Chair of the European Data Protection Board European Data Protection Board

 

Dear Ms X,

I have received a complaint against the European Data Protection Board (EDPB) concerning how it adopted its Opinion 11/2024 on the use of facial recognition in airports.

The complainant claims, among others, that, in preparing the opinion, the EDPB failed to consult interested parties as set out in the General Data Protection Regulation (GDPR)[1], thereby negatively affecting the rights and interests of relevant stakeholders.

I have decided to open an inquiry into this aspect of the complaint to obtain clarifications from the EDPB on this matter.

The GDPR provides that, where appropriate, the EDPB has to consult interested parties.[2] The EDPB rules of procedure use the same general wording.[3]

By indicating that the EDPB should consult “where appropriate”, the legislator gave the EDPB a margin of discretion for deciding in what cases a consultation should be carried out. While it is not my role as European Ombudsman to substitute my judgment for that of the EDPB in terms of when to carry out a public consultation, my inquiry is aimed at assessing how the EDPB exercised its discretion in this case and how it communicated about the reason why it decided not to carry out a public consultation.

I take note that the EDPB’s Internal Guidance on Article 64(2) GDPR[4] sets out best practices to follow when preparing an Article 64(2) Opinion. Although the Guidance is not a binding instrument, the Ombudsman has consistently taken the view that institutions should follow the rules they set for themselves.

The Guidance clarifies when and how it may be “appropriate”, within the meaning of Article 70(4) GDPR, to conduct a public consultation. I acknowledge that, at the time of publication of Opinion 11/2024, the EDPB’s Internal Guidance had not yet been updated to set out the elements to take into account when deciding whether to hold a public consultation. Nevertheless, the absence of such guidance did not relieve the EDPB of the need to carry out an internal assessment of the need to carry out a public consultation. The criteria set out in the Guidance could thus still be used in this case, unless the EDPB provides different criteria that it applied before the update of the Guidance.

In this case, the EDPB, in its correspondence with the complainant, stated that Article 70(4) GDPR does not create an obligation to consult interested parties systematically as such. While this is not disputed, the explanations provided by the EDPB to the complainant do not make it clear how it assessed the need for a public consultation or on what basis it decided that such consultation was not needed.

In the absence of such explanation, I cannot assess whether the EDPB properly exercised its discretion.

In light of this, I would appreciate it if the EDPB could provide a written reply to this complaint and set out how it assessed the need to carry out a public consultation in this case and, on which basis it concluded not to do so.

In addition, I have decided that it is necessary for my inquiry team to inspect the EDPB’s internal documentation about this assessment. I would thus be grateful if the EDPB could provide my Office with copies of any document relating to EDPB’s internal assessment of the need for a public consultation on Opinion 11/2024.

While the complainant has raised other concerns in its complaint, I concluded that there are insufficient grounds to open an inquiry into them. I do not expect the EDPB to address such issues in its reply to my Office. The complainant has been informed accordingly.

I would be grateful if the EDPB could provide its reply and copies of the requested documents by 17 November 2026.

Information or documents that the EDPB considers to be confidential will not be disclosed to the complainant or any other person without the prior agreement of the EDPB.[5] Please note, however, that the EDBP’s reply will be shared with the complainant and published on our website. If the EDPB wishes to provide the Ombudsman with confidential information in its reply, such information should therefore be put in a confidential annex to the reply and clearly marked as confidential.

If, in the course of this inquiry, the EDPB becomes involved in court proceedings concerning the same subject matter as this complaint, I would ask you to let us know.

Yours sincerely,

Teresa Anjinho
European Ombudsman

Strasbourg, 17/08/2026

 

[1] Regulation (EU) 2016/679 on the protection of natural persons with regards to the processing of personal data and on

the free movement of such data (General Data Protection Regulation), Article 70(4), https://eurlex.

europa.eu/eli/reg/2016/679/oj.

[2] GDPR, Article 70(4) reads as follows: “The Board shall, where appropriate, consult interested parties and give them

the opportunity to comment within a reasonable period. The Board shall, without prejudice to Article 76, make the results

of the consultation procedure publicly available”.

[3] European Data Protection Board, rules of procedure, Article 30 reads as follows: “The Board shall, where appropriate,

organize consultations of interested parties in accordance with Article 70 (4) GDPR. The means and consultation period

shall be decided on a case-by-case basis”, https://www.edpb.europa.eu/system/files/2022-

04/edpb_rules_of_procedure_version_8_adopted_20220406_en.pdf.

[4] Internal EDPB Document 3/2019 on internal guidance on Article 64(2) GDPR, Version 2, Adopted on 02 December 2025, https://www.edpb.europa.eu/system/files/documents/2025-12/edpb_internaldocument_201903_bestpracticesonarticle64-2-opinions_appendix_en.pdf.

[5] Please clearly mark such material ‘Confidential’. Encrypted emails can be sent to our dedicated mailbox. Information and documents of this kind will be deleted from the European Ombudsman’s files shortly after the inquiry has ended.