Rozhodnutí 01/2026 evropského inspektora ochrany údajů ze dne 16. ledna 2026, kterým se přijímají pravidla pro uplatňování požadavku předchozího souhlasu evropského inspektora ochrany údajů při odvolávání pověřenců pro ochranu osobních údajů [2026/199]

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/ECOJ L 295, 21.11.2018, p. 39 , ELI: http://data.europa.eu/eli/reg/2018/1725/oj. (the Regulation, or EUDPR), and in particular Articles 44(8) and 58(1)(a),

Having regard to Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHAOJ L 135, 24.5.2016, p. 53 , ELI: http://data.europa.eu/eli/reg/2016/794/oj. (Europol Regulation), and in particular Articles 41a(8), 43(1) and 43(4)(a) thereof,

Having regard to Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHAOJ L 295, 21.11.2018, p. 138 , ELI: http://data.europa.eu/eli/reg/2018/1727/oj. (Eurojust Regulation), and in particular Articles 36(4), 40(1) and (4) thereof,

Having regard to Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (the EPPO)OJ L 283, 31.10.2017, p. 1 , ELI: http://data.europa.eu/eli/reg/2017/1939/oj. (EPPO Regulation), and in particular Articles 48(1), 77(4), 85(1) and (4) thereof,

The rules on the application of the requirement of prior consent by the EDPS for the dismissal of Data Protection Officers are laid down in the Annex to this Decision.

OJ L 295, 21.11.2018, p. 39 , ELI: http://data.europa.eu/eli/reg/2018/1725/oj.

(1) The Treaty on the Functioning of the European Union provides that an independent authority is to control the compliance with the rules on protection of personal data processed by Union institutions, bodies, offices and agencies (Union institutions and bodies).

(2) Regulation (EU) 2018/1725 established the European Data Protection Supervisor (EDPS) that is responsible for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies. To this effect, the EDPS monitors and enforces the application of that Regulation by such Union institutions and bodies.

(3) The Regulation provides for the compulsory designation of a Data Protection Officer (DPO) in each Union institution, body, office and agency. This compulsory designation requirement is also provided for by Regulations (EU) 2016/794, (EU) 2018/1727 and (EU) 2017/1939.

(4) Given the central role of the DPO in advising the controller and monitoring the application of the rules governing the processing of personal data, it is essential that DPOs remain able to perform their tasks independently and effectively in all contexts. This is equally important in relation to the processing of administrative personal data relating to the internal functioning of Union institutions and bodies, as well as for operational personal data processed in the performance of Union institutions and bodies tasks when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three TFEU to meet the objectives and tasks laid down in the legal acts establishing those bodies, offices or agencies. The DPO’s ability to provide impartial advice, monitor compliance, and act as a point of contact for data subjects and the EDPS should therefore be safeguarded and effectively supported.

(5) The independence of the DPO is a structural guarantee essential for ensuring compliance with the applicable provisions on data protection and enabling the DPO to perform their statutory duties without fear of retaliation. Protecting DPO independence is a prerequisite for an effective data protection governance framework within the Union institutions and bodies and an important safeguard for individuals’ fundamental rights under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.

(6) To that end, the Regulation provides that a designated DPO may only be dismissed from their post only if they no longer fulfil the conditions required for the performance of their duties, and only with the prior consent of the EDPS. In addition, the Regulation establishes that a DPO may not be dismissed or penalised by the controller or processor for performing their tasks. Equivalent requirements apply to the DPOs of Europol, Eurojust and the EPPO under their respective legal frameworks. The Court of Justice has also clarified that the prohibition of the dismissal, by a controller or processor, of a data protection officer or of the imposition, by a controller or processor, of a penalty on him or her means that that officer must be protected against any decision terminating his or her duties, by which he or she would be placed at a disadvantage or which would constitute a penaltyJudgment of the Court of 22 June 2022 , C-534/20, Leistritz AG , ECLI:EU:C:2022:495, paragraph 21. .

(7) Any intended dismissal of a DPO should therefore subject to a clear, predictable and fair procedure allowing the EDPS to verify whether the legal conditions are fulfilled, and in particular whether the intended dismissal is based on objective grounds that do not impair the independence or the effective performance of the DPO’s tasks.

(8) In light of the experience acquired by the EDPS concerning enforcement of the provisions concerning DPOs, and in particular in order to ensure the consistent application of the EDPS prior consent requirement for the dismissal of DPOs across all Union institutions and bodies, and to prevent any circumvention of the mandatory requirement for prior EDPS consent, the information to be provided to allow the EDPS to perform its task should be laid down in advance for all Union Institutions and bodies in a clear and foreseeable manner.

(9) In the interest of legal certainty, the EDPS should also clarify how the right to be heard of the DPO concerned and of the Union institution and body should be ensured and should also specify the conditions under which the EDPS will give or refuse consent.

(10) It is also necessary to clarify how the EDPS will ensure a rapid intervention where the independence of the DPO concerned may be at imminent risk, for instance in situations involving possible retaliatory action, threats of dismissal or other circumstances requiring immediate EDPS action in the public interest and in the interest of the DPO concerned. In these situations, the importance of ensuring that consent is correctly requested and thus ensuring the lawfulness of the dismissal justifies a swift exercise of the powers of the EDPS, without prejudice to any legal remedy available.

(11) It is therefore appropriate to set out in a single instrument the information that EUIs should provide for the EDPS to assess requests for prior consent to DPO dismissals, together with the rules governing the submission and examination of such requests, the applicable deadlines, transparency and publication requirements, and the corrective measures typically applied in case of non-compliance,

These rules apply to all Union institutions and bodies under the supervisory competence of the EDPS.

OJ L 135, 24.5.2016, p. 53 , ELI: http://data.europa.eu/eli/reg/2016/794/oj.

Article 1 Article 1

Article 2 Article 2

Article 3 Article 3

This Decision shall enter into force on the twentieth day following its publication in the Official Journal of the European Union.

OJ L 295, 21.11.2018, p. 138 , ELI: http://data.europa.eu/eli/reg/2018/1727/oj.

OJ L 283, 31.10.2017, p. 1 , ELI: http://data.europa.eu/eli/reg/2017/1939/oj.

Judgment of the Court of 22 June 2022 , C-534/20, Leistritz AG , ECLI:EU:C:2022:495, paragraph 21.

HAS ADOPTED THIS DECISION: