The European Ombudsman and the European Data Protection Supervisor: Good Administration, Transparency, and Institutional Accountability

The European Ombudsman and the European Data Protection Supervisor: Good Administration, Transparency, and Institutional Accountability

Introduction

The European Union is not governed exclusively through legislation, political institutions, and judicial decisions. Its legal order also depends on the quality of its administration. Decisions must be taken fairly, public authorities must explain their actions, personal information must be handled lawfully, and individuals must have effective means of challenging administrative conduct that infringes their rights.

These requirements become particularly important because the institutions and bodies of the European Union exercise extensive administrative powers. The European Commission manages policies and programmes, supervises compliance with EU law, administers funding, and conducts investigations. EU agencies collect and process information, coordinate regulatory activities, and sometimes exercise significant powers affecting individuals and organisations. The Parliament, Council, Court of Justice, and other Union bodies also process personal data and perform administrative functions.

Two independent supervisory offices play a distinctive role in ensuring that this administrative activity remains accountable: the European Ombudsman and the European Data Protection Supervisor (EDPS).

The European Ombudsman investigates maladministration by EU institutions, bodies, offices, and agencies. The office addresses failures of fairness, transparency, impartiality, procedural correctness, and responsible administration. Its work is closely connected with the right to good administration under Article 41 of the Charter of Fundamental Rights of the European Union.

The European Data Protection Supervisor, by contrast, is the independent data protection authority responsible for supervising the processing of personal data by EU institutions, bodies, offices, and agencies. Its principal legal framework is Regulation (EU) 2018/1725. It investigates complaints, conducts audits, issues guidance, advises the Union institutions, and may exercise corrective and enforcement powers.

Although their functions differ, both offices protect individuals against the improper exercise of administrative authority. Their work demonstrates that institutional accountability is not limited to political scrutiny or judicial review. It also requires specialised mechanisms capable of examining administrative conduct, identifying systemic weaknesses, and promoting lawful institutional practices.

This article examines their legal foundations, institutional independence, jurisdiction, powers, procedures, relationship with fundamental rights, and contribution to the accountability of the European Union.

1. The Constitutional Foundations of Administrative Accountability

The European Ombudsman and the EDPS operate within a constitutional framework in which public administration is subject to the rule of law.

The EU institutions do not possess unlimited administrative discretion. Their decisions must comply with the Treaties, secondary legislation, general principles of EU law, and the Charter of Fundamental Rights. Administrative convenience cannot justify the disregard of procedural rights, and institutional objectives cannot automatically override individual rights.

Three constitutional principles are particularly important.

First, the principle of legality requires EU institutions and bodies to act within the powers conferred upon them by the Treaties and applicable legislation. Administrative action must have an appropriate legal basis and remain within the limits established by that basis.

Second, the principle of good administration requires decisions to be taken impartially, fairly, and within a reasonable time. Individuals affected by administrative decisions must receive appropriate procedural protection.

Third, the protection of personal data requires public authorities to process personal information lawfully, fairly, and for legitimate purposes. Administrative institutions cannot treat personal data as an unrestricted institutional resource.

These principles are supported by several provisions of primary EU law.

1.1 Article 41 of the Charter: The Right to Good Administration

Article 41 of the Charter of Fundamental Rights establishes an express right to good administration.

It provides that every person has the right to have their affairs handled impartially, fairly, and within a reasonable time by the institutions, bodies, offices, and agencies of the Union.

The right includes several specific procedural guarantees:

• The right to be heard before an individual measure adversely affecting a person is adopted.
• The right of access to one’s file, subject to legitimate confidentiality interests and professional or business secrecy.
• The obligation of the administration to give reasons for its decisions.
• The right to compensation for damage caused by the Union and its servants in the performance of their duties, in accordance with the general principles common to the laws of the Member States.
• The right to communicate with Union institutions in any of the languages of the Treaties and to receive an answer in the same language.

Article 41 is important because it transforms standards of administrative conduct into fundamental rights.

Good administration is therefore not simply a question of institutional efficiency or managerial quality. It is a legal requirement governing the relationship between public authorities and individuals.

The European Ombudsman contributes to the practical protection of this right by examining complaints about administrative conduct. The EDPS protects a closely related dimension of administrative fairness by ensuring that personal information is processed in accordance with the law.

The full provision is available in Article 41 of the Charter of Fundamental Rights.

1.2 Articles 42 and 43: Transparency and the Right to Complain

Article 42 of the Charter recognises the right of access to documents held by EU institutions, bodies, offices, and agencies, regardless of their medium.

This right supports democratic scrutiny. Citizens and residents must be able to understand how public decisions are prepared, what evidence is considered, and how institutional responsibilities are exercised.

Article 43 establishes the right to refer cases of maladministration to the European Ombudsman, subject to the jurisdictional limits laid down by the Treaties.

Together, Articles 41, 42, and 43 establish an important relationship between administrative fairness, institutional transparency, and independent scrutiny.

The rights are distinct but mutually reinforcing. Access to information enables scrutiny; good administration requires fair procedures; and the Ombudsman provides a mechanism through which administrative failures may be examined.

1.3 Article 16 TFEU: The Constitutional Basis of Data Protection

Article 16 of the Treaty on the Functioning of the European Union establishes the Union’s authority to adopt rules concerning the protection of individuals with regard to the processing of personal data.

It also provides for independent supervisory authorities to monitor compliance with data protection rules.

The provision is particularly significant because it applies to the Union institutions and bodies themselves. The EU is not merely a regulator requiring companies and Member States to respect data protection. It must also comply with the same fundamental principles when processing personal information in the exercise of its own functions.

Article 16 therefore provides the constitutional foundation for the European data protection framework and the institutional independence of the EDPS.

