EDPB Article 97 GDPR application report: GDPR successful but improvements needed

1 Adop ted Contribution of the EDPB to the report on the application of the GDPR under Article 97 Adopted on 12 December 2023 2 Adop ted 3 Adop ted Ge neral EDPB policy messages 1 The application of the GDPR in the first 5 and a half years has been successful. The GDPR has strengthened, modernised and harmonised data protection principles across the EU. Awareness of data protection rights and obligations was raised significantly among data subjects, as well as public and private organisations. Additionally, supervisory autho rities (SAs) 2 are using their investigative and corrective powers whenever appropriate and have reinforced their cooperation. The GDPR is also contribut ing to an increased global visibility of the EU legal framework and is often considered as a model by countries outside the EU who are revising their own legal framework , or adopting data protection legislation for the first time Since 2018 , the EDPB has consolidated its position as the EU body in charge of ensuring the consistent application of the GDP R , making use of the full set of instruments at its disposal .

In this regard, the EDPB has adopted 40 guidelines and recommendations and 190 c onsistency o pinions 3 , in order to clarify fundamental provisions of the GDPR and to ensure consistency in the application of the GDPR by SAs 4 . This demonstrates the important role played by the EDPB in providing guidance to stakeholders and data subjects on key aspects of the GDPR, thus promoting and facilitating compliance with its provisions. Furthermore, the ED PB built a framework in order for new compliance tools such as codes of conduct and certification mechanisms to become operational in a consistent manner and thereby facilitate compliance . T he EDPB also has a unique role in the EU digital landscape as it p rovides the dispute - resolution mechanism under the GDPR . The Board demonstrated its readiness and ability to resolve disputes between SAs on enforcement of cross - border matters and to ensure a consistent application of the GDPR , by adopting 11 Binding Decisions (Articles 65 and 66), among which 2 were urgent binding decisions .

The increasing number of cases reaching the EDPB are a logical consequence of the growing complexity and quantity of cases at the national level. Besides, t he rise in the number o f complaints and investigations by SAs , as well as the ir increasing legal and technical complexity , have also underlined the importance of cooperation in order to achieve a cons istent enforcement of the GDPR. The EDPB is convinced that effective and effici ent cooperation between data protection authorities leads to a common data protection culture and consistent enforcement practices. The EDPB considers that the existing tools in the GDPR have the potential to achieve such a goal, although this requires tha t they are used in a sufficiently harmonised way . In particular, there are several challenges while implementing the cooperation and consistency mechanism, as the EDPB underlined in the previous report 5 .

In this respect, the EDPB welcomes the draft European Commission’s Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural 1 This text has been drafted in the context of the EDPB contribution to the Commission’s report on the application of the GDPR, notably concerning Chapters V and VII of the GDPR in accordance with Article 97 GDPR. References to “EU” and “Member States” made throughout this document should be understood as references to “EEA” and “EEA Member States” respectively. 2 In some parts of this document, the abbreviation “DPA” is also used. 3 Data until 1 December 2023. 3 of this document, which provides a detailed overview. 1 of this document. 4 Adop ted rules relating to the enforcement of Regulation (EU) 2016/679 ( hereinafter ‘the Proposal on procedural rules ’) which took account of the views expressed by the EDPB in the so - called ‘Wish list’ 6 .

At the same time, the EDPB highlights the need to ensure harmonisation of the rules and efficiency of the tools , as clarified in the EDPB - EDPS Joint Opinion 1/2023 on the Proposal o n procedural rules (hereinafter ‘Joint Opinion 1/2023’). The EDPB also reiterates the need to address the existing practical obstacles to efficient cooperation between the national SAs and the EDPS 7 . Furthermore, the EDPB recalls that additional cooperati on actions in the area of GDPR enforcement are essential in order to ensure a consistent application of the law . The EDPB and the SAs are paying special attention to this matter and have committed to different actions in order to achieve this goal. Several concrete actions have been taking place following the adoption of the Vienna Statement on enforcement cooperation 8 in which the EDPB members highlighted their commitment to cross - border cooperation.

Thes e actions include the creation of case - specific taskforces, the launch of several coordinated enforcement actions , the Support Pool of Experts, the adoption of a templ ate for complaints 9 , and the exchange of information on national enforcement strategies in order to agree on annual enforcement priorities at EDPB level. T he SAs have also committed to prioritis ing cases of strategic importance and tak ing the necessary act ions to ensure efficiency and a transparent and timely exchange of information and discussions. Additionally , SAs agreed to an increased use of consistency opinions by the EDPB in order to provide clarity on matters of general application. The EDPB and th e SAs will continue their efforts in enhancing enforcement cooperation and achieve more efficient and consistent results within the current legal framework, including with the further harmonisation that will be provided by the Proposal on procedural rules.

There are , however , considerable challenges ahead. The technological landscape is continuously evolving and new technologies emerge regularly . The GDPR fully applies to emerging technologies and provides rules which foster innovation while, at the same time, ensur ing the protection of personal data. The EDPB and SAs will continue to develop guidance on new and emerging technologies and are following regulatory developments closely. The importan ce of data in the digita l economy is undeniable and new legislation ha s been introduced which provide additional rules to create a safer digital space, establish safe data sharing or access and a level playing field for businesses. In the context of those laws , new responsibiliti es may be placed upon the SAs and/ or EDPB with regard to the supervision an d enforcement of new legal acts, such as the D ata G overnance A ct (DGA) , D igital S ervices A ct (DSA) , D igital M arkets A ct (DMA) and the 6 See EDPB Letter to the EU Commission on procedural aspects that could be harmonised at EU level sent on 10 October 2022.

eu/our - work - tools/our - documents/letters/edpb - letter - eu - commission - procedural - aspects - could - be en 7 See Section 9 of the EDPB - EDPS Joint Opinion 1/20 23. 8 EDPB Statement on enforcement cooperation adopted on 28 April 2022. pdf 9 Template Complaint form and Template Acknowledgement of receipt adopted on 20 June 2023. 5 Adop ted Proposal for an A rtificial I ntelligence Act 10 . However, it is important to note that the resources of the SAs and EDPB are not increasing at the same pace as their responsibilities and tasks. In addition, there is a lack of harmonisation with regard to the powers of the SAs under the new regulations adopted in the context of the Commission’s Digital Strategy and the European Data Strategy . This lack of clarity in the implementation of the power s of the SAs may lead to fragmentation and legal uncertainty on the supervision and enforcement of those regulations.

Therefore, it is of the utmost importance that all SAs are provided with sufficient resources by the Member States to carry out their tasks effectively . T he EDPB, meanwhile, is also entrusted with new tasks under new legal acts and its tasks under the GDPR continue at an increased intensity . In particular , its role provid ing the dispute - resolution mechanism has increased significantly and wi ll likely continue to do so as enforcement is growing at 10 Respectively: Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on Europea n data governance and amending Regulation (EU) 2018/1724 ; Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC ; Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 and the Proposal for a Regulation of the European Parliament and the Council laying down harmonised rules on artificial intelligence.

11 See Section 6 of this document on promoting awareness. 4 . 6 Adop ted national level . I ts role as the body in charge of ensur ing the consistent application of the GDPR is gaining even more significance, with the adoption of a high number of consistency Opinions , Bindin g Decisions and guidance since the entry into application of the GDPR. Finally, given the impact of its decisions which weigh in on difficult legal questions and on the amounts of significant fines eventually imposed by the SAs , the EDPB is facing a significant number of legal challenges before the EU Courts . Therefore, it is also essential to ensure that the EDPB Secretariat is provided with the necessary resources, as it plays a key role in the preparation and execution of many of the current and future tasks entrusted to the EDPB under EU legislation 14 , and thus in harmonising the guidance, procedures, enforcement processes and practices of SAs across Member States .

