Why no official involvement?
I wonder why the EDPS isn't being formally involved.
According to the EU's official website:
"The EDPS is an independent supervisory authority devoted to protecting personal data and privacy and promoting good practice in the EU institutions and bodies. He does so by:
monitoring the EU administration's processing of personal data;
advising on policies and legislation that affect privacy; and
cooperating with similar authorities to ensure consistent data protection."
Large committees always seem to get these things wrong, smaller bodies/individuals seem to be less likely to make a balls up.