News from the European Data Protection Supervisor (EDPS). Disclaimer: http://europa.eu/!HP66qc

Website: https://www.edps.europa.eu
Privacy: https://europa.eu/!BcqwCQ

Last Notes

*** Managing Shadow AI's Hidden Data Breach Risk ***
The new blogpost by @npub1vtd…gz7j Wojciech Wiewiorowski is out!
Shadow AI is the use of unauthorised AI tools by staff without their organisation's knowledge or approval. The risks are significant: personal data can leak into systems with no legal basis for processing, no oversight on where it goes, and no way to fulfil individuals' rights. Security backdoors can open without IT teams ever noticing.
How can EU institutions respond?
☑️ Clear AI governance policies,
☑️ Technical controls,
☑️ Compliant alternatives to unapproved tools, and
☑️ Ongoing staff training.
Protecting data and embracing innovation are not in conflict, but clear governance is key.
▶️ Read the full blogpost: https://link.europa.eu/bTJvkV
https://social.edps.europa.eu/system/media_attachments/files/116/752/951/021/928/365/original/6e55bc3ff70c8c5a.png

2026-05-21 07:07:42 GMT

*** CPDP 2026 – Day 2: EDPS on stage ***
Day 2 at hashtag#CPDP2026! Here is where you can find us today:
📌"Simplification for Whom? Unpacking the Consumer Impact of the Digital Omnibus" - Romain Robert, Head of Digital Regulation in the Policy and Consultation Unit, speaks in panel on the impact of the digital ombnibus on consumers and whether proposed measures are necessary and proportionate.
📌 "What is so special about special categories of data?" – Brendan Van Alsenoy, Acting Head of Policy and Consultation Unit, moderates the EDPS panel with Gianclaudio Malgieri, Ruth Boardman, Anne Debet and Stéphane Kolanowski on the scope, logic and limits of sensitive data under the GDPR
📌 "Stranger Things Online: Navigating Child Safety in the Digital Age" – Jeroen Wauman, Supervision and Enforcement Unit, joins experts from Europol, academia and civil society on emerging online threats and fundamental rights (EDEN panel)
📌 "Unlocking the Data Economy: The EU Data Act in Practice" – Georgia Bakatsia, Supervision and Enforcement Unit, on the early real-world impact of the Data Act, its interplay with GDPR, DSA, DMA and AI Act, and its role in future data-sharing frameworks
Find us at the EDPS and EDPB booth!
#CPDP2026
https://social.edps.europa.eu/system/media_attachments/files/116/611/299/432/463/202/original/11778702ee3eb2e7.jpg
https://social.edps.europa.eu/system/media_attachments/files/116/611/298/787/267/515/original/dc185741bcba76dc.jpg

2026-04-27 08:00:06 GMT

Ten years ago, the adoption of the General Data Protection Regulation (#GDPR) marked a milestone for privacy and data protection in Europe.
Built on decades of work since the Data Protection Directive 95/46/EC, the GDPR created a modern, harmonised system fit for the digital age - strengthening individuals’ rights, reinforcing accountability, and shaping a common approach across the EU 🇪🇺.
Over the past decade, it has proven its value: giving people greater control over their personal data, fostering trust in the digital economy, and inspiring similar frameworks around the world.
As we look ahead, preserving this achievement remains essential. In the context of ongoing simplification efforts, the EDPS has emphasised that efforts to streamline rules should maintain a high level of protection and legal certainty.
Ensuring clarity, consistency, and strong safeguards will be key to keeping Europe at the forefront of data protection in the years to come.
📖 Read more about the history of GDPR: https://link.europa.eu/dFPdmX
https://social.edps.europa.eu/system/media_attachments/files/116/475/544/789/931/884/original/e5917caacbde6aef.png