Article 16 TFEU must be read together with Article 8 of the Charter, which expressly recognises the right to the protection of personal data.

2. The European Ombudsman: Legal Status and Institutional Independence

The European Ombudsman is an independent office established under Article 228 TFEU.

The Ombudsman is elected by the European Parliament for the duration of the parliamentary term. The office is designed to investigate administrative conduct independently of the institution or body whose actions are being examined.

The present statutory framework is Regulation (EU, Euratom) 2021/1163, which establishes the regulations and general conditions governing the performance of the Ombudsman’s duties. It replaced the earlier framework established by Decision 94/262.

The Ombudsman is not a court, a legislative institution, or an administrative appeal authority. The office performs a specialised accountability function by examining whether the administration has acted consistently with the law and the principles of good administration.

2.1 Appointment and Independence

Article 228 TFEU provides that the European Ombudsman is elected by the European Parliament.

The Ombudsman must perform the office independently and may neither seek nor accept instructions from governments, EU institutions, bodies, or other entities.

This independence is essential. An office investigating administrative misconduct would lose credibility if the institution under examination could direct its conclusions or influence the handling of complaints.

The Ombudsman may not engage in another occupation during the term of office, whether remunerated or not.

The Treaty also provides for dismissal by the Court of Justice at the request of the European Parliament if the Ombudsman no longer fulfils the conditions required for the performance of the office or is guilty of serious misconduct.

These arrangements establish institutional independence while preserving accountability through legally defined procedures.

2.2 Scope of the Ombudsman’s Jurisdiction

The Ombudsman investigates maladministration in the activities of:

• The European Commission.
• The European Parliament.
• The Council of the European Union.
• EU agencies and decentralised bodies.
• EU offices and other Union administrative entities.

The jurisdiction is broad in institutional terms, but it is limited to the administration of the European Union.

The Ombudsman cannot ordinarily investigate the conduct of national, regional, or local administrations of Member States. This remains the case even where the complaint concerns the application or implementation of EU law.

Complaints about national administrations should normally be directed to the relevant national ombudsman, administrative authority, or court. The European Network of Ombudsmen facilitates cooperation and referrals between national and European offices.

The Ombudsman also cannot investigate complaints against private companies or individuals merely because their conduct concerns an EU policy area.

There is an important exception concerning the Court of Justice of the European Union: the Ombudsman cannot investigate the Court when it acts in its judicial role. This protects judicial independence and prevents administrative supervision from becoming an indirect means of reviewing judicial decisions.

The Ombudsman may, however, examine administrative activities of Union bodies within the scope of the Treaty, subject to the applicable jurisdictional rules.

3. Maladministration: Meaning, Forms, and Legal Significance

The concept of maladministration is central to the Ombudsman’s work.

EU law does not reduce maladministration to a narrow list of technical procedural violations. It encompasses failures to comply with the law, breaches of the principles of good administration, and conduct inconsistent with fundamental rights.

Maladministration may occur even where an administrative decision is not formally unlawful in the strict sense required for annulment by a court.

This distinction is important. Judicial review and Ombudsman investigations have different purposes. A court examines legal questions within its jurisdiction and applies the relevant procedural and substantive standards. The Ombudsman may also examine administrative fairness, transparency, responsiveness, and institutional practice.

3.1 Common Forms of Maladministration

Maladministration can take several forms.

Unreasonable delay

An institution may fail to process an application, respond to correspondence, or complete an administrative procedure within a reasonable period.

Not every delay constitutes maladministration. The complexity of the matter, the information required, and the procedural context may be relevant. Nevertheless, prolonged and unexplained inactivity can violate the standards of good administration.

Failure to give reasons

An administrative decision should explain the legal and factual considerations supporting it. A person affected by a decision must be able to understand why it was adopted and, where appropriate, challenge it.

Lack of impartiality

Officials must not allow personal interests, institutional bias, or irrelevant considerations to distort administrative decision-making.

Unfair treatment

An institution may act inconsistently, disregard legitimate expectations, apply procedures arbitrarily, or fail to treat comparable cases consistently.

Failure to provide access to documents

Unjustified refusal, delay, or inadequate handling of requests for access to EU documents may constitute maladministration.

Lack of transparency

Administrative procedures may become problematic when the institution fails to disclose relevant information, does not explain its reasoning, or does not properly document important decisions.

Misuse of administrative discretion

An institution may possess discretion under EU law but must exercise it within the limits of the relevant legal framework. Discretion does not authorise arbitrary or discriminatory conduct.

Failure to respect fundamental rights

Administrative conduct may amount to maladministration where it disregards rights protected by the Charter, including procedural rights and privacy guarantees.

3.2 Maladministration and Illegality Are Not Identical

One of the most important features of the Ombudsman’s mandate is that maladministration is broader than a conventional judicial finding of illegality.

For example, an EU institution may technically possess the authority to adopt a particular administrative decision. Nevertheless, the manner in which it exercises that authority may be unfair, insufficiently transparent, unnecessarily delayed, or inconsistent with standards of good administration.

The Ombudsman may examine such conduct even where the central question is not whether the decision should be annulled.

This does not mean that the Ombudsman can disregard the law or replace judicial review. Rather, the office examines administrative responsibility from a complementary perspective.

The distinction is especially relevant where the complaint concerns institutional behaviour, procedural quality, or systemic administrative practices rather than the legal validity of a particular act.

4. Complaints and Investigations Before the European Ombudsman

Article 228 TFEU authorises the Ombudsman to investigate complaints submitted by eligible persons and to conduct inquiries on the Ombudsman’s own initiative.

The detailed procedure is governed by Regulation 2021/1163 and the implementing provisions adopted under it.

