Resolution (EU) 2022/1710 of the European Parliament of 4 May 2022 with observations forming an integral part of the decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2020, Section IX – European Data Protection Supervisor
Date: 2022-05-04
Institutions: European Parliament
Subjects: European Data Protection Supervisor, budgetary discharge, financial year, general budget (EU)








L_2022258EN.01014201.xml










5.10.2022   


EN


Official Journal of the European Union


L 258/142








            RESOLUTION (EU) 2022/1710 OF THE EUROPEAN PARLIAMENT
         
of 4 May 2022
         
with observations forming an integral part of the decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2020, Section IX – European Data Protection Supervisor


THE EUROPEAN PARLIAMENT,






—


having regard to its decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2020, Section IX – European Data Protection Supervisor,










—


having regard to Rule 100 of and Annex V to its Rules of Procedure,










—


having regard to the opinion of the Committee on Civil Liberties, Justice and Home Affairs,










—


having regard to the report of the Committee on Budgetary Control (A9-0086/2022),










A.


whereas in the context of the discharge procedure, the discharge authority wishes to stress the particular importance of further strengthening the democratic legitimacy of the Union institutions by improving transparency and accountability, and implementing the concept of performance-based budgeting and good governance of human resources;










B.


whereas data protection is a fundamental right, protected by European law and enshrined in Article 8 of the Charter of Fundamental Rights of the European Union;










C.


whereas Article 16 of the Treaty on the Functioning of the European Union provides that compliance with the rules relating to the protection of individuals, with regard to the processing of personal data concerning them, shall be subject to control by an independent authority;










D.


whereas Regulation (EU) 2018/1725 of the European Parliament and of the Council (1) provides for the establishment of an independent authority, the European Data Protection Supervisor (the ‘Supervisor’), responsible for protecting and guaranteeing the right to data protection and privacy, and tasked with ensuring that the institutions and bodies, offices and agencies of the Union embrace a strong data protection culture;










E.


whereas the Supervisor carries out its functions in close cooperation with fellow Data Protection Authorities (DPAs) as part of the European Data Protection Board (EDPB), and it serves the public interest while being guided by principles of impartiality, integrity, transparency and pragmatism;










F.


whereas the Supervisor shall delegate the powers of the Authorising Officer to the Director in accordance with the charter of tasks and responsibilities concerning the budget and administration of the Supervisor provided in accordance with Article 72(2) of Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council (2), while the function of the Accounting Officer of the Supervisor shall be performed by the Accounting Officer of the Commission in accordance with the Decision of the European Data Protection Supervisor of 1 March 2017;










G.


whereas the COVID-19 pandemic made it necessary for the Supervisor to review and adapt its internal functioning and work methods in order to continue to fulfil its mission;











1.


Notes with satisfaction that the Court of Auditors (the ‘Court’) identified no significant weaknesses in respect of the audited topics related to human resources and procurement for the European Data Protection Supervisor (the ‘Supervisor’);












2.


Emphasises the fact that on the basis of its audit work, the Court concluded that the payments as a whole for administrative expenditure of the institutions, including that of the Supervisor, were free from material error for the financial year 2020; welcomes the fact that no specific issue was detected by the Court on the regularity of the transactions;












3.


Is aware that Chapter 9 ‘Administration’ of the Annual Report of the Court is focused on expenditure on human resources, buildings, equipment, energy, communication and information technology and that the Court indicates that this spending is low-risk;






Budgetary and financial management







4.


Notes that in 2020, the Supervisor was allocated a budget of EUR 19 476 998, representing an increase of 16,3 % compared to the 2019 budget of EUR 16 638 572; understands that the overall increase was mainly due to the impact of the new tasks set out in Regulation (EU) 2018/1725 (also referred to as the ‘GDPR for EUIs’) and the new supervisory responsibilities in connection with enforcement and judicial cooperation agencies, such as, amongst others, the EPPO and Eurojust; observes that other elements that contributed to the increase were the consolidation of the European Data Protection Board (EDPB) Secretariat operated by the Supervisor, the Supervisor’s 2020-2024 strategy, which is linked to the new mandate, and the temporary allowances foreseen for the end of the mandate of the previous Supervisor;










5.