2026-03-17 08:15:33 GMT

*** Towards trustworthy AI in the EU public administration: The EDPS Compass for its new role under the AI Act ***
The EDPS publishes the EDPS Compass for its new role under the AI Act.
The Compass sets the direction for how the EDPS will carry out its new responsibilities under the AI Act as Market Surveillance Authority for AI systems used by EU institutions, and notified body for certain high-risk AI systems.
Building on the earlier steps of the AI Preparedness Strategy and the establishment of the AI Unit, the document outlines the vision, priorities and key actions that will guide the EDPS over the next two years.
A key step as the AI Act moves into practical supervision within EU public administration.
Read the full document https://link.europa.eu/W9XTC9
https://social.edps.europa.eu/system/media_attachments/files/116/243/516/544/749/655/original/5487f2896c5c2950.png

2026-02-23 09:07:01 GMT

*** International Data Protection Authorities Issue Joint Statement on Privacy Risks of AI-Generated Imagery ***
The EDPS is among the 61 signatories of a Joint Statement on AI-Generated Imagery issued by data protection authorities from the Global Privacy Assembly.
The statement responds to growing concerns about AI systems that can create highly realistic images and videos of identifiable individuals without their knowledge or consent. A key focus is the increasing risk of harm to children, underscoring the urgent need for responsible AI development and strong privacy safeguards.
As AI capabilities evolve, so must our global approach to protecting individuals’ rights and dignity.
Read the Joint Statement https://link.europa.eu/vrvR9X
@npub1vtd…gz7j #AI #GPA

2026-02-17 11:58:33 GMT

📨 EDPS just published its Press Release.
The extension of the interim rules to combat online child sexual abuse material (CSAM) is an opportunity to address shortcomings and prevent indiscriminate scanning.
A new EDPS Opinion comments on the proposal to extend interim rules for combating CSAM an additional two years while inter-institutional negotiations continue around a permanent framework.
The EDPS offers specific suggestions on how to ensure greater legal certainty in line with the GDPR, and underlines the need for effective safeguards against general and indiscriminate scanning of individuals' data.
@npub1vtd…gz7j said: “Protecting children from abuse is a shared and vital duty, and we must ensure no legal vacuum emerges in this fight. However, ‘temporary’ measures must not bypass fundamental rights. This extension is the right moment to address some of the concerns that have been raised also during the discussions around a long-term Regulation, to ensure that scanning is not indiscriminate and that there is always a clear legal basis for the processing of personal data.”
👉 Read the Press Release: https://link.europa.eu/vF3kFK
📄 Read the full Opinion: https://link.europa.eu/qvtnhJ
https://social.edps.europa.eu/system/media_attachments/files/116/085/792/527/176/370/original/44a72d5e983a27a1.png

2026-02-13 09:22:07 GMT

#EDPS has issued new guidance and binding rules to protect data protection officer (DPO) independence across EU institutions 🇪🇺 .
All EU institutions, bodies, offices and agencies (EUIs) are required to have a DPO. To strengthen their effectiveness and independence, the EDPS has supplemented its Supervisory Guidance on the role of DPOs (18 December 2025) with binding rules around DPO dismissal. These rules set out a clear process that EUIs must follow before when seeking the EDPS’s prior consent before dismissing a DPO.
@npub1vtd…gz7j said: “Since 2002, DPOs have been a cornerstone of effective data protection governance within EUIs. The updated Guidance and Rules on Consent for DPO Dismissal reinforce the DPO’s position as a critical internal safeguard for the protection of personal data.”
📃 Read the press release here: https://link.europa.eu/RgtKyn
🔎 Read the Supervisory Guidelines: https://link.europa.eu/FRQWTn
https://social.edps.europa.eu/system/media_attachments/files/116/062/578/356/300/694/original/fee49d69ea82e9e5.png

