European Data Protection Board unveils work programme for 2024-2025

The European Data Protection Board (EDPB) has adopted a new work programme outlining its key priorities and activities for 2024-2025. Announced on October 8, 2024, the programme aims to implement the first half of the EDPB's 2024-2027 strategy and address critical data protection issues facing stakeholders across the European Union.

A primary focus of the work programme is developing further guidance on key concepts in EU data protection law. According to the EDPB, this will include new guidelines on topics such as anonymization, pseudonymization, legitimate interest, children's data, and "consent or pay" models. The board also plans to issue guidance on data processing for scientific research and the implications of recent Court of Justice rulings on passenger name records.

To make its guidance more accessible, the EDPB will create information streams tailored for non-expert audiences, including factsheets, templates and checklists. This includes expanding the EDPB Data Protection Guide for Small Businesses.

The work programme also emphasizes supporting the development of compliance measures for data controllers and processors. The EDPB will issue opinions on accreditation requirements, codes of conduct, and certification criteria, including for the European Data Protection Seal. Engagement with stakeholders will focus on certification mechanisms, cybersecurity schemes, and raising awareness of compliance tools.

Another key pillar of the programme aims to reinforce cooperation between data protection authorities and cultivate a common enforcement culture. The EDPB plans to encourage greater use of cooperation tools outlined in the GDPR and Law Enforcement Directive. This includes developing guidance on mutual assistance procedures, urgency procedures, and the application of administrative fines.

To support enforcement, the EDPB will continue implementing its Coordinated Enforcement Framework. The 2024 coordinated action will focus on the right of access, with a fourth action planned for 2025. The board also aims to identify strategic cases for prioritized cooperation and create task forces as needed for enforcement matters.

Other initiatives include expanding the Support Pool of Experts to provide operational support to EDPB members, continuing staff exchange programmes, and organizing training workshops on topics like certification and binding corporate rules.

The EDPB also plans to evaluate and enhance the IT tools used for cooperation, including the Internal Market Information (IMI) system. A new application will be developed to monitor GDPR procedures in IMI and automate statistics and reporting.

Recognizing the complex and evolving regulatory environment, the work programme outlines efforts to promote consistent application of different regulatory frameworks. The EDPB will continue its active role in forums like the Digital Markets Act High Level Group and European Data Innovation Board.

New guidelines will address the interplay between data protection law and other EU regulations, including the AI Act, Digital Services Act, and Digital Markets Act. The board also plans guidance on topics like political advertising, crypto asset transfers, and anti-money laundering requirements.

Cooperation with other regulatory authorities, including those focused on competition and consumer protection, is emphasized as a key action area. The EDPB will also monitor and assess new technologies, developing human-centric guidance on issues like generative AI, blockchain, and telemetry data.

The final pillar of the work programme focuses on the EDPB's role in global data protection efforts. This includes continued work on data transfer mechanisms under GDPR and the Law Enforcement Directive. The board will issue opinions on adequacy decisions, administrative arrangements, binding corporate rules, and certification as a transfer tool.

To promote high data protection standards internationally, the EDPB plans to support information exchange among members active in global forums and engage with the wider international community. The programme also emphasizes facilitating cooperation between EU and non-EU data protection authorities, particularly for enforcement matters.

Key Facts

• The work programme was adopted on October 8, 2024 and covers the period until December 31, 2025
• It is the first of two programmes implementing the EDPB's 2024-2027 strategy
• Key focus areas include enhanced guidance, strengthened enforcement cooperation, addressing new technologies, and global engagement
• Specific initiatives include new guidelines on anonymization, children's data, and AI
• The EDPB plans to create more accessible resources for non-expert audiences and small businesses
• Coordinated enforcement actions are planned for 2024 (on right of access) and 2025
• New IT tools will be developed to support GDPR procedures and reporting