Resolution (EU) 2023/1838 of the European Parliament of 10 May 2023 with observations forming an integral part of the decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2021, Section IX – European Data Protection Supervisor
Date: 2023-05-10
Institutions: European Parliament
Subjects: European Data Protection Supervisor, budgetary discharge, financial year, general budget (EU)








L_2023242EN.01015801.xml










29.9.2023   


EN


Official Journal of the European Union


L 242/158








            RESOLUTION (EU) 2023/1838 OF THE EUROPEAN PARLIAMENT
         
of 10 May 2023
         
with observations forming an integral part of the decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2021, Section IX – European Data Protection Supervisor


THE EUROPEAN PARLIAMENT,







—


having regard to its decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2021, Section IX – European Data Protection Supervisor,










—


having regard to Rule 100 of and Annex V to its Rules of Procedure,










—


having regard to the opinion of the Committee on Civil Liberties, Justice and Home Affairs,










—


having regard to the report of the Committee on Budgetary Control (A9-0070/2023),












A.


whereas in the context of the discharge procedure, the discharge authority wishes to stress the particular importance of further strengthening the democratic legitimacy of the Union institutions by improving transparency and accountability, and implementing the concept of performance-based budgeting and good governance of human resources;












B.


whereas data protection is a fundamental right, protected by European law and enshrined in Article 8 of the Charter of Fundamental Rights of the European Union;












C.


whereas Article 16 of the Treaty on the Functioning of the European Union provides that compliance with the rules relating to the protection of individuals, with regard to the processing of personal data concerning them, shall be subject to control by an independent authority;












D.


whereas Regulation (EU) 2018/1725 of the European Parliament and of the Council (1) provides for the establishment of an independent authority, the European Data Protection Supervisor (the ‘Supervisor’), responsible for protecting and guaranteeing the right to data protection and privacy, and tasked with ensuring that the institutions and bodies, offices and agencies of the Union embrace a strong data protection culture;












E.


whereas the Supervisor carries out its functions in close cooperation with fellow Data Protection Authorities (DPAs) as part of the European Data Protection Board (EDPB), and it serves the public interest while being guided by principles of impartiality, integrity, transparency and pragmatism;












F.


whereas the Supervisor shall delegate the powers of the Authorising Officer to the Director in accordance with the charter of tasks and responsibilities concerning the budget and administration of the Supervisor provided in accordance with Article 72(2) of Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council (2), while the function of the Accounting Officer of the Supervisor shall be performed by the Accounting Officer of the Commission in accordance with the Decision of the European Data Protection Supervisor of 1 March 2017;















1.


Notes that the budget of the European Data Protection Supervisor (the ‘Supervisor’) falls under MFF heading 7, ‘European public administration’, which amounted to a total of EUR 10,7 billion in 2021; notes that the Supervisor is a relatively small institution the budget of which represents approximately only 0,18 % of the total administrative budget;












2.


Notes that the European Court of Auditors (the ‘Court’) in their Annual Report for the financial year 2021 increased their sample of transactions under ‘Administration’ from 48 in 2020 to 60 in 2021;












3.


Notes that the Court mentions that their work over many years indicates that overall this spending is low-risk; however, notes that the annual Report on the implementation of the Union budget for the 2021 financial year does not provide any relevant information on the Supervisor and invites the Court to include in the next annual reports comprehensive data regarding the completion of all requirements necessary for a consistent discharge procedure;












4.


Notes with satisfaction that in their Annual Report for the financial year 2021, the Court notes that they did not identify any specific issues concerning the Supervisor;





Budgetary and financial management









5.


Notes that the budget for the Supervisor also covers the work of the independent Secretariat of the European Data Protection Board (the ‘Board’), where the Supervisor is a member and provides staff to the Secretariat;












6.


Welcomes the 2021 annual report published by the Supervisor; notes that in 2021 the Supervisor met or surpassed the targets set out in eight out of nine key performance indicators (KPIs);












7.


Notes that the budget for the Supervisor was EUR 19 463 193 for 2021 representing a marginal decrease of 0,07 % compared to 2020; which should however also be assessed against the background that the budget increased by 16,3 % from 2019 to 2020, which coincides with the beginning of the COVID-19 pandemic and the related increase in workload;












8.


Notes furthermore that the budget implementation rate was 86 % for the year 2021, which represents a significant increase from 2020 where the implementation rate was 73 %; acknowledges that also for 2021 the budget implementation was heavily affected by the COVID-19 pandemic, which first and foremost severely limited physical events, conferences and missions;












9.


