EU Data Protection Chief Selection Faces Complaints and Delays

The selection process for a new European Data Protection Supervisor (EDPS) has encountered significant challenges, prompting two complaints to the EU Ombudsman. The current EDPS, Wojciech Wiewiórowski, whose mandate expired in December 2023, continues to serve as discussions about his potential replacement remain unresolved.

The Ombudsman’s office confirmed to Euronews that it received a complaint prior to the summer concerning the selection process for the new head of the EDPS. This office oversees compliance with EU data protection rules across institutions. As of now, an inquiry has not been initiated, as the European Commission has been given time to respond to the issues raised. Additionally, a second, more urgent complaint has been received, which is currently under analysis to determine whether an inquiry will be opened.

The deadlock surrounding the selection procedure stems from differing preferences expressed by the European Parliament and EU member states. The European Parliament’s Civil Liberties, Justice and Home Affairs Committee (LIBE) supported the appointment of Bruno Gencarelli, a long-time Commission official from Italy. Conversely, member states favor Wiewiórowski for another term. Negotiations to reach a consensus have not yet yielded results.

In March 2024, Gencarelli’s nomination faced scrutiny from the Centre for AI & Digital Humanism and privacy academics. They raised concerns about the implications of appointing someone with a longstanding Commission background to a role intended to uphold independence. Their letter to the presidents of the Parliament and Commission, as well as the Council Presidency, emphasized that appointing Gencarelli would violate the EDPS’s constitutionally protected independence and the principle of good administration.

The EDPS role has traditionally been held by individuals with backgrounds in national supervisory authorities. Wiewiórowski, along with his predecessors Peter Hustinx and Giovanni Buttarelli, all came from such backgrounds. The appointment of a former Commission official as EDPS would mark a departure from this precedent.

As the debate continues, Wiewiórowski remains in his position, with the Commission stating it cannot comment on the current state of the selection process. They clarified that there is no set deadline, and the current EDPS will remain in place until a successor is appointed.

Established in 2004, the EDPS’s role includes providing opinions on legislative proposals and influencing upcoming digital legislation. It is important to note that the EDPS does not possess the authority to impose fines for breaches of EU privacy rules; this responsibility lies with national data protection authorities.

The situation raises significant questions about the future direction of data protection oversight in Europe, particularly as the EU navigates evolving digital landscapes and privacy concerns. The outcome of this selection process will undoubtedly have implications for how effectively the EU can enforce its data protection standards and safeguard citizens’ privacy rights.