2026-02-11 14:25:35 GMT

🇪🇺 EDPB and EDPS adopt a Joint Opinion on the Digital Omnibus Regulation, supporting simplification and competitiveness while safeguarding fundamental rights.
The Digital Omnibus proposal aims to streamline the EU’s digital framework, focusing on the GDPR, the ePrivacy Directive and the Data Acquis. While we support reducing administrative burdens, we emphasise that simplification must not come at the expense of individual protections.
We strongly urge co-legislators not to adopt the proposed changes to the definition of personal data, as they would significantly narrow its scope and conflict with CJEU case law.
“We must make sure that any changes to the GDPR and EUDPR actually clarify obligations and bring legal certainty while maintaining trust and a high level of protection of individual rights and freedoms,” said @npub1vtd…gz7j , the EDPS.
The Joint Opinion also highlights the need for clear oversight by Data Protection Authorities regarding cookie banners and the re-use of public sector data. For more detailed information, check the links below:
📃 Read the Press Release: https://link.europa.eu/FQGCqv
📃 Read the Joint Opinion: https://link.europa.eu/mnNyvR
https://social.edps.europa.eu/system/media_attachments/files/116/052/454/135/651/975/original/60d21e8935e04976.png

2026-01-28 08:43:37 GMT

Today, on 28 January, we celebrate the 20th anniversary of Data Protection Day, a milestone that reminds us of the enduring importance of privacy and the evolution of data protection from Convention 108 to today’s GDPR.
In his opening remarks, Wojciech Wiewiorowski, the Supervisor, reminded that “effective enforcement of data protection rules in the digital world is not only the institutional mission of the EDPS; it is also a topic which requires constant reflection and open exchanges. [...] We need to be able to work together efficiently and effectively, so that together we can deliver the right outcomes for individuals, businesses and society as a whole.”
“In less than 10 years, the GDPR has become the gold standard in the field of data protection, not only at the European level, but also worldwide. [...] The GDPR is more than a regulatory instrument: it is anchored in Articles 7 and 8 of the Charter of Fundamental Rights and cannot be compromised in the context of reform debates.”
“The role of data protection extends far beyond the realm of privacy and indeed it often becomes a safeguard for democracy itself” concluded the Supervisor.
👉 Read the full speech here: https://link.europa.eu/bYPww6
#DataProtection #DataProtectionDay #DPD2026 #Convention108 @Council of Europe
https://social.edps.europa.eu/system/media_attachments/files/115/971/820/437/200/458/original/5985583129b8b606.png
https://social.edps.europa.eu/system/media_attachments/files/115/971/820/412/042/478/original/214374f2857c55c0.png

2026-01-15 10:08:21 GMT

🗓️ Attending #DPD2026? Can't wait? We have got something special for you: a great line up of speakers!
Co-hosted by Council of Europe, the Data Protection Day celebrates the signing of Convention 108, the first legally binding treaty protecting privacy in the digital age. To mark the occasion, we invite you to a one-day event focused on new frontiers in data protection.
Europe faces a pivotal moment. Nearly a decade after the entry into application of the GDPR, discussions on its future invite reflection on how Europe can maintain leadership in data protection.
Our keynote speakers will set the scene, led by @npub1vtd…gz7j #EDPS, Beatriz de Anchorena #CoE, Jelena Virant Burnik #EDPB, Anu Bradford Columbia Law School & Thomas Zerdick #EDPS.
🗣️ The discussions will benefit from multidisciplinary expertise spanning public administration, academia and the private sector. Have a peek into the programme here: https://data-protection-day.eu/
🔗 Would you like to reserve your spot for 28 January 2026 in Brussels or online? Register today: https://link.europa.eu/yRvbbk
https://social.edps.europa.eu/system/media_attachments/files/115/898/550/603/297/327/original/0653ddc4bbc58a4d.mp4

2026-01-08 10:11:38 GMT

*** EDPS PRESS RELEASE ***
The EDPS supports targeted access to value added tax (VAT) data to combat tax fraud, but warns that a new Proposal sits at the crossroads between administrative cooperation and criminal law enforcement.
The European Commission has put forward a Proposal aimed at strengthening the fight against intra-Community VAT fraud by amending Regulation (EU) No 904/2010 to grant the European Public Prosecutor's Office (EPPO) and the European Anti-Fraud Office (OLAF) specific direct and centralised access to VAT information at EU level.
The EDPS welcomes the objectives of the Proposal and acknowledges that specific and limited direct access to administrative databases can be necessary for effective investigations. However, this exceptional access must be clearly circumscribed and carefully safeguarded. It should not be misconstrued as a precedent for more general application.
Furthermore, certain parameters - purpose limitation, data minimisation and accountability - must be defined to ensure compliance with EU data protection law.
📃 Read the press release to find out more: https://link.europa.eu/nBkYrw
https://social.edps.europa.eu/system/media_attachments/files/115/858/925/218/273/617/original/1b8c43e46ff57cae.png

