On 15 February 2023, the European Data Protection Board (EDPB) launched a coordinated enforcement action for the first time. The first coordinated enforcement action focuses on the use of cloud-based services by the public sector. Under the action, 22 supervisory authorities, including the European Data Protection Supervisor (EDPS), will address over 80 public bodies across the European Economic Area (EEA), including EU institutions. The action will cover a wide range of sectors (e.g. health, finance, tax, education, central buyers or providers of IT services) to explore the challenges they are facing with General Data Protection Regulation (GDPR) compliance when using cloud-based services. Based on the results, the supervisory authorities will decide on possible additional national supervision and enforcement actions. The insights gained may also feed into a targeted follow-up at the EU level.

The EDPB, established by the GDPR, is an independent European body that facilitates the consistent application of data protection rules throughout the EU and promotes cooperation between the EU’s data protection authorities. It is composed of representatives from the EU national data protection authorities (national supervisory authorities) and the EDPS. Its secretariat is provided by the EDPS and based in Brussels. The coordinated enforcement action follows the EDPB’s decision of October 2020 to set up a Coordinated Enforcement Framework (CEF).