Newsletter (118)

The EDPS joined 60 other data protection authorities from the Global Privacy Assembly in signing a joint statement on AI-generated imagery.

The signatories represent a united position around serious concerns about AI systems that generate realistic images and videos that depict identifiable individuals without their knowledge and consent. Of most concern are the potential harms to children.

Find the statement here

On 10 February, representatives from EU institutions, bodies, offices and agencies (EUIs) gathered in Brussels for the third meeting of the AI Act Correspondents Network (AIACN). 2026 marks a decisive year for the AI Act and the network’s focus has shifted from anticipation to concrete action. Indeed, this year transparency obligations will become applicable, and the EDPS will assume its role as market surveillance authority.

The meeting featured a hands-on workshop led by the EDPS AI Unit, where participants navigated a case study on high-risk AI in recruitment, exploring the practicalities of human oversight and bias prevention. Discussions also tackled the legal and infrastructure challenges of generative AI, including an update on the European Commission’s own tool, GPT@EC.

Looking ahead, the EDPS will soon publish the EDPS AI Compass, a guiding document setting out the AI Unit’s operational priorities for the next two years. In the meantime, the AI regulatory sandbox pilot project is developing and will serve as a shared learning space to ensure that EUIs' innovation remains grounded in fundamental rights.

Read the blogpost from the Supervisor

Data protection officers (DPOs) are a cornerstone of data protection governance among the European Union institutions, offices, bodies and agencies (EUIs). Recently, the EDPS took action to help ensure this remains the case, adopting two key documents designed to strengthen their effectiveness and independence.

On 18 December 2025, the EDPS issued supervisory guidance clarifying the interpretation of the DPO role and the institutional guarantees required for their function.

Building on this, the organisation adopted a decision on 16 January 2026 which establishes binding rules requiring EUIs to obtain the prior consent of the EDPS before dismissing a DPO prior to the end of their term.

These measures, which apply immediately, reinforce the DPO position as a critical internal safeguard and ensure the consistent, independent application of EU data protection law.

Read the press release

Read the supervisory guidance

Read the decision

Every year on 28 January, we celebrate Data Protection Day. This date marks the anniversary of the Council of Europe’s Convention 108, the first binding international law securing individuals’ rights to protection of their personal data. This year, it also coincided with the 20th anniversary of Data Protection Day, the 10th anniversary of the GDPR’s adoption, and the introduction of the European Commission's Digital Omnibus proposal.

To mark the occasion, the EDPS and the Council of Europe (CoE) co-hosted a conference in Brussels. The discussions brought together experts and policymakers, including keynote speakers Beatriz de Anchorena (Chair of the Committee of Convention 108), Jelena Virant Burnik (Deputy Chair of the EDPB), and Professor Anu Bradford, to explore the future of Europe's digital legal order.

A central theme was that simplification should not be a euphemism for deregulation. Meaningful simplification must enhance legal certainty without eroding fundamental rights.

Highlights from the day included a deep dive into the outcome of the EDPS v SRB (Single Resolution Board) judgment, reinforcing that personal data must be assessed contextually rather than in the abstract, and a reflection on how the law can remain conceptually robust enough to match rapidly evolving tracking technologies without the need for constant reinvention.

Catch up with the event here

Read the Supervisor’s speech

Read the speech of the EDPS Secretary General 

Watch the highlights

Listen to it

In a joint opinion, the EDPS and the EDPB voiced their support for streamlining the implementation of the AI Act but called for stronger safeguards to protect fundamental rights.

While supporting the Commission’s goal to simplify the implementation of the AI Act and welcoming initiatives like EU-level regulatory sandboxes to foster innovation, the two organisations stress that data protection authorities must maintain a central role in supervising data processing within these environments.

Specific concerns were raised regarding several proposed changes that could undermine accountability:

• The use of special categories of personal data (such as health or ethnicity) for bias correction should be strictly limited to situations where the risk of adverse effects is serious.
• The requirement to register high-risk AI systems should remain, because without it, providers could unduly claim exemptions to avoid public scrutiny.
• Providers and deployers must retain their primary responsibility to ensure their staff are AI-literate.
• Core provisions for high-risk systems should not be postponed.

Read the joint opinion

Read the joint press release

In a recent blogpost, Supervisor Wojciech Wiewiórowski explains why an EDPS audit of a European Union institution, body, office or agency (EUI) can be a timely ‘health check’ that identifies data protection risks before they escalate. What is a legal necessity can also be foundational to institutional trust.

Read the blogpost

4 March 2026 – Governance and Enforcement structure of the AI Act
Speech by the European Data Protection Supervisor Wojciech Wiewiórowski at the IMCO-LIBE AI Act Working Group, Brussels, Belgium.

4 February 2026 – 18th Joint Parliamentary Scrutiny Group on Europol (JPSG)
Speech by the Supervisor at the 18th meeting of the Joint Parliamentary Scrutiny Group on Europol (JPSG), Brussels, Belgium.

28 January 2026 – Data Protection Day 2026: Reset or Refine? – Opening remarks
Opening remarks by the Supervisor on Data Protection Day 2026, Brussels, Belgium.

28 January 2026 – Data Protection Day 2026: Reset of Refine? – Closing remarks
Closing Remarks by EDPS Acting Secretary-General Thomas Zerdick on Data Protection Day 2026, Brussels, Belgium.

27 January 2026 – Towards a Digital Clearinghouse 2.0
Opening remarks by the Supervisor at the ‘Towards a Digital Clearinghouse 2.0’ event, Brussels, Belgium.