Report on the use of SPE external experts in 2024

1 Adopted Report on the use of SPE external experts in 2024 13 March 2025 2 CONTENTS Introduction ................................ ................................ ................................ ................................ ............. 3 1 Continuous exchanges between SPE contact points ................................ ................................ ....... 3 2 A growing pool of external experts ................................ ................................ ................................ . 4 3 Enhanced transparency of SPE projects ................................ ................................ .......................... 5 3.1 Publication of deliverables and annual report ................................ ................................ ........ 5 3.2 Improving the availability of deliverables ................................ ................................ ............... 5 4 SPE projects ................................ ................................ ................................ ................................ ..... 5 4.1 SPE projects launched in 2023 and completed in 2024 ................................ .......................... 5 4.1.1 Complex Algorithms and effective Data Protection Supervision for AI systems ............ 6 4.1.2 Website auditing tool (version 2) ................................ ................................ .................... 7 4.1.3 How to take enforcement action on the GDPR outside of the EU? ................................ 8 4.2 SPE Projects launched in 2024 ................................ ................................ ................................ . 8 4.2.1 OSS Case Digest on the right of access ................................ ................................ ............ 8 4.2.2 Internal training regarding the use of Pirogue Tool Suite ................................ ............... 9 5 SPE events - Bootcamp on mobile app auditing ................................ ................................ ............ 10 6 Conclusion ................................ ................................ ................................ ................................ ...... 10 3 INTRODUCTION The Support Pool of Experts (SPE) is a project under pillar 2 of the EDPB 2024 - 2027 strategy ( ‘ supporting effective enforcement and efficient cooperation between national supervisory authorities ’ ) 1 . The SPE provides support in the form of expertise for investigations and enforcement activities of common interest to SAs and enhances cooperation/solidarity by reinforcing and complementing the strengths of the individual SAs and addressing operational ne eds. A first report on the use of SPE external experts was published in 2024 to report on the activities of the SPE in 2023 2 . This report focuses on the main initiatives continued or conducted in 202 4 as part of the SPE . It also provides a recap of the activities of the SPE contact points and the applicable procedure s for the call for expression of interest addressed to external experts and to launch a project. Three projects which were launched in 2023 were continued and completed in 2024 . In addition, nine new projects were launched in 2024 , such as the One - Stop - Shop Case Digest on the right of access . Four out of these nine new projects were completed in 2024 . Finally, the EDPB organised a second in - person bootcamp for SA s ’ experts on the theme of mobile app auditing , which included an internal training regarding the use of Pirogue Tool Suite organised through a n SPE project . This report does not cover other enforcement cooperation related initiatives, although some of them may fall in the scope of the SPE such as co llaboration on strategic cases , CEF actions, investigation priorities, or the EDPB secondment programme. 1 CONTINUOUS E XCHANGE S BETWEEN SPE CONTACT POINTS The group of SPE contact points met three times remotely in 2024 . It is coordinated by the EDPB Sec retariat and includes participants from SAs. • Among others, the SPE contact points: • Follow al l information on SPE activities, • Discuss and propose ongoing and future SPE projects, in particular they identify specific needs in enforcement cases that will require experts ’ support, • I dentify an SA ’ s operational needs for national investigations with respect to the SPE, • Share enforcement experiences and good practices between SAs, • Analyse provided enforcement documentation/solutions , • Disseminate information within the respective SAs , • Develop common methodologies: IT knowledge and more specific legal issues (e.g. BCR, data transfer to third countries, online platforms, IoT research), and 1 Its Terms of Reference https://edpb.europa.eu/sites/default/files/files/file1/edpb document supportpoolofexpertstor en.pdf were adopted by the EDPB plenary in December 2020 and the project plan was adopted in December 2021. 