Notes that the execution rate in 2021 was 89,60 % and the average payment time was of 19,98 days; encourages the Supervisor to reduce the delay in payments with the use of electronic solutions, which contribute to making public authorities more transparent and sustainable;












10.


Welcomes that the Supervisor, during 2021, continued to implement the approach to reach a higher degree of administrative efficiency making use of service level agreements and participate in large inter-institutional framework contracts;





Internal management, performance and internal control









11.


Acknowledges that 2021 was also a challenging year, not least due to the COVID-19 pandemic, which created the immediate need to safeguard staff wellbeing and at the same time created new tasks, including the setting up the EU Digital COVID Certificate and the monitoring of Passenger Locator Forms, contact tracing apps, and other technologies used to fight against the virus, and ensuring that they were fully in line with the Union personal data protection legislation;












12.


Welcomes that the Supervisor immediately created an internal COVID-19 task force to actively monitor and assess the Union’s responses to the pandemic, which raised questions and concerns about the protection of personal data and privacy rights of individuals; furthermore welcomes that the Supervisor launched a competition to employ more specialised experts on data protection and adapted the internal organisation to reflect the increased workload on data protection;












13.


Welcomes that the Supervisor, in its answers to last year’s discharge resolution, mentions that it has decided to reinforce ex-ante controls through appropriate checklists and has decided to recruit one full-time staff member for the function of Internal Control Coordinator in order to improve internal procedures and make the organisation more efficient from the first quarter of 2023;












14.


Welcomes that the Supervisor has engaged in a Business Continuity and Crisis Management review exercise with relevant internal and external stakeholders following an internal assessment of the lessons learnt from the COVID-19 pandemic as also encouraged by the European Parliament in the 2020 discharge resolution; understands that the process is still ongoing and expects to benefit from the lessons learnt and possible measures taken as part of the 2022 discharge procedure;





Human resources, equality and staff well-being









15.


Notes that, at the end of 2021, the Supervisor had 132 members of staff, which represents a small increase from the end of 2020 where there were 124 staff members and a significant increase from the end of 2019, where there were 107 staff members; notes with concern that the number of contract agents increased from 37 at the end of 2020 to 49 at the end of 2021, whereas the number of officials decreased from 72 to 68 during the same period; encourages the Supervisor to provide permanent contracts to its employees to guarantee business continuity and work security; underlines that the Supervisor is facing challenges in attracting specialists with the necessary expertise in specific domains and encourages the Supervisor to explore ways of increasing the visibility of its vacancies;












16.


Takes note that the Supervisor had to deal with four times more legislative consultations compared to 2019, and notes that there is only one new member of staff to absorb this increase in workload; notes further that data sets in the Union institutions, which the Supervisor is responsible for monitoring, are also increasing drastically;












17.


Notes with satisfaction that, at the end of 2021, the number of Union nationalities represented among the staff increased further to 21, compared to 20 at the end of 2020; notes further that the representation of more nationalities has helped to develop a better geographical balance in the institution; calls on the Supervisor to also continue promoting equal opportunities and geographical balance for the middle and senior management posts;












18.


Notes that while the two senior management posts are occupied by men, women account for 75 % (3 out of 4) of middle manager posts; notes that among the categories from GFII to GFIV, 38 out of 48 persons equivalent to almost 80 % were women; further notes that women account for 63 % of the total workforce in 2021, up from 58 % in 2020;












19.


Welcomes that the Supervisor, in its answers to last year’s discharge resolution, mentions that the HR staff of the Supervisor regularly follow the ‘Unconscious Bias in Selection and Recruitment’ training in order to ensure a good implementation of the Equal Opportunities Strategy;












20.


Notes that the occupation rate at the end of 2021 was 88 %, which is rather low; understands at the same time that some selection procedures were ongoing at the end of 2021, while some posts were kept open in anticipation of the data protection laureate list being published at the end of the first semester 2022; further notes that no senior or middle management posts were vacant during 2021;












21.


Welcomes that the Supervisor focussed on ensuring the mental well-being of both Supervisor and Board staff during the COVID-19 pandemic, including, inter alia, by providing both individual and team coaching;












22.


Welcomes that the Supervisor has developed the system for flexible working arrangements, including through the flexitime regime that allows staff to decide on a daily basis when to start and finish their work between 07:00 and 20:30; further welcomes that the Supervisor has also created a system whereby staff may accumulate overtime, which can be compensated;












23.


Notes that the current rules allow staff members to telework up to 3 days per week and in agreement with the line manager, some staff members may be allowed to telework more than 60 %; welcomes that the teleworking rules allow staff to work outside the place of employment a maximum of 15 days per year with the possibility of adding another 15 days upon the approval of the appointing authority; encourages the Supervisor to allow teleworking whenever possible if members of staff request it;












24.


