What you should know about administrative inquiries and disciplinary proceedings
This document refers to procedures concerning staff of public administrations such as EU institutions and bodies. An administrative inquiry may be launched for a number of reasons such as psychological or sexual harassment, if a member of staff engages in external activities during office hours without permission, conflicts of interest or a suspicion of a staff member inflating the working hours on his timesheets. Aside from the alleged victim and the person under investigation, an inquiry might also involve witnesses and third parties (persons merely quoted in the file). If, following the administrative inquiry, there is enough evidence to show that the person under investigation is responsible for serious misconduct, fraud or other irregularity affecting the financial or other interests of the public administration, a disciplinary proceeding can be initiated. The severity of the disciplinary sanction will depend on the seriousness of the misconduct. The accused person can be dismissed or be suspended for a specific period.
What are the main data protection issues?
Data quality and data minimisation: It is important not to process more personal data (also referred to as personal information) than necessary. How? By only collecting relevant - and not more information than necessary - in the first place. During an administrative inquiry, investigators may have personal information which is of no interest or relevance to the investigation. In the case of harassment, for example, the sexual orientation of the alleged victim is irrelevant unless it is the reason for the harassment. In the case of alleged external activities or a conflict of interest, emails exchanged between the person under investigation and the medical service of the public administration about his health are irrelevant to the purpose of the inquiry. Any such information should be promptly removed from the file and not processed further. The principle of minimising the amount of data gathered, stored and processed should be applied to all means and steps of the investigation.
Right of information: Individuals under investigation in particular should receive information from the investigating body about the opening and closing of the inquiry related to them, on how and why their personal information will be processed, if their data will be transferred to a Disciplinary Board, about the hearing and its outcome. In rare cases, informing the individual under investigation about the inquiry or the disciplinary proceeding at an early stage may be detrimental to the investigation. For instance, the person under investigation might be an expert in IT and he might be able to destroy important elements against him, or the alleged harasser might be informed only at the end of the inquiry in order to protect the alleged victim's identity. If the right of information is restricted or deferred, which is to be decided on a case by case basis, the investigating administration should be able to demonstrate the reasoning and should document them before the decision is taken (accountability principle).
Right of access - Persons under investigation and alleged victims should, as a rule, have full access to the personal information relating to them in the inquiry or disciplinary proceeding. Exceptions to the right of access of the person under investigation may apply, in particular to protect other individuals (for example, a person under investigation regarding harassment may experience a limitation to his right of access in order to protect the alleged victim; a person being investigated for fraud may not have access to the identity of a witness in order to protect the witness' rights and freedoms). As for the right of information, exceptions to the right of access should be assessed on a case by case basis and documented. The right of access of a witness should be stricly assessed on a need-to-know basis, i.e. the witness does not need to have access to the whole file but only to the information about him that is processed by the administration.
Retention periods: The retention periods of the inquiry and disciplinary files should be clearly defined and should vary depending on the outcome of the case. A file of an inquiry which does not lead to a disciplinary proceeding should not be kept for as long as a file of a disciplinary proceeding that results in a disciplinary sanction.
Transfers: During the investigation, investigators can request information from other services or departments, which will involve transfers of data within the administration. If the investigators in a fraud inquiry about reimbursement of medical expenses, request data on the medical expenses' claims of the person under investigation, their request should be clear, precise and concern only relevant data; they should specify the exact information they need and why it is necessary for the investigation. The body providing the information should also verify that those requesting are indeed competent to conduct inquiries and should transfer only the information requested and not disclose other (irrelevant) information on other individuals, for example information on the spouse and on the children of the person under investigation.
Outsourcing: If an expert, for instance a handwriting expert or a specialised doctor, is required to provide his assessment on a particular issue in the context of an inquiry, the contract between the administration and the expert (also called processor) should state that the latter will act only on instruction of the administration; it should also stipulate the purpose of the outsourcing, the data protection principles and the security obligations incumbent on the expert.
Data security- Due to the sensitive nature of the data processed, the administration should put specific security measures in place on access control and management of all the information processed in the context of an inquiry or a disciplinary proceeding.
More information
The following non-exhaustive list is a selection of documents for further reading on administrative inquires and disciplinary proceedings:
EDPS Guidelines:
EDPS Guidelines on administrative inquires and disciplinary proceedings
EDPS Guidelines on the Rights of Individuals with regard to the Processing of Personal Data
EDPS prior-check Opinion:
Joint Prior Check Opinion on the processing of administrative inquiries and disciplinary proceedings in six Executive agencies, 2013-1022 (REA), 2013-1012 (CHAFEA), 2014-0136 (INEA), 2014-0723 (EACEA), 2014-0805 (ERCEA) and 2014-0937 (EASME).
Joint Prior Check Opinion on the processing of administrative inquiries and disciplinary proceedings in five decentralised EU agencies (2010-0752)
Related topics:
Anti-harassment procedures
Anti-Fraud Procedures
Whistleblowing
Security measures for personal data processing