Regarding international transfers , the EDPB expects the Commission to finalise its work on the review of the adequacy decisions adopted under Directive 95/46/EC. It also underlines the importance to continue to develop, expand and multiply adequacy decisions with third countries and international organisations . The EDPB will continue to pay special attention to the correct implementation of the recent adequacy decisions and will contribute to the evaluation of current adequacy decisions and the adoption of future ones . With regard to transfer tools under Article 46, the EDPB recalls the adoption of several documents aimed at providing guidance 15 , as well as its swift reaction after the Schrems II judgement to provide clarity with regard to the supplementary measures that may complement transfer tools. The EDPB welcomes the adoption by the Commission of the new set of SCCs and welcomes its commitment to develop SCCs covering transfers to controllers and processors subject to Article 3(2) GDPR.

T he Commission should also consider the development of SCCs that cover transfers to international o rganisations and take into account the specificities of these organisations . The EDPB further encourages the Commission to continue developing international cooperation for the protection of personal data and underlines the importance of effective enforcem ent cooperation . Finally, the EDPB underlines the continuous need to ensure that trade agreements are not used to challenge existing and future EU law on the protection of personal data and privacy, which are fundamental rights in the EU. In conclusion, 5 and a half years after the entry into application of the GDPR, the EDPB takes a positive view of the implementation of the GDPR including its capacity to also stand the test of new technological and societal developments. Therefore, the EDPB considers that there is no need to revise the legislative text at this point in time .

The EDPB calls upon the EU legislators, as well as the Europ ean Commission, to work towards greater clarity and homogeneity as to the new roles and powers entrusted to the SAs and the EDPB under new legislation , and to take the necessary actions to ensure that SAs and the EDPB have sufficient human, technical and financial resources. The adoption of the new Regulation laying down additional procedural rules relating to the enforcem ent of the GDPR should also be given priority, taking into consideration the proposals of the EDPB and EDPS in Joint Opinion 1/2023. 14 Including in the context of new legal acts such as the Data Governance Act and the Data Act, which envisage a specific role for the EDPB within the European Data Innovation Board. 15 See section 3 on international transfers . 7 Adop ted Questionnaire on the application of the GDPR under Article 97 Contribution of the European Data Protection Board 16 In addition to the general policy messages above, the EDPB would like to provide a synthesis of the contributions and replies provided by its members to the Questionnaire sent by the European Commission.

This allows the EDPB as a single body to convey some additional messages with a n EU - wide perspective. 3. CHAPTER V The elements presented below constitute a summary answer of the EDPB’s gener al view on the international transfer tools as a response to the Commission’s questions , while specific answers to these questions can be found in the national contributions. Adequacy decisions Adequacy decisions are a durable means to ensure the continuo us protection of personal data transferred from the EEA to third countries and international organisations . In this context: - The EDPB welcomes the interest of third countries and international organisations to engage with the EU in the context of an adequacy decision and the subsequent evaluation of relevant data protection frameworks by the Commission. - The EDPB expects the Commission to finalise its work on the review of the adequacy decisions adopted un der Directive 95/46/EC.

- The EDPB recommends the Commission to develop , expand and mul tiply adequacy negotiations, particular ly , where feasible, with European countries that are not part of the EU , but also with other third countries and international org anisations whose legal framework s are essentially equivalent to that in the EU. In this context, countries who play an important role in the global digital economy and to which a particularly large amount of personal data is transferred from the EEA should be especially taken into consideration. 16 With reg ard to Section 3 of the EDPB Contribution, it reflects the input provided by the national SAs and the EDPS. Sections 4, 5 and 6 reflect the replies provided by the national SAs to the questionnaire sent by the European Commission. Some SAs may not gather c ertain statistics requested in the questionnaire. Thus, when specific data was not provided by the SA or is not available, it is reflected in the tables as “ - “ and in the charts as a blank space.

The EDPB further encourages the Commission to continue developing international cooperation in the framework of Article 50 GDPR agreements and underlines the importance of effective enforcement cooperation , in particular with those countries where the largest portion of the entities subject to the GDPR according to Article 3 ( 2 ) are established . Among those countries, the EDPB would like to point out the G7 countries and countries benefiting from adequacy dec isions for the negotiation of enforcement agreements . In particular , the EDPB recommends that the Commission take s due account of progress in the EU accession talks with EU candidate countries , as the gradual integration of the EU acquis in the field of data protection may facilitate t he negotiations of cooperation agreements. In this regard, the EDPB has developed a toolbox of essential data protection safeguards to be concluded in addition to or inserted in an enforcement cooperation agreement 17 .

Other transfer tools Since 2018, the EDPB supported t he deployment of new GDPR tools, such as codes of conduct and certification . It considers those new tools as promising transfer tools and encourages interested stakeholders to develop appropriate codes of conduct and certification schemes. On Codes of Conduct and Certification as tools for transfers, the EDPB has contributed to the exchange of best practices and the streamlining of the procedures via the adoption of documents and guidelines for interested stakeholders, including , among others, Guidelines 07/2022 on certification as a tool for transfers 18 , Guidelines 04/2021 on Codes of Conduct as tools for transfers 19 , the EDPB Document on the procedure for the adoption of the EDPB opinions regarding national criteria for certification and European Data Protection Seals and the EDPB Document on the procedure for the development of info rmal “Codes of Conduct sessions ’’ 20 .

eu/our - work - tools/support - cooperation - and - enforcement/consistency - and - cooperation - procedures en 9 Adop ted The EDPB further recalls its work on the Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR 21 and Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance wi th the EU level of protection of personal data 22 . C ontractual clauses ensuring appropriate data protection safeguards can be used as a tool for data transfers from the EU to third countries, according to the GDPR. This includes standard contractual clauses (SCCs) adopted by the European Commission. The EDPB welcomes the adoption by the Commission of the new set of SCCs for data transfers from controllers or processors in the EU subject to the GDPR to controllers or processors established outside the EU and not subject to the GDPR , in 2021, following the corresponding EDPB - EDPS Joint Opinion 2/2021.

The EDPB remains committed to advise the Comm ission for the elaboration of new sets of SCCs . The EDPB welcomes the Commission ’s commitment to adopt additional sets of SCCs for data transfers to controllers or processors established outside the EU whose processing operations are direc tly subject to the GDPR, a nd recommends that it also consider s tailor - made SCCs covering transfers to international organisations . g. the Council of Europe, the Ibero - American Network, ASEAN). The EDPB considers that BCRs are a good tool for transfers available for groups of companies. Since the coming into force of the GDPR, the EDPB has adopted 80 positive Opinions on natio nal decisions approving BCRs 23 . In addition, the EDPB has updated the referential and application form for controller BCR s 24 , building upon the agreement reached by the SAs in the course of BCRs’ approval procedures and providing additional guidance.

Current ly, the EDPB is conducting the same exercise with regard to processor BCR s . International convergence The EDPB acknowledges the increase in cross - border transfers of data through the globalization of economic and social activities, due to the ubiquitous op portunities offered by digital technologies. While recognizing the benefits that may arise from cross border transfers of data, the EDPB also highlights that these transfers may raise serious challenges to the protection of personal data and privacy. In th is context, the EDPB takes note of the different international initiatives and ongoing work in various international forums. The EDPB emphasi s es that ensuring ‘trust’, including a high standard of protection of personal data , is a fundamental requirement and prerequisite to facilitate the free flow of data. eu/our - work - tools/our - documents/guidelines/guidelines - 052021 - interplay - between - application - article - 3 en 23 This information reflect s figures until 1 December 2023.

eu/our - work - tools/our - documents/recommendations/recommendations - 12022 - application - approval - and en 10 Adop ted In this respect, the EDPB underlines the continuous need to ensure that trade agreements cannot be used to challenge existing and future EU law on the protection of person al data and privacy, which are fundamental rights in the EU. The EU’s horizontal provisions for cross - border data flows and for personal data protection, which the Commission has repeatedly stated as non - negotiable, allow the EU to include measures to faci litate cross - border data flows in trade agreements while preserving individuals’ fundamental rights to data protection and privacy. 4. 1. 1. One - stop - shop mechanism (OSS) - Article 60 GDPR Since 2018, the EDPB has continued work ing on constantly improving cooperation within the existing legal framework and ensuring its efficiency . This work is also based on the significant ly increased experience of the SAs with the one - stop - shop mechanism since the beginning of the GDPR’s applica tion .

