What changed between the plenary report and the adopted text

Removed:2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION

Added:2. European Parliament resolution of 7 May 2025 with observations forming an integral part of the decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2023, Section IX – European Data Protection Supervisor (2024/2028(DEC))

Removed:with observations forming an integral part of the decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2023, Section IX – European Data Protection Supervisor

Changed:D. whereas Regulation (EU) 2018/1725 of the European Parliament and of the Council provides for the establishment of an independent authority, the European Data Protection Supervisor (the ‘EDPS’), responsible for protecting and guaranteeing the right to data protection and privacy, and tasked with ensuring that the institutions and bodies, offices and agencies of the Union embrace a strong data protection culture;

Changed:16. Underlines the important role of consultation and advice of EDPS in the legislative process; notes that, pursuant to Article 42(1) of Regulation (EU) 2018/1725, the EDPS responded to 80 formal legislative consultations and its advice took the form of 54 opinions (27 in 2022), 26 formal comments (49 in 2022) and 34 informal comments (30 in 2022) to the Commission and to the co-legislators in response to legislative consultation requests in 2023; commends the EDPS for its input with regard to the AI Act, in particular EDPS’ own-initiative opinion on the AI Act and advice on the AI liability rules, as well as for EDPS’ input to the GPA resolution on generative AI systems; acknowledges a significant increase (+93(+ 93 %) of consultation requests over the last five years;

Changed:17. Notes that, in 2023, the EDPS carried out eight investigations and five pre-investigations, marking a significant increase compared to previous years; notes that in 2023 the EDPS was actively involved in a total of 13 investigations and seven pre-investigations, either launched in 2023 or carried over from prior years; notes that the EPDS continued two complex and resource-intensive formal investigations from 2021 into the use by European Union Institutions, Bodies and Agencies (EUIBAs) of cloud services from non-EU/EEA entities, including a focus on the Commission'sCommission’s use of Microsoft 365; urges the finalisation of those investigations on time because of their significant impact on the working of institutions; notes further that the EDPS also launched five investigations based on complaints about EUIBAs'EUIBAs’ websites, focusing in a broad way on privacy and data protection issues, with preliminary assessments expected in 2024;

Changed:19. Notes that the EDPS investigated the Commission'sCommission’s alleged use of micro-targeting on platform X and continued two pre-investigations: one case concerning EUIBAs’ use of Trello cloud service, which was closed in 2023 and another one on EUIBAs’ use of profiling, which was carried out in 2024; notes that a total of six investigations and four pre-investigations (one pre-investigation in 2022) were launched in the Area of Freedom, Security, and Justice (FSJ), reflecting a significant increase from 2022; notes the EDPS’ concerns with regard to the challenges that may arise in the case of investigations where joint action between national authorities and EUIBA’sEUIBAs is needed; notes in addition that, as part of its audit plan for 2023, the EDPS audited the following bodies: the European Personnel Selection Office, the European Investment Bank, the European Central Bank, the European Centre for Disease Prevention and Control and the European Medicines Agency;

Changed:20. Recalls that in 2022 the EDPS brought an action for annulment of two provisions of the amended Europol Regulation before the General Court, which was later rejected; notes that meanwhile the EDPS decided to appeal the order of the General Court in caseCase T-578/22,T578/22 , believing the issues raised should be addressed at the highest level; regrets that the EDPS did not realise the manifest inadmissibility of its appeal, even if the institution did not intend to challenge an act by Europol, but a retroactive change in the legal framework aimed at neutralising the effects of the EDPS’ enforcement actions; calls on the institution to cooperate with Union institutions and agencies, before initiating legal proceedings that prevent the fulfilment of its mandate and the use of its resources for purposes for which they were intended; notes further that the EDPS also followed up on the implementation of its Order of 3 January 2022, including checks on Europol’s reporting; regrets that the final report on that matter was communicated by the EDPS only on 22 July 2024;

Changed:23. Recalls the Treaty on the European Union that the EU and its institutions shall promote solidarity and equality between women and men;

