Privacy officials’ travel to home countries sets off EU alarm bells

BRUSSELS — Top officials at the European Union's in-house data protection authority have expensed a high number of trips to their home countries in past years, an analysis by POLITICO shows — prompting calls for closer scrutiny from a key oversight committee.

Figures obtained by POLITICO reveal a pattern in which the most senior officials at the European Data Protection Supervisor (EDPS) took a large share of official missions to their own home countries over the 2017-2023 period.

The findings are "deeply concerning" and “highly irregular," said Czech center-right lawmaker Tomáš Zdechovský, who holds a key role in the European Parliament. The figures suggest that "some of the European Union’s most senior officials appear to have used mission budgets to repeatedly travel to their home countries under the pretext of official duties," he said in a comment.

The figures raise questions about the oversight and approval process for travel spending by the EU institution, and whether officials are using the system for personal benefit. POLITICO previously uncovered dubious travel expense practices at other EU institutions, such as when top Commission official Henrik Hololei cleared himself of any conflict of interest in taking freebie flights on Qatar Airways while his team negotiated a major aviation deal with the Gulf state.

Reacting to POLITICO's reporting on the EDPS' travel data, the head of the authority Wojciech Wiewiórowski on Wednesday told Parliament he had "nothing to hide," and the practice of sending high-level EDPS officials to their home countries was “absolutely a deliberate decision.”

The EDPS is in the middle of a contested and controversial race to select its next chief supervisor. The European Parliament and EU Council reached a stalemate in January, with the EU Council pushing to reappoint Wiewiórowski for a second term and Parliament favoring to pick one of the European Commission's key data protection officials, Bruno Gencarelli, to replace him.

Home sweet home

The European Parliament's civil liberties committee already scrutinized EDPS spending in a recent opinion drafted by Zdechovský that flagged a “significant” increase in mission costs in recent years and warned of a lack of transparency about mission expenses.

Missions undertaken by EDPS staff can include attending conferences, events and official meetings, as well as trips to visit or audit the EU institutions that the regulator supervises.

The EDPS oversees whether the EU institutions are following privacy rules. It also gives advice to the institutions on data protection.

POLITICO examined mission travel documents provided by the EDPS, analyzing its three most senior officials from 2017 to 2023: former European Data Protection Supervisor Giovanni Buttarelli; current (caretaker) European Data Protection Supervisor Wojciech Wiewiórowski; and Secretary General Leonardo Cervera Navas.

POLITICO also looked at mission travel for the agency as a whole, including around 100 lower-level staffers and officials running the secretariat of Europe's national data protection regulators' group, the European Data Protection Board (EDPB).

Cervera Navas took a total of 36 trips to his native Spain over the seven-year period. His next most frequently visited countries were France and Germany, with six trips each. By comparison, Wiewiórowski visited Spain five times over the same period, while Buttarelli did not visit the country.

Cervera Navas was only appointed as the agency's (first-ever) secretary general in 2023, having previously joined the EDPS as a manager in 2010 and being appointed director in 2018. While serving as director from 2018-2023 he was the only person at the EDPS with this title; no other director has been appointed since he took up the role of secretary general.

Meanwhile, former supervisor Buttarelli, who passed away in August 2019, took 29 trips to his home country of Italy, compared to four trips to his second-most visited country, the United States, and three trips each to France and the United Kingdom. By comparison, Wiewiórowski took nine trips to Italy in 2017-2023, and Cervera Navas three.

The current supervisor, Wiewiórowski, most often visited his home country of Poland and the Netherlands, with 20 mission visits to each. France was third with 13 trips.

The preference of senior officials for visiting their home countries is even clearer when these top officials are compared with all staff missions across the institution.

Mission data provided by the EDPS included individual entries from EDPS staff, as well as entries from the EDPB (European Data Protection Board) secretariat, which is overseen by the EDPS.

The analysis of trip destinations included both EDPS or EDPB secretariat staff because the anonymized entries did not allow the two to be separated. However, EDPB staff mission spending represented a small share of total spending compared to EDPS staff missions. For example, in 2023 total EDPS staff mission spending (excluding top officials Wiewiórowski and Cervera Navas) was €180,930, while EDPB mission costs were €54,166.92.

Almost half of all trips taken by Cervera Navas over the period were to Spain, his home country. By contrast, less than 5 percent of travel for other EDPS and EDPB staffers was to Spain.

Likewise, almost 60 percent of trips taken by Buttarelli were to Italy, compared to less than 8 percent for other EDPS and EDPB staff.

'Deeper audit'

The European Parliament's opinion, drafted by Zdechovský in January, raised “concern about the significant increase in EDPS staff mission costs” in recent years and called for more transparency. Spending rose to €284,580 in 2023 from €28,789 in 2021.

But the authority's February rebuttal said the increase had been due to the resumption of travel after the pandemic, as well as to inflation.  

Still, Zdechovský, who holds a lot of sway as the European People's Party (EPP) coordinator in the Parliament’s budgetary control committee, called for a “deeper audit” of EDPS mission expenditures in his comments to POLITICO, and urged that the regulator be required to publish justifications for each trip taken by senior officials.  

“If patterns suggest systematic abuse, we must be ready to act, either through a proposal for a budgetary revision, or calls for reforms to travel and mission policy,” he said.  

The Parliament’s budgetary control committee is due to deliver its discharge (where it decides whether to sign off on the accounts of an EU institution) on the EDPS budget for 2023 at the upcoming May plenary session in Strasbourg.

Native language requests

In response to POLITICO’s reporting, current EDPS Wojciech Wiewiórowski (who is holding a caretaker position at the moment) told members of the Parliament’s civil liberties committee on Wednesday: “We try to send to the member states the persons who can take part in the discussion, who are not there just to lecture, just to say something, but who will go into the discussion with the people there,” he said.

Following POLITICO's reporting, EDPS Secretary-General Leonardo Cervera Navas told reporters on Wednesday it was “super important” for the authority to be transparent on mission spending. “We have to be fully accountable, this is the strength of our democracy … But we have to be serious about these budgets and figures and the money we invest in effective supervision,” he said.

He warned it would be a “mistake” to freeze spending on EDPS missions or inspections, especially as the office’s responsibilities under the AI Act are ramping up.

“I think it’s really, really important that our budget on missions grow[s] and we can send many people around to interact with AI especially, and to participate in global discussions about this subject,” Cervera Navas said.

The EDPS' Head of Communication Olivier Rossignol said in a comment there was “always a transparent decision” to share events among senior officials according to their native language (Italian for the late Buttarelli, Polish for Wiewiórowski and Spanish for current Secretary General Cervera Navas).

“Italy, Poland and Spain are three important Member States in the European Union that organize a lot of events and high-level meetings on data protection and privacy. These three countries are often used to work in their national language because [the] specialized audience is not always fully operational in English, and do appreciate native speakers on expert topics and fields,” Rossignol said.

Rossignol said that missions by the EDPS supervisor and secretary general are validated by the secretary general as head of the authority’s secretariat, while the secretary general’s own trips are agreed and confirmed in advance by the supervisor. He added that missions by the supervisor and secretary general are coordinated at weekly meetings with the information and communication unit that publishes the agenda online, as well as with middle managers.

This article was updated to include comments by Wiewiórowski and Cervera Navas responding to POLITICO's initial reporting.