In the 2019 evaluation report, the EDPB identified a number of challenges in the framework of the OSS mechanism, namely the different national administrative procedures, the different interpretations of concepts relating to the cooperation mechanism and the diverging approaches of the Lead Supervisory Authorities ( LSAs ) as regards the start of the cooperation procedure, the timing of involvement of the Concerned Supervisory Authorities ( CSAs ) and the communication of relevant information to them. In order to remedy the problems identified, the EDPB has, as committed, further clarified the applicable procedural steps under Article 60 GDPR and worked towards a common interpretation of key concepts and terms of the OSS mechanism and the cooperation proce dure. 2 GDPR 25 T he figures corresponding to the year 2023 may not be final in several instances, since the data was collected before the end of the year and, therefore, is still subject to changes .

When data was not provided or is not available, it is reflected in the table s as “ - “ and in the graphs as a blank space. If an SA has not provided any data for a specific question, it is not included in the table/graph. 11 Adop ted  Template Complaint form In addition, during a high - level meeting in Vienna in April 2022, the EDPB members agreed to further enhance cooperation on strategic cases and to diversify the range of cooperation methods used. Following the meeting, the EDPB adopted a Statement on enforcement cooperation 26 reiterating their commitment to strengthened cross - border cooperation and started implementing targeted actions to enhance cooperation further, such as the identification of strategic cases for which cooperation is prioritised. An important outcome of the meeting was the decision to draf t a list of concrete aspects in national procedural law that the EDPB wishes to see harmonised at EU level in order to maximise the positive impact of GDPR cooperation .

This so - called ‘W ish list’ was sent to the European Commission for its consideration on 10 October 2022. The European Commission took swift action and on 4 July 2023, it published the Proposal on procedural rules . The EDPB and EDPS were formally consulted in accordance with Article 42(2) of Regulat ion (EU) 2018/1725 and adopted Joint Opinio n 1/2023 on 19 September 2023. As highlighted in this Joint Opinion , the EDPB very much welcomes that the Proposal o n procedural rules aims to foster effective enforcement of data protection rules and ha rmonis e the rights of the parties , and intends to giv e effect to many of the suggestions contained in the EDPB ’s ‘ W ish list’. The EDPB also welcomes the Proposal’s objective to strengthen consensus finding at an early stage. However, the EDPB and EDPS ma d e detailed recommendations for improvement that would allow the new Regulation to attain the objectives pursued.

In the context of the current evaluation, f ollowing the request made by the European Commission, the EDPB also gathered some relevant statistics on the OSS mechanism, collected on the Internal Mar ket Information system ( IMI ), which is used to ensure the cooperation with the data protection authorities. 1 The functioning of the OSS and statistics 27 Number of procedures launched to identify the LSA and CSAs It should be recalled from the outset that , when a processing is of cross - border nature ( within the meaning of Art icle 4(23) GDPR), there is a need to identify the LSA and the CSAs that will be involved in the cooperation process. A dedicated workflow has been provided within IMI to facilitat e exchanges and decision - making by SAs on this matter. eu/our - work - tools/our - documents/statements/statement - enforcement - cooperation en 27 The statistics collected by the EDPB on IMI reflect the state of play until 3 November 2023.

12 Adop ted As reflected in the table below 28 , between 25 May 2018 and 3 Novemb er 2023, 3813 procedures were initiated to identify the LSA and CSAs. SAs from all Member States 29 have been identified at least once as an LSA or a CSA. Number of case entries in the Case register Between 25 May 2018 until 03 November 2023 , 2397 case entries have been registered in IMI. All the cases with a cross - border component are registered in a central database (IMI Case register) from which cooperation and consistency procedures can be initiated. Not all cases which are registered in Case register concern One - stop - shop procedures. R eferences to case register entries in these statistics do not have a 1 - to - 1 correlation to the number of cross - border complaints handled per country as multiple complaints may be bundled in one case register entry , depending on the SA’s practices. Thus, a single case entry may relate to multiple cross - border cases and may lead to several national decisions 30 .

In addition, the IMI case register does not include those cross - border cases that are still in the preliminary phase of identifying the roles of the LS As and CSAs and not all cross - border complaints filed at individual SAs may have been uploaded onto IMI yet. Therefore the IMI statistics may differ from the national reporting by the SAs as the national case management systems are usually organised around the individual complaints. A n entry in the Case register may: • refer to one complaint and can lead to Article 60 procedure; • refer to several complaints and in consequence can lead to the several Article 60 procedures and therefore to several SA decisions ; 28 When data was not provided or is not available, it is reflected in the tables as “ - “ and in the graphs as a blank space. If an SA has not provided any data for a specific question, it is not included in the table/graph. 29 References to “Member States” mad e throughout this document should be understood as references to “EEA Member States”.

30 An entry in the case register may also be done for launching a Mutual Assistance request of general nature, which will not lead to any SA decision. Therefore, the numbe r of case entries does not, in itself, provide information on the cooperation behind them but rather reflects the way in which SAs organise their work in the IMI. e. for transferring the complaints that do not concern the cross - border processing in accordance to Article 4 (23) GDPR and in consequence does not lead to Article 60 procedure. The number of decisions under Article 60 GDPR The IMI system offers different steps to follow when handling Article 60 procedures: • informal consultation to exchange information and enable the cooperation between involved SAs prior to the submission of the draft decision ; • draft decision submitted by th e LSA to the CSAs which triggers the formal OSS procedure; • revised draft decision submitted by the LSA to the CSAs in case the CSAs raised (a) relevant and reasoned objection(s); • final decision submitted to all EDPB members.

Between 25 May 20 18 and 3 Novem ber 20 23 , LSAs issued 1436 draft decisions under Article 60(3), out of which 990 resulted in final decisions under Article 60(6). The detailed breakdown is available below 31 . *UK: Prior to leaving the EU and the EDPB 31 When data was not provided or is not available, it is reflected in the tables as “ - “ and in the graphs as a blank space. If an SA has not provided any data for a specific question, it is not included in the table/graph. e. cases involving cross - border processing that have only local imp acts in the Member State of the SA where the complaint was first lodged or that first detected a possible infringement , which enables the SAs to agree that the local competent SA will handle the complaint, instead of the LSA . The SAs used the Article 56(2) GDPR procedure 107 times. The detail ed breakdown is available below 32 . *UK: Prior to leaving the EU and the EDPB 32 When data was not provided or is not available, it is reflected in the tables as “ - “ and in the graphs as a blank space.

If a n SA has not provided any data for a specific question, it is not included in the table/graph. 807 772 554 583 581 1129 847 612 859 748 940 567 556 731 443 528 897 526 570 613 582 540 759 840 822 673 561 819 583 688 248 0 200 400 600 800 1000 1200 AT BE BG CY CZ DE DK EE ES FI FR GR HR HU IE IS IT LI LT LU LV MT NL NO PL PT RO SE SI SK UK* Number of Article 60 Draft Decisions Received per Concerned SA* 2 15 11 15 1 6 2 1 7 12 2 7 1 4 13 1 1 6 0 2 4 6 8 10 12 14 16 CZ DE DK ES FI FR GR HU IE IT MT NL NO PL RO SI SK UK* Number of Article 56(2) procedures initiated by SAs* 15 Adop ted *UK: Prior to leaving the EU and the EDPB Following the question raised by the European Commission, o nly 4 SAs had comment s with respect to the identification and handling of local cases under Article 56(2) GDPR. One SA shared that it is sometimes difficult to distinguish Art icle 56(2) GDPR cases from non - cross - border processing cases because if a case can be identified as a local one, it coul d also be interpreted as a non - cross - border case .

An SA highlighted the practical importance of the local cases procedure, especially for smaller enforcement actions, and stressed it would be useful to have it clarified further , including for the case of groups of undertakings. The same SA also considers that the absence of an objection by the LSA should be interpreted as sufficient for the competent SA (CompSA) to proceed. Another SA expressed the view that, when the LSA has decided not t o handle a case in accordance with Art icle 56(5) GDPR, the IMI system should provide a mechanism preventing other SAs from declaring themselves as concerned SAs (CSAs) . I n their view, t he fact that other SAs declare themselves as CSAs should not bring into question the assessment made by the receiving SA , as the competent SA, and the LSA when deciding to handle the case as a local one . Finally, one SA pointed out that the time required for obtaining the views of the LSA has usually been considerable and there have been several exchanges of documents and information even after the initial submissions .