4.1 Who May Submit a Complaint?

A complaint may be lodged by:

• Any citizen of the European Union.
• Any natural person residing in a Member State.
• Any legal person having its registered office in a Member State.

The right is not restricted to individuals who are citizens of the EU. Businesses, associations, and other eligible organisations may also complain.

The complainant does not necessarily need to demonstrate that they have suffered direct individual damage. The Ombudsman’s mandate also permits attention to broader public-interest concerns.

A complaint must identify its subject and the complainant. The complainant may request that the complaint, or parts of it, remain confidential.

4.2 Time Limits and Prior Administrative Contact

Article 2 of Regulation 2021/1163 establishes two important procedural requirements.

First, a complaint must normally be lodged within two years from the date on which the relevant facts came to the complainant’s attention.

Second, the complainant must first make appropriate administrative approaches to the institution, body, office, or agency concerned.

This requirement gives the institution an opportunity to address the problem before the Ombudsman intervenes.

For example, a person who believes that the Commission has improperly refused access to a document should normally first use the relevant administrative procedure for requesting review of that refusal.

The Ombudsman is not intended to replace the ordinary administrative channels of the institution. The office provides an additional mechanism of independent scrutiny where those channels have not adequately resolved the matter.

4.3 Admissibility and Jurisdiction

The Ombudsman must determine whether the complaint falls within the office’s mandate and satisfies the applicable procedural requirements.

A complaint may be inadmissible where:

• It concerns a national or private authority rather than an EU institution or body.
• It concerns judicial activity of the Court of Justice.
• It was submitted outside the applicable two-year period.
• The complainant failed to make appropriate prior administrative approaches.
• The complaint does not satisfy the statutory requirements.

The Ombudsman may also close a matter where it is manifestly unfounded or where further inquiry is not justified.

The statutory procedure is designed to balance accessibility with the effective administration of complaints.

4.4 Investigative Powers

Once an inquiry is opened, the Ombudsman may request information and explanations from the institution concerned.

The institution must cooperate with the investigation in accordance with the Treaty and statutory framework.

The Ombudsman may examine relevant documents, request observations, and seek explanations from officials. The institution concerned is given an opportunity to respond to the allegations and findings.

These investigative powers are important because administrative accountability requires more than receiving complaints. It requires access to sufficient information to establish what occurred and whether the conduct was consistent with the applicable standards.

The Ombudsman may also conduct inquiries on the office’s own initiative, particularly where repeated or serious administrative failures suggest a systemic problem.

4.5 Own-Initiative Inquiries

Own-initiative inquiries allow the Ombudsman to examine administrative practices without waiting for an individual complaint.

This is particularly important where a problem affects a large number of people, concerns a recurring institutional practice, or raises questions of public interest.

For example, the Ombudsman may examine whether an EU institution consistently applies its transparency obligations, how it handles public consultations, or whether its procedures adequately protect individuals affected by administrative decisions.

Own-initiative investigations therefore give the office a preventive and systemic dimension.

They allow the Ombudsman to identify weaknesses in institutional practice and recommend improvements before the same problem generates numerous individual complaints.

5. The Ombudsman’s Findings, Recommendations, and Remedies

The Ombudsman does not possess the same remedial powers as the Court of Justice.

The office cannot annul an EU legal act, substitute its own administrative decision for that of the institution, or award damages in the manner of a court exercising jurisdiction over a damages claim.

Its principal instruments are findings, recommendations, proposals for solutions, and suggestions for improvement.

5.1 Findings of Maladministration

Where an inquiry establishes maladministration, the Ombudsman informs the institution concerned of the findings.

The institution is expected to respond and explain what action it intends to take.

The Ombudsman may recommend a solution designed to correct the individual problem or address the underlying administrative failure.

For example, where an institution has unreasonably delayed a response, the appropriate solution may be to complete the procedure and provide the necessary explanation.

Where the problem concerns an unclear internal policy, the Ombudsman may recommend changes to the relevant administrative practice.

5.2 Recommendations and Proposals for Solutions

Recommendations may concern both individual complaints and broader institutional practices.

They may call upon an institution to:

• Reconsider a particular administrative procedure.
• Provide an adequate explanation.
• Improve the handling of access-to-documents requests.
• Correct inconsistent administrative practices.
• Improve transparency in decision-making.
• Introduce clearer internal rules.
• Strengthen safeguards against conflicts of interest.
• Improve the quality of communication with individuals.

The recommendations are not equivalent to judicial orders. Their effectiveness depends substantially on institutional cooperation, the authority of the Ombudsman’s findings, and public and parliamentary scrutiny.

Nevertheless, the absence of direct coercive power does not make the office insignificant. Its work can generate institutional changes and establish standards of administrative conduct.

5.3 Relationship with Judicial Remedies

The Ombudsman does not replace the right to bring proceedings before the EU courts.

A person seeking annulment of an EU act, damages, or judicial protection against an enforceable decision must consider the relevant judicial procedures and their strict admissibility and time-limit requirements.

An Ombudsman complaint should not be assumed to suspend or extend the time limits for judicial proceedings.

Furthermore, Article 228 TFEU excludes investigations into alleged facts that are or have been the subject of legal proceedings, while the Statute prevents the Ombudsman from questioning the soundness of a court’s ruling.

The distinction reflects the different institutional purposes of judicial review and administrative oversight.

Judicial proceedings determine legal disputes through binding judgments. Ombudsman inquiries examine administrative conduct and encourage institutional compliance with principles of good administration.

6. Transparency and Access to Documents

Transparency is one of the most important areas of the Ombudsman’s work.

