EDPB adopts report on DPO coordinated enforcement

During its January plenary session on Wednesday, 17 January, the European Data Protection Board (EDPB) adopted a report on the findings of its 2023 coordinated enforcement framework (CEF) focusing on the designation and position of data protection officers (DPOs). During the course of the year, 25 data protection authorities (DPAs), including the European Data Protection Supervisor (EDPS), sent CEF questionnaires to a total of 61,962 recipients, 42,875 organisations and 19,087 DPOs. Of those contacted, 17,490 completed questionnaires were submitted from 15,108 organisations and 2,382 DPOs. 

In its statement, the EDPB highlighted four main challenges: 

• The lack of designation of a DPO, even where mandatory, 
• Insufficient resources or expert knowledge for the DPO, 
• DPOs not being fully entrusted with the tasks required under data protection law,
• Lack of independence or reporting to the highest level of management.

Otherwise, the EDPB confirmed the results were largely encouraging. 

EDPB chair Anu Talus said: "DPOs play an important part in contributing to compliance with data protection law and promoting effective protection of data subject rights. Through the CEF, DPAs investigated whether DPOs have the means to fulfil their tasks, as required by the GDPR. The report provides an analysis of the challenges faced by DPOs, along with points of attention and recommendations to address these challenges."

In a separate statement, EDPS Wojciech Wiewiórowski said: "The results and further analysis of this Coordinated Enforcement Action reconfirm the crucial role that data protection officers have in bridging the gap between EU data protection law and its practical application in the EUIs. Whilst improvements can be made, I take note of these results with great satisfaction."

In its analysis of the report, IAPP News Editor Joe Duball examines the key findings.