Print

Vorabkontrolle

Manche Verfahren, die EU-Institutionen eingeführt haben, bringen Risiken für das Recht auf Datenschutz und die Grundfreiheiten des Einzelnen mit sich.

Der frühere Rechtsrahmen (Verordnung (EG) Nr. 45/2001) verpflichtete die EU-Institutionen, uns eine Meldung zu machen, bevor sie risikobehaftete Datenverarbeitungsverfahren einführten.

Im Allgemeinen waren unsere Stellungnahmen zu Vorabkontrollen öffentlich.

Die Verordnung (EU) 2018/1725 stützt sich auf die frühere Verordnung und entspricht der Datenschutzgrundverordnung (EU) 2016/679 (DSGVO), die für die meisten Organisationen gilt, die personenbezogene Daten in den Mitgliedstaaten verarbeiten. Im Vergleich zu den früheren Vorschriften werden durch die Verordnung (EU) 2018/1725 die Dokumentationspflichten stärker an den Risiken ausgerichtet, die die Verarbeitung personenbezogener Daten mit sich bringen. Dies bedeutet beispielsweise, dass die Dokumentationsanforderungen für das Abonnieren eines Newsletters von EU-Institutionen niedriger sind als etwa für ein intelligentes Videoüberwachungssystem, das öffentlich zugänglichen Raum überwacht, oder für eine Datenbank, die Profile von Reisenden zu Kontrollzwecken erstellt.

Je nach Verfahren müssen die EU-Institutionen bei der Verarbeitung von personenbezogenen Daten (als „Verantwortliche“) nicht unbedingt alle nachstehend aufgeführten Schritte durchlaufen (diese Schritte sind im Leitfaden „Rechenschaftspflicht vor Ort“ beschrieben):

    • Erstellung der grundlegenden Dokumentation („Verzeichnis“) aller Verarbeitungsvorgänge;
    • Prüfung der Wahrscheinlichkeit, dass der Vorgang ein hohes Risiko für die Personen darstellt, deren Daten verarbeitet werden, und Konsultation des DSB, wenn dies der Fall zu sein scheint;
    • Muss die EU-Institution eine Datenschutz-Folgenabschätzung durchführen, so sind dabei diese Risiken eingehender zu untersuchen und spezifische Garantien/Kontrollen zu ihrer Bewältigung zu entwickeln;
    • Deuten die Ergebnisse der Datenschutz-Folgenabschätzung auf hohe Restrisiken für den Datenschutz hin, muss die EU-Institution beim EDSB eine vorherige Konsultation beantragen (siehe Artikel 40 bzw. Artikel 90 der Verordnung (EU) 2018/1725 für verwaltungstechnische und operative personenbezogene Daten).

Artikel 39 der Verordnung 2016/794 über Europol sieht für neue Arten von Verarbeitungsvorgängen in Bezug auf operative Daten – Daten, die von Europol zur Unterstützung der Mitgliedstaaten bei der Verhütung und Bekämpfung von schwerer Kriminalität und Terrorismus verarbeitet werden – eine vorherige Ad-hoc-Konsultation vor. Entsprechend sieht Artikel 72 der Verordnung 2017/1939 über die Europäische Staatsanwaltschaft (EuStA) einen besonderen Mechanismus zur vorherigen Konsultation für die Verarbeitung von operativen Daten vor, nämlich von Daten, die im Zusammenhang mit strafrechtlichen Ermittlungen und Strafverfolgungsmaßnahmen der EuStA verarbeitet werden. Die Verordnung 2018/1725, einschließlich des Standardmechanismus für die vorherige Konsultation, ist für die Verarbeitung von verwaltungstechnischen Daten durch Europol und die EuStA anwendbar, wozu beispielsweise auch Daten über Mitarbeiter und Besucher gehören.

Wenn eine EU-Institution unsicher ist, ob sie uns eine Verarbeitung zwecks vorheriger Konsultation melden muss, kann ihr DSB uns in dieser Frage konsultieren.

Wie auch bei den früheren Stellungnahmen zur Vorabkontrolle sind die Stellungnahmen im Allgemeinen öffentlich. Allerdings können wir sensible Elemente erforderlichenfalls, wie etwa im Zusammenhang mit Sicherheitsaspekten, löschen. Einige Stellungnahmen, die naturgemäß sensibel sind, insbesondere im Bereich Polizei und Justiz, werden gegebenenfalls nicht veröffentlicht. Aus Gründen der Transparenz enthält unser Jahresbericht eine Zusammenfassung dieser Stellungnahmen.

Filters

14
Jun
2007
Opinions Prior Check and Prior Consultations

Medical file (Brussels) - Parliament

Opinion of 14 June 2007 on a notification for prior checking regarding the "Camed-Brussels" (Case 2004-205)

The prior checking refers to the activities of the Medical Service at the European Parliament (EP) in Brussels – CAMED; monitoring health at work, in particular pre-recruitment medical examinations and annual check-ups; medical emergencies at the workplace, preventive health care and various consultations.
 
The pre-recruitment medical examination carried out includes a medical questionnaire to be filled in by the candidate and a series of medical examinations. The doctor enters a summary of the examination and the conclusions in the medical questionnaire. He then sends the department concerned a declaration stating that the person is either fit or unfit to work.
 
The annual medical check-up is an administrative requirement for all officials and other staff in active employment pursuant to Article 59(6) of the Staff Regulations. It includes laboratory examinations, a clinical examination, including a medical questionnaire to be filled in on a voluntary basis by the person examined, and an objective clinical examination. The person concerned may also request that an HIV test be made when a blood sample is taken for the annual medical check-up. The person concerned is asked to give explicit consent in writing for this purpose. The annual medical check-up may be carried out either by one of the EP's Medical Officers or by a doctor chosen by the person concerned. In the latter case, the doctor must send the Medical Service as soon as possible the report on the medical check-up and the results of the examinations carried out.
 