The right of public access to documents is established by Article 42 of the Charter and Article 15 TFEU. Regulation (EC) No 1049/2001 provides the principal framework for public access to European Parliament, Council, and Commission documents.

The right applies to documents held by the relevant institutions, subject to the exceptions established by the applicable legislation.

These exceptions include certain interests relating to public security, defence, international relations, privacy, commercial interests, court proceedings, inspections, investigations, and institutional decision-making.

The existence of exceptions does not mean that access may be refused automatically. The institution must apply the relevant legal criteria and provide an adequate explanation.

6.1 The Ombudsman’s Role in Access-to-Documents Disputes

The Ombudsman investigates complaints concerning the handling of requests for public access to EU documents.

Typical problems include:

• Unreasonable delays.
• Inadequate explanations for refusals.
• Failure to identify relevant documents.
• Overly broad reliance on exceptions.
• Inconsistent treatment of comparable requests.
• Insufficient transparency concerning institutional decision-making.

The Ombudsman may examine whether an institution has correctly applied the relevant rules and whether its administrative approach respects the principles of openness and accountability.

The office’s work is particularly important where the refusal or delay affects the ability of individuals, journalists, researchers, or civil society organisations to scrutinise public decision-making.

6.2 Transparency and Democratic Accountability

Access to documents is not merely an administrative convenience.

It allows the public to examine how policies are formulated, how evidence is evaluated, and how institutional decisions are justified.

Without adequate transparency, the formal existence of democratic institutions may not provide sufficient opportunities for meaningful scrutiny.

The Ombudsman therefore contributes to democratic accountability by examining whether institutions comply with their transparency obligations.

The office’s Guide on the Right of Public Access to EU Documents provides a useful explanation of the legal framework and practical issues arising in this area.

7. The European Data Protection Supervisor: Legal Status and Mandate

The European Data Protection Supervisor is an independent supervisory authority responsible for monitoring compliance with data protection law by EU institutions, bodies, offices, and agencies.

The EDPS began operating in 2004 under the earlier Regulation (EC) No 45/2001. Its current principal legal framework is Regulation (EU) 2018/1725.

The Regulation establishes rules for the protection of natural persons with regard to the processing of personal data by Union institutions and bodies.

The EDPS is not simply an advisory office. It exercises independent supervisory functions and possesses investigative, corrective, and authorisation powers under the applicable legislation.

Its mandate reflects the principle that public institutions must comply with data protection requirements just as private organisations and national public authorities must do.

7.1 Constitutional and Legislative Foundations

The principal legal foundations of the EDPS are:

• Article 16 TFEU, establishing the Union’s competence in data protection and the requirement for independent supervision.
• Article 8 of the Charter, recognising the fundamental right to the protection of personal data.
• Regulation (EU) 2018/1725, establishing the rules applicable to EU institutions and bodies.
• Relevant provisions of the Treaties and sector-specific legislation governing certain Union agencies and bodies.

Article 8 of the Charter requires personal data to be processed fairly, for specified purposes, and on the basis of consent or another legitimate basis laid down by law.

It also establishes the right of individuals to access personal data concerning them and to have inaccurate data rectified.

The provision further requires compliance to be subject to control by an independent authority.

The EDPS gives practical effect to this requirement within the institutional and administrative structure of the European Union.

7.2 Independence of the EDPS

The EDPS must perform its tasks independently and without external influence.

This independence is necessary because the authority supervises institutions that participate in the Union’s legislative, executive, regulatory, and administrative activities.

The EDPS must be able to investigate the processing of personal information by the Commission, Parliament, Council, agencies, and other Union bodies without being directed by those institutions.

Independence also protects the credibility of its advisory work. The authority must be able to identify privacy risks in proposed legislation and administrative systems even where those proposals originate from powerful Union institutions.

8. Regulation (EU) 2018/1725: Data Protection Within the EU Institutions

Regulation (EU) 2018/1725 is the central legal instrument governing the processing of personal data by EU institutions, bodies, offices, and agencies.

It is closely aligned with the General Data Protection Regulation (GDPR), which governs most processing by private organisations and public authorities within Member States. However, the two instruments have different institutional fields of application.

The GDPR principally applies to controllers and processors within its territorial and material scope. Regulation 2018/1725 establishes the corresponding framework for Union institutions and bodies.

This distinction is important. The EU administration cannot simply rely on the GDPR as the direct and complete legal framework for all its own processing activities.

8.1 Fundamental Data Protection Principles

The Regulation establishes principles that govern the processing of personal information.

Lawfulness, fairness, and transparency

Personal data must be processed on a lawful basis and in a manner that is fair to the data subject. Individuals should be informed about relevant processing activities.

Purpose limitation

Personal data must be collected for specified, explicit, and legitimate purposes. It should not subsequently be processed in a manner incompatible with those purposes.

Data minimisation

Institutions should collect and process only the personal information necessary for the relevant purpose.

Accuracy

Personal data must be accurate and, where necessary, kept up to date. Inaccurate information should be corrected or erased without undue delay, subject to the applicable legal framework.

Storage limitation

Personal information should not be retained longer than necessary for the purposes for which it is processed, subject to lawful archival and other exceptions.

Integrity and confidentiality

Appropriate technical and organisational measures must protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage.

Accountability

The institution responsible for processing must be able to demonstrate compliance with its legal obligations.

These principles are especially important in the public sector because EU institutions often process information relating to employment, funding, research, migration, law enforcement, public health, and the exercise of individual rights.

8.2 Data Subjects’ Rights

Regulation 2018/1725 provides individuals with rights in relation to personal data processed by EU institutions.

Depending on the circumstances and applicable exceptions, these include:

• The right to receive information about processing.
• The right of access to personal data.
• The right to rectification.
• The right to erasure.
• The right to restriction of processing.
• The right to object to certain processing activities.
• The right to lodge a complaint with the EDPS.