Takes note that the Supervisor is currently setting up a working group to develop a strategic approach to ensure that the workload is equally shared and distributed among staff, based on the results of Staff Satisfaction surveys; welcomes that no cases of burnout were reported during 2021; further welcomes that the number of people on sick leave and number of days of absence because of sick leave fell in 2021 compared to 2020;












25.


Welcomes that, in 2021, no cases of psychological or sexual harassment were reported and that the Supervisor ensures that they will remain vigilant to ensure that no such cases will occur in the future;












26.


Welcomes that the Supervisor and the Board recruits a relatively large number of trainees for the size of its institution; further welcomes that all 8 trainees recruited in March 2021 and the 9 trainees recruited in October 2021 received remuneration;





Ethical framework and transparency









27.


Notes that the Supervisor’s Ethical Framework, which was updated in 2019, among other things, includes mandatory introduction training for newcomers on harassment, preventing conflicts of interest and other ethical areas; notes that 25 persons received training on these areas during 2021 and that all staff joining the institution have to sign a Declaration of confidentiality and they must declare an absence of conflicts of interest; further welcomes that a session on whistleblowing will be added during 2022;












28.


Requests the Supervisor to provide information on the code of conduct for senior management posts that it decided to start drafting;












29.


Welcomes that there were no OLAF investigations involving members of staff from the Supervisor or the Board during 2021; notes that there was one European Ombudsman case involving the Supervisor in 2021, which was closed with the conclusion that it had been settled and thus no recommendations were addressed to the Supervisor; further welcomes that there was no cases of conflicts of interest or whistleblowing in 2021;












30.


Notes that, currently, the Supervisor does not use the Interinstitutional Transparency Register but that the Agenda, recorded meetings and the interventions of the Supervisor, including meetings with interest representatives are published on the Supervisor’s website; calls on the Supervisor to finalise its internal analysis of the available options and to join the Interinstitutional Agreement on a mandatory transparency register;












31.


Welcomes the follow-up done by the Supervisor on a citizen's data access request; highlights, however, that the Supervisor issued a decision in the case before all the facts had been checked and established, although the complaint procedure had been underway for over two years and was still ongoing at the end of 2022; calls on the Supervisor to review its rules of procedure for ensuring an efficient and timely review of complaints by citizens, taking into account all relevant information (3);












32.


Notes that there was no cases of staff leaving the institution in order to join the private sector in 2021 and no cases involving cooling-off periods; welcomes that there were no cases of former MEPs, Commissioners or high-level officials (from AD14) receiving money from the budget as advisors or others;












33.


Calls for an end to the use of external companies that, according to Yale University’s ranking (4), continue to operate in Russia;





Digitalisation, cybersecurity and data protection









34.


Notes that budget commitments for the year 2021 were 20 % higher than in 2020 with regard to IT projects and equipment, including videoconferencing equipment, which has allowed hybrid meetings to be carried out in the organisation;












35.


Acknowledges that many central IT functions including in the area of cybersecurity are provided by the European Parliament as the Corporate Service Provider and CERT-EU (the Computer Emergency Response Team); asks the Supervisor to keep an overview of the personal data exchanged among the Union institutions for the purpose of ensuring cybersecurity; welcomes that the Supervisor, nevertheless, is taking steps in order to improve its digital effectiveness and security, including through providing regular cybersecurity raising awareness training for all of its staff, including an introduction training for newcomers;












36.


Appreciates that the Supervisor continues to pilot and showcase the use of open source tools in order to prevent vendor lock-in, retain control over technical systems, provide stronger safeguards for user’s privacy and data protection, and increase security and transparency for the public, as an alternative to proprietary tools; encourages the Supervisor to communicate such considerations to other Union institutions;












37.


Welcomes the new TechSonar initiative aiming to monitor emerging technology trends to better understand their potential impact on individuals and to ensure a sustainable digital future where the protection of personal data is guaranteed;












38.


Recalls that the Supervisor’s workload is likely to further increase due to the growing digitalisation trend in the Union, the revision of agencies’ mandates and the initiatives presented by the Commission especially in the field of justice and home affairs, namely the opinions on Europol’s mandate, DSA/DMA, the NIS 2.0 Directive and the joint opinions on the Artificial Intelligence Act and EU Digital COVID Certificate appreciates the contribution of the Supervisor to the legislative work in cooperation with the Board; stresses the importance to adapt human and financial resources to the increasing workload and to increase the Supervisor's budget accordingly;





Buildings









39.


