What changed between the draft committee report and the plenary report

2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION

6 unchanged paragraphs

with observations forming an integral part of the decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2023, Section IX – European Data Protection Supervisor

(2024/2028(DEC))

The European Parliament,

– having regard to its decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2023, Section IX – European Data Protection Supervisor,

– having regard to Rule 102 of and Annex V to its Rules of Procedure,

– having regard to the opinion of the Committee on Civil Liberties, Justice and Home Affairs,

Changed:– having regard to the report of the Committee on Budgetary Control (A10-0000/2025),(A10-0053/2025),

Change 2

Changed:A. whereas, in the context of the discharge procedure, the discharge authority wishes to stress the particular importance of further strengthening the democratic legitimacy of the Union institutions by improving transparency and accountability, and implementing the concept of performance-based budgeting and good governance of human resources;resources (HR);

B. whereas data protection is a fundamental right, protected by Union law and enshrined in Article 8 of the Charter of Fundamental Rights of the European Union;

C. whereas Article 16 of the Treaty on the Functioning of the European Union provides that compliance with the rules relating to the protection of individuals, with regard to the processing of personal data concerning them, is to be subject to control by an independent authority;

D. whereas Regulation (EU) 2018/1725 provides for the establishment of an independent authority, the European Data Protection Supervisor (the ‘EDPS’), responsible for protecting and guaranteeing the right to data protection and privacy, and tasked with ensuring that the institutions and bodies, offices and agencies of the Union embrace a strong data protection culture;

Change 3

Changed:E. whereas the EDPS carries out its functions in close cooperation with fellow Data Protection Authorities (DPAs) as part of the European Data Protection Board (EDPB), and it serves the public interest while being guided by principles of impartiality, integrity, transparencytransparency, pragmatism and pragmatism;respects Union legislation;

Change 4

Changed:1. Notes that the budget of the EDPS falls under MFF headingHeading 7 ’European public administration’, which amounted to a total of EUR 12,3 billion, i.e. 6,4 % of Union budget spending, in 2023; notes that the budget of the EDPS represented 0,18 % of MFF headingHeading 7 appropriations;

Change 5

Changed:2. Notes that the Court of Auditors (the ‘Court’), in its Annual Report (the ‘Court’s report’) for the financial year 2023, examined a sample of 70 transactions under MFF Heading 7, of which 21 (30 %) contained errors; further notes that for five of those errors, which were quantified by the Court, the Court estimated a level of error below the materiality threshold;

Change 6

Changed:3. Notes from the Court’s report its observation that administrative expenditure comprises expenditure on human resourcesHR including pensions, which in 2023 accounted for about 70 % of the total administrative expenditure, and on buildings, equipment, energy, communications and information technology; welcomes the Court’s renewed opinion that, overall, administrative spending is low risk;

4. Notes from the Court’s report that in 2023 it audited a salary payment of an official who had last made a declaration concerning rights to family and child allowance in 2020; echoes the Court’s concern that delays in receiving and verifying such declarations increase the risk of ineligible payments;

Budgetary and financial management

Change 7

Changed:5. Notes that the final adopted budget for the EDPS was EUR 22 711 559 in 2023, which represents an increase of 12,06 % compared to 2022; notes that the budget of the EDPS also covers the work of the independent Secretariat of the European Data Protection Board (the ‘Board’);EDPB; notes from the Annual report of the EDPS for 2023 (the ‘Annual Report’) that the adopted budget of the BoardEDPB was EUR 7,67 million in 2023, including EUR 300 000 granted by means of an amending budget which was needed due to an increase in litigation activities in 2023;

Change 8

Changed:6. Notes with satisfactionAcknowledges that the budget monitoring and planning efforts of the EDPS in the financial year 2023 resulted in a budget implementation rate of current year commitment appropriations of 96 % in 2023 (slightly lower than in 2022 when that rate was 98 %); further notes from the report on the EDPS annual accounts for 2023 that the current year payment appropriations execution rate was 84 % (lower than 88 % in 2022); notes in addition, from EDPS replies to the questionnaire submitted by the Committee on Budgetary Control for the 2023 budgetary discharge (the ‘Questionnaire’), that the execution rate of payment appropriations overall was 91,33 % in 2023,2023 lower(lower than 94,09 % in 2022;2022);