Changed:24. Notes that, at the end of 2023, the EDPS had 129 members of staff, compared to 127 in 2022; notes that the EDPS employed 50 contract staff (CA) under Article 3(b) of the Staff Regulations of Officials and the Conditions of Employment of Other Servants (52 CA in 2022), 7 temporary agents (TA) under Article 2(b) and 2(c) (6 TA in 2022) and used the services of 12 external services providers (EXT) working intra-murosintra muros in 2023 (8 EXT in 2022); encourages the EDPS to continue its efforts towards a more balanced geographical representation among all Member States specifically at managerial level; welcomes the increased diversity of nationalities represented, but notes with regret the continued underrepresentation of women in senior management positions; calls for the adoption of a gender parity roadmap, including proactive recruitment measures and leadership training programs for female staff members;

Changed:32. Notes that, in 2023, the EDPS focused its efforts on increasing staff awareness of the EDPS/EDPB ethical framework by organising mandatory dedicated training sessions for all staff and induction trainings for EDPS/EDPB newcomers, appointing a new ethics officer and participating in the ‘Comité Paritaire des Questions Statuaries’ working group on ethics; welcomes the establishment of a mailbox by the EPDS, where members of staff can submit their requests regarding any ethics related inquiries, as well as the use of Commission’s Ethics module in Sysper;SYSPER; encourages the EDPS to continue raising awareness and organising surveys to assess the level of staff awareness of the EDPS/EDPB ethical framework;

Changed:44. Welcomes the EDPS'sEDPS’s focus on ensuring that external contractors meet the necessary moral and ethical standards expected of all Union institutions, bodies, offices and agencies, particularly in light of the previous use of external companies by EDPS that, according to Yale University'sUniversity’s ranking, continue to operate in Russia;

Changed:46. Acknowledges the leading role of EDPS in enhancing the cybersecurity preparedness of the Union institutions, while working closely with bodies such as European Union Agency for Cybersecurity (ENISA) and cybersecurity hubs such as CERT-EU; urges it to develop a structured audit framework for cybersecurity risks within Union bodies; notes that, in 2023, the EDPS continued to improve its readiness to protect personal data and sensitive information against cyber-attacks in view of the rapidly changing cybersecurity threat landscape; commends in that context the EDPS for reviewing its security policies and methodologies in preparation for the impact of the Cybersecurity Regulation (Regulation (EU, Euratom) 2023/2841);2023/2841 of the European Parliament and of the Council ); notes from the Questionnaire that the EDPS introduced a request for two additional full-time equivalents to cover cybersecurity infrastructure in connection with EDPS’s obligations under that Regulation as well as the EDPS’ role as a member of the Interinstitutional Cybersecurity Board (IICB); notes further with appreciation that the EPDS upgraded its Information Security Policy and the EDPS Acceptable Use Policy to address specific cybersecurity threats in relation to teleworking, use of personal mobile devices and banning of dangerous applications (TikTok); notes that the EDPS did not encounter any cyber-attacks in 2023; calls for annual public reporting on detected threats, response measures, and institutional cyber resilience;

Changed:57. Welcomes the pivotal role played by the EDPS in 2023 in the coordination of the Data Protection Authorities of the Member States (DPAs) to promote consistent data protection across the Union; notes that the EDPS joined 26 DPAs in a coordinated enforcement action on the role and tasks of data protection officers (DPOs), assessing their compliance with Regulation (EU) 2018/1725; notes the continued active involvement of the EPDS in the Coordinated Supervision Committee (CSC) within the area of FSJ addressing issues such as handling complaints against Europol and enhancing cooperation processes; appreciates furthermore all the other steps taken to improve cooperation between the EDPS and the DPAs such as the conduction of a joint Europol inspection with national authorities (Poland and Lithuania) and the participation in the coordinated supervisory action on processing minors'minors’ data in Europol systems, the participation in an operational visit to the European Delegated Prosecutor’s office in Lisbon under a Working Arrangement with Portugal'sPortugal’s DPA and the coordination of an onsite inspection in Lesvos with Greece’s DPA to verify data collection practices during Joint Operations by Frontex; acknowledges that those interinstitutional engagements help the EDPS align with best practices of Union institutions and benefit from the exchange of information with peer departments;