2 Available at https://www.edpb.europa.eu/our - work - tools/our - documents/support - pool - experts - projects/report - use - spe - external - experts en . 4 • Encourage the creation of new methodologies harmonising approaches on inspections and enforcement. 2 A GROWING POOL OF EXTERNAL EXPERTS A reserve list of external experts was set up f ollowing a call for expressions of interest in February 2022 3 4 . Experts can apply through a n electronic procedure 5 , 6 . Following its extension , the reserve list is valid until 10 February 20 2 6 . Interested parties can apply at any time prior to the last three month s of validity of the list, until 10 November 2025. At the end of 2024, 568 experts are present on the reserve list. In 2024, the Secretariat received 87 additional applications from possible external experts. The following selection procedure was followed for these applications: The pool in figures 2024 Since F eb 20 22 Applications received 87 7 90 Selection committee’s meetings 5 13 Candidates currently on the reserve list 6 5 56 8 7 ( 72 %) Split of the reserve list by confirmed field(s) of expertise: Legal expertise 4 2 39 7 (70%) Technical expertise 2 2 1 50 (26%) Technical & legal expertise 1 21 ( 4 %) The reserve list can then be used to propose a specific project to a candidate, depending on the EDPB ’s needs and whether a specific profile matches these needs . 3 https://edpb.europa.eu/system/files/2022 - 02/call for expressions of interest support pool of experts.pdf 4 The SPE consists of qualified experts in areas such as IT auditing, website security, mobile OS and apps, IoT, cloud - computing, behavioural advertising, anonymization techniques, cryptology, AI, UX design, Fintech, Data science, digital law, etc. 5 https://ec.europa.eu/eusurvey/runner/PoolOfExperts 6 https://edpb.europa.eu/system/files/2022 - 02/SPS Support%20Pool%20of%20Experts external final 0.pdf 7 One SPE expert withdrew from the list in 2024. Receipt of application Pre - assessment by the EDPB staff in charge Final assessment by the selection committee Final decision sent to the candidate Applications are assessed and results shared within a maximum of 3 months after the date of their reception Added to the reserve list Rejected 5 3 ENHANCED TRANSPARENCY OF SPE PROJECTS 3.1 Publication of deliverables and annual report Until January 2025 , the deliverables of t e n projects were published , following decisions of the EDPB Plenary . They are all accessible on the EDPB’s website at https://www.edpb.europa.eu/our - work - tools/our - documents/publication - type/support - pool - experts - projects en . It is important to note that while the above deliverables are made publicly available on the EDPB’s website, the views expressed in these documents are only those of their authors (i.e. the SPE experts) and do not reflect the official position of the EDPB. The EDPB does not guarantee the accuracy of the information included in these documents. Neither the EDPB nor any person acting on the EDPB’s behalf may be held responsible for any use which may be made of the information contained in these deliverables. Some excerpts may be redacted from these deliverables as their publication would undermine the protection of legitimate interests, including, inter alia, the privacy and integrity of an individual regarding the protection of personal data in accordance wit h Regulation (EU) 2018/1725 and/or the commercial interests of a natural or legal person. A specific disclaimer is included in each of the deliverables made public. E xtracts of the One - Stop - Shop ( OSS ) case digest s on the right to be forgotten and on security/data breaches were included in the EDPB annual report for 2022 8 and 2023 9 . Finally , a first report on the use of SPE external experts was published in 2024 10 . 3.2 Improving the availability of deliverables T he SPE section available on the EDPB website at https://www.edpb.europa.eu/support - pool - experts - spe - programme en has been updated and enhanced. I t includes a n updated and consolidated list of the main published SPE project s . 4 SPE P ROJECTS Since the launch of the SPE initiative, twenty - two projects have been launched, out of which seventeen had been completed at the end of 2024 . Overall, seven SAs proposed new projects since 2022. Four out of these seven SAs proposed a project in 2024 after a previous successful one . 4.1 SPE projects launched in 2023 and completed in 202 4 T hree project s were launched in 2023 and were successfully completed over the course of 2024. 8 https://edpb.europa.eu/system/files/2023 - 04/edpb annual report 2022 en.pdf , pages 42 - 50. 9 https://www.edpb.europa.eu/system/files/2024 - 04/edpb annual report 2023 en.pdf , pages 34 - 35. 