7. Notes further that the amount of carry-overs (C8) from 2023 to 2024 was EUR 2 517 942,67 or 11,08 % of the total budget for 2023, compared to EUR 1 827 354,23 or 9,01 % of the total budget for 2022; notes that the execution rate of the C8 budget in 2023 was 76,65 % (higher than 73,77 % in 2022);

8. Welcomes an improvement in the average time to pay from 25 days in 2022 to 19 days in 2023, with 97,50 % of payments processed on time; notes that that improvement is also due to the EDPS having solved an old bug with the electronic payment system for invoices linked to mission costs; notes further a significant increase in the number of payments from 799 in 2022 to 1335 in 2023; observes in that context that the number of transactions is still lower than pre-pandemic levels due to changes in the way of working (such as hybrid meetings or virtual events for experts);

Change 9

Changed:9. Notes that the effects of illegal Russia’s war of aggression against Ukraine continued to create budgetary pressure on the EDPS in 2023, including through rising inflation and the consequent increase in energy costs, with the most affected budget lines being staff salaries, building security and rental costs, mission costs and services provided by external staff; commends in that context the EDPS for having re-adjusted its priorities and having implemented internal reallocation within budget chapters; understands that that budgetary optimisation was necessary in order to successfully manage the indexation of staff salaries and rental costs, as well as an increase in the costs of external lawyer support services due to an increased number of EDPS binding decisions which led to a bigger number of cases to be defended before the Court of Justice of the European Union (CJEU) with the help of external legal assistance; regrets in that context that the EDPS had to postpone some of its activities, such as a feasibility study on artificial intelligence; calls on the EDPS to abide to the competences of its mandate with a collaborative approach with the Union institutions and agencies and to avoid initiating any legal action, especially those which are manifestly inadmissible, in order to avoid negative repercussions on the management of resources, which do not allow the EDPS to carry out its activities as an Institution;

Change 10

Removed:10. Notes from the Questionnaire that the EDPS budget for staff missions increased by 28,90 % from EUR 251 000 in 2022 to EUR 323 421 in 2023 due to an increase in prices for flight tickets and hotel costs; notes that, as part of that budget, an amount of EUR 33 000 was dedicated for missions of the Supervisor in 2023; also notes, from the Annual Report, that the number of staff missions increased from 171 in 2022 to 246 in 2023;

Added:10. Expresses concern about the significant increase in EDPS staff mission costs, from EUR 28 789 in 2021 and EUR 176 903 in 2022, to EUR 284 580 in 2023; calls on the EDPS to assess whether the resources spent on missions are being used appropriately and effectively; notes that the EDPS ceased making public the number of missions funded by organisers, as well as information on which unit or sector participated in each mission, thus reducing transparency regarding mission expenses; calls on the EDPS to reinstate this practice; encourages the EDPS to promote the use of video-conferencing tools where suitable, as this could contribute to lowering the number of missions and reducing costs; calls on the EDPS to assess whether the resources spent on missions are being used appropriately and effectively.

4 unchanged paragraphs

Internal management, performance and internal control

11. Notes that the EPDS used nine key performance indicators (KPIs) to monitor its performance in 2023, in alignment with the main objectives of the EDPS Strategy 2020-2024 which is implemented through the Annual Management Plan; notes from the Annual Report that the EDPS over-delivered in almost all areas, as indicated by the results of KPIs for 2023, except for one KPI (the number of EDPS followers on some social media accounts); notes with concern that the EDPS encountered considerable challenges due to a growing workload and intricate data protection issues arising from the rapidly evolving digital landscape, as well as due to the extension of the EDPS mandate to supervisory activities (such as audits and investigations) and replies to consultations and prior consultations, all in the context of a limited budget; notes from the EDPS’ follow-up report to Parliament’s resolution on the implementation of the EDPS’ budget for 2022 (the ‘Follow-up Report’) that several legislative developments in the last two years have impacted the work and resources of the EDPS, due to the extension of Eurojust’s mandate, new information to be received by Europol under the Digital Services Act, the roll out of the new Union’s large-scale databases and interoperability framework in the justice and home affairs field and the entry into force of the Artificial Intelligence Act (the “AI Act”); calls on the Commission and on the budgetary authority to take those matters into consideration during the annual budgetary procedure;

