De Europese Toezichthouder voor gegevensbescherming (EDPS) heeft de resultaten bekendgemaakt van een onderzoek naar de rol, verantwoordelijkheden en taken van DPO's binnen EU-instellingen, organen, bureaus en agentschappen (EUI's) (1). Uit de enquête blijkt een hoge mate van bewustzijn en naleving van de adviezen van functionarissen voor gegevensbescherming door de EUI's. Deze enquête, gelanceerd in maart 2023 (2), maakt deel uit van de Gecoördineerde Handhavingsactie van het Europees Comité voor gegevensbescherming (EDPB) (3), uitgevoerd door de EDPS samen met de andere 26 autoriteiten voor gegevensbescherming en privacy van de Europese Unie (EU) en de Europese Economische Ruimte (EER). Dit artikel gaat verder in het Engels.
The Coordinated Enforcement Action focuses on the role, responsibilities and tasks of data protection officers in EUIs. To support this work, the EDPS sent a questionnaire to EUIs’ data protection officers to check their compliance with the applicable data protection law, Regulation (EU) 2018/1725. This involved, in particular, verifying data protection officers’ independence; how their advice is followed; and how they carry out their duties to ensure compliance with the applicable rules whenever EUIs are processing personal data.
Wojciech Wiewiórowski, EDPS, said: “The results and further analysis of this Coordinated Enforcement Action reconfirm the crucial role that data protection officers have in bridging the gap between EU data protection law and its practical application in the EUIs. Whilst improvements can be made, I take note of these results with great satisfaction. Since its beginnings in 2004, my institution has made every effort to build a solid cooperation with the data protection officers (DPO) of the EUIs, especially through the EDPS-DPO network, to instil a strong culture of data protection compliance - this must continue”.
The survey and accompanying report show that, in general, data protection officers have a tangible impact and influence on their respective EUIs. The EDPS takes positive note of this, acknowledging that the level of experience and expertise of data protection officers is high and clearly indicates that the role of data protection officers is becoming more professionalised. There is still room for improvement; the EDPS remarks that data protection officers lack time and resources to perform their duties optimally. In its report, the EDPS states that if data protection officers do not have sufficient time and resources to perform their duties, there is a risk that data protection is not perceived as a priority by their EUI, which may, even if not consciously, have a negative impact on the application of Regulation (EU) 2018/1725. Data protection culture must be further fostered, the EDPS writes in its report.
The information gathered from the survey will continue to inform the EDPS’ work with the network of EUIs’ data protection officers, with the aim to further strengthen their role and independence in the months to come. The EDPS has shared the results of the survey’s questionnaire with the EDPB, as part of a wider report on the role, tasks and responsibilities of data protection officers across the EU/EEA. Likewise, the EDPS will continue to actively participate in the EDPB’s Coordinated Enforcement Framework, a series of coordinated actions that seek to streamline enforcement actions and cooperation amongst the data protection and privacy authorities of the EU/EEA.
The rules for data protection in the EU institutions, as well as the duties of the European Data Protection Supervisor (EDPS), are set out in Regulation (EU) 2018/1725.
About the EDPS: The EDPS is the independent supervisory authority with responsibility for monitoring the processing of personal data by the EU institutions and bodies, advising on policies and legislation that affect privacy and cooperating with similar authorities to ensure consistent data protection. Our mission is also to raise awareness on risks and protect people’s rights and freedoms when their personal data is processed.
Wojciech Wiewiórowski (EDPS) was appointed by a joint decision of the European Parliament and the Council to serve a five-year term, beginning on 6 December 2019.
(1) https://edps.europa.eu/data-protection/our-work/publications/reports/2024-01-18-coordinated-enforcement-action-results-survey-role-responsabilties-and-tasks-data-protection-officers_en
(2) https://edps.europa.eu/press-publications/press-news/press-releases/2023/coordinated-enforcement-action-role-data-protection-officers-0_en
(3) https://edpb.europa.eu/news/news/2024/edpb-identifies-areas-improvement-promote-role-and-recognition-dpos_en
(4) https://eur-lex.europa.eu/eli/reg/2018/1725/oj
(5) https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32018R1725&from=EN
(6) http://europa.eu/about-eu/institutions-bodies/index_en.htm