3 Did you raise relevant and reasoned objections? SAs from 1 8 Member States have indicated that they have raised relevant and reasoned objections in accordance with Article 60( 4 ) GDPR . 2. Mutual assistance The GDPR provides the possibility for SAs to provide mutual assistance to each other, sending, for instance , relevant information and request s for supervisory measures, as well as requests to carry out prior authorisations and consultations, inspections and investigations. In the IMI system, two choices are offered to SAs, either to rely on a “Formal Mutual Assistance request” under Article 61 GDPR , which entails a legal deadli ne of 1 month to reply to the request received or to rely to an “Informal Mutual Assistance request”, which will not be framed by this legal deadline but it is rather based on the general spirit of good cooperation. The SAs have triggered 971 procedure s under Article 61 GDPR (“Formal Mutual Assistance”) .

Furthermore, the SAs have launched 12313 procedures to assist each other on a voluntary basis (“Voluntary Mutual Assistance”) . While designing the GDPR modules in IMI, SAs introduced this procedure to enable a more flexible mutual assistance for matters not needing a tight deadline, as it is based on the general principle of cooperation between SAs. A detailed breakdown is provided below 34 . Article 61 Formal Mutual Assistance 34 When data was not provided or is not available, it is reflected in the tables as “ - “ and in the graphs as a blank space. If an SA has not provided any data for a specific question, it is not in cluded in the table/graph. 1 Did you ever use the Formal Mutual Assistance in the case of carrying out an investigation? Most of the SAs (83%) already used the Formal Mutual Assistance in the case of carrying out an investigation. 2 Could you explain why you have never used Mutual Assistance - Article 61 procedure for carrying out an investigation?

All SAs used Voluntary Mutual Assistance for carrying out an investigation . T he few SAs that have never used Formal Mutual Assistance in the co ntext of an investigation found the voluntary mutual assistance mechanism more appropriate to deal with their cases. 3 Did you ever use this tool in the case of monitoring the implementation of a measure imposed in another Member State? Eight SAs from eight Member States used this tool for monitoring the implementation/enfo rcement of a measure imposed in another Member State. 4 Could you explain why you have never used Mutual Assistance - Article 61 procedure for monitoring the implementatio n of a measure imposed in another Member State? The SAs that have never used the Formal Mutual Assistance for monitoring the implementation of a measure imposed in another Member State generally did not find it relevant or necessary for that particular purpose .

5 What is your experience when using Mutual Assistance - Article 61 procedure? The vast majority of SAs find the Formal Mutual A ssistance a very useful tool for cooperation to either receive information or initiate actio n with other authorities and have not encountered any particular obstacle in applying the Mutual Assistance P rocedure . 608 77 20 64 103 2036 265 65 395 126 578 36 11 278 4245 51 202 21 180 444 15 314 635 221 829 12 40 177 107 158 0 500 1000 1500 2000 2500 3000 3500 4000 AT BE BG CY CZ DE DK EE ES FI FR GR HR HU IE IS IT LI LT LU LV MT NL NO PL PT RO SE SI SK Number of Initiated Voluntary Mutual Assistance procedures 19 Adop ted The voluntary mutual assi stance exchange, not entailing a legal deadline and strict duty to answer, is more frequently used and generall y effective. In this regard, while the use of the 'formal' mutual assistance is more limited because of the possible legal consequences in case of non - compliance with an assistance request, SAs usually rely on the 'Voluntary' Mutual Assistance to inform an other SA about a received complaint concerning a private body or a non - public body, to submit legal inquiries or to provide updates on the state of play of a case, exchange documents or request other kinds of information and assistance.

Lastly, o ne SA pointed out that clarifications on certain aspects of Mutual Assistance under Article 61 GDPR are necessary, but that the Mutual Assistance Request Guidance that the EDPB is working on is expected to be able to provide most of those clarifications. 3. 1 Did you ever use this tool (both receiving staff from another DPA or sending staf f to another DPA) in the case of carrying out and investigation? Five joint operations have been initiated on which SAs from 7 Member States have been involved in total. 2 Could you explain why you have never used Joint Operations - Article 62 procedure for carrying out an investigation? The vast majority of the SAs that have never used Joint Operations procedure for carrying out an investigation did not find it relevant or necessary in the context of the cases they dealt with. Three SAs highlig hted the lack of enough resources in order to use the Art 62 procedure.

Two SAs pointed out the practical and legal obstacles mostly under national law including the lack of national provisions implementing Article 62 GDPR 35 , while one SA noted the lack of clarity regarding 35 In particular, the AT SA underlined that the national law does not contain any provision implementing Article 62 GDPR. The BE SA also referred to the legal obstacles under national law. 20 Adop ted the application of the procedures and the complexities of the procedure that requires lo ng preparations and paper work. 3 Did you ever use Joint Operations in the case of monitoring the implementation/enforcement of a measure impose d in another Member State? No SAs have use d Joint Operations in the case of monitoring the implementation/enforcement of a measure imposed in another Member State . 4 Could you explain why you have never used Joint Operations - Article 62 procedure for implementation/enforcement of a measure imposed in another Member State?

The vast majority of the SAs that have never used Joint Operations procedure for implementation/enforcement of a measure imposed in another Member State did not find it appropriat e for that purpose . Some SAs repeated the lack of sufficient resources. 5 What is your experience when using Joint operations - Article 62 procedure? The SAs do not have enough practical experience to reply to this question. However, three SAs involved in a strategic case for which this procedure was used agreed that , so far , the experience has been very positive from both a legal and a technic al perspective. One of them noted that the EDPB approved format fo r a Joint Operation Action Plan 36 strikes a good balance between , on the one hand, the required structure to work together, and on the other hand , an appropriate degree of freedom to make appropriate work plan for the case at hand. Another SA pointed out that the A rticle 62 procedure has been used to handle cooperation also outside of the OSS mechanism.

In contrast , one SA found the procedure very impractical mostly due to difficulties with language and some challenges in agreeing protocols. The EDPB has adopted Document 1/2021 on the application of Art icle 62 GDPR – Joint Operations in order to provide more clarity and consistency with regards to the practical implementation of this tool 37 . pdf , p. 13. 37 See Internal EDPB Document 1/2021 on the application of Article 62 GDPR – Joint Operations. 23 Adop ted The Secretariat deals with a wide range of tasks, such as: drafting EDPB documents including EDPB binding decisions and consistency o pinions, ensuri ng compliance with the legal framework applic able to the EDPB as an EU body , providing IT solutions to ensure transparent communications, handling media and press relations, planning and organising meetings and carrying out tasks related to the EDPB ’s budget and finance s . T he Litigation and International Affaires sector and the Legal Affairs - Cooperation and Enforcement sector are L egal sectors .

They provide analytical legal support wherever needed to fulfil the tasks of the Secretariat un der Article 75(6) GDPR. In particular, a large part of the legal officers’ time is de dicated to providing support to the Board in relation to the drafting of opinions 50 , binding decisions 51 and other texts adopted by the Board , pursuant to Article 75(6)(g) GDPR. T he Secretariat has, so far, led the drafting of a very significant number of documents adopted by the EDPB 52 . This includes the drafting of 10 out 11 of the binding decisions adopted on the basis of Article 65 GDPR and th e 2 urgent binding decisions adopted on the basis of Article 66 GDPR , as well as most of the EDPB opinions adopted on the basis of Article 64 GDPR . Besides , legal officers provide support in relation to litigations involving the EDPB. In particular, they d efend the EDPB decisions that are challenged before the CJEU 53 , and work on litigation cases that may have an interest for the EDPB 54 .