12. Welcomes the fact that, in 2023, the EDPS strengthened its ability to assess and prepare for emerging technological trends and their potential impact on privacy and data protection; notes that this was achieved through a foresight-based approach, with a focus on monitoring developments in areas such as large language models, digital identity wallets, the internet of behaviours, extended reality, and deep fake detection; welcomes in that context the publication by the EDPS of its third TechSonar initiative on emerging technologies; congratulates moreover the EDPS for having been awarded the GPA Global Privacy and Data Protection Awards 2023 in the category of innovation;

13. Notes that 2023 was marked by several organisational changes or updates that were needed in order to respond and adapt to the evolving data protection challenges; welcomes in this context the appointment of a Secretary-General from 1 July 2023; notes in addition the transition of two sectors into units such as ‘Information and Communication’ and ‘Governance and Internal Control’ and the creation of three new specialised sectors under the ‘Technology and Privacy’ (T&P) unit: ‘Systems Oversight and Audit’, ‘Technology Monitoring and Foresight’ and ‘Digital Transformation’;

Change 11

Added:14. Emphasises the role of the EDPS in supervising the processing of personal data by Union institutions, bodies, offices and agencies; notes with concern the length of proceedings before the EDPS, as the EDPS did not close a single investigation in 2023, but in comparison to the previous year, in 2023, the number of notifications beyond the 72 hours significantly decreased;

15. Notes that the EDPS received 420 complaints, i.e. 53 more than in 2022, out of which 73 were admissible and 347 inadmissible in 2023; notes that the EDPS issued a final decision, opinion or reply in 31 out of 73 complaint cases received in 2023 within 44 days on average and responded to all 347 inadmissible complaints received; notes that, out of all admissible complaints (ongoing and received in 2023), 55 cases were finalised in 2023, which represents an increase of 17 % compared to 2022; acknowledges the efforts made by the EDPS to reduce the high number of complaints by developing a dynamic tool on the EPDS’ website, although the volume of complaints remained challenging due to limited resources in 2023; notes with satisfaction that the EDPS developed various procedural tools and policies to enhance its investigatory processes in 2023; commends in that context the EDPS for having amended its Rules of Procedure, whereby the “review procedure” is replaced by a “preliminary assessment” in order to safeguard the right to be heard of all the involved parties, thus contributing to a fair and timely handling of complaints and investigations;

16. Underlines the important role of consultation and advice of EDPS in the legislative process; notes that, pursuant to Article 42(1) of Regulation (EU) 2018/1725, the EDPS responded to 80 formal legislative consultations and its advice took the form of 54 opinions (27 in 2022), 26 formal comments (49 in 2022) and 34 informal comments (30 in 2022) to the Commission and to the co-legislators in response to legislative consultation requests in 2023; commends the EDPS for its input with regard to the AI Act, in particular EDPS’ own-initiative opinion on the AI Act and advice on the AI liability rules, as well as for EDPS’ input to the GPA resolution on generative AI systems; acknowledges a significant increase (+93 %) of consultation requests over the last five years;

Change 12

Changed:16.17. Notes that, in 2023, the EDPS carried out eight investigations and five pre-investigations, marking a significant increase compared to previous years; notes that in 2023 the EDPS was actively involved in a total of 13 investigations and seven pre-investigations, either launched in 2023 or carried over from prior years; notes that the EPDS continued two complex and resource-intensive formal investigations from 2021 into the use by European Union Institutions, Bodies and Agencies (EUIBAs) of cloud services from non-EU/EEA entities, including a focus on the Commission's use of Microsoft 365; urges the finalisation of those investigations on time because of their significant impact on the working of institutions; notes further that the EDPS also launched five investigations based on complaints about EUIBAs' websites, focusing in a broad way on privacy and data protection issues, with preliminary assessments expected in 2024;

