EDPB Strategy 2024-2027

The mission and legal task of the European Data Protection Board (EDPB) is to ensure the consistent application of EU data protection rules and to promote effective cooperation among data protection authorities throughout the European Economic Area (EEA). Since their entries into application in 2018, the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED) have strengthened, modernised and harmonised data protection across the European Economic Area (EEA). Awareness of data protection rights has risen significantly among data subjects, while controllers and processors in both the public and private sectors have become increasingly aware of their obligations. Meanwhile, supervisory authorities (SAs) are actively using their investigative and corrective powers to effectively enforce the law when appropriate and have reinforced their cooperation. The EDPB has also provided, and will continue to provide, legal and technical guidance on data protection matters.

In addition to this guidance, the EDPB has adopted other documents, including binding decisions, to ensure the consistent application of EU data protection laws. The EDPB is committed to continuing all of these works. The focus of the EDPB has continued to evolve in recent years. In particular, the EDPB has increased its focus on enhancing cooperation among SAs, with the goal of ensuring efficient and consistent enforcement of data protection rules. In the coming years, the EDPB will strengthen this activity while, at the same time, continuing to raise awareness among the wider public, including SMEs, and supporting compliance with the law. New EU laws which will affect data protection and individuals’ data protection rights have been, or will be, introduced in the context of digitalisation. The EDPB reiterates the need for a strong protection of personal data in the context of these laws, including those relating to Artificial Intelligence, the European Data Strategy and the Digital Services Package.

We will therefore continue our existing work on the interplay between those laws and the GDPR, while also promoting the necessary supervision of data protection issues, the keeping of individuals at the centre and the effective protection of individuals’ rights. This is also true for the LED, as well as for both the existing and new EU information systems facilitating border control and law enforcement in the broader sense. The EDPB remains committed to ensuring the coordinated supervision of these systems and remains vigilant about the effect that they have on the protection of personal data. The EDPB will also continue to address the challenges raised by new technologies, such as Artificial Intelligence. It will further engage on these issues to promote high legal standards and cooperation amongst data protection and privacy authorities, and other regulators globally. In light of these objectives, the EDPB’s Strategy for 2024 – 2027 is based on four main pillars highlighting our main objectives and the key actions for achieving them.

This strategy will be complemented by two Work Programmes and the EDPB will report on the progress achieved as part of our annual report. EDPB Strategy 2024-2027 EDPB STRATEGY 2024-2027 April 2024 We will continue providing guidance on key issues. This will include, for example, guidance on the application of the GDPR to particularly vulnerable data subjects, such as children, and on the application of particularly notable provisions, such as legitimate interest. The EDPB reiterates its goal that such guidance will be practical, including the use of examples when appropriate, and be drafted in a way that is accessible to the relevant audience and helps stakeholders to properly implement data protection law. We will continue supporting the development and implementation of appropriate and effective compliance measures, such as certification and codes of conduct. As part of this, the EDPB will engage with key groups of stakeholders to, for example, help explain how these tools can be used.

We will develop information streams which complement our technical and legally-focused publications. These information streams will focus on accessibility and will be tailored for, among others, non-experts, individuals (including children), and SMEs. These may include, for example, information sheets or factsheets which communicate a Guideline’s core messages in an accessible way, or further improvements and promotion of the Data Protection Guide for Small Businesses. We will also invest in the visibility of the EDPB and in generating greater awareness about what the EDPB is and does. KEY ACTION 1 KEY ACTION 2 KEY ACTION 3 Following the EDPB’s existing guidance on the key concepts of EU data protection law, we will further enhance our efforts to achieve a consistent application and effective enforcement of the law. One way in which we will do this is by further providing concise and clear guidance on important topics.

g. children). We will also continue to assess how personal data is being accessed and used by public authorities for law-enforcement purposes. Enhancing harmonisation and promoting compliance PILLAR 1 EDPB STRATEGY 2024-2027 We will continue to follow through on the commitments made in the Vienna Statement on enforcement cooperation. In particular, the EDPB will continue to foster the identification of strategic cases for which cooperation will be prioritised and to provide methodologies and tools promoting a harmonised approach to investigation and enforcement. The Support Pool of Experts, the Coordinated Enforcement Framework and the EDPB secondment programme will also be further developed. We will reiterate our commitment to the smooth functioning of the One Stop Shop and other cooperation and consistency provisions set out under the GDPR. As part of this, the EDPB will continue to ensure that any requests for Opinions or Binding Decisions under the GDPR consistency mechanisms are fulfilled efficiently by providing clear and robust responses.