Notes that the COVID-19 pandemic has had a negative impact on budget implementation (73 % in 2020, compared to 91,97 % in 2019); observes that, in particular, this impact is visible on the mission and training budgets (execution of less than 17 %) and on the organisation of meetings, including experts’ reimbursement and catering (execution of less than 15 %); notes that the resulting savings amount to EUR 2 183 000, which represents 11 % of the overall budget consumption;










6.


Notes that, in addition, the COVID-19 pandemic had an indirect impact on other parts of the budget that cannot be quantified precisely, such as the salary budget lines, which was negatively impacted due to delays in recruitment planned for 2020, and the building budget line, which was impacted by delays in the full occupation of the building, which is still shared with the European Ombudsman;










7.


Observes that, as a consequence of the Supervisor’s staff increase in 2019, the budget lines dedicated to the salary of officials and members of staff on contracts increased by 22 %; understands that, because of the large share of the overall budget dedicated to costs related to human resources, the delay in recruitment procedures (also a consequence of the COVID-19 pandemic) had a negative impact on the execution of the budget as a whole;










8.


Notes that the Supervisor’s investment in its digital transformation at least partially compensated the low budget execution rate as the IT-related budget lines for the Supervisor and the EDPB exceeded the initial allocation (109 %); observes that budget appropriations have been transferred from missions, travels, translation and interpretation to the finance other staff costs and IT equipment and services;










9.


Notes that, out of 36 procurement procedures launched by the Supervisor in 2020, only 1 was an open procedure and the rest were negotiated procedures, including 5 procedures without prior publication of contract notice; acknowledges the procurement challenges faced by the Supervisor and that due to the small size of the institution, the Supervisor participates in joint procurement procedures, as they are more efficient from financial perspective, while at the same time has to apply the strictest data protection standards on the object of such procedures, which has probably also contributed to the low implementation of the budget in 2020;










10.


Welcomes the ongoing efforts of the Supervisor in becoming a paperless institution, including the continuation of paperless interviews in 2020, the intention to automate appraisal, probation and evaluation reports via the implementation of new modules in the human resources interface in 2021, and the implementation of paperless finance systems in 2020 with respect to the processing of payments, budget management and procurement;





Internal management, performance, internal control







11.


Expresses its condolences at the passing of the Supervisor, Giovanni Buttarelli, in August 2019; takes note that Wojciech Wiewiorowski took office in December 2019 for a term of 5 years; agrees that the fact that Mr Wiewiorowski had been working as the Assistant Supervisor, and thus possesses a good knowledge of the institution, contributed to mitigating the challenge of the transition;










12.


Welcomes the adoption of the new management tool ‘Bluebell’, developed by the ERCEA (European Research Council Executive Agency), which allows for better forecasting and monitoring of the actual execution of budget lines based on data uploaded by operational units, with the benefit of significantly reducing manual interventions and making data more reliable;










13.


Welcomes that in 2020 the working processes were adjusted as a result of the COVID-19 pandemic, and all paper signatures and procedures were digitalised, resulting in more efficient and rapid administrative processes; understands that the Supervisor was obliged to postpone the on-site audits as the management of sensitive data prevented them from being carried out remotely;










14.


Notes that physical meetings were replaced by online meetings, which are less costly and less time-consuming; observes that the replacement of physical meetings had a greater impact on EDPB meetings, which used to take place every month or every second month, with great travel and interpretation costs, and were replaced with virtual meetings every second week;










15.


Welcomes that, in June 2020, the Supervisor issued its 2020-2024 Strategy ‘Shaping a safer digital future: a new strategy for a new decade’ focused on the three pillars of foresight, action and solidarity, in order to address digital challenges for a safer, fairer and more sustainable future; observes that the Supervisor has designed eight clear Key Performance Indicators (KPIs) to monitor the implementation of the strategy; remarks that in 5 out of 8 KPIs the targets were either met or surpassed in 2020, in particular the number of cases dealt with at international level (42 cases compared to a target of 10) and the number of opinions or comments issued in response to consultations (5 opinions and 12 formal comments compared to a target of 10 cases); highlights that the KPIs mentioned illustrate the crucial role of the Supervisor in the Union response to the COVID-19 pandemic in respect of guaranteeing fundamental rights to data protection and privacy;










16.


Notes that to carry out the ex-ante controls of its transactions, for both operational and financial aspects, the Supervisor has integrated the updated checklists into the new electronic workflow system ‘Speedwell’, which is connected with the accounting system and facilitates the basic controls applied to payments and commitments;










17.