Change 13

Added:18. Urges the EDPS to prioritise and enhance procedures for handling the personal data of minors under 15, particularly in the context of Europol’s systems, where such individuals may be marked as suspects; recognises the heightened vulnerability of that group and the need for robust safeguards;

19. Notes that the EDPS investigated the Commission's alleged use of micro-targeting on platform X and continued two pre-investigations: one case concerning EUIBAs’ use of Trello cloud service, which was closed in 2023 and another one on EUIBAs’ use of profiling, which was carried out in 2024; notes that a total of six investigations and four pre-investigations (one pre-investigation in 2022) were launched in the Area of Freedom, Security, and Justice (FSJ), reflecting a significant increase from 2022; notes the EDPS’ concerns with regard to the challenges that may arise in the case of investigations where joint action between national authorities and EUIBA’s is needed; notes in addition that, as part of its audit plan for 2023, the EDPS audited the following bodies: the European Personnel Selection Office, the European Investment Bank, the European Central Bank, the European Centre for Disease Prevention and Control and the European Medicines Agency;

Change 14

Changed:18.20. Recalls that in 2022 the EDPS brought an action for the annulment of two provisions of the amended Europol Regulation before the CJEU,General Court, which was later rejected by the CJEU;rejected; notes that meanwhile the EDPS decided to appeal the order of the General Court ruling in case T-578/22, believing the issues raised should be addressed at the highest level; acknowledgesregrets that the EDPS did not realise the manifest inadmissibility of its appeal, even if the institution did not intend to challenge an act by Europol, but a retroactive change in the legal framework aimed at neutralising the effects of the EDPS’ enforcement actions; notescalls on the institution to cooperate with Union institutions and agencies, before initiating legal proceedings that Europolprevent didthe notfulfilment supportof its mandate and the defendantuse co-legislatorsof inits thatresources case;for purposes for which they were intended; notes further that the EDPS also followed up on the implementation of its Order of 3 January 2022, including checks on Europol’s reporting,reporting; whereasregrets athat the final report on that matter was communicated by the EDPS only on 22 July 2024;

21. Notes that, after the pilot implementation of the new risk management framework at the EDPS in late 2022, an anonymous satisfaction survey was conducted in May 2023 to assess its effectiveness and gather additional suggestions; notes further that the survey results were positive, leading to the formal adoption of the framework on 26 June 2023;

Change 15

Changed:20.22. Notes that the internal audit service (IAS) carried out an audit on the methodology for the planning of EDPS audits in the EDPS in 2023; notes that the audit was concluded with two recommendations for which the EDPS submitted an action plan to the IAS; calls on the EDPS to keep the discharge authority informed on a regular basis on the progress made in that matter;

Change 16

Removed:Human resources, equality and staff well-being

Added:23. Recalls the Treaty on the European Union that the EU and its institutions shall promote solidarity and equality between women and men;

Removed:21. Notes that, at the end of 2023, the EDPS had 129 members of staff, compared to 127 in 2022; notes that the EDPS employed 50 contract staff (CA) under Article 3(b) of the Staff Regulations of Officials and the Conditions of Employment of Other Servants (52 CA in 2022), 7 temporary agents (TA) under Article 2(b) and 2(c) (6 TA in 2022) and used the services of 12 external services providers (EXT) working intra-muros in 2023 (8 EXT in 2022); notes that the EDPS had 23 nationalities (from the Member States) represented among its staff in 2023, which is, despite the over-representation of five nationalities, an excellent score for such a small institution and an improvement in comparison with 22 nationalities in 2022;

Added:HR, equality and staff well-being

Removed:22. Notes a high occupancy rate of the establishment plan of 95,65 % but also a high turnover rate of 13 % in 2023; notes that most of the unfilled positions were a result of candidates being unsuitable, given the EDPS’ need for highly specialised profiles and the small pool of eligible candidates; welcomes the addressing of those challenges through republication with a wider or more targeted dissemination of the vacancy or by redrafting the requirements; calls on the EDPS to continue to address the challenges in finding suitable candidates and to keep the discharge authority informed about improvements on staff recruitment and turnover;

