The EDPS : supervising EU institutions and bodies & enforcing data protection principles.
Date: 2013-12-12
Institutions: European Data Protection Supervisor
Subjects: EU institution, access to information, administrative transparency, data protection, protection of privacy

European Data 
Protection Supervisor

The EDPS: 
Supervising EU institutions 
and bodies & enforcing data 
protection principles

EDPS factsheet 3

  Every institution processes personal information. It might be yours...

Every	day,	personal information	is	processed	within	the	EU	administration.	Recruiting	and	
procurement	activities,	staff	appraisals,	the	collection	of	health	data	in	medical	files,	the	setting	
up	of	time	management	systems,	CCTV	and	access	to	EU	buildings	are	but	a few	examples.

When	EU	institutions	and	bodies	process	personal data,	they	must	comply	with	the	principle	
of	 accountability	and	 the	 obligations	 set	 out	 in	 the	 EU Data Protection Regulation 
45/2001.	They	must	be	able	to	demonstrate	this	compliance.	

  Why is this necessary?

If	the	personal	information	held	about	you	by	one	of	the	European	Institutions	is	inaccurate,	
out	of	date	or	disclosed	to	the	wrong	person,	the	damage	caused	to	you	may	be	quite	serious.	
You	could	be	unfairly	refused	a professional	contract,	mistaken	for	somebody	else,	blamed	for	
unauthorised	disclosure	of	information,	or	even	become	a victim	of	identity	theft.

Everyone	is	entitled	to	protect	their	personal	information.	Data	protection	is	a fundamental	
right,	protected	by	European	law	and	enshrined	in	Article 8	of	the	Charter of Fundamental 
Rights of the European Union.	

More	specifically,	the	rules	for	data	protection	when	the	EU	institutions	and	bodies	process	
personal	data	are	set	out	in	 Regulation (EC) No. 45/2001.

  What is the role of the EDPS?

The	EDPS	is	the	European	Union’s	independent	data	protection	authority.	We	monitor	and	
ensure	the	protection of personal data and privacy	when	EU	institutions	and	bodies	pro-
cess	the	personal	information	of	individuals. 	

We	advise	EU	institutions	and	bodies	on	all	matters	relating	to	the	processing	of	personal 
information.	We	are	consulted	by	the	EU	legislator	on	proposals	for	legislation	and	new	pol-
icy	development.	We	monitor	new	technology	that	may	affect	the	protection	of	personal	
information.	We	intervene	before	the	Court	of	Justice	of	the	EU	to	provide	expert	advice	on	
interpreting	data	protection	law.	We	also	cooperate	with	national	supervisory	authorities	and	
other	supervisory	bodies	to	improve	consistency	in	protecting	personal	information.

In	our	supervisory	role,	we	monitor and ensure	that	the	EU	institutions	comply	with	data	
protection	rules;	we	hold	the	EU	administration	accountable	for	this	compliance	and	promote	

a ‘data	protection	culture’	within	the	institutions.	We	do	so	in	close	cooperation	with	the	Data	
Protection	Officers	(DPOs)	in	each	EU	institution	or	body.

  How does the EDPS monitor and supervise?

The	EDPS	has	a number	of	compliance monitoring tools	to	assist	in	these	tasks:

•	

Prior checking

Where	an	EU	institution	or	body	intends	to	process	personal	data	in	processing	operations	that	
present	 specific risks,	 for	 example	‘early	 warning	 systems’,	 such	 as	 databases	 used	 for	
anti‑fraud	purposes	in	procurement,	or	asset	freezing	operations,	they	must	first	notify	these	
to	the	EDPS	for	prior checking.	The	aim	is	data	protection	by design	i.e.	build	data	protection	
into	the	design	and	architecture	of	the	operation.	In	most	cases,	this	prior	checking	exercise	
leads	to	a set	of	recommendations	from	the	EDPS	that	helps	the	EU	institution	or	body	to	
comply	with	data	protection	rules	once	the	operation	is	in	place. 	

