European Data Protection Board (EDPB)

What is the EDPB?

The EDPB replaced the Article 29 Working Party when the GDPR took effect on 25 May 2018. Its members are the heads of the national data protection authorities of the EEA states plus the European Data Protection Supervisor; the European Commission attends without a vote. It has legal personality, a secretariat in Brussels provided by the EDPS, and a chair elected for five years.

Its tools are guidelines and opinions, which national regulators and courts follow in practice, and binding decisions under the consistency mechanism when regulators disagree on a cross-border case. It does not fine companies itself; the national authorities do.

What has it said about face search?

• Guidelines 05/2022 on facial recognition in law enforcement, adopted in final form in April 2023, which set out why one-to-many face matching is high-risk biometric processing.
• Statements on scraping: the EDPB's ChatGPT taskforce report (May 2024) and later opinions treat web scraping for AI training as processing that needs a lawful basis and transparency, the same analysis national regulators applied to Clearview and PimEyes.
• Coordination of the Clearview cases: the decisions by the French, Italian, Greek and Dutch authorities were taken with EDPB consistency in mind, which is why their reasoning is near-identical.
• Smart glasses: in November 2026 the EDPB adopted a preliminary statement warning that glasses with cameras collect personal data almost invisibly and that pairing them with face or voice recognition in public is high-risk.

1. 2018-05-25

   EDPB established

   Replaces the Article 29 Working Party under GDPR Article 68.

2. 2023-04-26

   Facial recognition guidelines finalised

   Guidelines 05/2022 on the use of facial recognition technology in law enforcement.

3. 2024-05-23

   ChatGPT taskforce report

   Common position on scraping and lawful basis for training data.

4. 2026-11

   Preliminary statement on smart glasses

   Data protection risks of camera glasses and face recognition in public spaces.

How does it affect a complaint about a face search engine?

If the engine has an EU establishment, the complaint goes to the lead authority in that country and other authorities are consulted; a disagreement ends in an EDPB binding decision. If the engine has no EU establishment, as with Clearview AI and PimEyes, each national authority can act on its own, which is why there are separate Dutch, French, Italian and Greek Clearview decisions rather than one. Complaints go to the national authority, such as the CNIL, not to the EDPB.