These rights are not absolute. The Regulation permits certain restrictions where necessary and proportionate to protect specified public interests, institutional functions, or the rights of others.

However, restrictions must have a legal basis and comply with the applicable safeguards. An institution cannot exclude data subject rights merely because compliance would be administratively inconvenient.

8.3 Controllers, Processors, and Data Protection Officers

The Regulation places primary responsibility for lawful processing on the relevant EU institution or body acting as controller.

Controllers determine the purposes and means of processing, subject to the applicable legal framework.

Processors handle personal data on behalf of controllers and must comply with the contractual and statutory obligations governing their activities.

EU institutions must also designate Data Protection Officers (DPOs), whose functions include advising the institution, monitoring compliance, and cooperating with the EDPS.

The DPO provides an important internal safeguard. The EDPS, however, remains the independent external supervisory authority.

The distinction between internal compliance and external supervision is essential. An institution cannot replace independent oversight merely by appointing an internal officer.

9. The EDPS’s Supervisory, Investigative, and Enforcement Powers

Article 58 of Regulation 2018/1725 establishes the powers of the EDPS.

These powers are considerably more direct than the Ombudsman’s principal instruments of recommendations and proposals for solutions.

The EDPS may investigate potential infringements, obtain information, conduct audits, and exercise corrective powers where the legal requirements are satisfied.

9.1 Investigative Powers

The EDPS may:

• Order controllers and processors to provide information necessary for supervisory tasks.
• Conduct data protection audits.
• Notify controllers or processors of alleged infringements.
• Obtain access to personal data and information necessary for investigations.
• Obtain access to relevant premises and data-processing equipment in accordance with Union law.

These powers allow the EDPS to examine actual processing operations rather than relying exclusively on institutional explanations.

An investigation may arise from a complaint, information received from another source, or the EDPS’s own supervisory priorities.

Audits may examine whether an institution has appropriate technical and organisational safeguards, lawful processing arrangements, suitable retention policies, and effective internal procedures.

9.2 Corrective Powers

Where an infringement is established, the EDPS may use corrective powers provided by the Regulation.

Depending on the circumstances, these may include:

• Issuing warnings concerning proposed processing operations.
• Reprimanding a controller or processor for an infringement.
• Ordering compliance with data subject requests.
• Ordering the correction or erasure of personal data, or restriction of processing.
• Imposing a temporary or definitive limitation, including a ban on processing.
• Ordering the suspension of data flows to a recipient.
• Referring matters to the Court of Justice where the conditions for judicial proceedings are satisfied.

The exact measure depends on the nature and seriousness of the infringement, the circumstances of the processing, and the statutory framework.

The EDPS must exercise its powers consistently with due process, proportionality, and effective judicial protection.

9.3 Advisory and Authorisation Powers

The EDPS also performs an advisory function.

It may issue opinions to EU institutions and bodies, advise on proposed legislation, and provide guidance on data protection issues.

Consultation is particularly important where new policies or technological systems may affect personal privacy.

For example, a proposed EU administrative system involving extensive personal-data processing may require an assessment of necessity, proportionality, security, retention, and access controls.

The EDPS may also exercise specific authorisation functions under Regulation 2018/1725, including in relation to certain international transfers and contractual or administrative arrangements.

Its advisory role therefore operates alongside its supervisory and enforcement responsibilities.

10. Complaints to the European Data Protection Supervisor

Individuals who believe that an EU institution or body has infringed their data protection rights may lodge a complaint with the EDPS.

The complaint mechanism is an important element of independent supervision.

10.1 Who May Complain?

A person may complain where they consider that the processing of personal data concerning them by an EU institution or body infringes Regulation 2018/1725.

The complaint may concern, for example:

• Unlawful collection of personal data.
• Processing without an appropriate legal basis.
• Inadequate information about processing.
• Unjustified refusal of access.
• Failure to rectify inaccurate data.
• Excessive retention.
• Insufficient security.
• Unauthorised disclosure.
• Failure to respect applicable restrictions and safeguards.

The EDPS provides mechanisms for submitting complaints, including an electronic complaint form.

10.2 Examination of Complaints

The EDPS examines complaints within its supervisory mandate.

The authority may request information from the institution concerned, investigate the relevant processing activities, and determine whether the applicable data protection rules have been respected.

The EDPS must handle complaints in accordance with the requirements of Regulation 2018/1725, including procedural fairness and the obligation to inform the complainant of the progress and outcome of the matter.

The authority may refuse to act on requests that are manifestly unfounded or excessive, particularly where they are repetitive, subject to the statutory requirements.

10.3 Relationship with Judicial Remedies

The EDPS does not replace judicial protection.

Under the Regulation, individuals may have access to judicial remedies against legally relevant decisions of the EDPS, subject to the applicable conditions.

The EDPS may also bring matters before the Court of Justice or intervene in proceedings where the Treaties and legislation permit.

This creates a system in which administrative supervision and judicial review complement one another.

The EDPS can investigate and enforce data protection obligations within its mandate, while the EU courts retain authority to determine legal disputes falling within their jurisdiction.

11. The EDPS and the GDPR: Why the Distinction Matters

One frequent source of confusion is the relationship between the EDPS and the General Data Protection Regulation.

The EDPS is not the general data protection authority for every organisation operating within the European Union.

Its principal supervisory jurisdiction concerns the processing of personal data by EU institutions, bodies, offices, and agencies.

National data protection authorities supervise processing within their respective national jurisdictions under the GDPR and applicable national legislation.