•	

Consultations on administrative measures

EU	institutions	and	DPOs	can	consult	the	EDPS	for	advice	when	drawing	up	measures	or	inter-
nal	rules	that	involve	the	processing	of	personal	information,	if	they	are	complex	or	may	result	

in	considerable	risks	to	the	rights	and	freedoms	of	individuals.	We	have	issued	Opinions	on	
a diverse	range	of	subjects	such	as	the	publication	of	personal	data	on	the	internet,	the	inter-
nal	use	of	email,	the	transfers	of	personal	data	to	third	countries	and	the	billing	of	individual	
users	for	non‑work	related	phone	calls.	The	EDPS	has	issued	a policy paper	to	guide	EU	insti-
tutions	and	bodies	as	to	when	they	must	consult	us. 	

•	

Cooperation with DPOs

In	order	to	monitor	compliance,	the	EDPS	relies	heavily	on	the	DPOs	of	the	EU	institutions	and	
bodies.	Each	EU	institution	has	at	least	one	DPO	to	ensure	that	the	EU	data	protection	Regula-
tion	is	applied	and	a register	of	DPO appointments	can	be	found	on	our	website.	The	tasks,	
duties	 and	 powers	 of	 the	 DPO	 and	 the	 respective	 implementing	 rules	 are	 outlined	 in	
guidelines	published	by	the	EDPS.	To	support	them	in	these	tasks,	we	also	run	a dedicated	
DPO corner	on	our	website.	In	addition	to	bilateral	meetings	and	contacts	with	the	DPOs,	we	
also	take	part	in	the	regular	meetings	of	the	DPO	network	and	offer	tailor‑made	training. 	

•	

Awareness raising

The	EDPS	publishes	thematic guidelines	on	core	issues	of	data	protection	to	serve	as	refer-
ence	documents	for	the	EU	administration.	These	issues	include:

	– Staff	recruitment;
	– Health	data	at	work;
	– Administrative	inquiries	and	disciplinary	proceedings;
	– Tasks,	duties	and	powers	of	the	DPO;
	– Video‑surveillance;
	– Anti‑harassment	procedures;
	– Staff	evaluation.	

We	also	offer	workshops	on	topical	issues	as	well	as	regular	 training	activities	for	DPOs	and	
Data	Protection	Coordinators	(DPCs).

•	

Horizontal monitoring and reporting exercises

In	order	to	ensure	an	adequate	overview	and	to	gather	statistics	to	benchmark	and	compare	
the	performance	of	EU	institutions	and	bodies,	we	carry	out	general	monitoring and report-
ing exercises,	such	as	periodic	surveys	on	their	compliance	with	Regulation	(EC)	45/2001	and	
our	more	recent	survey	on	the	status	of	DPOs. 	

•	 Monitoring compliance

In	addition	to	general	stock	taking	exercises,	we	can	carry	out	targeted	monitoring	exercises	
where,	as	a result	of	our	supervision	activities,	the	EDPS	has	concerns	about	the	level	of	compli-
ance	in	specific	institutions	and	bodies.	Some	of	these	are	correspondence‑based	while	others	
take	the	form	of	a one	day	visit	to	the	institution	or	body	concerned	to	address	the	shortcomings.	

For	fact	finding,	the	follow‑up	of	cases	and	for	monitoring	of	compliance	in	general,	we	can	
also	carry	out	inquiries	and	inspections	(general,	thematic,	targeted)	on	our	own	initiative.	

•	

Enforcement

Where	 monitoring	is	 simply	 not	 enough	 to	 ensure	 compliance,	the	 EDPS	 can	 rely	 on	 his	
enforcement powers	set	out	under	Article	47	of	Regulation	(EC)	45/2001.	Among	other	
things,	these	include	the	right	to	impose	a ban	on	a particular	data	processing	operation.

•	

Complaints

If	you	think	that	your	rights	have	been	infringed	by	an	EU	institution	or	body	processing	your	
personal	information	and	you	have	not	been	able	to	settle	this	with	the	institution	concerned	
or	its	DPO,	then	you	can	lodge	a complaint	with	the	EDPS	to	investigate.	A complaint form	is	
available	on	our	website.	

