The EDPB has published its 2024 Annual Report. The report provides an overview of the EDPB's work in 2024 and highlights key milestones, such as the adoption of the 2024-2027 Strategy, the increase in the number of consistency opinions under Section 64(2) AVG, and ongoing efforts to provide guidance and legal advice.
Chairman of the EDPB, Anu Talus, stated:
"As I look back on the work of the past year, I am proud to present our achievements. In 2024, we reaffirmed our commitment to ensuring individuals' fundamental rights to privacy and data protection in a rapidly changing digital landscape.
We adopted a new strategy and continued to serve as a central player in providing guidance and ensuring consistent application of the General Data Protection Regulation (GDPR) across Europe. To support the understanding and application of data protection rights and obligations, we have expanded our outreach activities with a special focus on businesses and non-expert individuals. In addition, we have been given new roles under the new digital legislations."
The EDPB Strategy 2024-2027 sets out key priorities and actions to strengthen and modernize data protection in Europe, to ensure consistent enforcement of the AVG and to respond to emerging challenges, including cooperation between supervisors. The strategy also strengthens the EDPB's global presence by working with international partners and representing the EU data protection model in key international forums.
The number of consistency opinions under Article 64(2) AVG has increased significantly. In 2024, the Council issued eight such opinions, including on 'consent or pay' models at large online platforms, the use of facial recognition at airports, and the use of personal data to train AI models .. These opinions address general issues and ensure consistency prior to enforcement.
The EDPB actively participated in legislative discussions by issuing statements drawing attention to data protection implications. For example, it issued statements on the draft procedural rules for enforcement of the AVG, and on the role of data protection authorities within the framework of the AI Regulation..
In addition, the EDPB has expanded its general guidelines to help organizations comply with the AVG. In 2024, it adopted four new guidelines, including guidelines on legitimate interest and on data transfers to authorities in third countries.
In 2024, the EDPB maintained an active dialogue with stakeholders to promote open communication and mutual understanding among regulators, industry representatives, civil society organizations and academic institutions. To gather relevant insights from organizations with data protection expertise, the Board launched public consultations on its adopted guidelines and organized two stakeholder events, regarding the upcoming guidelines on "Consent or pay" models and in preparation for the opinion on AI models.
New digital legislations, including the Digital Markets Act (DMA), the Digital Services Act (DSA), the AI Act, the Data Governance Act (DGA) and the Data Act, build on the AVG. To ensure consistency between the application of the AVG and these laws, the EDPB actively contributed to regulatory cooperation by working with European and international partners, including the EU AI Office and the high-level group around the DMA.
Finally, the EDPB continued its efforts to make information on the AVG more accessible to a wider and non-expert audience by presenting it in clear and non-technical language. For example, the Data Protection Guide for Small Businesses is now available in 18 languages. In addition, the Council has launched a series of summaries of EDPB guidance to help non-expert individuals and organizations more easily recognize key areas of concern.
Download the Annual Report here.
Download a brief summary of the Annual Report here.