For example, a complaint concerning a private online retailer’s unlawful processing of customer information would normally fall within the jurisdiction of the competent national data protection authority, not the EDPS.

Similarly, a complaint about the processing of personal information by a national ministry would normally be directed to the relevant national supervisory authority.

The EDPS is responsible for the EU institutional level.

11.1 The European Data Protection Board

The European Data Protection Board (EDPB) must also be distinguished from the EDPS.

The EDPB is established under the GDPR and supports consistent application of data protection rules across the Member States.

It brings together representatives of national supervisory authorities and the European Data Protection Supervisor. The EDPS provides the EDPB’s secretariat, but the two bodies have different legal identities and functions.

The EDPB contributes to consistency through guidelines, opinions, and binding decisions in specified cross-border cases.

The EDPS, by contrast, supervises EU institutions and bodies under Regulation 2018/1725 and performs additional advisory functions.

The distinction can be summarised as follows:

Authority	Principal responsibility
European Data Protection Supervisor	Supervises personal-data processing by EU institutions and bodies
National data protection authorities	Supervise processing within their national jurisdictions under the GDPR and national law
European Data Protection Board	Promotes consistent application of the GDPR across the EU
Court of Justice of the European Union	Provides judicial interpretation and review within its jurisdiction

The institutional separation prevents the mistaken assumption that the EDPS can investigate every data protection complaint arising anywhere in the European Union.

12. Specialised Data Protection Supervision in EU Agencies

The EDPS’s work is particularly important because several Union agencies process sensitive or extensive personal information.

These include agencies and bodies operating in areas such as policing, judicial cooperation, migration, border management, and financial regulation.

Examples include Europol, Eurojust, and the European Public Prosecutor’s Office.

The applicable supervisory framework may include both Regulation 2018/1725 and specific provisions in the founding legislation of the relevant body.

This is especially important in the area of law enforcement and judicial cooperation, where personal data may relate to criminal investigations, suspects, victims, witnesses, and other individuals.

The EDPS must therefore consider the particular legal framework governing each institution or agency while maintaining the independence and effectiveness of data protection supervision.

The distinction between central EU systems and national authorities’ use of those systems can also require cooperation between the EDPS and national supervisory authorities.

For example, a central EU database may be supervised by the EDPS, while national authorities remain responsible for the processing operations performed by national bodies under their own jurisdiction.

This shared supervisory structure is essential for large-scale information systems operating across borders.

13. The Relationship Between the European Ombudsman and the EDPS

The European Ombudsman and the EDPS are separate independent offices with different legal mandates.

Their work nevertheless overlaps in several important areas.

Both examine the conduct of EU institutions and bodies. Both contribute to the protection of individual rights. Both may investigate administrative practices and identify systemic weaknesses. Both promote institutional accountability.

The difference lies primarily in the legal nature of the problem under examination.

The Ombudsman examines maladministration. The EDPS examines compliance with data protection obligations.

13.1 A Practical Distinction

Consider a hypothetical situation in which an EU agency collects personal information from individuals participating in a funding programme.

Several problems may arise.

If the agency fails to explain why an application has been delayed, treats applicants inconsistently, or refuses to provide an adequate explanation of an administrative decision, the matter may fall within the Ombudsman’s mandate.

If the agency collects excessive personal information, retains it without an adequate legal basis, discloses it unlawfully, or refuses a legitimate data access request, the matter may fall within the EDPS’s mandate.

Some situations may involve both dimensions.

For example, an institution may mishandle a data access request by failing to respond within a reasonable period and providing no adequate explanation. The underlying issue may involve both administrative maladministration and data protection compliance.

The competent authority and applicable procedure depend on the precise facts and the rights involved.

13.2 Complementary Rather Than Competing Supervision

The two offices should not be viewed as competing authorities.

The Ombudsman is concerned with the quality, fairness, and integrity of EU administration. The EDPS is concerned with the lawful processing and protection of personal data.

An institution may comply with data protection legislation but still act in an administratively unfair manner. Conversely, an institution may follow an otherwise orderly administrative procedure while unlawfully processing personal information.

The two forms of supervision address different legal risks.

Their complementary operation reflects a broader principle of EU governance: institutional accountability requires more than one form of oversight because public administration affects individuals in multiple ways.

14. Administrative Accountability in the Digital Age

The work of both offices has become increasingly significant as EU institutions rely on digital systems, interconnected databases, automated procedures, and artificial intelligence.

Digital administration creates opportunities for efficiency, but it also introduces new risks.

Administrative decisions may increasingly depend on automated data processing, algorithmic assessments, or information obtained from multiple sources.

These developments raise questions about transparency, accuracy, responsibility, human oversight, and the ability of individuals to understand decisions affecting them.

14.1 Artificial Intelligence and Administrative Fairness

The use of artificial intelligence in public administration may affect how applications are assessed, how risks are identified, and how administrative resources are allocated.

Where automated systems influence decisions affecting individuals, institutions must ensure that the relevant legal safeguards are respected.

The right to good administration remains applicable. An institution cannot avoid its obligations merely because a decision has been assisted by an algorithm.

The Ombudsman may examine whether the institution has acted transparently, provided adequate explanations, and maintained appropriate administrative safeguards.

The EDPS may examine whether the underlying personal-data processing complies with Regulation 2018/1725, including the requirements concerning lawfulness, fairness, transparency, purpose limitation, and data minimisation.

14.2 Data Protection and Algorithmic Accountability

Automated processing may involve large volumes of personal information and complex relationships between datasets.

The EDPS’s supervisory role is therefore particularly relevant to questions such as:

• Whether personal data is processed for a legitimate and specified purpose.
• Whether the data used is accurate and necessary.
• Whether the processing creates disproportionate risks for individuals.
• Whether appropriate technical and organisational safeguards exist.
• Whether individuals can exercise their rights effectively.
• Whether automated decision-making complies with the applicable legal restrictions.