10 Available at https://www.edpb.europa.eu/our - work - tools/our - documents/support - pool - experts - projects/report - use - spe - external - experts en . 6 4.1.1 Complex Algorithms and effective Data Protection Supervision for AI systems SAs are increasingly dealing with questions regarding the training and use of Artificial Intelligence during investigations. The DE SA (Federal) expressed the need to further strengthen enforcement capacity building in this area . An SPE project was launched in November 2023 and was completed in March 2024 by the SPE expert Dr. Kris Shrishak. The two reports produced tackle two topics, namely: • Tool - based evaluation of bias in AI applications and automated decision making systems . This report looks into the different main type s of bias and how to address them in a practical point of view ( i.e. methods and tools). One import ant conclusion of the report is that these technical approaches and tools should be complemented with contextual and socio - cultural knowledge as AI systems are not purely technical, but socio - technical. • The effective implementation of data subjects’ rights during the development and use of AI . This report covers techniques and methods to implement the right to rectification and the right to erasure when AI systems process personal data. Implementing these rights is challenging but many technical approaches have been proposed. • Available at https://www.edpb.europa.eu/our - work - tools/our - documents/support - pool - experts - projects/ai - complex - algorithms - and - effective - data_en by Dr. Kris Shrishak 7 4.1.2 Website auditing tool (version 2) In 2022, a project developed a user - friendly and documented tool for website inspections, building on the Website Evidence Collector 11 (WEC). The expert for this project was Dr. Jérôme Gorin. The version 1, under EUPLv1.2+, was only available to Supervisory Authorities . The project being a success, the EDPB members requested to launch a public second version with multiple new features . Version 2 of the tool was made public in June 2024 . It included multiple new features, such as different languages, the possibility to have multiple knowledge databases and a first basic SaaS version. 11 Open source tool developed by EDPS : https://edps.europa.eu/node/5452 de • Version 2 p ublished as Free and Open Source Software under EUPL 1.2 Licence, available at https://code.europa.eu/edpb/website - auditing - tool by Dr. Jérôme Gorin 8 4.1.3 How to take enforcement action on the GDPR outside of the EU? It is frequent that a company does not have an establishment within the EU and still processes personal data of data subjects in the EU . The GDPR stipulates that these companies must comply with the GDPR, even if they are not es tablished within the EU (Art. 3(2) GDPR). In addition, they must also designate a representative within the EU who can serve as a point of co ntact for data subjects and SAs (based on Art. 27 GDPR). In practice, however, it sometimes happens that foreign companies do not adhere to this. Against this background, t he NL SA has identified challenges in requesting companies outside the EU to pay fines. The project was launched in November 2023 and completed in April 2024 by t he SPE expert Dr. Helena Kastlová . The produced legal report include s the following : • An analysis of the options for actions that US law would or would not provide the NL SA in a specific enforcement case to collect a fine or to take any form of enforcement action . • A more strategic guidance on options that can be used for future cases that have a similar background . 4.2 SPE Projects launched in 202 4 A total of nine new projects were launched in 2024 , touching up on many diverse subject matters, both legal and technical . Four of them were c ompleted over the course of 2024 . 4.2.1 OSS Case Digest on the right of access The EDPB commissioned a third 12 thematic case digest . Case digests are overviews of decisions adopted under the one - stop - shop (OSS) procedure about a particular topic 13 . The purpose is to give 12 Case digest on the right to object and the right to erasure, Alessandro Mantelero, 9 December 2022; Case digest on security of processing and data breach notification, Professor Eleni Kosta, 27 November 2023; available at https://www.edpb.europa.eu/about - edpb/publications/one - stop - shop - case - digests_en . 