REPORT on discharge in respect of the implementation of the general budget of the European Union for the financial year 2019, Section IX – European Data Protection Supervisor

2. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION

with observations forming an integral part of the decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2019, Section IX – European Data Protection Supervisor

(2020/2148(DEC))

The European Parliament,

– having regard to its decision on discharge in respect of the implementation of the general budget of the European Union for the financial year 2019, Section IX – European Data Protection Supervisor,

– having regard to Rule 100 of and Annex V to its Rules of Procedure,

– having regard to the opinion of the Committee on Civil Liberties, Justice and Home Affairs;

– having regard to the report of the Committee on Budgetary Control (A9-0067/2021),

A. whereas in the context of the discharge procedure, the discharge authority wishes to stress the particular importance of further strengthening the democratic legitimacy of the Union institutions by improving transparency and accountability, and implementing the concept of performance-based budgeting and good governance of human resources;

1. Welcomes the conclusion of the Court of Auditors (the ‘Court’), according to which the payments as a whole for the year ended on 31 December 2019 for administrative and other expenditure of the European Data Protection Supervisor (the ‘’EDPS’) were free from material error and that the examined supervisory and control systems for administrative and other expenditure were effective;

2. Notes with satisfaction that in its annual report for 2019, the Court observed no serious weaknesses in respect of the audited topics related to the EDPS’ human resources and procurement activities;

3. Regrets, as an overall observation, that chapter 9 ‘Administration’ of the Annual Report of the Court has a rather limited scope and conclusions, notwithstanding the fact that the Multiannual Financial Framework Heading 5 ‘Administration’ of the is considered low risk; requests that the audit work for the chapter on Administration be more focused on issues of high or even critical relevance for the EDPS;

4. States that in 2019, the EDPS had a total allocated budget of EUR 16 638 572 (compared to EUR 14 449 068 in 2018 and EUR 11 324 735 in 2017), which represented a 15,15 % increase compared to the 2018 budget; notes that the budget implementation rate in terms of commitments was 91,97 % (compared to 93,7 % in 2018 and 89 % in 2017) ; recognizes the positive trend in terms of the payment implementation rate which was 80,69 % (compared to 75,2 % in 2018 and 77 % in 2017) with a payment appropriation carry-over rate of 12,18 %; calls however on the EDPS to continue its efforts in terms of prudent budget estimates;

5. Notes that the overall budget increase was mainly due to the impact of the new tasks resulting from the Regulation (EU) 2018/1725 (the General Data Protection Regulation, GDPR), which lays down the data protection obligations for the Union institutions and bodies in relation to the processing of personal data and the development of  new policies) and the necessary growth of the European Data Protection Board (EDPB) that was created on 25 May 2018 and for which the EDPS was entrusted to provide an independent secretariat; recognises that 2019 was the first full year of operation of the EDPB Secretariat and of the implementation of the GDPR, which justifies the increase; the related allocated budget increase amounted to 51% (from 3 594 746 EUR in 2018 to 5 413 838 EUR in 2019);

6. Welcomes the EDPS’ follow-up to the 2018 discharge resolution, for example the additional information provided in relation to the payment appropriation rate of 75 % for 2018, which resulted finally in an execution rate of 90,79 % of the whole 2018 budget (including payments from carry-over);

7. Appreciates the diligent and proactive action of the EDPS in monitoring the Union institutions’ respect for data protection; notes in particular the EDPS’ investigation into the use of NationBuilder, a US-based political campaigning company, for the processing of personal data as part of the Parliament’s activities relating to the 2019 European election, as well as for the guidelines issued on the use of body temperature checks by Union institutions in the context of the COVID-19 crisis;

Human resources

8. Notes that at the end of 2014, the EDPS comprised 55 members of staff (compared to 96 at the end of 2019), which signifies almost a doubling in the number of staff; is aware that the EDPS' budget is mostly administrative, with a large proportion being used for expenditure relating to persons, buildings, furniture, equipment and miscellaneous running costs; notes that a substantial number of staff are contract staff employed for a temporary period, such as the replacement of staff on parental leave or for the implementation of specific actions;

9. Notes a substantial increase in the number of contract agents from 2013 to 2019 (from 12 to 31) compared to the number of officials in the same period (from 45 to 58); acknowledges the advantages of using contract agents in terms of cost-efficiency and flexibility but asks the EDPS to reflect on the need to offer prospects of professional progression to its staff and to retain specialised knowledge in the institution;

10. Notes that the EDPS acknowledges the stronger burden on senior and middle management and, subsequently, on case officers due to the absence of an assistant supervisor while the new Regulation (EC) 2018/1725 was entering into force; calls on the institution to re-examine its organisational chart and report back to the budgetary authority;