Notes that, due to an internal re-organisation at the end of 2019, the previous ex post verifier was deployed within the finance team and thus, in order to avoid the risk of self-review, could not carry out the ex post control; understands the challenge for a small institution to find a replacement with a thorough understanding of the financial legal and regulatory framework, despite having launched a call for expressions of interest; urges the Supervisor to explore and implement the most suitable alternative out of those already identified in its annual report;










18.


Notes that the Internal Audit Service (IAS) of the Commission carried out an audit of the Supervisor’s activities when supervising Europol, with the aim of assessing adequacy and effectiveness of the internal control system for the supervisory activities related to Europol; welcomes that the auditors recognised the ongoing efforts made by the Supervisor to improve the governance arrangements and internal control systems for the supervision of Europol; is aware that the final audit report was issued in September, that shortly after the Supervisor submitted an action plan to the IAS covering all the recommendations considered adequate by the IAS in order to mitigate the risks identified; points out that such risks were mainly related to weaknesses in the follow-up of the Supervisor’s recommendations and stemmed from the handling of sensitive non-classified and classified information via IT systems;





Human resources, staff well-being and gender equality







19.


Notes that in 2020 the Supervisor had a total of 113 members of staff, compared to 96 in 2019; highlights that twenty new positions were granted by the budgetary authorities in 2020 to cover the additional responsibilities set out in Regulation (EU) 2018/1725, new supervisory tasks in connection with enforcement and judicial cooperation agencies, and new responsibilities following the consolidation of the EDPB for which the Supervisor provides an independent Secretariat;










20.


Notes the very low occupation rate (86,90 %) of the establishment plan; understands that the Supervisor used the reserve list of 33 data protection experts resulting from the 2018 competition and also hired contract staff to fill specific needs or posts that were vacant on a temporary basis due to long absences; notes the challenges faced by the Union institutions in attracting experts in specific domains, due, inter alia, to limited competitiveness and attractiveness of salaries; stresses in particular the challenge for the Supervisor in recruiting highly specialised data protection staff through EPSO and understands the need to organise specialised competitions to build on the knowledge and experience acquired by contract staff; encourages the Supervisor to continue with good practices in recruitment procedures validated by other institutions, in particular remote interviews and online tests;










21.


Notes the favourable change in the geographical distribution of the staff as a whole, considering the size of the institution, with 20 Member States represented in 2020; welcomes the introduction of 3 nationalities compared to 2019, and notes a reduction in the disproportionate share of posts occupied by Belgian nationals (from 27 % to 23 %); notes that there is no change in the geographical distribution of the middle and senior management posts; understands that the need for specialised profiles to fulfil the Supervisor mandate can limit selection boards when considering the geographical aspect and encourages the Supervisor to consider further steps to provide a more balanced representation;










22.


Calls on the Supervisor to continue paying attention to issues related to gender balance, equal opportunities and geographical distribution, in particular during selection procedures; suggests that the Supervisor consider mandatory training on unconscious gender bias and equal opportunity policy implementation for managers and members of selection boards;










23.


Notes that in both 2019 and 2020 the gender balance among the overall staff remained constant, with approximately 58 % being made up of women and 42 % being made up of men; observes that, at middle management level, the figures remain the same as 2019 with 75 % women and 25 % men; notes that, as was the case in 2019, both senior management posts are occupied by men; welcomes that the 2020-2024 strategy includes a commitment to mainstream gender perspective, in support of the Equal Opportunity (‘EO’) Strategy endorsed in 2017;










24.


Notes that the Supervisor offers several working arrangements and that all staff benefit from flexitime, excluding recipients of management allowance; observes that prior to the COVID-19 pandemic, women made up the majority of users of flexible working arrangements, namely teleworking (61,6 % in 2019 and 67,5 % in 2020), part-time working regime (89 % in 2019 and 87,5 % in 2020), parental leave (87 % in 2019 and 90 % in 2020) and time credits (100 % both in 2019 and 2020); stresses the disproportionate gender imbalance across the users and thus, asks the Supervisor to engage in more intense communication on the viability and benefits of these arrangements, i.e. mandatory information sessions for newcomers, and to ensure that making use of the available working arrangements will not penalise in any way the career progress of the employees;










25.