13 EDPB’s public register with the one - stop - shop final decisions is available at https://edpb.europa.eu/our - work - tools/consistency - findings/register - for - article - 60 - final - decisions_en . • Available at https://www.edpb.europa.eu/our - work - tools/our - documents/other/report - extraterritorial - enforcement - gdpr nl by Dr. Helena Kastlová • Available at https://www.edpb.europa.eu/system/files/2025 - 01/oss - case - digest - right - of - access en.pdf by Prof. Dr. Hanne Marie Motzfeldt 9 the S As and the general public, including privacy professionals, insight s into the decisions adopted by S As following cross - border cooperation procedures. The SPE expert Professor Dr. Hanne Marie Motzfeldt drafted a case digest on the right of access. This is a topic on which S As cooperate a lot, as shown by the large volume of decisions available. The O SS case digest summarises how S As interpret the different components of the right of acces s in various contexts. In addition, the case digest analyses previous cases where exceptions and limitations to the right of access were raised by controllers. Overall, the case digest provides useful examples on the exercise of the right of access, for instance in the event of fake profiles or accounts w hich impersonate data subjects. This work complements the CEF 2024 on the right of access 14 . The case digest also refers to the available guidance at EU level, and in particular, EDPB Guidelines 01/2022 on the r ight of acces s. This project was launched in May 2024 and completed in November 2024. 4.2.2 Internal training regarding the use of Pirogue Tool Suite The capacity of SAs to audit smartphones consistently and efficiently is crucial for ensuring compliance and protecting user privacy. Effective auditing allows authorities to detect and address potential breaches of privacy and data protection laws. T he PiRogue Tool Suite (PTS) is one of the tools used by pioneer SAs on the subject and, in the spirit of facilitating the coordination and cooperation on mobile applications auditing, the expert Estelle Onfroy provided a training on PTS to all interested S As. T he training session took place during a bootcamp on mobile app auditing which was addressed to SAs’ staff working in inspection departments in September 2024 ( see section 5 below). PTS is composed of the PiRogue, an open hardware device (based on a Raspberry Pi) which operates as a network router analysing network traffic in real time, and of Colander, an incident response and 14 https://www.edpb.europa.eu/news/news/2025/cef - 2024 - edpb - identifies - challenges - full - implementation - right - access en • Presented during the bootcamp by Esther Onfroy 10 knowledge management platform that helps transforming the collected information into browsable knowledge, and generating reports and detection rules. The hands - on training session covered various aspects of the tool and provided the skills and knowledge necessary to effectively use it. Best practices for conducting audits using the tool were also explained. Small groups of auditors were able to perform a mobile audit during the session. The SPE expert provided the necessary equipment as well as a detailed slide deck. Lastly, t he seven other projects that were launched over the course of 2024 are either ongoing at the date of this report or were completed but not yet made public. More details relating to these projects may follow. 5 SPE EVENTS - BOOTCAMP ON MOBILE APP AUDITING The Secretariat organised a second in - person b ootcamp in Brussels to allow SA ’ experts to exchange knowledge, best practices and test tools for mobile apps auditing . Around 50 experts from 27 SAs met in Brussels on 18 - 19 September 2024 to participate in this bootcamp. Of these experts, at least twenty participated in an EDPB meeting or event in Brussels for the first time. In addition, at least thirteen of them already took part in the firs t b ootcamp. The two - day bootcamp consisted in a mix of presentations and hands - on training , which included : • Presentation by the EDPB Secretariat on the SPE and relevant projects on auditing . • Presentation on the privacy and security of mobile apps and their supply chain. • H ands - on training on PiRogue Tool Suite by SPE expert Esther Onfroy (see Section 4.2.2). • Networking social event among the participant. • P resentation of two projects developed by PERéN, followed by a brief discussion of each project . • Presentation with preliminary findings , challenges and lessons learned in mobile app auditing. • Participants were invited to share ideas and experiences from mobile app auditing as part of an open floor discussion. In the survey distributed after the event, most participants repeatedly expressed intere st in having further bootcamps. 6 CONCLUSION This report provides a brief overview of t he SPE projects continued or launche d in 2024 with the reserve list of external experts. Many diverse pro jects have been launched in 2024 , including a growing trend of projects on AI systems, which shows the eagerness of SAs to benefit from the use of external expertise, whether legal or technical - or both. Additional projects will be launched in 2025 and t he Secretariat also plans to organise a third bootcamp . Finally, the Secretariat will have to address the end of the validity of the reserve list of SPE experts in early 2025 .