11. Underlines efforts made relating to wellbeing; notes that the EDPS has adhered to the Fit@work programme of the Commission; observes that the EDPS plans to enlarge the premises in 2021, following the relocation of the European Ombudsman, and will use this opportunity to install a well-being room and a library; notes that the EDPS provides staff with contacts and information concerning psychosocial as well as medical support, and that this was strongly implemented in the period of the COVID-19 crisis; notes the informal mid-term appraisals with staff (on top of the official annual appraisal), which give them the opportunity to voice concerns and give feedback in an informal way;

12. Observes that the EDPS staff comprises 19 Union nationalities and had a gender representation of 39 % male staff and 61 % female staff in 2019; notes that the most important actions in support of gender equality were the nominations at middle management level (one male and three female heads of unit); notes further the introduction of greater flexibility as regards remote working; highlights the fact that women use the flexible working arrangement much more often than men; appreciates the inclusion of an equal opportunity clause, both in  recruitment materials and vacancy notices, stating that the EDPS is an equal opportunities employer and welcomes applications from those with disabilities; believes that such a clause shall be maintained and included by default in all future vacancy notices;

13. Underlines the EDPS' initiatives aimed at using office space more sustainably and optimising it as well as reducing the energy level in the building, such as the promotion of structural and occasional teleworking, and the reimbursement of 50 % of the cost of public transport tickets to staff who cease to use office parking spaces and return their parking vignette;

14. Notes that the EDPS is a small organisation with a need for highly specialised staff, however, there is a slight geographical imbalance in staff, in that only 19 Union nationalities are represented in the EDPS, of which Belgian citizens hold 28 % of the positions; invites the EDPS to consider further measures to ensure a more balanced representation of Union nationalities;

Ethics and integrity policy

15. Appreciates that the ethics framework of the EDPS was revised on 12 November 2019 pursuant to the new legal framework, notably Regulation (EU) 2018/1725; highlights the formal establishment of the position of ethics officer with a clear mandate, including reporting to the management board at least once per year on the implementation of the ethics framework;

16. Calls on the EDPS to envisage the preparation of a code of conduct for the EDPB senior management (chair, vice chairs, etc); highlights that the two revised codes of conduct (for staff and for the EDPS) were adopted on 6 December 2019; notes that the revised code of conduct for staff has paid particular attention to whistleblower protection; welcomes the fact that all newcomers are provided with an awareness-raising session on the EDPS’ ethical framework and the new code of conduct for staff;

17. Welcomes the fact that the EDPS has also adopted a revised decision concerning the terms and conditions for internal investigations in relation to the prevention of fraud, corruption and any illegal activity detrimental to Union interests in September 2019; notes that the importance of this topic has been underlined in staff meetings and will be flagged at the next awareness raising session to all staff;  

18. Considers the EDPS equal opportunities clause to be an an excellent signal for the inclusion of those with disabilities and for ensuring equal opportunities as well as for strengthening work place diversity;

19. Commends the EDPS for having put all guidelines and procedures related to the ethical framework on the intranet immediately after their adoption; calls on the EDPS to organise awareness-raising activities for the staff,  including members of staff other than newcomers, regarding the applicable ethical framework and to adopt a proactive system to avoid conflicts in the workplace; notes the revised decision on external activities adopted on 13 September 2019, and the fact that the related presentations with real life examples had to be postponed due to the pandemic;

Buildings

20. Notes that according to the original plans the EDPS should have occupied the whole MTS building as of September 2019; notes, however, that due to external factors the move of the Ombudsman was delayed and consequently the expansion didn’t happen, which affected the execution under Title 2 of the EDPS’ budget;

21. Notes that the new telework decision allows staff to work at home, allowing the EDPS to make more use of shared offices and make savings on related expenditure;

Inter-institutional cooperation

22. Recognises that due to the very small size of the office of EDPS, the concluding of service level agreements (SLA) such as with the Commission for training, for the medical service, for the use of Sysper, for the appraisal system, for the payment of salaries, for staff insurance and the organisation of missions, for accounting services and transportation services, is important for efficiency gains; encourages the inter-institutional activities of the EDPS, including the 60 framework contracts initiated by various Union institutions; notes that the EDPS has SLAs with the Parliament for IT and building-related expenditure;

23. Invites the EDPS to explore the possibility of joining the transparency registry on the basis of a SLA; notes the inter-institutional cooperation through SLA between the EDPS and other Union institutions and bodies; calls on the EDPS to carry out comprehensive and realistic cost benefit analysis before entering in any agreement;