Notes that following the departure of the European Ombudsman at the end of October 2021, the Supervisor and the Board became the only tenants on Rue Montoyer 30 in Brussels, which is rented to them by the European Parliament; notes that three floors of the building were subsequently refurbished and over 100 Supervisor and Board staff moved offices; further notes, that the refurbishment involved modernisation and adapting the building to new working conditions after the COVID-19 pandemic, including the addition of portable teleconferencing systems;












40.


Notes that, in the 2020 discharge report, the European Parliament encouraged the Supervisor to take into consideration in its building strategy the needs of people with reduced mobility or other disabilities; notes that in the replies the Supervisor refers to the Administrative Agreement it has with the European Parliament; nevertheless encourages the Supervisor to give special attention to this area in its building strategy;





Environment and sustainability









41.


Welcomes that the Supervisor has continued its work towards becoming a paperless institution, including by ensuring that the payment cycle for invoices is managed electronically, that selection and appraisal processes within HR are managed in a paperless way;












42.


Welcomes that the Supervisor continues to encourage the use of public transport by reimbursing 50 % of monthly/annual fees for public transport and continues to allocate sufficient space in its garage facilities for staff to park their bikes;












43.


Notes that the Supervisor stated that it will inquire about the plans regarding the installation of solar panels on the building rented by the European Parliament and encourages the Supervisor to advocate for the installation of such panels;





Interinstitutional cooperation









44.


Welcomes the cooperation between the Supervisor, in its supervisory role, and the other Union institutions, bodies and agencies, especially the EPPO as a newly established body;












45.


Welcomes that the Supervisor is closely monitoring the evaluation of the digital euro project by the European Central Bank concerning issues like the right to privacy and the protection of personal data; recognises the Supervisor’s need for additional resources in order to supervise this project;












46.


Welcomes the initiative proposed by the Supervisor to establish a support pool of experts comprised of both the Board and external experts to accompany the national Data Protection Authorities in their work on investigations and enforcement activities of significant common interest;












47.


Notes that the Supervisor had a dialogue with Europol concerning its processing of large-scale datasets in order to ensure that data is processed in a compliant manner; notes that the Supervisor highlighted several times since September 2020 its serious concern relating to data minimisation and retention of datasets lacking a data subject classification; encourages the Supervisor to continue the dialogue in order to address these problems;












48.


Notes that the Supervisor has not concluded any new inter-institutional agreements during 2021 but has revised an Administrative Agreement with the European Parliament with a view to creating a permanent Supervisor’s office at the Parliament’s premises in Strasbourg, which will also allow for a closer link with the Council of Europe and will facilitate regular inspections of eu-LISA databases, which processes personal data on a large scale;












49.


Acknowledges the two investigations concerning transfers of personal data to non-EU/EEA countries launched in the framework of the Supervisor’s Schrems II Strategy;





Communication









50.


Notes with satisfaction that, in 2021, the Supervisor organised several events, which also served to increase its role and the understanding of its mission among the wider public, including the Data Protection Day, Europe Day, the Supervisor’s trainees’ conference and podcasts, the Supervisors Civil Society Summit, the annual Computers, the Privacy and Data Protection Conference, the Global Privacy Assembly and the Future of Data Protection conference;












51.


Appreciates that the Supervisor prepared a public pilot phase of two social media platforms, EU Voice and EU Video, that were launched in 2022 to promote the use of decentralised, free and open source technologies as an alternative to social networks; understands that these pilot initiatives contribute to the Union’s strategy for data and digital sovereignty that aims to foster the Union’s independence in the digital world;












52.


Welcomes the Supervisor’s efforts to monitor, and explain to the wider public, emerging developments in technology and their potential impact on data protection and privacy, through the TechDispatch and TechSonar reports; recognises the need for additional technical qualified employees to ensure the proper follow-up of these tasks; notes with satisfaction that the TechDispatch initiative has received the Global Privacy and Data Protection 2021 Award in the category of ‘Education and Public Awareness’, on the occasion of the 43rd Global Privacy Assembly 2021; encourages the Supervisor to increase its capacities in the field of technology monitoring and launch information campaigns on its findings and recommendations.







(1)  Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

(2)  Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012 (OJ L 193, 30.7.2018, p. 1).

(3)  This relates to the case of Mr van der Linde, a Dutch citizen, which has been reported in media. If the entire procedure could have been handled more swiftly, the citizen may have been satisfied with the outcome of the complaint filed with the EDPS (the complaint was sent to the EDPS in the second half of 2020).

(4)  https://som.yale.edu/story/2022/over-1000-companies-have-curtailed-operations-russia-some-remain