EDPS is Participating in EDPB's Coordinated Enforcement Action to Supervise Data Protection Officers

The Office of the European Data Protection Supervisor (“EDPS”) announced that it will take part in the European Data Protection Board’s (“EDPB”) Coordinated Enforcement Action on the designation and position of data protection officers ("DPO”), which will include 26 data protection authorities of the EU and the European Economic Area (“EU/EEA”).

Coordinated Enforcement Action is part of the EDPB’s Coordinated Enforcement Framework (“CEF”), which the EDPS actively participates in. With the Coordinated Enforcement Action, CEF aims to ease enforcement actions and cooperation amongst the data protection authorities of the EU/EEA.

In order to contribute to data protection compliance and promote effective protection of data subject rights, DPOs act as intermediaries between data protection authorities, individuals and the business units of an organisation. About the role of DPOs Wojciech Wiewiórowski from EDPS, said; “The role of a data protection officer is crucial in ensuring that data protection law is applied within entities in the EU, and within EU institutions, bodies, offices and agencies (EUIs). By bridging the gap between EU data protection law and its practical application, data protection officers help to promote the effective protection of individuals’ privacy and personal data. Cooperating with the EDPB aims to facilitate the consistent and coherent application of data protection law, its principles, and good practices across the EU/EEA.”

Due to the DPO’s essential function, The EDPS’ participation in the EDPB’s Coordinated Enforcement Action will focus on the role, responsibilities, and tasks of DPOs in the EU. To assess whether DPOs comply with the applicable data protection laws, have the necessary position and required resources to carry out their duties in accordance with Articles 37-39 of the GDPR, participating DPAs will follow various methods, such as;

• Sending questionnaires to DPOs to aid in fact-finding or determining if a formal investigation is needed,
• Initiating formal investigations,
• Following up on ongoing investigations

These methods may involve checking DPOs’ independence, their advice process and their process of fulfilling duties in light of EUIs’ activities implying the processing of individuals’ personal data.

The results of this joint initiative will be analysed in a coordinated manner, and the DPAs will determine if further national supervision and enforcement actions are necessary. Additionally, the aggregated results will provide deeper insights into the topic, allowing for targeted follow-up at the EU level.

The first Coordinated Enforcement Action, launched in 2022, focused on the use of cloud services by the public sector, and the findings of the first CEF initiative were published on January 18, 2023. Similarly, the results of this second Coordinated Enforcement Action on data protection officers will be analysed collaboratively, and a report on the findings will be published.