An electronic application (CLINIDOC) enables medical acts and consultations concerning persons who came into contact with the Medical Service to be followed through.
 

The EDPS carried out a prior check on the activities mentioned by the European Parliament's Medical Service in Brussels and concluded that the proposed processing operation did not appear to infringe the provisions of Regulation (EC) No 45/2001, provided that account was taken of certain recommendations, in particular that the EP should not collect any other data than is necessary to determine fitness for service or to limit guaranteed benefits at the pre-recruitment medical examination; that, in general terms, the EP should undertake a thorough reassessment of the questions posed in the questionnaire for the pre-recruitment medical examination and annual medical check-up in the light of the principles of adequacy, relevance and proportionality, for the purposes of judging fitness for service; that it should consider the period of storage of medical data in the light of the recommendations made by the EDPS on 26 February 2007 in response to the consultation with the Board of Heads of Administration concerning the latter's proposal for a 30‑year storage period for medical documents; that the EP introduce a procedure for non-recruited persons or other persons (visitors, parliamentary assistants, freelances, staff of outside firms, etc.), concerning whom medical information has been recorded so that they too enjoy right of access under Article 13 of Regulation (EC) No 45/2001; and that the EP supplement the information provided in the waiting rooms in particular by giving details on theEuropean Parliament's Intranet site. In addition, this notice could be enclosed with the letter of invitation to the pre-recruitment examination or annual check-up.

Verfügbare Sprachen: Englisch, Französisch
Topics
Privacy in the EU Institutions
Health Data in the Workplace
13
Jun
2007
Opinions Prior Check and Prior Consultations

Competence inventory - European Training Foundation

Opinion of 13 June 2007 on a notification for prior checking regarding ETF's competence inventory (Case 2006-437)

This opinion is on the "competence inventory" exercise of the European Training Foundation (ETF) was issued. This complex exercise serves to create a very detailed database listing all relevant competences of each employee. It involves self-assessment, peer-review and moderation by a panel to ensure consistency throughout the ETF. The primary purpose is to obtain aggregate data for strategic management purposes such as to identify competence gaps and adjust recruitment and training polices accordingly.

The EDPS concluded that there are doubts on the proportionality of the establishment of the database and the data quality. For these reasons, the EDPS recommended that ETF reconsiders the necessity of carrying out the competence inventory exercise and look for less intrusive alternatives.

In any event, the EDPS insisted that the database should not result in a parallel performance evaluation system and ETF's management must clearly and explicitly recognise the limitations of the reliability of the data to inform decisions that individually affect data subjects, for example, assessment of applications for internal mobility. Therefore, the data should never be used for pre-selection or exclusion, but only as one of several sources to inform decision-making. Similarly, the competence inventory should not be used for performance appraisal, promotion or assessing contract renewal. Moreover, use of the database should not lead to dismissal, exclusion when tasks are allocated or team leaders and managers are selected, or to similar prejudices to staff members.

Verfügbare Sprachen: Englisch, Französisch
Topics
Privacy in the EU Institutions
Staff Evaluation
12
Jun
2007
Opinions Prior Check and Prior Consultations

Financial irregularities panel - Parliament

Opinion of 12 June 2007 on a notification for prior checking concerning the "Financial Irregularities Panel" (Case 2007-139)
By Bureau Decision of 10 March 2004 the European Parliament set up a specialised financial irregularities panel. The role of the panel, which functions independently, is to issue to the Appointing Authority - or, where appropriate, to the authority empowered to conclude contracts of employment - opinions evaluating, in cases which have been referred to the panel, whether financial irregularities have occurred, how serious they are and what their consequences might be.
The main recommendations issued by the EDPS in his opinion on the financial irregularities panel relate to the quality of the data collected, their storage, the relations between the panel and OLAF, and information supplied to data subjects.

Verfügbare Sprachen: Englisch, Französisch
Topics
Privacy in the EU Institutions
6
Jun
2007
Opinions Prior Check and Prior Consultations

Free phone service - OLAF

Opinion of 6 June 2007 on a notification for prior checking on a free phone service (Case 2007-74)

OLAF has put this tool at the public's disposal, enabling individuals to provide information that may be useful in the fight against fraud, corruption and other illegal activities affecting the financial interests of the Community. Anyone, EU staff as well as citizens, can use the Free Phone Service to report such types of unlawful behaviour.
After listening to the voice messages and deleting those that are deemed fully improper and pointless, OLAF investigators summarise the remaining messages in a "free phone screening form". This form indicates whether or not the messages are relevant to OLAF's work or to that of other authorities, such as member states or European Commission services. Based on this assessment, OLAF will deem them irrelevant, investigate them further and potentially open an investigation, or send them to other authorities if the case is relevant for them.
The OLAF Free Phone Service is subject to prior checking as it deals with data which may relate to suspected offences, criminal convictions or security measures. In his opinion, the EDPS concluded that OLAF has substantially followed all the principles of the Regulation. Nevertheless some recommendations were made, including:
  • ensuring the deletion of voice messages with information deemed irrelevant. This should not be recorded in writing or, if so, should be deleted immediately after confirmation of their irrelevance.
  • ensuring the right to information to those who have been named by callers who use the Free Phone Service, subject to the application of the exceptions provided for in the Regulation.
  • setting up a voice recording so that, upon calling the Free Phone Service, a short version of the privacy statement is provided or, alternatively, publishing it on OLAF's website.
Verfügbare Sprachen: Englisch, Französisch
Topics
Privacy in the EU Institutions
Investigations