The EDPS will launch a pilot campaign on EU institutions' (EUIs) main websites. By employing the EDPS Website Evidence Collector, we will regularly look for data protection and privacy issues. The resulting factual reports will help EU institutions to identify areas of improvement and take corrective measures when needed. This action will also allow the EDPS to monitor and support EUIs’ progress. Based on available resources, the EDPS might scale up this pilot campaign to cover more of the EUIs' websites (+1.300)
The websites of EU institutions provide users with access to information and services. The accelerated digitalisation of EUIs has in turn increased the number, size and complexity (i.e. embedding of third party components such as maps, video or audio) of these websites.
In 2018, the EDPS developed the Website Evidence Collector (WEC) tool for its remote website audits. The EDPS made this tool publicly available so controllers and DPOs could identify potential issues and areas of improvement on their websites. However, despite the WEC’s availability, the knowledge and use of the WEC by EUIs is very limited.
In the initial phase of this campaign, the EDPS will employ the WEC to regularly (every 6 months) check on the main website of each EUI under its remit (around 70).
The WEC output will be fine-tuned to produce a factual simplified report per website. These reports will help DPOs and controllers to identify and assess elements that could be problematic from a data protection point of view and to take corrective actions if needed. The WEC output will also serve as a source for statistics that will allow the EDPS to monitor the evolution of the detected problematic elements.
The initial phase of this campaign will start in 2024 and will be carried out as follows:
- A first wave setting the baseline. This first execution will aim to set the initial state of play to allow measuring the EUIs websites’ improvement. The DPO of each institutions will receive a notification including the report with the results of the execution of the WEC, information about next steps of the pilot and a reminder of the possibility to use the WEC tool proactively.
- A second wave six months after the baseline. We will execute again the WEC on the same websites and check the evolution of the detected problematic elements. The EDPS will send a notification to each DPO signaling the progress, or lack thereof, regarding the problematic elements.
- A last wave 12 months after the baseline. We will execute once more the WEC on the same websites and check the evolution of the detected problematic elements. DPOs will receive ad-hoc notifications with the results at the conclusion of the pilot phase. The EDPS will publish in its website an anonymised report with the main findings of this pilot.
If the pilot phase is successful and the necessary resources can be allocated, the EDPS will assess the possibility of scaling up this campaign to cover all websites under EUIs’ responsibility (+1.300).