Added:24. Notes that, at the end of 2023, the EDPS had 129 members of staff, compared to 127 in 2022; notes that the EDPS employed 50 contract staff (CA) under Article 3(b) of the Staff Regulations of Officials and the Conditions of Employment of Other Servants (52 CA in 2022), 7 temporary agents (TA) under Article 2(b) and 2(c) (6 TA in 2022) and used the services of 12 external services providers (EXT) working intra-muros in 2023 (8 EXT in 2022); encourages the EDPS to continue its efforts towards a more balanced geographical representation among all Member States specifically at managerial level; welcomes the increased diversity of nationalities represented, but notes with regret the continued underrepresentation of women in senior management positions; calls for the adoption of a gender parity roadmap, including proactive recruitment measures and leadership training programs for female staff members;

Removed:23. Notes that, in the second half of 2023, the EDPS’ human resources (HR) team launched a pilot for a new on-boarding process for newcomers, with sessions that cover, inter alia, presentations of core units’ work, ethics, procurement procedures and information security, whereas three on-boarding sessions were offered in 2023; invites the EDPS to continue offering to newcomers “on-boarding” sessions that include ethics training, as they have become the standard in the European institutions; notes moreover that 12 individual sessions were offered for EDPS and EDPB staff, six sessions of group coaching in which participants (manager level) learned from each other, as well as a one-year team coaching with a designer for leadership development at the European School of Administration in 2023;

Added:25. Notes that the EDPS had 23 nationalities (from the Member States) represented among its staff in 2023, which is an improvement in comparison with 22 nationalities in 2022; notes with dissatisfaction the over-representation of five nationalities and an underrepresentation of other nationalities; urges the EDPS to continue its efforts to achieve a balanced geographical distribution of nationals from all Member States within its staff, by improving communication, fostering visibility, and enhancing job conditions to attract underrepresented nationalities;

Removed:24. Notes, from the Questionnaire, that the EDPS offers flexible and hybrid working arrangements, that are well-received by members of staff who can benefit, inter alia, from parental leave, time credits, part-time work or working from abroad for a limited number of days per year; notes that, in 2023, the majority of staff made use of those working conditions, whereas 86,30 % of staff were on teleworking in 2023;

Added:26. Observes that, in 2023, the EDPS maintained a workforce comprising 65 % women and 35 % men, consistent with trends from previous years; regrets the absence of women in senior management roles, despite achieving gender parity among the six middle management positions; urges the EDPS to intensify its efforts to ensure gender-balanced representation across all staff levels, and invites the EDPS to promote the application of women also with a view to the next election of the Supervisor by Parliament;

Added:27. Notes a high occupancy rate of the establishment plan of 95,65 % but also a high turnover rate of 13 % in 2023; notes that most of the unfilled positions were a result of candidates being unsuitable, given the EDPS’ need for highly specialised profiles and the small pool of eligible candidates; welcomes the addressing of those challenges through republication with a wider or more targeted dissemination of the vacancy or by redrafting the requirements; welcomes the steps taken by the EDPS regarding the hiring process; calls on the EDPS to continue to address the challenges in finding suitable candidates and to keep the discharge authority informed about improvements on staff recruitment and turnover;

Added:28. Notes that, in the second half of 2023, the EDPS’ HR team launched a pilot for a new on-boarding process for newcomers, with sessions that cover, inter alia, presentations of core units’ work, ethics, procurement procedures and information security, whereas three on-boarding sessions were offered in 2023; invites the EDPS to continue offering to newcomers “on-boarding” and to all members of staff mandatory sessions that remind the importance of principles such as ethics, conflicts of interest, transparency, internal control and anti-fraud, as they have become the standard in the Union institutions; notes moreover that 12 individual sessions were offered for EDPS and EDPB staff, six sessions of group coaching in which participants (manager level) learned from each other, as well as a one-year team coaching with a designer for leadership development at the European School of Administration in 2023;