24. Welcomes the enhanced cooperation between the EDPS and the national data protection authorities under the umbrella of the EDPB, as defined in the GDPR in respect of joint inspection e.g. by Europol; agrees that under the GDPR cooperation is no longer an option or an ancillary task, but a core and integral part of the tasks of every supervisory authority and that this is an important step towards formalising and strengthening exchanges and cooperation among supervisory authorities within the Union;  

25. Appreciates the fact that the EDPS continued to work with its regional and international partners to mainstream data protection through international agreements and to ensure consistent protection of personal data worldwide over the past five years; welcomes the fact that the EDPS has dedicated significant time and effort to the development of greater data protection convergence globally, in view of the fact that data flows internationally, across borders, while data protection rules are still decided on a largely national, and even regional, basis;

Digitalisation, cybersecurity

26. Notes that the EDPB Secretariat has developed IT solutions to enable effective and secure communication between EDPB members, including the internal market information system (IMI), in which 807 cases were registered from the entry into application of the GDPR up to the end of 2019;

27. Recalls that the workload of the EDPS as a responsible body for monitoring data protection compliance in all JHA agencies has increased in the last years, and is expected to increase further due to increasing digitalisation in Union institutions, bodies and agencies;

28. Welcomes the fact that the EDPS developed and made publicly available in 2019 an open source inspection software tool called “website evidence collector”, which has received international acclaim and won the 2019 prize for innovation; welcomes the fact that the EDPS continuously evaluates other open source software that can be used to increase transparency and avoid vendor lock-in effects; observes the successful webinars recently conducted in partnership with the Delft Technical University, which helped in the implementation of the open-source online learning platform ’big blue button‘ in a privacy-friendly manner;   

29. Welcomes the EDPS’ efforts to improve digitalisation and cybersecurity in Union institutions through the inspection of their websites using an open source software tool, which revealed that several websites were not compliant with the EUDPR or with the ePrivacy Directive and did not follow the EDPS Guidelines on web services; invites the EDPS to report to the Parliament on any persisting issues regarding the non-compliance of institutions with EUDPR and the ePrivacy Directive;

30. Notes with satisfaction also the EDPS’ focus on developing and sharing technological expertise in order to ensure effective data protection for example through the TechDispatch publication, launched in July 2019, which describes a different emerging technology in each issue, aiming to provide information on the technology itself, an assessment of its possible impact on privacy and data protection and links to further reading on the topic;  

31. Welcomes the setting up an internal Task Force on COVID-19, which produced a number of orientation papers and technology primers to improve the compliance of contact tracing apps with data protection, which provided feedback to the Commission on a solution for their interoperability and worked with the EDPB to combat the potential misuse of digital data in the context of the pandemic; encourages the EDPS to continue providing the institutions with detailed opinions regarding data protection issues that may arise from digital initiatives used to counter the pandemic, including contact tracing-apps and vaccination or test certificates;

32. Welcomes the activities aimed at verification of compliance with data protection rules and its assessment of Union bodies in this regard; notes that the supervisory activities of EDPS are guided by the accountability principle and follow a risk-based approach;

Communication

33. Welcomes the fact that the EDPB Secretariat set up a network of communication officers within the Supervisory Authorities, to ensure joint communication on EDPB news, joint information campaigns and joint development of communication tools; notes that this network met twice in 2019 and adopted a joint 2020 EDPB information and communication plan;

34. Encourages the EDPS to continue fostering the global debate on digital ethics; highlights the launch of a series of webinars focusing on a specific area of concern and which were published in the form of a podcast on the EDPS’ website; welcomes the ongoing discussion on digital ethics further developed at the 2019 international conference, which continued through the workshop on artificial intelligence, ethics and data protection, and through the organisation of an event focusing on the environmental impact of digital technologies;  

35. Notes that a complex approach is needed in order to make the Union institutions’ homepages accessible to persons with all kind of disabilities, including the availability of national sign languages; suggests that disability-affected persons are involved in this process;

Internal management, internal control, finance, performance

36. Calls on the EDPS to report on the exact role and specific tasks of the Coordinated Supervision Committee, established in 2019 in the context of data processing by large information systems in use within the Union institutions bodies, offices and agencies; notes that this Committee functions autonomously with respect to the EDPB’s activities, adhering to its own rules of procedure and working methods and that the Secretariat of the Committee is provided by the EDPB Secretariat;