We also reiterate our commitment to the collegiate nature of the EDPB, including to our task under Article 70(1)(u) GDPR to promote the cooperation and effective bilateral and multilateral exchanges of information and best practices. The EDPB will support efforts for the adoption of the EU Regulation laying down additional procedural rules relating to the enforcement of the GDPR, including by continuing to provide feedback on and suggestions for that proposal during the legislative process, as appropriate. Further, we will prepare for its practical implementation. These preparations will include, among other things, a proactive examination of our working methods and procedures to ensure the full application of the opportunities provided by this Regulation. Reinforcing a common enforcement culture and effective cooperation PILLAR KEY ACTION 1 KEY ACTION 2 KEY ACTION 3 Building on the Vienna Statement on enforcement cooperation , the “wish list” letter to the EU Commission on procedural aspects that could be harmonised at EU level , and the EDPB-EDPS Joint Opinion 01/2023 on the Proposal laying down additional procedural rules relating to the enforcement of the GDPR , as well as other EDPB initiatives and actions in this field, the EDPB will further strengthen the efforts to ensure effective enforcement by, and cooperation between, the members of the EDPB.

The EDPB will continue to support the development of cooperation and enforcement tools, and the sharing of expertise to increase the robustness of our common procedures, methodologies and decisions. 2 1. Statement on enforcement cooperation , adopted on 28 April 2022 2. Letter to Commissioner Reynders , sent on 10 October 2022 3. EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 , adopted on 19 September 2023 1 2 3 EDPB STRATEGY 2024-2027 We will provide guidance on the interplay between the application of the GDPR and other EU legal acts, particularly the EU Artificial Intelligence Act or those derived from the EU Data Strategy and the Digital Services Package. This will be done with a view to promoting the right to data protection in the overall regulatory architecture and contributing to a consistent application of different regulatory frameworks.

The EDPB will also be ready to apply the consistency mechanism and to adopt binding decisions in the context of the Data Act when personal data is concerned. We will continue to monitor and assess new digital technologies to promote a human- centric approach, including those relating to, among others, Artificial Intelligence and digital identity. We will continue to issue guidance, where necessary, on the data protection implications of new technologies, and the correct application of the GDPR in the fast- developing digital landscape. This guidance will, among other things, include a further focus on the implementation of data protection concepts and principles in the context of new technologies, in particular in areas with significant risks for data subjects or where the data subjects belong to a particularly vulnerable group, such as children. We will secure cooperation with other regulatory authorities on matters with an impact on data protection, in particular with consumer protection authorities, competition authorities, and authorities competent under other legal acts, including the EU Artificial Intelligence Act or those adopted under the European Data Strategy and the Digital Services Package.

Further, the EDPB will continue to take an active role in the DMA High Level Group and the European Data Innovation Board. PILLAR KEY ACTION 1 KEY ACTION 2 KEY ACTION 3 Following developments in the EU regulation of the digital landscape and the rapid developments in technology, the EDPB recognises the need to directly address the role and importance of data protection in the cross-regulatory and interdisciplinary context. As part of our responses to this need, we will promote consistency and cooperation with other regulatory authorities in these contexts, including on topics relating to the regulation of Artificial Intelligence, the European Data Strategy and the Digital Services Package. We will also continue to promote a human-centric approach to new technologies. 3 Safeguarding data protection in the developing digital and cross-regulatory landscape EDPB STRATEGY 2024-2027 Building on the EDPB’s existing work, we will support the exchange of information and cooperation among EEA data protection authorities active in international forums.

We will also continue to engage with the international community, promoting high data protection standards and reinforcing the EDPB’s involvement in international discussions. We will, in particular, participate in the global dialogue on data transfers, access to personal data by public authorities and emerging technologies. The EDPB will further facilitate and strengthen cooperation between the members of the EDPB and non-EU countries’ data protection and privacy authorities. In this context, we will increase our efforts relating to our contributions on international cooperation and supporting enforcement, and further develop our current approaches. We will continue working on the GDPR and the LED data transfer mechanisms, including their commonalities with, impact on, and role in the global dialogue. We will continue to focus on specific GDPR tools, including the EDPB’s roles in the adequacy decision, certification, code of conduct and binding corporate rule procedures, and we will provide further guidance on the practical implementation of those tools.

1 KEY ACTION 2 KEY ACTION 3 The EDPB and its members will continue to promote a global dialogue on privacy and data protection, endorsing the effective protection of data subjects’ rights and recognising that data does not stop at the EU border. This includes a focus on the international community and supporting cooperation on enforcement amongst EU and non-EU authorities. 4 EDPB STRATEGY 2024-2027 Contributing to the global dialogue on data protection