processing and by cooperating with national supervisory authorities with a view to ensuring the consistent protection of individuals’ fundamental rights and freedoms, including the right to data protection and privacy, irrespective of where they live in the Union; Is of the opinion however that the implementation of GDPR, notwithstanding its harmonisation of rules, may be particularly challenging for small and medium sized companies (SMEs); asks the EDPS to further alleviate the administrative burden on SMEs; calls on the EDPS to consider the possibility of conducting a cost evaluation of the implementation of GDPR in the near future; Calls on the EDPS to strengthen further its efforts in ensuring that Union institutions are able to effectively implement the data protection rules; notes that the EDPS launched four investigations in 2019 with the objective of improving data protection practices; welcomes in particular the investigation into the use of Microsoft products and services by Union institutions, providing as a result a platform for discussion both on how to take back control over the IT services and products offered by the big IT service providers and on the need to collectively create standard contracts instead of accepting the terms and conditions as they are written by such providers.

Versions

1. 2021-04-29