Changed:61. Notes that the pilot project of the platforms EU Voice and EU Video (free and open-source social media networks, privacy-oriented and based on Mastodon and PeerTube software) continued in 2023; welcomes in that context the EDPS’ contribution to the Union'sUnion’s strategy on data and digital sovereignty in order to promote the Union'sUnion’s independence in the digital world and compliance with the data protection legal framework.

Changed:1. Notes that the budget of the EDPS falls under MFF Heading 7 ’European‘European public administration’, which amounted to a total of EUR 12,3 billion, i.e. 6,4 % of Union budget spending, in 2023; notes that the budget of the EDPS represented 0,18 % of MFF Heading 7 appropriations;

Changed:11. Notes that the EPDS used nine key performance indicators (KPIs) to monitor its performance in 2023, in alignment with the main objectives of the EDPS Strategy 2020-2024 which is implemented through the Annual Management Plan; notes from the Annual Report that the EDPS over-delivered in almost all areas, as indicated by the results of KPIs for 2023, except for one KPI (the number of EDPS followers on some social media accounts); notes with concern that the EDPS encountered considerable challenges due to a growing workload and intricate data protection issues arising from the rapidly evolving digital landscape, as well as due to the extension of the EDPS mandate to supervisory activities (such as audits and investigations) and replies to consultations and prior consultations, all in the context of a limited budget; notes from the EDPS’ follow-up report to Parliament’s resolution on the implementation of the EDPS’ budget for 2022 (the ‘Follow-up Report’) that several legislative developments in the last two years have impacted the work and resources of the EDPS, due to the extension of Eurojust’s mandate, new information to be received by Europol under the Digital Services Act, the roll out of the new Union’s large-scale databases and interoperability framework in the justice and home affairs field and the entry into force of the Artificial Intelligence Act (the “AI‘AI Act”);Act’); calls on the Commission and on the budgetary authority to take those matters into consideration during the annual budgetary procedure;

Changed:15. Notes that the EDPS received 420 complaints, i.e. 53 more than in 2022, out of which 73 were admissible and 347 inadmissible in 2023; notes that the EDPS issued a final decision, opinion or reply in 31 out of 73 complaint cases received in 2023 within 44 days on average and responded to all 347 inadmissible complaints received; notes that, out of all admissible complaints (ongoing and received in 2023), 55 cases were finalised in 2023, which represents an increase of 17 % compared to 2022; acknowledges the efforts made by the EDPS to reduce the high number of complaints by developing a dynamic tool on the EPDS’ website, although the volume of complaints remained challenging due to limited resources in 2023; notes with satisfaction that the EDPS developed various procedural tools and policies to enhance its investigatory processes in 2023; commends in that context the EDPS for having amended its Rules of Procedure, whereby the “review‘review procedure”procedure’ is replaced by a “preliminary‘preliminary assessment”assessment’ in order to safeguard the right to be heard of all the involved parties, thus contributing to a fair and timely handling of complaints and investigations;

Changed:28. Notes that, in the second half of 2023, the EDPS’ HR team launched a pilot for a new on-boarding process for newcomers, with sessions that cover, inter alia, presentations of core units’ work, ethics, procurement procedures and information security, whereas three on-boarding sessions were offered in 2023; invites the EDPS to continue offering to newcomers “on-boarding”‘on-boarding’ and to all members of staff mandatory sessions that remind the importance of principles such as ethics, conflicts of interest, transparency, internal control and anti-fraud, as they have become the standard in the Union institutions; notes moreover that 12 individual sessions were offered for EDPS and EDPB staff, six sessions of group coaching in which participants (manager level) learned from each other, as well as a one-year team coaching with a designer for leadership development at the European School of Administration in 2023;