Shaping a safer digital future

The EDPS Strategy 2020-2024

A new strategy for a new decade

Human rights should never be taken for granted. We must continuously work to defend and preserve them. In recent years, we have observed the fragility of the rule of law and other fundamental values in our democratic institutions that Europeans share with many other places in the world.

Bolstered by the Lisbon Treaty, which puts the EU Charter of Fundamental Rights on an equal footing with the Treaties, data protection has, in the last decade, become, a bulwark for most, if not for all democratic rights and freedoms. This is particularly important for those in a position of vulnerability, such as children and the elderly, patients or mentally ill person, asylum seekers or even employees under some circumstances of power imbalance.

Technological advances, occurring thanks to human ingenuity and ability to derive insights from experience, are, nowadays, particularly driven by personal data. The companies that have exploited these technologies have become the most valuable in the world, dominating not only their respective markets but also global information flows. Consumer choice is now very restricted and popular services have often not been designed in compliance with the EU legal framework in mind. Governments are also keen to exploit the technologies that promise innovation, efficiency and that are cost effective. At the same time, technologies designed to increase convenience and prosperity - from behavioural targeting to facial recognition - now enable authoritarian states to strengthen and export their self-serving model of surveillance, repression and censorship.

Wojciech Wiewiórowski

European Data Protection Supervisor

Read more

Strategy pillars

Our strategy describes how we intend to carry out our statutory functions and deploy the resources available to address these challenges. There are three pillars to the strategy, each reflecting our values.

  • Foresight: our commitment to being a smart institution that takes the long-term view of trends in data protection and the legal, societal and technological context.
  • Action: proactively develop tools for EUI to be world leaders in data protection. To promote coherence in the activities of enforcement bodies in the EU with a stronger expression of genuine European solidarity, burden sharing and common approach.
  • Solidarity: our belief is that justice requires privacy to be safeguarded for everyone, in all EU policies, while sustainability should be the driver for data processing in the public interest.
Leonardo Cervera Navas



EDPS continuously works to be a recognised and respected centre of expertise that helps understand the impact of the design, evolution, risks and deployment of digital technology on the fundamental rights to privacy and data protection.


We want to be a smart administration in a smart EUI environment.

Knowledge is an essential asset for the EDPS to effectively support strategic objectives. However, we do not want to be a centre of excellence in a way that does not benefit the outside world. We want to share knowledge, expertise and contribute to the smart administration of the EUI environment.

Our aim is to use the best expertise and latest sustainable technology, to look after our people, promote diversity in all its forms, as well as being transparent and inclusive towards our stakeholders.

Read more


We want to know what is going on and what is going to happen

The EDPS places strategic importance on integrating the technological dimension of data protection into our work. As a data protection supervisory authority, we must closely examine both the potential risks and opportunities offered by these advances, understand the possibilities of new technologies and, at the same time, encourage the integration of data protection by design and data protection by default in the innovation process.

We aim to explain in a simple way the interaction between these trends, and to include data protection in the new EU skills agenda. In our work with the EDPB, as well as an advisor to the EUI, we focus on areas where the interests of data protection interacts with technology and other areas of law, including competition law, consumer law, finance and payment services.

The EDPS is uniquely positioned to monitor developments in the Areas of Freedom, Security and Justice (AFSJ). This is particularly emphasised through our role as supervisory authority of Europol, Eurojust, EPPO, Frontex, EASO or eu-LISA.

Read more


The EDPS will keep providing the necessary support to EUI, so that they can continue to lead by example in safeguarding digital rights and responsible data processing.


We are going to use the tools we have and develop new ones.

Privacy and data protection are cornerstones in any democratic society based on the rule of law and fundamental rights. Likewise, a free internet society depends on the design of technology. This is particularly relevant whenever the EU adopts laws and policies related to the processing of personal data, or when EUI process personal data.

Personal data have and will continue to play an important role in the fight against the COVID-19 pandemic. Our laws, such as the GDPR and the ePrivacy rules, allow for the processing of personal data for public health purposes, including in times of emergency. Data protection law is well-equipped to help support the public good, and do not represent an obstacle, in fighting the virus. It is certainly possible to build technological solutions, which are compliant with the legal data protection framework. Some recent application show that societies can take up technologies while upholding privacy and data protection rights. It remains paramount that EUI and Member States continue to actively engage with DPAs.

Read more


We do not protect data - we protect human beings.

The GDPR is directly applicable throughout the EU. Nevertheless, it provides Member States with the possibility to further legislate their respective laws. This could compound the fragmentation of national approaches. The EDPB exists to check and avoid such fragmentation.

The EDPS has a unique dual role as a full member and provider of the EDPB’s secretariat. We will exercise this role creatively, seeking to represent the wider EU interest, and contribute to the success of the EDPB, as well as ensuring the consistent application and enforcement of the GDPR and the Data Protection Law Enforcement Directive. We aim to develop with other DPAs a common set of tools.

Read more


The EDPS promotes a positive vision of digitisation that enables us to value and respect all individuals. The full potential of data shall be dedicated to the good of society and with respect to human rights, dignity and the rule of law.


We actively promote justice and the rule of law.

Solidarity, being aware of shared values, interests and objectives, is at the heart of the EU project. As an EU institution, the EDPS is committed to upholding the rule of law and democracy. As an independent data protection supervisory authority, we act in line with these values. When we believe that these are threatened, we speak up, and vigorously defend them. Likewise, we take action if the independence of other DPAs and the ‘collective independence’ of the EDPB are jeopardised.

When planning strategies on democracy and human rights, the EU should promote digital justice and privacy for all. Privacy and data protection can never be traded for access to essential services. Data protection is one of the last lines of defence for vulnerable individuals, such as migrants and asylum seekers approaching EU external borders. Although the EU has accumulated a patchwork of measures in the areas of police and judicial cooperation and border management, the legal framework remains fragmented, creating unnecessary discrepancies. This puts unwarranted constraints on the EDPS’ supervisory and enforcement powers.

Read more


We know there is only one world.

Data processing and data protection have to go green.

The EDPS is a socially-responsible organisation. Our values are to treat people – our employees, the people whose activities we supervise, the individuals whose data is processed by EUI, our stakeholders - and the natural environment around us, with respect.

The ongoing development of AI and blockchain based technologies, as well as illegal tracking and profiling of individuals generate an increasing amount of dangerous waste, due to short-lived connected goods, combined with exponential carbon footprint emissions. This is a great source of concern in light of the EU Green Deal and data protection in this new decade.

Enforcing personal data minimization and responsible data processing can be part of the solution to help counteract these damaging trends. There should be competition on the most beneficial ways to use data, not on who can collect the most.

Read more