Overview
This article establishes a secretariat under the European Data Protection Supervisor (EDPS) to support the European Data Protection Board (EDPB). The secretariat assists with analytical, administrative, and logistical tasks, operating under the instructions of the Board Chair. It ensures separate staff reporting lines, a published Memorandum of Understanding (MoU), and manages communications, translations, and preparation of Board opinions and decisions.
Key Principles
Support Function: Provides administrative, analytical, and logistical assistance to the Board.
Operational Oversight: Operates under the instructions of the Chair while maintaining independence.
Separate Reporting Lines: Staff report separately to preserve clarity and accountability.
Transparency: Publish a Memorandum of Understanding outlining roles and responsibilities.
Communication Management: Handle Board communications, translations, and documentation of opinions and decisions.
Organizational Applicability
This article applies to:
The Secretariat supporting the EDPB under the EDPS.
EDPB Chair and Deputy Chairs directing Secretariat tasks.
Supervisory authorities and EU institutions interacting with Board outputs.
Teams responsible for administrative, analytical, and logistical functions.
Implementation Requirements
Establish a secretariat with defined roles and responsibilities under the EDPS.
Ensure staff follow Chair’s instructions while maintaining separate reporting lines.
Prepare and manage Board opinions, decisions, communications, and translations.
Publish a Memorandum of Understanding clarifying the Secretariat’s mandate and operations.
Implementation Guidance
Define clear workflows for administrative, analytical, and logistical tasks.
Train staff on procedures for preparing opinions, decisions, and managing communications.
Implement document management and translation protocols to support Board operations.
Periodically review Secretariat effectiveness and compliance with MoU guidelines.
Periodic Review
Frequency: Annually or when staffing, Board operations, or procedures change.
Responsible Role: Secretariat leadership, EDPB Chair, and EDPS oversight.
Outcome: Ensure efficient support for Board operations, transparency, and accountability.
Non-Compliance Risks
Fines: Up to €20 million or 4% of global annual turnover for supervised entities failing GDPR obligations.
Legal Exposure: Risks from incomplete, delayed, or inaccurate Board outputs.
Reputational Damage: Loss of trust in Board effectiveness and support structures.
Operational Risk: Ineffective Secretariat may delay decisions, opinions, and communications impacting GDPR enforcement.