Notes that, as a result of the COVID-19 pandemic, the Supervisor adopted, on 12 March 2020, teleworking as the general regime and on 19 March 2020 its decision to extend the teleworking regime until 13 April 2020; underlines that, teleworking has been used intensively as a flexibility tool to guarantee business continuity and to facilitate members of staff in handling the difficult conditions imposed by the COVID-19 pandemic and notes that, accordingly, no posts were excluded; observes that the Supervisor issued in 2020 a ‘Guidance on Telework’; is aware that, as per Autumn 2020, the teleworking regime is only partial and that access to the institution’s premises has been gradually increased in line with the sanitary situation;










26.


Remarks that a ‘Director Decision of teleworking from abroad’ allowed teleworking from abroad during the period from 15 June to 15 September 2020, provided that days of teleworking were combined with an equal amount of annual leave; believes that such an exceptional measure was fully justified by the need to better accommodate the private and personal lives of members of staff during the lockdown period;










27.


Notes that IT equipment for teleworking was provided to all members of staff under the terms and conditions of the Service Level Agreement (SLA) in force with Parliament at no additional cost; observes that members of staff were given the possibility of reimbursement for a bigger screen and an ergonomic chair (up to EUR 150 and EUR 200 respectively) from the Joint Sickness Insurance Scheme (JSIS);










28.


Welcomes that the Supervisor adopted guidelines in March 2020 to recognise, prevent and manage burnout and that training focused on managing stress and building resilience with a particular focus on prevention of burnout on the agenda for 2021; encourages the management team to address immediately any symptoms of possible burnout and to analyse the causes;










29.


Notes that no case of harassment was reported in 2020, and appreciates that the Supervisor signed, in December 2020, a revision of its anti-harassment decision in order to clarify the rights and obligations of each party; welcomes that the role of the confidential counsellor was further developed and an appointment procedure was established; regrets that no training courses on harassment or whistleblowing were organised in 2020 and calls on the Supervisor to make full use of the digital channels to deliver and update such training periodically for all members of staff (apart from newcomers); appreciates that the Supervisor started to offer a mandatory presentation on harassment to newcomers in 2021 during the welcome days;










30.


Welcomes the establishment of the well-being coordinator, who will be the contact point for all staff questions in this area and will collaborate with other key actors to ensure that well-being oriented activities are organised and;










31.


Notes that 16 trainees were recruited in total in 2020 over two sessions, March and July 2020; welcomes the fact that all of the trainees were paid by the Supervisor, although with the intermediation of DG EAC of the Commission; observes that all the trainees received a laptop and token to telework; welcomes the fact that the Supervisor allowed its trainees to work from abroad upon request;





Ethical framework and transparency







32.


Notes that the Supervisor’s Ethics Framework was updated in 2019, requiring all newcomers to follow a mandatory presentation on ethics during their induction training and, furthermore, that a survey on staff awareness is envisaged for 2021; welcomes the appointment of the new Ethics Officer in May 2021, currently tasked with updating training and organising presentations of the ethics framework to staff and setting up a survey about staff awareness; welcomes that the Supervisor has a dedicated space on the intranet informing members of staff about its Ethics Framework and raising awareness about it, including all relevant documents and procedures;










33.


Recalls that the code of conduct for members of staff was reviewed in December 2019 in order to adapt it to the changes in the institution and to the new legal framework, in particular to incorporate Regulation (EU) 2018/1725, as well as to include members of staff of the EDPB Secretariat; notes that the specific code of conduct for the Supervisors was also revised and adopted in December 2019 aiming to integrate ethical insights into their daily work; notes that, following Parliament’s call, the Supervisor has decided to start the drafting of a code of conduct for senior management posts;










34.


Observes that the Supervisor does not currently use the interinstitutional Transparency Register but publishes the agenda and interventions of the Supervisor on its website, including meetings with interest representatives, to ensure accountability towards citizens; encourages the Supervisor to explore ways to link its own register to the Transparency Register;





Digitalisation, cybersecurity, data protection







35.


Notes with appreciation that the Supervisor places importance on analysing the possibilities, risks and challenges that innovative technologies and other initiatives may have on data protection and individuals’ personal data with a view to shaping a safer digital future for the Union, as embedded in the Supervisor Strategy 2020-2024;










36.