The EDPS also advises EU institutions on emerging technologies and the privacy implications of proposed policies.

14.3 Transparency Without Unnecessary Disclosure

Digital administration also creates a tension between transparency and confidentiality.

An institution may be required to disclose information about its decision-making while simultaneously protecting personal data, commercially confidential information, or information covered by legitimate security restrictions.

Neither transparency nor data protection should be treated as an absolute principle that automatically overrides all others.

The applicable legal framework requires a careful assessment of the competing interests and the relevant exceptions.

The Ombudsman and the EDPS approach this problem from different legal perspectives, but both contribute to a system in which institutional openness and individual privacy can be protected together.

15. Institutional Accountability and the Rule of Law

The existence of independent supervisory offices is an important feature of the EU’s system of checks and balances.

The European Ombudsman and the EDPS do not replace the political institutions or the judiciary. Their role is to ensure that administrative authority remains subject to independent scrutiny.

Their contribution can be examined through four dimensions.

15.1 Legal Accountability

The offices promote compliance with the applicable legal framework.

The Ombudsman examines administrative conduct against the requirements of EU law and good administration. The EDPS supervises compliance with data protection legislation.

Their work helps ensure that institutional authority is exercised within legally established limits.

15.2 Procedural Accountability

Public institutions must follow fair procedures.

This includes giving reasons, respecting relevant rights, responding within a reasonable time, handling complaints properly, and providing appropriate safeguards when processing personal information.

The offices help identify procedural failures that might otherwise remain difficult for individuals to challenge.

15.3 Institutional Learning

Both offices can identify recurring weaknesses and encourage changes in administrative practice.

An individual complaint may reveal a broader problem affecting many people. Own-initiative inquiries, audits, guidance, and recommendations can help institutions correct systemic weaknesses.

This preventive function is particularly valuable because institutional accountability should not depend exclusively on litigation after harm has occurred.

15.4 Public Confidence

The legitimacy of public administration depends partly on whether individuals can understand and challenge its conduct.

Independent supervision helps demonstrate that EU institutions are not exempt from the rules they establish for others.

The offices therefore contribute to public confidence by providing mechanisms through which administrative conduct can be examined and, where necessary, corrected.

16. Limits and Challenges of Independent Supervision

The Ombudsman and the EDPS operate within defined legal and institutional limits.

Their independence does not mean that they possess unlimited jurisdiction or unrestricted powers.

The Ombudsman’s recommendations are not equivalent to binding judicial judgments. Their effectiveness depends on institutional cooperation, follow-up, and the willingness of the relevant body to implement improvements.

The EDPS possesses stronger corrective powers in its specialised field, but it must exercise them within the statutory framework and respect the procedural rights of the institutions and persons concerned.

Several challenges remain.

16.1 Institutional Complexity

The EU administrative structure includes numerous institutions, bodies, offices, and agencies.

Determining which authority is responsible for a particular decision or processing activity may be difficult, especially where several entities participate in a single administrative process.

Effective accountability requires clear allocation of responsibilities and cooperation between supervisory bodies.

16.2 Fragmentation of Oversight

Different forms of supervision may apply to the same institutional activity.

An administrative procedure may raise questions of transparency, data protection, financial responsibility, or fundamental rights.

Although specialised oversight improves expertise, it can also create complexity for individuals who are unsure which authority should receive a complaint.

16.3 Balancing Rights and Public Interests

EU institutions must often reconcile individual rights with legitimate public interests.

Security, law enforcement, public health, financial supervision, and the protection of confidential information may justify certain restrictions under EU law.

However, restrictions must remain legally justified and proportionate.

Independent supervision is particularly important where institutions rely on broad public-interest arguments to justify limitations on individual rights.

16.4 Technological Development

The speed of technological change may create challenges for traditional administrative procedures and supervisory methods.

Artificial intelligence, large-scale databases, biometric information, automated assessments, and cross-border data transfers require continuous attention.

The supervisory authorities must be capable of examining not only established administrative practices but also new forms of institutional decision-making.

17. Practical Examples: Which Authority Should Be Contacted?

The distinction between the European Ombudsman and the EDPS becomes clearer when applied to practical situations.

Example 1: An EU institution fails to respond to correspondence

A person has repeatedly contacted an EU institution but receives no response concerning an administrative matter.

This may constitute maladministration. After making appropriate administrative approaches, the person may consider submitting a complaint to the European Ombudsman.

Example 2: An EU agency refuses access to personal data

An individual requests access to personal information held by an EU agency. The agency refuses without an adequate legal basis.

The matter may fall within the EDPS’s data protection supervisory mandate.

Example 3: An EU institution refuses access to a public document

A journalist requests a document concerning an EU policy decision and receives an unexplained refusal.

The matter may be examined by the Ombudsman, subject to the applicable access-to-documents procedures.

Example 4: A national authority unlawfully processes personal data

A person believes that a national government department has unlawfully processed personal information.

The appropriate authority is normally the national data protection supervisory authority, not the EDPS.

Example 5: An EU agency uses inaccurate personal information

An EU agency processes inaccurate information concerning an individual and refuses to correct it despite an appropriate request.

The individual may lodge a complaint with the EDPS.

Example 6: An EU institution conducts an unfair administrative procedure involving personal data

An institution delays a procedure, provides inadequate reasons, and processes personal data in a manner that may violate Regulation 2018/1725.

Depending on the circumstances, the matter may raise both maladministration and data protection issues. The two offices have distinct mandates and may address different aspects of the same factual situation.