37. Is aware that the EDPS uses a number of key performance indicators (KPIs) to assist in the monitoring of its performance; welcomes the fact that the EDPS met or exceeded - in some cases significantly - the targets set in six of the eight KPIs, e.g. the number of cases dealt with at international level (62 in 2019, exceeding a target of 10), and the number of opinions/comments issued in response to consultation requests (26 consultations in 2019, exceeding a target of 10 consultations); invites the EDPS to closely monitor and adapt where necessary objectives which are performing poorly;

38. Notes that the EDPS revised the Internal Control Standards (ICS) decision in November 2019 in order to update the legal framework applicable to the IDPS; notes that following a suggestion from the Court, the ICS monitoring report will be issued annually instead of biannually and is now presented to the management board; notes that the monitoring of the implementation of the ICS is the responsibility of the internal control coordinator, who reports directly to the director;  

39. Is aware that the Commission’s internal auditor (IA) is also the internal auditor for the Supervisor; regrets that during 2019, the IA did not perform any audit, but rather issued its annual internal audit report for 2019 with only two statements and there are no open recommendations; asks the IDPS to facilitate closer cooperation with the IA and to ensure proper annual auditing;

40. Welcomes the publication of the cost of internal control activities representing 3,77 % of the IDPS’ expenditure; notes that the calculation model consists of a single global indicator, which is calculated by dividing the approximate overall cost of control by all expenditure made during the year (budget implementation in terms of payments);  

41. Notes that, due to the increased budget, payment requests increased substantially, from 1 777 transactions in 2018 to 2 653 transactions in 2019; agrees that this increased workload requires solutions in order to render the institution more efficient in terms of processing of financial operations, and welcomes the introduction of a paperless workflow system from 1 January 2020;

42. Asks the EDPS to report on any improvements made on the efficiency of administrative processes, which seem to be essential due to  an ever-increasing workload and the continuing increase in size of the institution; recalls furthermore the necessity of ongoing reforms to ensure that the EDPS is well equipped to respond to future challenges in data protection;

43. Welcomes the efforts of the EDPS to improve its working methods and thereby make savings; calls on the EDPS to report to the budgetary authority on the new systems and applications developed in this area, namely the Speedwell workflow system for the payment of invoices and Bluebell to improve the contribution of the units to the establishment of the budget;

44. Observes that the Secretariat of the EDPB organised 11 plenary meetings and 90 expert subgroup meetings; notes that nearly 70 % of the official documents adopted by the EDPB since May 2018 were drafted by the EDPB Secretariat’s legal team; notes that the EDPB adopted five new guidelines aiming at clarifying the range of provisions under the GDPR; underlines that the EDPB Secretariat is the main drafter for opinions and decisions on consistency and that it organises stakeholder events to gather input and opinions on issues with a view to developing guidance; notes that another task of the EDPB is to issue advice to the legislator;  

45. Welcomes the fact that the new supervisory framework came into force for the processing of personal data at the European Union Agency for Criminal Justice Cooperation (Eurojust), as well as the fact that the EDPS is taking over responsibility for monitoring Eurojust’s compliance with the applicable Union rules on data protection.

46. Concludes that in 2019, the EDPS received 59 admissible complaints seeking an in-depth inquiry, and that the EDPS issued 48 complaint decisions; notes that the EDPS also received 151 inadmissible complaints, the majority relating to data processing at national level as opposed to processing by a Union institution or body; notes that the EDPS replied to all inadmissible complaints, directing the complainant to the relevant authority;  

47. Welcomes the completion of the Supervisor’s Strategy 2015-2019, which focused on digitisation, global partnerships and the modernisation of data protection, bringing the concepts of ethics and accountability to the forefront of data protection discourse and application

Environmental dimension

48.  Appreciates that the EDPS is closely following EMAS initiatives and has started to convert human resources processes (selections, appraisal) and financial and administrative processes (payments, MiPS) into paperless procedures; notes the initiatives carried out by the EDPS to reduce the use of plastic bottles by its staff; agrees to the EDPS’ strategy in providing more flexible ways of working for its staff (occasional and structural teleworking); notes that those flexible working arrangement help to reduce energy for the EDPS as well as to use office space in a more optimal way; invites the EDPS to consider actions to further reduce the carbon footprint, such as choosing clean and renewable sources of energy;

GDPR

49. Agrees that data controllers and processors within the Union now benefit from a single set of rules bringing interlocutors through the one-stop-shop mechanism to an increasing extent; agrees that the GDPR also contributes to increased global visibility of the Union legal framework