Other tasks carried out by the L egal sectors include, inter alia: implement ing the EDPB’s decision to further enhance enforcement cooperation on strategic cases and to diversify the range of cooperation methods used 55 ; contributing to the legal discussions in EDPB meetings ; preparing summaries of SA s ’ one - stop - shop final decision s an d making those national decisions publicly available to a wider audience 56 in a public register 57 and elaboratin g , develop ing and implement ing document management policies and procedures 58 . The legal officers’ tasks also involve administrative activities, for instance linked to communications between EDPB members, or in relation to the preparation of EDPB meetings , carried out in close cooperation with the coordinators of E xpert S ubgroups and 50 Adopted under Articles 64 or 70 GDPR. 51 Adopted under Article s 65 or 66 GDPR. 52 In particular, EDPB Secretariat led the drafting for 67% of the documents adopted in 2018 and 2019; over 60% of the documents in 2020 and over 35% of those adopted in 2021 (including Recommendations 01/2020, the EDPB Binding Decisions and the EDPB Strategy) a nd contributed to a further 25%.

In 2022, it led the drafting of 26 documents and contributed to other 23. The figures for 2023 will be reflected in the 2023 Annual Report. 53 To date, the EDPB has been defendant in 11 cases brought by controllers before the General Court following the adoption of binding decisions; in one appeal brought by a controller before the Court of Justice following the adoption of a binding decision; a nd in one case brought by an individual following the EDPB’s refusal to access to a file. 54 For example, on the EDPB’ s application to intervene in Case C - 413/23 EDPS v SRB , which addresses the concept of ‘personal data’ . pdf . 56 Due to some national legal restrictions, not all decisions can be made publicly available or before they are made available, data concerning natural and/or legal persons needs to be redacted. eu/our - work - tools/consistency - findings/register - for - article - 60 - final - decisions en .

58 See, for example, the EDPB’s deci sion on records management (adopted on 20 September 2023). 24 Adop ted Taskforces and with the Chair for Plenary meetings , and with the support of the Administrative Matters sector. In addition to the core tasks of the EDPB Secretariat defined by the GDPR, its staff assists the EDPB with its compliance obligations. In practice, three legal officer s are entrusted with DPO activities in addition to their other legal responsibilities , two staff members are also in charge of information security (LISO), and the legal officers support the transparency officer to handle requests for public access to documents under Regulation 1049/2001. Besid es , legal of ficers work on r equests for information and media enquiries and regularly present the activities of the EDPB in external engagements. Furthermore, the EDPB Secretariat provides the Secretariat of the Coordinated Supervision Committee ( CSC) 59 .

At the moment, 4 legal officers provide analytical and administrative support to the C SC in addition to their other tasks within the E DPB Secretariat. 351 physical, hybrid and remote EDPB meetings since 2020) 60 , and coordinating the translation and proofreading of all off icial EDPB documents in all official EU languages pursuant to Article 75(6) (e ) and (f) GDPR. The tasks of the Administrative Matters s ector also include, among others, the management of the members’ contact lists for efficient and secure communication; the operational initiation of financial files , for instance linked to public procurement ; participation in the preparation, monitoring and rev iew of the EDPB budget as well as its implementation; and collaboration with the EDPS, the European Commission and the European Parliament on matters of administration and service provided to the EDPB. The IT Matters sector develops, suppo rts and enhances the IT systems for internal and external communications of the EDPB , in line with Article 75(6)(d) GDPR .

I t also provides IT services for the EDPB S ecretariat ’s functioning . With the external consultants ’ help , the IT sector manages E DPB IT Tools 61 , including the provision of comprehensive training and user guides; compiling relevant usage statistics ; and providing of IT support for the organisation of EDPB meetings , such as the plenary voting system. The Information and Communications sector aims a t ensur ing transparent and timely communication with third parties. Its tasks, in light of Article 75(6)(c) GDPR, cover inter alia : day - to - day media relations and drafting and distributing press releases; coordinatin g external communications with the EDPB communications network which gather s the communications officers of the EDPB members ; ensuring 59 The C SC was formally established within the framework of the EDPB in December 2019. It is a group o f national supervisory authorities and the European Data Protection Supervisor (EDPS) to ensure coordinated supervision of large scale IT systems and of EU bodies, offices and agencies, in accordance with Article 62 of Regulation (EU) 2018/1725 or with the EU legal act establishing the large scale IT system or the EU body, office or agency.

In line with the MoU agreed with the EDPB, the EDPS is responsible for ensuring that the EDPB receives adequate human resources , working place and infrastructure, financial resources and support where needed. To that effect, 7 EDPS FTEs under EDPB budget provid e the support to the EDPB and its Secretariat in relation to : finance and procurement, HR, other horizontal matters (including building management, ethics, internal control and liais on with different auditing stakeholders) , and graphic design. b. e. opinions and binding decisions. The Secretariat has played a key role in shaping the Article 65(1)(a) GDPR 63 procedure and methods for the preparation and drafting of the binding decisions, including the work on the relevant EDPB guidelines 64 . Often, EDPB binding decisions concern high profile cases leading to the imposition of large administrative fines. The questions that are subject to EDPB dispute resolution require a careful legal analysis and in - depth discussions among the members of the EDPB within a tight legal timeframe .

Consequently, whenever a LSA request s a binding decision to the EDPB, the legal officers working on such request have to dedicate all or most of their time to this process and most of their regular tasks must be allocated to other legal officers, which creates a very high work pressure on the whole Secretariat 65 . The first step in the process is assessing the completeness of the file submitted by the LSA in order to make sure that the EDPB has all i nformation necessary to adopt a binding decision, as well as to ensure compliance with Article 41 of the Charter 66 . 5 FTEs 67 , for an average duration of 3 months. The assessment of the completeness of the file by the EDPB Secretariat on 62 A rticle 10(6) and 11(5) of the EDPB Rules of Procedure, as last modified on 6 April 2022. 63 No binding decisions pursuant to Article 65(1)(b) and 65(1)(c) GDPR have been adopted by the EDPB so far.

64 EDPB Guidelines 09/2020 on RROs, where the Secretariat was lead rapporteur, and EDPB Guidelines 03/2021 on Article 65(1)(a), where the Secretariat was co - rapporteur. 65 While this was an occasional activity that started in 2020, with 1 or 2 cases a year, since 2022, the impact of this activity on the rest of legal act ivities was more important, with 3 to 5 decisions in a year. 66 EDPB Guidelines 03/2021 on Article 65(1)(a), paragraph 18, 25. 67 Binding decisions cover different legal questions to address and in order to meet the legal deadlines, the work has to be split between different legal officers, which are working in very close cooperation with each other’s. 26 Adop ted behalf of the Chair 68 has taken, on average, 1 month and 2 weeks 69 . In 2023, the average time for this assessment was 1 month. Once the completeness phase is over , the preparation of a binding decision under Article 65(1)(a) GDPR includes assess ing the admissibility of the objections raised by the concerned SAs ( in this regard, a proposal is usually prepa red by the EDPB Secretariat , and then discussed by the EDPB members), drafting the text of the binding decision which is then discuss ed with the EDPB members, and that lead s to its adoption at an EDPB plenary meeting.

Un til now, the work of the EDPB Secretariat has always enabled the EDPB to meet the tight 70 legal deadline for the adoption of the binding decision (normally one - month deadline , extendable to 2 months). The EDPB Secretariat may also need to devote resources to Article 65 files that do not, in the end, lead to a binding decision as the file is eventually withdrawn by the referring SA. For instance, an Article 65(1)(b) GDPR procedure was triggered by an SA that eventually withdrew it, hence it did not lead to t he adoption of a decision by the EDPB. 2 FTEs worked on this file for the 2 months duration between submission and withdrawal , including on the assessment of the completeness of this file , the analysis and presentation of the subject matter and on the related exchanges with the SA s . 25 FTE during that period . The preparation and adoption of urgent binding decisions or urgent opinions under Article 66 GDPR require a n even more intense workload on the side of the Secretariat, given the shorter timeframe afforded by the GDPR (two weeks) 72 .