2025-12-17 11:34:06 GMT

Today, the EDPS had the pleasure of hosting the December meeting of the Interinstitutional Committee on Digital Transformation (ICDT). Bringing together representatives from across the EU Institutions, the ICDT is a key forum for coordinating digital transformation efforts, from cloud and data governance to AI and interoperability.
@npub1vtd…gz7j Wojciech Wiewiorowski opened the meeting with introductory remarks, highlighting that efficiency and compliance must go hand in hand, especially at a time when institutions feel the pressure to do more with less. He also stressed that as we navigate a technological revolution driven by artificial intelligence, significant risks and responsibilities emerge, requiring continued vigilance in how AI is deployed, particularly with regard to data protection.
A warm thank you to all institutions for their active participation, and to the @npub1ypk…kdd0 for chairing the Committee’s work. We look forward to continuing this collaboration in the year ahead!
https://social.edps.europa.eu/system/media_attachments/files/115/734/690/088/970/874/original/36394eb82592e994.jpg
https://social.edps.europa.eu/system/media_attachments/files/115/734/690/089/245/336/original/b4cbf3f02cd7f02a.jpg

2025-10-22 08:08:15 GMT

*** Annual Privacy Forum 2025 ***
Today marked the 13th edition of the Annual Privacy Forum, where experts from across Europe gathered to bridge the gap between privacy and data protection research and policy. This year’s edition was organised by the Goethe University Frankfurt, Karlstad University, and RSA Conference, with active participation from @European Union Agency for Cybersecurity (ENISA) and the #EDPS.
In his opening remarks, @npub1vtd…gz7j Wojciech Wiewiorowski addressed some of the most pressing challenges in data protection and cybersecurity: "October marks the EU Cybersecurity Month. Alongside the EDPS daily role in supervising the protection of individuals affected by cybersecurity incidents impacting EUIs systems, we are present and playing an active role in the initiatives that EU institutions are carrying out".
He added: "Strong cybersecurity is essential to the EU's resilience and the protection of fundamental rights. The greater the intrusion, the greater the risks for our rights, and the stronger our safeguards must be".
In his address, he spoke about the simplification agenda: "True simplification means making rules clearer, more coherent, and easier to apply, without weakening the protections for individuals. Simplification should mean strengthening and streamlining enforcement, maintaining independence, and preserving the GDPR as a landmark for Europe's fundamental rights".
#APF25 #Cybersecurity #GDPR
https://social.edps.europa.eu/system/media_attachments/files/115/416/789/883/791/146/original/04ec934be0809f2e.jpg

2025-10-16 13:41:00 GMT

*** OPINION ***
The EDPS has published an Opinion on the Recommendation for a Council Decision authorising the opening of negotiations for a digital trade agreement with Canada.
The objective of this Recommendation is to authorise the @npub1m96…ag4y to open negotiations with Canada in order to complement the existing EU–Canada Free Trade Agreement by establishing comprehensive rules on digital trade. These negotiations may address issues such as cross-border data flows with trust, data localisation requirements and the protection of personal data.
The EDPS recalls that the protection of personal data is a fundamental right in the European Union and therefore cannot be subject to negotiations in the context of trade agreements.
Read the Opinion https://link.europa.eu/J99p6r
https://social.edps.europa.eu/system/media_attachments/files/115/384/124/101/268/222/original/3c110adddddce990.jpg

2025-09-03 08:51:50 GMT

⚡ Great Scott, we are back!⚡
This is heavy! We're thrilled to announce that we are back to #Mastodon!
Follow us on this ride back to the future of open and privacy-friendly social media.
After all, where we're going, we don't need roads🚀
https://social.edps.europa.eu/system/media_attachments/files/115/139/229/431/108/349/original/c4a55a30646cec11.png