Acknowledges the role of the Supervisor in the global debate on digital ethics in particular having regard to the development of Artificial Intelligence and Facial Recognition Technology; highlights that the Supervisor co-chairs the Working Group on Ethics and Data Protection in Artificial Intelligence of the Global Privacy Assembly, the international meeting of the data protection and privacy authorities on a global level, on the issue of artificial intelligence and digital ethics;










37.


Is aware that the main IT infrastructure, back-office tools and services used by the Supervisor are provided by the Commission or Parliament in accordance with the SLA on the use of IT services; welcomes the initiative to start building up the Supervisor’s IT capability by hiring an IT Support Agent to provide, among other tasks, general IT support, act as a contact and liaison point for all IT applications in use at the institution, assess the current and future needs in the area of IT and propose and implement solutions; Welcomes that in 2020 the Supervisor decided to launch the ‘IT Gap Analysis’ to analyse the need to support its tasks in terms of IT support, map the existing tools and systems, and then identify possible gaps;










38.


Remarks that in December 2020, the Supervisor signed an SLA with CERT-EU (the Computer Emergency Response Team for the Union Institutions) for the provision of a large range of cybersecurity services (awareness training activities, cybersecurity exercises, notification of cyber threats and vulnerabilities that potentially affect the Supervisor, and ad-hoc support in the handling of cybersecurity incidents); notes that, as a follow-up to the completion of an Internal Audit, the Supervisor planned the implementation of the recommendations related to cybersecurity, such as integrating cybersecurity risks in a new and improved Risk Management Framework and a new process to regularly assess the cybersecurity level of its Service Providers;










39.


Notes that, during 2020, the Supervisor continued the transition process towards the data protection framework set out in Regulation (EU) 2018/1725 in parallel with ensuring its business continuity during the COVID-19 pandemic; welcomes that the Supervisor appointed a full-time Data Protection Officer in September 2020 to strengthen its capacity to scrutinise personal data processing activities and to implement safeguards and mitigate risks to rights and freedoms of data subjects;










40.


Asks the EDPS to map the current usage of open-source technology in the Union institutions and assess the added value of prioritising the development of open-source tools in terms of data protection and privacy;





Buildings and security







41.


Recalls that the Supervisor’s staff increase called for an agreement with Parliament in order to acquire additional office space and to occupy the whole building which was shared, at the time, with the European Ombudsman; recalls that the budget lines dedicated to buildings, furniture and equipment were therefore increased to cover the extra costs related to extra rent and charges; notes that the delay in the foreseen expansion led to a low implementation of such budget lines;










42.


Encourages the Supervisor to take into consideration within its building strategy the needs of people with reduced mobility or other disabilities, adopting a broader definition of reasonable accommodation, envisaging effective solutions to facilitate access of people with disabilities to IT tools and platforms, to align to the Union institutions’ approach in terms of medical care and coverage;





Environment and sustainability







43.


Welcomes the many actions adopted by the Supervisor to reduce its environmental footprint; notes that, in 2020, the Supervisor continued its path towards becoming a paperless institution, by insistently endorsing the full electronic management of invoices and payments and the electronic signature of documents;










44.


Welcomes that the Supervisor incentivises the use of public transport, through the reimbursement of 50 % of public transport fees, and the use of bicycles, by providing an adequate number of bike racks in its garage facilities;










45.


Encourages the Supervisor to undertake tangible actions towards sustainable development, and to adhere to the Union Eco-Management and Audit Scheme (EMAS) developed by the Commission to enable organisations to evaluate, report, and improve their environmental performance;










46.


Encourages the Supervisor to access the interinstitutional Green Public Procurement (GPP) Helpdesk managed by Parliament since 2017, which focuses on sustainable development, environmental issues and social aspects of public procurement;





Communication and multilingualism







47.


Notes the publication of the Supervisor Strategy 2020-2024, together with a new corporate brochure and video; observes that the Supervisor has also developed a consistent and targeted communication strategy with various stakeholders to address the newest developments of the COVID-19 pandemic and data protection issues arising therefrom;










48.


Welcomes the interest of the Supervisor in social media and other platforms to ensure greater dissemination of information; underlines in particular the public pilot projects Mastodon (alternative to Twitter/Instagram) and PeerTube (alternative to YouTube) and understands that the aim is to find a consensus for a common Union platform with other Union institutions while exploring other opportunities, such as the Union hosting of the open source social media; believes providing information to citizens on non-proprietary platforms contributes to maintaining independence and transparency of public institutions;










49.