5 FTEs , for an average duration of 1 month. Such duration cov ers an average of 2 weeks 74 to assess the completeness of the file by the EDPB Secretariat on behalf of the Chair 75 , and the 2 - week 68 So far, the procedure s under Article 65(1)(a) and Article 66(2) GDPR led to the adoption of 11 binding decisions. For each of them, the EDPB Secretariat, w hen assessing the completeness of the file on behalf of the Chair, identified information and/or documents missing in order to enable the EDPB members to have all the elements of fact and law to make a decision on the case at hand. This information and/or documents was requested by the EDPB Secretariat to the LSA, or another CSA, as appropriate. ). Therefore, the time referred to also includes the time that it took for the SAs to provide the information requested. 69 This average duration of the completeness of the file by the EDPB Secretariat also includes one request for a binding decision under Article 65(1)(a) GDPR that was eventually withdrawn by the LSA, hence that did not lead to the adoption of a decision by the EDPB.

70 Binding decisions usually relate to complex legal questions on which the LSA and the CSAs did not manage to find consensus. There is no limi t on the objections that can be raised by CSAs, nor a limitation of CSAs having the opportunity to raise objections. Therefore, this may lead to an important number of legal questions to be addressed within the legal deadline. 71 Including 3 months preparatory work prior to submission and 1 month follow up after the procedure was withdrawn. 72 The two weeks deadline starts running when the file is considered complete by the Chair of the EDPB and the SA that submitted it, and shared with the all the ED PB members. 73 So far, no SA has requested the EDPB to adopt an urgent opinion under Article 66(3) GDPR. 74 This average duration of the completeness of the file by the EDPB Secretariat also includes one request for an urgent binding decision that was event ually withdrawn by the requesting SA, hence that did not lead to the adoption of a decision by the EDPB.

75 So far, the procedure under Article 66(2) GDPR led to the adoption of 2 urgent binding decisions. For each of them, the EDPB Secretariat, when asses sing the completeness of the file on behalf of the Chair, identified information and/or documents missing in order to enable the EDPB members to have all the elements of fact 28 Adop ted DE: The figures reflect a sum of the data provided by most of the DE SAs. Three DE SAs did not provide figures. Thus, t he total number for Germany is higher. BE: The SA underlined the challenges due to the lack of resources . The figure provided is a very broad estimate and corresponds to the time currently allocated to the EDPB activities. DK: The SA started registe ring time on each task in 2023. It is not possible for the SA to separate the time allocated to EDPB activities from other international activities in the previous years. 4. Human, technical and financial resources for effective cooperation and participation to the consistency mechanism As already underlined in the previous report, t he EDPB notes that the effective application of the GDPR and the success of the one - stop - shop mechanism is largely dependent on the time and resources that SAs have at their dispo sal.

It is therefore of the utmost importance that the Member States provide SAs with strengthened human, financial and technical resources. This would enable the SAs to perform their increased missions properly and meet the expectations of the legislator and of the public. The need for sufficient resources also applies to the EDPB Secretariat, which plays a key role in the preparation and execution of many of the tasks entrusted to the EDPB. The resources of the EDPB Secretariat ha ve a direct impact on th e efficiency of the EDPB but also on the possibility for the EDPB to support SAs national enforcement activities and to create synergies on this matter. 1 How many staff (full - time equivalent) has your DPA? 78 CZ SA : 17% of the staff of the CZ SA is entrusted to activities unrelated to data protection. 78 When data was not provided or is not available, it is reflected in the tables as “ - “ and in the graphs as a blank space.

Some SAs have barely seen their budget increase, whereas one SA has even less budget, despite the increase of tasks. 3 Is your DPA dealing with tasks beyond those entrusted by the GDPR, including under the new EU legislation adopted under the Data Strategy? Whereas GDPR - related tasks still have a prominent role in the tasks carried out by the SAs, all the SAs carry out other tasks beyond those entrusted by the GDPR. 5 . Please explain, if needed The majority of the SAs have underlined their tasks regarding the supervision and enforcement of the Law Enforcement Directive ( LED ) 81 , the enforcement of the national legislation implementing the Directive on privacy a nd electronic communications (e - Privacy Directive) 82 and the coordinated supervision of EU agencies and large - scale systems. There are discrepancies regarding the tasks entrusted to SAs under new EU legislation adopted in the framework of the Data Strategy remain .

Some SAs are already in charge of new tasks under the DSA , the DMA or the DGA , whereas a similar 81 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detectio n or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA 82 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) as amended by Directive 2006/24/EC and Directive 2009/136/EC 107% 62% 100% 130% 8% 26% 93% 31% 39% - 15% 33% 11% 64% 16% 67% 1% 58% 34% 52% 36% 62% 23% 84% 25% 48% 58% 17% 6% -40% -20% 0% 20% 40% 60% 80% 100% 120% 140% AT BE BG CY CZ DK EE FI FR GR HR HU IE IS IT LI LT LU LV MT NL NO PL PT RO SE SI SK Purcentage Increase Percentage increase of budget for different SAs between 2020 and 2024 32 Adop ted number of SAs expressed uncertainty on whether and if so, the type of tasks they will be entrusted to perform in that respect, as well as with regard to the Proposal for an AI Act and the Data Act 83 .

The lack of harmonisation in this regard may lead to lega l uncertainty and discrepancies in the application and enforcement of the relevant legislation 84 . Some SAs also mentioned other tasks they perform on the basis of EU legislation, such as the PNR Directive 85 , Regulation 2021/1232 on a temporary derogation fo r the purpose of combating online child sexual abuse 86 , Regulation 2019/ 493 regarding the protection of personal data in the context of elections to the European Parliament 87 and the Whistleblowing Directive 88 , among others. Finally, a variety of other task s are assigned to them by national laws. For example, several SAs underline that they are also in charge of requests for access to documents, supervision of credit information or of national security activities, among others. A more detailed overview is pr ovided by the individual answers of the SAs. 6 How would you assess the sufficiency of the resources from your DPA from a human, financial and technical point of view?

87 Regulation (EU, Euratom) 2019/493 of the European Parliament and of the Council of 25 March 2019 amending Regulation (EU, Euratom) No 1141/2014 as regards a verification procedure related to infring ements of rules on the protection of personal data in the context of elections to the European Parliament . 88 Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law . 7 Is your DPA properly equipped to contribute to the cooperation and consistency mechanisms? More than half of the SAs (57%) stated that they are not properly equipped to contribute to the cooperation and consistency mechanism. 8 How many persons (FTE) work on the issues devoted to the cooperation and consistency mechanisms? 89 The number of staff members working on these matters varies among the SAs. A breakdown is provided below.

One SA clarified that a nonymous repo rts are also accepted and may give rise to investigations, but are not considered or counted as complaints as such . g. eu/our - work - tools/our - documents/ other/template - complaint - form - and - template - acknowledgement - receipt en . 1. 100 When data was not provided or is not available, it is reflected in the graphs as a blank space. If an SA has not provided any data for a specific question, it is not included in the graph. 2. 1 The number of “own - initiative” investigations launched by your DPA since 25 May 2018 101 The number of own - initiative investigations launched varies among SAs. Several factors may impact the possibility and/or suitability to launch an own - volition investigation , includi ng the availability and amount of resources . However, it is clear in the graph below that a significant number of investigations have been launched at the initiative of the SAs.

101 When data was not provided or is not available, it is reflected in the tables as “ - “ and in the graphs as a blank space. If an SA has not provided any data for a specific question, it is not included in the table/graph. 3. 1 The number of decisions in which you used your corrective powers 103 103 When data was not provided or is not availa ble, it is reflected in the graphs as a blank space. If an SA has not provided any data for a specific question, it is not included in the graph. 2 The number of t imes you used any other corrective power other than fines. Please specify the type of measure by reference to Article 58(2) GDPR 104 The data provided in the table below shall be read with respect to the following categories: 1) Issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation 2) Issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation 3) Order the controller or the processor to comply with the data subject's requests to exercise his or her rights pursuant to this Regulation 4) Order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period 5) Order the controller to communicate a personal data breach to the data subject:2018 6) Impose a temporary or definitive limitation including a ban on processing 7) Order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19 8) Withdraw a certification or to order the certificatio n body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met 9) Order the suspension of data flows to a recipient in a third country or to an international organisation 104 When data was not provided or is not available, it is reflected in the tables as “ - “.

