EDPS welcomes adoption of new data protection rules for EU institutions

The adoption of new data protection rules for the EU institutions and bodies represents another vital step forward in the development of a comprehensive EU framework for data protection in the digital age, the European Data Protection Supervisor (EDPS) said today.

Giovanni Buttarelli, EDPS, said: “The new Regulation, which applies from today, brings the data protection rules for the EU institutions and bodies (EUI) in line with the standards imposed on other organisations and businesses by the General Data Protection Regulation (GDPR). Under the new rules, which we may refer to as the EUI-GDPR, the EDPS remains responsible for ensuring the effective protection of individuals’ fundamental rights and freedoms whenever their personal data is processed by the EU institutions or on their behalf, whether this is to ensure EU markets work better, to evaluate and supervise medicines in the EU or to fight against terrorism and organised crime. This role includes promoting public awareness and understanding of the risks to people’s rights and freedoms in relation to the processing of personal data, as well as increased cooperation with national data protection authorities. The EU institutions are expected to lead by example in applying the new rules and ensure compliance from day one onwards”.

As the supervisory authority for the 66 EU institutions, bodies, offices and agencies, the EDPS has been working hard over the past two years to ensure that the transition to the new Regulation is a resounding success. In addition to regular meetings and workshops with the Data Protection Officers (DPOs) of the EU institutions, the EDPS has carried out an extensive programme of visits, meetings with top management and training sessions covering the full spectrum of EU institutions, bodies and agencies. These sessions have focused not only on those EU employees known as controllers, who are directly involved in the processing of personal data, but also on raising awareness among management and EU staff in general.

The EDPS campaign has put particular emphasis on the importance of accountability, the idea that EU institutions not only comply with the new rules, but that they are able to demonstrate this compliance. The EDPS expects top management to set the tone here, by building data protection into their risk management plans and ensuring that data protection is ingrained into the culture of their organisations. To help them with this, the EDPS has updated and is producing new guidance documents, on topics such as accountability, risk assessment and Data Protection Impact Assessments (DPIAs), data breach notifications and transparency and information obligations.

As an EU institution, the EDPS is also subject to the new rules. An Internal Task Force on the Transition to the New Regulation has been hard at work ensuring that the EDPS is prepared to lead by example and act as an accountable controller, while also providing assistance to other EU institutions as they continue their preparations. Acting as an effective supervisory authority for EUROPOL, and preparing to take on the same role for EUROJUST and the European Public Prosecutor’s Office (EPPO) in the near future, are good examples of some of the challenges we face and are taking steps to tackle effectively.

The EDPS looks forward to working in close cooperation with the EU institutions and bodies in the coming weeks, months and years, in order to ensure that they continue to lead by example in the protection of personal data across the EU and globally. He welcomes the adoption of this new Regulation with great enthusiasm.