Encourages the Supervisor to undertake communication initiatives aiming to increase its role and the understanding of its mission among a wider public; notes that on 21 January 2020, the Privacy Camp hosted the EDPS Civil Society Summit to discuss the state of data protection and privacy in the Union with civil society organisations; observes that the Supervisor hosted an online workshop in October 2020 on the theme ‘Data Protection in International Organisations in Times of Crisis’;










50.


Remarks that the total costs related to translation in 2020 amounted to EUR 1 250 827,45, out of which EUR 342 255,65 related to the Supervisor and EUR 908 571,80 related to the EDPB; invites the Supervisor to further explore the use of neural translation through specific engines as well as other options together with the Commission, the Translation Centre and the World Intellectual Property Organisation (WIPO);





Interinstitutional cooperation







51.


Notes with appreciation that also in 2020, and despite the COVID-19 pandemic, the Supervisor was able to deliver several training sessions to many Union institutions giving guidance on how to protect individuals’ personal data;










52.


Appreciates that the Supervisor produced a guidance on Data Protection Impact Assessment (DPIA); highlights that the Supervisor has monitored how Union institutions have been using DPIA since the entry into force of Regulation (EU) 2018/1725 through a survey in February 2020, and a report was published as a follow-up in July 2020;










53.


Agrees that because data flows across borders, there is a need to consider data protection in a global context; believes that the Supervisor’s active participation in a number of international fora is instrumental to the shaping and sharing of good practices, setting and developing guidance, and creating consistent and cohesive procedures based on common understanding of data protection rules; notes that the Supervisor is an active member of the Global Privacy Assembly (GPA) (previously known as the International Conference of Data Protection and Privacy Commissioners, ICDPPC);










54.


Calls on the Supervisor to ensure that the network of the Data Protector Officers (DPOs) remains active and dynamic, meeting twice a year, in such a way to guarantee consistency and alignment in dealing with data protection matters across Union institutions;










55.


Is aware that the Supervisor is a full member of the EDPB, the independent body established under the General Data Protection Regulation (GDPR) that promotes cooperation between national Data Protection Authorities (DPAs) to ensure the consistent application of data protection rules across the Union; understands that a Memorandum of Understanding determines the terms of cooperation between the EDPB and the Supervisor, with the latter being both member and provider of an independent Secretariat which offers administrative and logistic support, performs analytical work and contributes to the EDPB’s tasks;










56.


Remarks in particular that the EDPB Secretariat’s legal team drafted over 60 % of the guidelines, opinions, recommendations and statements adopted by EDPB in 2020, as follows: 13 guidelines, 2 recommendations, 32 opinions, its first dispute resolution binding decision, and legal advices; underlines that that the Supervisor attended all 27 EDPB plenary meetings which took place in 2020; points out that much of the work carried out by the EDPB takes place within expert subgroups, each relating to a specific area connected to data protection, and that the Supervisor participates in all EDPB expert subgroups and acts in many files as co-rapporteur or lead rapporteur;










57.


Observes that the Supervisor, together with the EDPB Secretariat and other EDPB members, adopted on 15 December 2020 the terms of reference of the SPE, a Support Pool of Experts established with the aim of assisting the carrying out of investigations and enforcement activities of significant common interest and enhancing cooperation and solidarity between all EDPB members;










58.


Welcomes that the Supervisor also issued several Opinions in 2020 as part of its duty to advise the Commission, Parliament and the Council on legislation and policy initiatives which have an impact on personal data protection;










59.


Notes that the withdrawal of the United Kingdom from the Union affected transfers of personal data from organisations subject to the GDPR to organisations in the UK and thus, welcomes the guidance provided by the Supervisor to stakeholders, which takes into account the legal effects of such transfers on Union data protection; notes in particular that the Supervisor expressed a number of concerns in its Opinion 14/2021, which were taken into account by the Commission in the UK GDPR and LED adequacy decisions;










60.


Appreciates the cooperation between the Supervisor and the European Public Prosecutor Office (EPPO) aimed at integrating the data protection rules into the EPPO procedures and IT systems, which is extremely challenging in light of the multi-layered EPPO structure and the interplay between the EPPO Regulation and the national provisions that requires coordination with the national DPAs;










61.


Notes furthermore that at the end of 2019, a new supervisory framework for the processing of personal data at Eurojust came into force, under which the EDPS is responsible for monitoring Eurojust’s compliance with the applicable Union rules on data protection; welcomes in that regard the close cooperation between the EDPS and Eurojust throughout the year 2020;










62.