18. Key Takeaways

The European Ombudsman and the European Data Protection Supervisor are independent offices that strengthen accountability within the EU administration.

Their principal functions are different but complementary.

The European Ombudsman:

• Investigates maladministration by EU institutions, bodies, offices, and agencies.
• Acts under Article 228 TFEU and Regulation 2021/1163.
• Protects standards of good administration, fairness, transparency, and accountability.
• Accepts complaints from eligible individuals and legal persons.
• May conduct own-initiative inquiries.
• Issues findings, recommendations, proposals for solutions, and suggestions for improvement.
• Cannot annul EU acts or replace the judicial remedies available before the EU courts.

The European Data Protection Supervisor:

• Supervises personal-data processing by EU institutions and bodies.
• Operates under Article 16 TFEU and Regulation 2018/1725.
• Investigates complaints and conducts audits.
• Issues advice and opinions on data protection matters.
• Possesses corrective and enforcement powers under the Regulation.
• Cooperates with national supervisory authorities and the European Data Protection Board.
• Does not serve as the general data protection authority for private organisations or national public administrations.

Together, these offices demonstrate that the rule of law requires both fair administration and effective protection of personal information.

19. Frequently Asked Questions

1. What is the European Ombudsman?

The European Ombudsman is an independent office established under Article 228 TFEU. It investigates complaints about maladministration by EU institutions, bodies, offices, and agencies and may also conduct inquiries on its own initiative.

2. Who can complain to the European Ombudsman?

Any EU citizen, natural person residing in a Member State, or legal person having its registered office in a Member State may lodge a complaint, provided the matter falls within the Ombudsman’s jurisdiction and the applicable procedural requirements are satisfied.

3. What is considered maladministration?

Maladministration includes failures to comply with the law or principles of good administration. It may involve unreasonable delay, unfair treatment, lack of transparency, inadequate explanations, discrimination, or misuse of administrative discretion.

4. Can the European Ombudsman annul an EU decision?

No. The Ombudsman cannot annul EU legal acts or replace judicial review. The office investigates administrative conduct and may issue findings, recommendations, and proposals for solutions.

5. Is there a time limit for complaints to the European Ombudsman?

Yes. Under Regulation 2021/1163, a complaint must normally be lodged within two years from the date on which the relevant facts came to the complainant’s attention. The complainant must also make appropriate administrative approaches to the institution concerned.

6. What is the European Data Protection Supervisor?

The EDPS is the independent data protection authority responsible for supervising the processing of personal data by EU institutions, bodies, offices, and agencies.

7. Which legislation governs the EDPS?

The principal framework is Regulation (EU) 2018/1725, read together with Article 16 TFEU and Article 8 of the Charter of Fundamental Rights.

8. Can the EDPS investigate a private company?

The EDPS does not ordinarily supervise private companies under the GDPR. Complaints concerning private organisations generally fall within the jurisdiction of the competent national data protection authority.

9. What powers does the EDPS possess?

The EDPS may investigate complaints, conduct audits, obtain information, issue warnings and reprimands, order corrective measures, and exercise other powers provided by Regulation 2018/1725.

10. What is the difference between the EDPS and the EDPB?

The EDPS supervises personal-data processing by EU institutions and bodies. The EDPB promotes consistent application of the GDPR across the Member States and performs functions assigned to it by that Regulation.

11. Can the European Ombudsman investigate a national government department?

No. Complaints concerning national, regional, or local administrations should normally be addressed to the relevant national ombudsman or competent authority, even where the matter concerns EU law.

12. Can the Ombudsman and the EDPS examine different aspects of the same matter?

Yes. An administrative practice may raise both questions of maladministration and data protection compliance. Each office may examine the aspects falling within its own legal mandate.

Conclusion

The European Ombudsman and the European Data Protection Supervisor occupy an important position within the constitutional and administrative structure of the European Union.

Their work demonstrates that institutional accountability cannot be understood solely through the relationship between legislative, executive, and judicial powers. A modern legal system also requires independent mechanisms capable of examining administrative conduct, protecting individual rights, and identifying failures that may not immediately result in judicial proceedings.

The Ombudsman safeguards the quality and fairness of EU administration. The EDPS ensures that the Union’s own institutions respect the fundamental right to personal data protection. One focuses on maladministration and institutional conduct; the other on the legality and accountability of personal-data processing.

Their functions are particularly important in a digital administrative environment in which institutions increasingly rely on complex information systems, automated processes, and extensive personal-data processing.

Ultimately, the significance of these offices lies in a fundamental constitutional proposition: the institutions of the European Union are not merely responsible for making and enforcing rules; they are themselves subject to the legal and ethical standards that those rules establish.

Primary Legal Sources and Further Reading

Treaties and Fundamental Rights

1. Article 16 TFEU – Protection of Personal Data
2. Article 228 TFEU – The European Ombudsman
3. Article 8 of the Charter of Fundamental Rights – Protection of Personal Data
4. Article 41 of the Charter – Right to Good Administration
5. Article 42 of the Charter – Right of Access to Documents
6. Article 43 of the Charter – European Ombudsman

European Ombudsman

7. Regulation (EU, Euratom) 2021/1163 – Statute of the European Ombudsman
8. European Ombudsman – Legal Basis and Statute
9. European Ombudsman – Making a Complaint
10. European Ombudsman – Guide to Public Access to EU Documents

Data Protection

11. Regulation (EU) 2018/1725 – Data Protection by EU Institutions and Bodies
12. Regulation (EU) 2016/679 – General Data Protection Regulation
13. European Data Protection Supervisor – Official Website
14. EDPS – Role as a Supervisory Authority
15. EDPS – Use of Supervisory and Enforcement Powers
16. European Data Protection Board