Added:29. Notes, from the Questionnaire, that the EDPS offers flexible and hybrid working arrangements, that are well-received by members of staff who can benefit, inter alia, from parental leave, time credits, part-time work or working from abroad for a limited number of days per year; notes that, in 2023, the majority of staff made use of those working conditions, whereas 86,30 % of staff made use of teleworking arrangements in 2023; considers that the building infrastructure should be optimised to reflect that high rate of teleworking, which could contribute to reducing operational costs and ensuring more efficient use of office space; welcomes the EDPS’ continued efforts to actively improve physical and mental well-being of its staff;

30. Commends the EDPS for carrying out several awareness-raising actions during the year 2023 with information sharing on elimination of racial discrimination, International Women’s Day, EU diversity month and learning about neurodiversity; notes that currently the EDPS does not employ staff with disabilities but has an equal opportunities clause included in all EDPS vacancy notices and actively encourages applications from candidates with disabilities;

Change 17

Changed:26.31. Notes from the Questionnaire that the EDPS considers confidential any information on burnout cases, including the number thereof; disagrees with that opinion and askscalls the EDPS to provide the discharge authority with the number of burnout cases on a yearly basis; notes with satisfaction that, in 2023, there were no harassment cases reported at the EDPS; welcomes the fact that, in 2023, the EDPS continued to provide an anti-harassment presentation delivered by one of the EDPS’ confidential counsellors, as part of the induction training called the ‘EDPS Welcome Day’; commends the publication of the decision on anti-harassment and the role of the confidential counsellors on the EDPS’ intranet;

Ethical framework and transparency

32. Notes that, in 2023, the EDPS focused its efforts on increasing staff awareness of the EDPS/EDPB ethical framework by organising mandatory dedicated training sessions for all staff and induction trainings for EDPS/EDPB newcomers, appointing a new ethics officer and participating in the ‘Comité Paritaire des Questions Statuaries’ working group on ethics; welcomes the establishment of a mailbox by the EPDS, where members of staff can submit their requests regarding any ethics related inquiries, as well as the use of Commission’s Ethics module in Sysper; encourages the EDPS to continue raising awareness and organising surveys to assess the level of staff awareness of the EDPS/EDPB ethical framework;

33. Welcomes the overall high level of transparency achieved by the EDPS concerning its activities, in particular as regards the publication of the agenda and the declaration of interests of the Supervisor and of the Head of EDPS Administration, in line with the Supervisor’s code of conduct of 2019; notes from the Follow-up Report that the EDPS has adopted two codes of conduct, whereas one of them applies to the Supervisor and the other one applies to the EDPS staff; understands that in cases when the Secretary-General is called to replace the Supervisor, the latter’s code of conduct also applies to the Secretary-General;

Change 18

Added:34. Notes with satisfaction that the EDPS has never been involved in any investigations by the European Anti-Fraud Office (OLAF) since its establishment;

35. Notes that, out of five inquiries opened by the Ombudsman in 2023 concerning the EDPS, four were closed without any further inquiry; notes that, for one enquiry, the decision was still pending and expected for Q4 2024; calls on the EDPS to keep the discharge authority informed as to the outcome of this enquiry;

Change 19

Changed:30.36. NotesRegrets that the EDPS has still not formally joined the Union’s Transparency Register (TR); nevertheless notes from the Follow-up Report that, with a view to formally joining the Union’s Transparency Register (TR),TR, the EDPS has launched an internal assessment on transparency measures, whereaswhereas, in 20232023, exploratory meetings and exchanges of the EDPS with secretariat of the TR took place; calls on the EDPS to inform the discharge authority of the outcome of that assessment exercise; reiterates its call on the EDPS to join and use the TR;TR, including for the proactive disclosure of meetings with any third parties, to ensure transparency in EDPS’ regulatory and advisory functions;

37. Notes with satisfaction that, in 2023, the EPDS established internal rules applicable to the hearing of persons that could be affected by an EDPS final decision adopted in own-initiative investigations and inquiries in order to ensure the proper exercise of their fundamental right to be heard in such proceedings; commends the EPDS for publishing a new factsheet on EDPS Investigations and a new EDPS Investigation Policy as well as for ensuring that all financial reports, including annual budgets, accounting and audit reports, are made publicly accessible through a Union institution website and other official channels, as the EPDS takes a leading role in enhancing the cybersecurity preparedness of the Union institutions;