EDPS publishes results of the Coordinated Enforcement Action on data protection officers

The EDPS publishes today the results of its survey on the role, responsibilities and tasks of data protection officers in the EU institutions, bodies, offices and agencies (EUIs). The outcome of the survey demonstrates a high level of awareness and compliance of EUIs with data protection officers’ advice. Launched earlier in March 2023, the survey is part of the European Data Protection Board’s (EDPB) Coordinated Enforcement Action that the EDPS conducts alongside the other 26 data protection and privacy authorities of the European Union (EU) and the European Economic Area (EEA).

The Coordinated Enforcement Action focuses on the role, responsibilities and tasks of data protection officers in EUIs. To support this work, the EDPS sent a questionnaire to EUIs’ data protection officers to check their compliance with the applicable data protection law, Regulation (EU) 2018/1725. This involved, in particular, verifying data protection officers’ independence; how their advice is followed; and how they carry out their duties to ensure compliance with the applicable rules whenever EUIs are processing personal data.

Wojciech Wiewiórowski, EDPS, said: “The results and further analysis of this Coordinated Enforcement Action reconfirm the crucial role that data protection officers have in bridging the gap between EU data protection law and its practical application in the EUIs. Whilst improvements can be made, I take note of these results with great satisfaction. Since its beginnings in 2004, my institution has made every effort to build a solid cooperation with the data protection officers (DPO) of the EUIs, especially through the EDPS-DPO network, to instil a strong culture of data protection compliance - this must continue”.

The survey and accompanying report show that, in general, data protection officers have a tangible impact and influence on their respective EUIs. The EDPS takes positive note of this, acknowledging that the level of experience and expertise of data protection officers is high and clearly indicates that the role of data protection officers is becoming more professionalised. There is still room for improvement; the EDPS remarks that data protection officers lack time and resources to perform their duties optimally. In its report, the EDPS states that if data protection officers do not have sufficient time and resources to perform their duties, there is a risk that data protection is not perceived as a priority by their EUI, which may, even if not consciously, have a negative impact on the application of Regulation (EU) 2018/1725. Data protection culture must be further fostered, the EDPS writes in its report.

The information gathered from the survey will continue to inform the EDPS’ work with the network of EUIs’ data protection officers, with the aim to further strengthen their role and independence in the months to come. The EDPS has shared the results of the survey’s questionnaire with the EDPB, as part of a wider report on the role, tasks and responsibilities of data protection officers across the EU/EEA. Likewise, the EDPS will continue to actively participate in the EDPB’s Coordinated Enforcement Framework, a series of coordinated actions that seek to streamline enforcement actions and cooperation amongst the data protection and privacy authorities of the EU/EEA.