Notes that, in 2020, the Supervisor has concluded or amended both interinstitutional service level agreements and administrative agreements with PMO, DG HR, DG EAC, DG BUDG and DG CERT-EU of the Commission, as well as a new administrative agreement with three directorate generals of Parliament (DG INLO, DG SAFE and DG PERS) concerning buildings, logistics and security services;










63.


Underlines the relevance of the Court of Justice judgement in the Case C-311/18 (known as the ‘Schrems II’ ruling) invalidating the EU-US personal data mechanism ‘Privacy Shield’; acknowledges the role of the Supervisor in monitoring the compliance of the transfers carried out in the context of contractual relationships with organisations based in the US;










64.


Expresses its concern at the result of the Supervisor inquiry into Europol’s processing of large dataset collected by national law enforcement authorities in the context of criminal investigations; understands that the procedures the Europol had in force did not provide adequate reassurance regarding compliance with the Europol Regulation in terms of categories of data subjects targeted by its processing, which represents the grounds on which important criminal intelligence is produced; calls on the Supervisor to support Europol in setting and implementing an action plan in order to address the pitfall detected, without weakening Europol contributions to the anti-fraud infrastructure of which it is a relevant component;










65.


Stresses that, on 2 July 2020, the Supervisor issued a Public Paper detailing the findings and recommendations of the Supervisor investigation into the use of Microsoft products and services by Union institutions; points out that these findings endorse public administrations’ efforts to keep control over how and why personal data is processed and ensure an adequate level of data protection when contracting ICT services, as outlined in the Supervisor’s strategic objective on ‘digital sovereignty’;





COVID-19 pandemic







66.


Underlines the crucial role of the Supervisor in protecting personal data and privacy, two fundamental rights in the Union, in the context of the COVID-19 pandemic, particularly the relevance and influence of its assessment of compliance with data protection of the numerous contact tracing and warning apps widespread during the pandemic; acknowledges the subsequent additional workload that has faced the Supervisor in addition to its regular tasks and appreciates that the Supervisor not only ensured business continuity but also increased its productivity thanks to, inter alia, the digitalisation of workflows; welcomes that the Supervisor established a special COVID-19 Task Force, created to deal with all these requests, the supervision and advice as regards those measures put in place to fight the pandemic (contact-tracing apps, temperature checks, vaccination); points out that, in March 2020, in response to the Commission’s consultation on the use of telecommunications data for the monitoring of the spread of the COVID-19 pandemic, the Supervisor suggested to focus on the minimisation of the collection and retention of personal data, data anonymisation, data security and data access, adequacy of data retention periods, and a decentralised approach to data storage and processing;










67.


Stresses that the EDPB has highlighted the fundamental importance of ensuring that every measure taken in the extraordinary pandemic-related circumstances is necessary, limited in time, of minimal extent and subject to periodic and genuine review as well as to scientific evaluation; calls on the Supervisor to continuously assess the situation, in order to address or mitigate the privacy risks associated with the development and use of the contact tracing apps;










68.


Notes that at the start of 2020 the Supervisor relied on the Business Continuity Plan (BCP) of which some provisions were used and adjusted in the initial phase of the COVID-19 pandemic; remarks that on 10 March 2020 the contingency plan for the administrative preparedness for the pandemic was adopted, and more specific measures were taken to tackle the upcoming pandemic;










69.


Notes that the Supervisor was the first Union institution to adopt teleworking as general regime for all members staff as per 12 March 2020 via the adaptation of its BCP and highlights that the institution has not had any cases of COVID-19 infection in the workplace; welcomes that the emergency measures adopted, in particular the generalisation of teleworking (i.e. no threshold within the units nor differentiation between structural and occasional), will be the object of discussion with the Staff Committee and incorporated into the new teleworking decision that is being negotiated and that will modify the Decision taken on this subject on 19 March 2019;










70.


Encourages the Supervisor to fully integrate in the internal management strategy the lessons learned from the COVID-19 pandemic, in terms of business continuity and crisis management approaches, IT responsiveness, resilience of the organisation, duty of care towards its staff, effectiveness of internal communication and flexibility of working processes.







          
      



(1)  Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

(2)  Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012 (OJ L 193, 30.7.2018, p. 1).