Rules of procedure of the European Data Protection Supervisor

SUMMARY OF:

They replace the former rules of procedure for the European Data Protection Supervisor (EDPS) set out in Decision 2013/504/EU, which it repeals.
They set out the guiding principles of the EDPS, along with rules on internal decision-making processes, the organisation and working of the secretariat, planning, internal administration, and the openness and transparency of the institution.
The rules were amended in 2022 to clearly distinguish the essential procedural rules governing the performance of the EDPS’s tasks from those concerning the organisational structure of the EDPS’s secretariat (since the latter should not be included in the rules of procedure).

The role of the EDPS is set out in Regulation (EU) 2018/1725 – see summary.

These rules take into account changes in European Union (EU) data protection legislation, specifically:

Regulation (EU) 2016/679, the general data protection regulation – see summary;
Directive (EU) 2016/680 on data protection by police and criminal justice authorities – see summary;
Regulation (EU) 2018/1727 on the European Union Agency for Criminal Justice Cooperation – see summary;
Regulation (EU) 2018/1241 on the European Travel Information and Authorisation System – see summary;
Regulation (EU) 2017/1939 on the European Public Prosecutor’s Office – see summary;
Regulation (EU) 2016/794 on the European Union Agency for Law Enforcement Cooperation – see summary.

Guiding principles

The rules require the EDPS to follow a number of guiding principles covering:

good governance, integrity and good administrative behaviour – the EDPS must act in the public’s interest as an expert, as well as an independent, reliable, proactive and authoritative body in the field of privacy and personal data protection;
accountability and transparency;
efficiency and effectiveness;
cooperation.

Role of the Supervisor

The Supervisor’s tasks include:

deciding the strategic priorities of the EDPS;
adopting policy documents corresponding to the tasks and powers of the EDPS;
deciding on the organisational structure of the EDPS secretariat, reflecting the strategic priorities.

Monitoring data protection

The EDPS must guarantee effective protection of rights and freedoms of individuals through the monitoring and enforcement of Regulation (EU) 2018/1725 and any other EU law that sets out tasks and powers for the EDPS.
In carrying out its investigative, corrective, authorisation and advisory powers, the EDPS may carry out compliance visits, surveys, visits every two months and informal consultations or encourage amicable settlements of complaints.

Complaints

The EDPS handles written complaints taking into account a number of factors including:
- the nature and gravity of the alleged violations;
- the importance of the damage suffered;
- the potential overall importance of the case.
It must inform the complainant as soon as possible.
It shall declare inadmissible and not handle complaints lodged more than 2 years after the complainant became aware of the alleged breach, except in duly justified and exceptional circumstances.
The complainant or institution concerned can ask the EDPS to review its decision.

Legislative consultation

In response to requests from the European Commission in accordance with Article 42(1) of Regulation (EU) 2018/1725, the EDPS can issue an opinion where the request concerns a proposal for a legislative act or a recommendation or proposal to the Council of the European Union pursuant to Article 218 of the Treaty on the Functioning of the European Union. Where the request concerns a draft delegated act or implementing act, the EDPS issues formal comments.

It has applied since 27 June 2020.

Article 7 of the Charter of Fundamental Rights states that everyone has the right to respect for their private and family life, home and communications.
Article 8 of the Charter of Fundamental Rights states that everyone has the right to personal data protection.
Article 16 of the Treaty on the Functioning of the European Union further develops that right. This article is the legal basis for any EU legislation on data protection.

For further information, see:

Decision of the European Data Protection Supervisor of 15 May 2020 adopting the Rules of Procedure of the EDPS (OJ L 204, 26.6.2020, pp. 49–59).

Successive amendments to the decision have been incorporated in the original text. This consolidated version is of documentary value only.