If an SA has not provi ded any data for a specific question, it is not included in the table. 4 Please provide examples of the type of circumstances and infringements that normally resulted in a fine and include the provisions of the GDPR breached. The SAs have imposed fines for the infringement of various substantive provisions of the GDPR. Most of the fines were imposed for infringing the GDPR provisions on lawfulness of processing (Art icle 6 GDPR) and security of processing (Art icle 32 GDPR), as well as the principles relating to processing of personal data (Art icle 5 GDPR); for unlawful processin g of special categories of personal data (Art icle 9 GDPR); for failure to comply with the obligations with regard to the rights of the data subjects (Art icle 12 to 22 GDPR), especially in relation to transparency, information and access to personal data (A rt icle 12 - 15 GDPR); for breach of the requirement for data protection by design and by default (Article 25 GDPR); for failure to cooperate with the supervisory authorities (Art icle 31 GDPR) and in relation to personal data breaches (Art icles 33 and 34 GDPR).

Fines have also been imposed for the breach of the conditions for valid consent (Art icle 7 GDPR); of the obligations related to controllers and processors (Art icles 28 and 29 GDPR ) , as well as in relation to the requirement of keeping re cords of processing activities (Art icle 30 GDPR); to conducting DPIA (Art icle 35 GDPR); to the requirements in relation to the data protection officers (Art icle 37 and 38 GDPR) and finally , in relation to the general principles for transfers of personal da ta (Art icle 44 GDPR). Typically, fines have been imposed when large - scale processing and a high number of data subjects have been at stake; when special categories of personal data and in particular, health - related data , have been concerned; when multiple provisions of the GDPR have been infringed or the infringements have had serious consequences; in case of non - compliance with previous compliance orders or administrative decisions of the SAs , as well as in case of failure to cooperate with the SAs and pro vide them with information .

The DK SA highlighted that the legal system of Denmark does not allow for administrative fines as set out in the GDPR and only the national courts are competent i n this regard . The SI SA indicated that it has not imposed any f ines under the GDPR yet , due to missing national implementing legislation that was passed only in 2023 , but had nevertheless imposed fines under the Slovenian Data Protection Act ZVOP 1 in the relevant period . Finally, the CZ SA underlined that their nati onal legislation does not allow the CZ SA to impose administrative fines on public authorities and bodies. 5 The average and median level of fines and the total amount of fines imposed by your DPA 105 The table below provides an overview 106 of the total amount of fines imposed by the SAs 107 under Article 83 GDPR or the corresponding national provision. For concrete figures on the average and median numbers, please check the individual contributions.

With regard to substantive reasons, they are related to different int erpretations of the law with regard to a variety of topics such as the legal basis, the right of access to personal data or the weighing of the mitigating and aggravating factors. A more detailed overview is provided by the individual answers of the SAs. 6. PROMOTING AWARENESS OF RIGHTS AND OBLIGATIONS Promoting awareness of the rights and obligations stemming from the GDPR is a task to which the EDPB and the SAs dedicate extensive resources. 1. At EDPB level Various a ctivities aimed at promoting awareness of data protection rights and obligations among the public and data controllers and processors have been undertaken at EDPB le vel . An overview of the most important ones is provided below . Press releases : The EDPB publishes a press release after each plenary meeting, as well as ad hoc press releases, to inform about documents that have been adopted by the EDPB.

eu/youreurope/business/ . Data Protection Day : Annually , the EDPB organises an awareness campaign on various aspects of the GDPR on the occasion of the International Data Protection day on 28 January. The campaigns include a video that is produced in collaboration with the press officers of the SAs, and a ser ies of social media posts, shared by the EDPB and SAs. eu/news/news/2021/edpb - celebrates - data - protection - day en Open Day European Institutions : Each year, the EDPB takes part in the Open Days of the European Institutions. Via an interactive information stand, staffed by EDPB and SA staff, visitors can lear n more about the activities about the EDPB and data protection in general. Awareness raising activities include: a Facial detection tool, a series of videos on Data Protection Day, the Guide for SMEs, and an online quiz. In 2023, we also developed and included a deepfake gamification tool.

On average, 13. 000 visitors attend the Open Day every year. Information stands at other conferences : The EDPB makes a systematic effort to set up an information stand at relevant conferences, to inform and engage with stakeholders about its activities and to distribute information material. html Public speaking engagements: The Chair and Deputy Chairs of the EDPB engage with other EU institutions or bodies, and represent the EDPB at conferences and multi - stakeholder platforms. Staff from the EDPB Secretariat also participate in events to promote EDPB’s activities. As such, the EDPB participates in various groups and summits, such as the Global Privacy Assembly, the G7 DPA roundtable, ENISA Advisory Group, Stakeholder Cybersecurity Certification Group. On average, the Chair and Deputy Chairs have 30 speaking engagements per year. These include presentations and panel discussions for a range of institutes, academic forums and policy age ncies.

Around 40 events per year are attended both physically and virtually by the EDPB Staff. These events are hosted by, amongst others, universities, law firms, companies and EU institutions. Publications: The EDPB publishes an annual report summarising the Board’s, the SAs’ and the EDPB’s activities in a given year. The Annual report includes a stakeholder survey about EDPB guidance. 2. At national level The SAs attach great importance to promoting awareness of data protection rights and obligations among the public and data controllers and processors and dedicate considerable resources to achieve this objective . All SAs replied that they have taken awareness - raising initiatives and provided examples. While a very wide range of activities have been mentioned, the most recurrent ones are the organisation of educational events, c onferences and information campaigns; the publication of newsletters, press releases and other materials online; the organisation of data protection - related events ( with the most frequently mentioned one being the Data Protection Day ) ; the provision of dir ect consultations in writing and via phone , as well as data protection - related trainings and workshops.

In terms of topics, m ost of the SAs have undertaken activities focusing on the protection of children’s privacy, SMEs, video surveillance, health and Covid19, security and data breaches. 65 Adop ted general activities in DSK framework, publicated guidance (leaflets, guidelines, ... S. de/ )  Republica 2023: Lecture on political targeting BW SA Baden - Wurttemberg (Lander Commissioner for Data Protection and Freedom of Information) The DPA DE/BW founded an education centre in July 2020 and thus supports the statutory advisory and information mandate with a wide range of events (such as seminars, panel discussions or workshops). The eve nts offered for controllers, processors and citizens generally meet with great interest. In 2022, for example, around 110 events were offered, with more than 4,000 registrations. de/bildungszentrum/ . With the "Schule digital" ("school digital") and "Datenschutz geht zur Schule" ("Data protection meets school") training series, radio play and promotion of Youngdata, the education centre has designed and established a series specifically for the school sector and will expand its range in the future with a more comprehensive self - study offer.

The DPA DE/BW uses various media for its outreach work. social/@lfdi ) for direct communication with citizens - on the DPA's Mastodon instance, around 100 public authorities from Baden - Württembe rg now use a data protection - friendly communication channel with their own account. social/ , where it streams live events and makes lectures and discussions available to the public. de/faqs/ . de/datenfreiheit/ ). de/ki - woche - 2023/ ). de/preistraeger - des - kommunalen - datenschutzwettbewerbs - 2022 - gekuert/ ) BY - LDA SA Bavaria - Private Sector (Bavarian Lander Office for Data Protection Supervision ) We are involved in a large number of activities de dicated to promoting awareness of data protection requirements, obligations, and rights, both with data controllers and processors and data subjects. g. ). We regularly attend both EU - wide and national/regional conferences on data protection and participate as speakers or on panels in events dedicated to data protection.