If	your	complaint	is	admissible,	the	EDPS	will	carry	out	an	inquiry	as	appropriate,	communicate	
the	findings	to	you	and	ensure	that	the	necessary	measures	are	adopted	by	the	institution.

The	EDPS	is	not	competent	for	issues	on	a national	level	and	has	no	supervisory	powers	for	
handling	complaints	on	the	processing	of	personal	information	by	national	authorities	or	pri-
vate	entities.	

EDPS key figures - 2012

	– 71 prior-check opinions adopted, 11 non prior check opinions

	– 86 complaints received, 40 admissible

	– 27 consultations received on administrative measures

	– 15 on-the-spot inspections and 6 visits carried out 

	– 	1 set of guidelines published	on	the	processing	of	personal	information	in	the	area	

of	leave	and	flexitime	

Glossary

•	

•	

•	

•	

•	

Personal information or data:	Any	information	relating	to	an	identified	or	identifiable	natural	
(living)	person.	Examples	include	names,	dates	of	birth,	photographs,	e‑mail	addresses	and	telephone	
numbers.	Other	details	such	as	health	data,	data	used	for	evaluation	purposes	and	traffic	data	on	the	
use	of	telephone,	email	or	internet	are	also	considered	personal	data.
Data processing:	Any	operation	or	set	of	operations	performed	upon	personal	data,	whether	or	not	
by	automatic	means,	such	as	collection,	recording,	organisation,	storage,	adaptation	or	alteration,	
retrieval,	consultation,	use,	disclosure	by	transmission,	dissemination	or	otherwise	making	available,	
alignment	or	combination,	blocking,	erasure	or	destruction.	
DPO / DPC:	A Data	Protection	Officer	(DPO)	is	appointed	by	every	EU	institution	and	body.	The	DPO	has	
the	duty	to	ensure,	in	an	independent	manner,	the	internal	application	of	the	provisions	of	the	Data	
Protection	Regulation	(EC)	45/2001.	Some	EU	institutions	have	appointed	a Data	Protection	Coordinator	
(DPC)	for	each	of	their	substructures	(e.g.	for	each	Directorate‑General	at	the	European	Commission).
EU institutions and bodies / EU administration:	all	institutions,	bodies,	offices	or	agencies	
operating	for	the	European	Union	(e.g.	European	Commission,	European	Parliament,	Council	of	the	
European	Union,	European	Central	Bank,	specialised	and	decentralised	EU	agencies).
Accountability:	Under	the	accountability	principle,	EU	institutions	and	bodies	put	in	place	all	those	
internal	mechanisms	and	control	systems	that	are	required	to	ensure compliance	with	their	data	
protection	obligations	and	should	be	able	to	demonstrate	this	compliance	to	supervisory	authorities	
such	as	the	EDPS.

Art. 41(2) of Regulation (EC) 45/2001
Art. 46 of Regulation (EC) 45/2001
Art. 47 of Regulation (EC) 45/2001

Further reading 
•	
•	
•	
Data	Protection	Regulation:	Regulation	(EC)	No	45/2001	of	the	European	Parliament	and	of	the	Council	of	
18	December	2000	on	the	protection	of	individuals	with	regard	to	processing	of	personal	data	by	the	Com-
munity	institutions	and	bodies	and	on	the	free	movement	of	such	data	(OJ	2001	L 8,	p.	1). 	
•	
•	
•	
•	
•	
•	
All	the	EDPS	documents	listed	in	this	section	are	available	on	the	EDPS	website:	 www.edps.europa.eu

EDPS	Prior	checking	opinions
EDPS	Opinions	on	administrative	measures
EDPS	complaint	form
EDPS	policy	paper	on	consultations
EDPS	thematic	guidelines
EDPS	general	and	targeted	monitoring	and	reporting	exercises

	@EU_EDPS

QT3012768ENC
doi	10.2804/46507