50. Emphasises the important role of the EDPS, namely, to ensure the protection of personal data and privacy of individuals by monitoring personal data processing by the Union institutions, bodies and agencies, by advising them on all matters related to personal data processing and by cooperating with national supervisory authorities with a view to ensuring the consistent protection of individuals’ fundamental rights and freedoms, including the right to data protection and privacy, irrespective of where they live in the Union;  

51. Is of the opinion however that the implementation of GDPR, notwithstanding its harmonisation of rules, may be particularly challenging for small and medium sized companies (SMEs); asks the EDPS to further alleviate the administrative burden on SMEs; calls on the EDPS to consider the possibility of conducting a cost evaluation of the implementation of GDPR in the near future;  

52. Calls on the EDPS to strengthen further its efforts in ensuring that  Union institutions are able to effectively implement the data protection rules; notes that the EDPS launched four investigations in 2019 with the objective of improving data protection practices; welcomes in particular the investigation into the use of Microsoft products and services by Union institutions, providing as a result a platform for discussion both on how to take back control over the IT services and products offered by the big IT service providers and on the need to collectively create standard contracts instead of accepting the terms and conditions as they are written by such providers ;

OPINION OF THE COMMITTEE ON CIVIL LIBERTIES, JUSTICE AND HOME AFFAIRS

2020/2148(DEC)

24.2.2021

OPINION

of the Committee on Civil Liberties, Justice and Home Affairs

for the Committee on Budgetary Control

on discharge in respect of the implementation of the general budget of the European Union for the financial year 2019, Section IX -  European Data Protection Supervisor and European Data Protection Board

(2020/2148(DEC))

Rapporteur for opinion: Caterina Chinnici

 

SUGGESTIONS

The Committee on Civil Liberties, Justice and Home Affairs calls on the Committee on Budgetary Control, as the committee responsible, to incorporate the following suggestions into its motion for a resolution:

1. Emphasises the important role of the European Data Protection Supervisor (‘EDPS’), namely to ensure the protection of personal data and privacy of individuals by monitoring personal data processing by the Union institutions, bodies and agencies, by advising them on all matters related to personal data processing and by cooperating with national supervisory authorities with a view to ensure the consistent protection of individuals’ fundamental rights and freedoms, including the rights to data protection and privacy, irrespective of where they live in the Union;

2. Recalls that the EDPS is not a decentralised Union agency; notes the Court’s position that the small budget of the EDPS, its low volume of financial transactions and the low level of assessed risks do not justify the publication of such report; takes the view that even if its budget represents a very small percentage of the Union budget, the legality and regularity of EDPS transactions should nevertheless be properly examined by the European Court of Auditors (‘the Court’) as transparency is vital for the appropriate functioning of all Union bodies; notes that the EDPS is neither covered by the report of the Court on the implementation of the Union budget for 2019, nor by the 2019 report on Union agencies and other bodies; calls therefore on the Court to reconsider its position and start publishing audit reports covering the EDPS from the coming year; requests therefore that the Court issues separate annual activity reports on the annual accounts of this important Union body which aims to ensure that Union institutions and bodies fully respect the right to privacy and data protection;

3. Welcomes the annual report published by the EDPS in March 2020; notes the 15.15% increase in its budget compared to 2018; appreciates the insights given therein on all EDPS activities in 2019; highlights in particular its cooperation with the European Data Protection Board;

4. Reminds that the workload of the EDPS as a responsible body for monitoring data protection compliance in all JHA agencies has increased in the last years, and is expected to further increase due to the growing digitalisation trend in Union institutions, bodies and agencies;

5. Highlights the fact that, according to the annual activity report of the EDPS, the Court has examined the financial year of 2019 and this examination did not give rise to any observations;

6. Acknowledges that the EDPS report on the implementation of its Internal Control System shows that the level of internal control is satisfactory and effective; notes that this assessment has neither been put into question by the Internal Audit Service of the Commission nor the Court.

7. Takes note of the follow-up of the Parliament's resolution concerning the discharge of the 2017 budget; welcomes that the EDPS has tackled the issues of retaliation and whistleblowing in its internal code of conduct by integrating anti-harassment policies, disciplinary proceedings and administrative investigations and that it has shown commitment to raise awareness regarding this issue among its staff; welcomes the positive trend towards a better gender balance within the organisation;

 

INFORMATION ON ADOPTION IN COMMITTEE ASKED FOR OPINION

 

 

FINAL VOTE BY ROLL CALL IN COMMITTEE ASKED FOR OPINION

 

 

 

 

Key to symbols:

+ : in favour

- : against

0 : abstention

 

INFORMATION ON ADOPTION IN COMMITTEE RESPONSIBLE

 

FINAL VOTE BY ROLL CALL IN COMMITTEE RESPONSIBLE