On the o ccasion of our numerous own - initiative investigations we publish the check lists which we use for such investigations so that they can serve as models to be used by (further) controllers/processors for internal compliance checks of their own; the recent to pics of such investigations include raising awareness for factors that facilitate the risk of data breaches, with a specific focus on small and medium enterprises (SME). de/ ); Data protection events; Training opportunities for DPOs of public bodies HE SA Hesse (Hessian Commissioner for Data Protection and Freedom of Information Our current focus is on increasing data privacy compliance at key points by providing intensive advice to individual key institutions (such as the central IT service provider of the state 67 Adop ted administration) in such a way that breaches are avoided and the number of complaints is reduced. g. eu ).

de/startseite/ ) Their staff conducted more than 200 lectures, w orkshops etc. - main topics:  2018: Requirements of the GDPR  2019: Requirements of the GDPR  2020: Requirements of the GDPR, practice of fines (Art icle 83 GDPR), home office, video conferencing. rlp. de/de/themenfelder - themen/infothek/faqs/ )  Information Events for specific Categories of Controller and data subjects  Podcast - Series "Daten - Funk" ( https://www. de/akademie/ SL SA Saarland (Independent Data Protection Center Saarland - Lander Commissioner for Data Protection and Freedom of Information) We do not have spe cial activities; with the exception of the general activities within the framework of DSK. de/datenschutz - in - sachsen - anhalt 76 Adop ted Another major campaign: in 2020, the publication of the guidelines and recommendation on cookies and other trackers was accompanied by the publication of a series of contents and tools for professionals, as well as the organisation of webinars for numerous asso ciations.

” . In addition to redesigning its website (and its tree structure in 2023), the CNIL has also produced and published a number of videos to make Internet users aware of their rights and teach them how to control their personal data. At the same time, the CNIL is designing infographics and posters for the general public to make its publications easier to understand. Since 2020, the digital education Department is stepping up privacy awareness campaigns aimed at young people, parents and teachers, strengthening partnerships and creating new ones. fr/fr/comprendre - l e - rgpd/les - webinaires - de - la - cnil - le - programme - de - septembre - decembre - 2023), GDPR Days The CNIL provided support to individuals through the various phone hotlines. This support also takes the form of responses to individual requests for advice (1315 legal a dvices in 2022 and 800 for DPOs only) or in meetings that may be organised with the CNIL’s services or through innovative support methods such as a regulatory sandbox or ""enhanced"" support for digital companies with strong economic development potential.

Its purpose is to conduct a comprehensive, in - depth, and complex investigation of the practical implementation of the obligation to disclose laid down in domestic legislation, as well as to formulate recommendations for legislators based on domestic and inter national experience and to disseminate the results. In connection with the enforcement of freedom of information as a fundamental right, a broad examination of the domestic practice has become timely in order to surface possible problems and hindering fact ors, which, after identification, can improve accessibility and optimize processes by formulating targeted solutions and proposals. hu/news/396 - press - release - comprehensive - development - project - launched - by - the - hungarian - national - authority - for - data - protecti on - and - freedom - of - information - for - the - enhanced - enforcement - of - freedom - of - information 3 ) DPO Annual Conference The National Data Protection and Freedom of Information Authority organizes the annual conference of Data Protection Officers every year.

hu/2021 - evi - dpo - konferencia/dpo - konferencia - 2021 - videok 4 ) Safer Internet Tent/ Awarness raising among children As part of the children's day, the Safer Internet Tent is set up in the City Park every year, where the Hungarian authority is also represented. In the S afer Internet Tent, in addition to useful information materials, children and their companions can meet NAIH employees who will answer their questions about information rights, test their knowledge by completing a data protection test, crossword or puzzle, and participate in other adventure prog rams. 96 Adop ted  Initiatives of SK SA  2021 Slovenský preklad Príručky o európskych právnych predpisoch v oblasti ochrany údajov dostupný na objednanie  2022 Úrad na ochranu osobných údajov SR sa zapája do prvej koordinovanej akcie EDPB  2023 Zriaďujeme emailovú schránku na ochranu osobných údajov detí a mládeže Data Protection Day  2019 Deň ochrany osobných údajov 2019, workshop úradu  2020 Deň ochrany osobných údajov  2021 Deň ochrany osobných údajov, 28.

január 2021  2022 Deň ochrany osobných údajov, 28. január 2022  2023 Deň ochrany osobných údajov, 28. január 2023 GDPR “birthday”  202 1 3. výročie uplatňovania všeobecného nariadenia o ochrane údajov (GDPR) a zákona č. 18/2018 Z. z. 2021)  2022 4. výročie uplatňovania všeobecného nariadenia o ochrane údajov ( GDPR)  2023 5 rokov uplatňovania všeobecného nariadenia o ochrane údajov News about the rules in the area of Data Protection  2018 Korigendum k nariadeniu GDPR  2019 Slovenská republika pristúpila k dodatkovému protokolu k Dohovoru 108  2021 Druhé korigendum všeobecného nariadenia o ochrane údajov  2023 Do prevádzky vstupujú obnovené Schengenské informačné systémy Judgement of CJEU  2019 Rozsudok o ukladaní cookies používateľov internetu  2020 Rozhodnutie SD EÚ vo veci Orange România SA  2021 Rozhodnutie SD EÚ vo veci Latvijas Republikas Saeima (Pokutov é body)  2022 Rozhodnutie SD EÚ vo veci Valsts ieņēmumu dienests  2023 Rozhodnutie SD EÚ vo veci X - FAB Dresden a vo veci KISA Implementing decision of Commission  2019 Rozhodnutie o primeranosti pre Japonsko  2021 Štandardné zmluvné doložky pre prenos osobných údajov do tretích krajín  2022 Rozhodnutie o primeranosti pre Kórejskú republiku na účely prenosu osobných údajov  2023 Rozhodnutie o primeranosti pre Spojené štáty americké Safe Internet Day  2021 Druhý februárový utorok je Medzinárodný deň bezpečnejšieho internetu  2022 Deň bezpečného internetu New initiatives of other SAs or EDPB 97 Adop ted  2019 Pozvánka na stretnutie zainteresovaných strán v oblasti práv do tknutých osôb (EDPB)  2020 Štandardné zmluvné doložky pre sprostredkovateľov (DK SA)  2021 Súťaž – návrh ikon na plnenie informačnej povinnosti prevádzkovateľa (IT SA)  2022 Výzva na zapojenie sa do EDPB Support Pool of Experts (EDPB)  2023 Sprievodca ochranou údajov pre malé podniky (EDPB) Adopted final guidelines/recommendation of EDPB  2018 Usmernenia k nariadeniu v slovenskom jazyku  2019 Usmernenia k územnej pôsobnosti  2020 Usmernenia o spracúvaní osobných údajov prostred níctvom kamerových zariadení  2021 Odporúčania k referenčnému kritériu primeranosti podľa smernice o presadzov aní práva  2022 Usmernenia ku kódexom správania ako nástrojom na prenos  2023 Usmernenia o certifikácii ako nástroji na prenosy Public consultation of EDPB  2019 Verejná konzultácia EDPB k usmerneniam o spracúvaní osobných údajov prostredníctvom kamerových zariadení  2020 Verejná konzultácia EDPB k usmerneniam k výkladu článkov 46 ods.

2 písm. a) a 46 ods. 3 písm. sk/uoou/sk/main - content/metodiky - uradu . SK SA covered topic such as – Surveillance by camera devices of natural persons at the family h ome ; Obligations of the e - shop operator ; Lawfulness of processing personal data; Status of legal entities and natural persons - entrepreneurs from the point of view of personal data protection ; 30 steps of compliance with the new legal regulation of personal data protection , etc. sk/uoou/ sk/content/prenos - osobnych - udajov (this section is available also in EN language) 98 Adop ted Employees of SK SA regularly take part in different conferences organized by third parties. For example Annual EPI conference on GDPR and Act on Data Protection is held unde r the auspices of the SK SA. Employees of SK SA provide trainings to different stakeholders on request (if it is in our human and time capacity). We also provide consultation in written and oral form for different stakeholders – data subjects, controller , public authorities etc. Please find attached table with information about this below: Relevant p eriod Consultation s provided 25/5/ 2018 – 24/ 5/ 2019 2181 25/5/ 2019 – 31/ 12/ 2019 719 2020 1095 2021 799 2022 836 9/2023 596