Print

Vorabkontrolle

Manche Verfahren, die EU-Institutionen eingeführt haben, bringen Risiken für das Recht auf Datenschutz und die Grundfreiheiten des Einzelnen mit sich.

Der frühere Rechtsrahmen (Verordnung (EG) Nr. 45/2001) verpflichtete die EU-Institutionen, uns eine Meldung zu machen, bevor sie risikobehaftete Datenverarbeitungsverfahren einführten.

Im Allgemeinen waren unsere Stellungnahmen zu Vorabkontrollen öffentlich.

Die Verordnung (EU) 2018/1725 stützt sich auf die frühere Verordnung und entspricht der Datenschutzgrundverordnung (EU) 2016/679 (DSGVO), die für die meisten Organisationen gilt, die personenbezogene Daten in den Mitgliedstaaten verarbeiten. Im Vergleich zu den früheren Vorschriften werden durch die Verordnung (EU) 2018/1725 die Dokumentationspflichten stärker an den Risiken ausgerichtet, die die Verarbeitung personenbezogener Daten mit sich bringen. Dies bedeutet beispielsweise, dass die Dokumentationsanforderungen für das Abonnieren eines Newsletters von EU-Institutionen niedriger sind als etwa für ein intelligentes Videoüberwachungssystem, das öffentlich zugänglichen Raum überwacht, oder für eine Datenbank, die Profile von Reisenden zu Kontrollzwecken erstellt.

Je nach Verfahren müssen die EU-Institutionen bei der Verarbeitung von personenbezogenen Daten (als „Verantwortliche“) nicht unbedingt alle nachstehend aufgeführten Schritte durchlaufen (diese Schritte sind im Leitfaden „Rechenschaftspflicht vor Ort“ beschrieben):

    • Erstellung der grundlegenden Dokumentation („Verzeichnis“) aller Verarbeitungsvorgänge;
    • Prüfung der Wahrscheinlichkeit, dass der Vorgang ein hohes Risiko für die Personen darstellt, deren Daten verarbeitet werden, und Konsultation des DSB, wenn dies der Fall zu sein scheint;
    • Muss die EU-Institution eine Datenschutz-Folgenabschätzung durchführen, so sind dabei diese Risiken eingehender zu untersuchen und spezifische Garantien/Kontrollen zu ihrer Bewältigung zu entwickeln;
    • Deuten die Ergebnisse der Datenschutz-Folgenabschätzung auf hohe Restrisiken für den Datenschutz hin, muss die EU-Institution beim EDSB eine vorherige Konsultation beantragen (siehe Artikel 40 bzw. Artikel 90 der Verordnung (EU) 2018/1725 für verwaltungstechnische und operative personenbezogene Daten).

Artikel 39 der Verordnung 2016/794 über Europol sieht für neue Arten von Verarbeitungsvorgängen in Bezug auf operative Daten – Daten, die von Europol zur Unterstützung der Mitgliedstaaten bei der Verhütung und Bekämpfung von schwerer Kriminalität und Terrorismus verarbeitet werden – eine vorherige Ad-hoc-Konsultation vor. Entsprechend sieht Artikel 72 der Verordnung 2017/1939 über die Europäische Staatsanwaltschaft (EuStA) einen besonderen Mechanismus zur vorherigen Konsultation für die Verarbeitung von operativen Daten vor, nämlich von Daten, die im Zusammenhang mit strafrechtlichen Ermittlungen und Strafverfolgungsmaßnahmen der EuStA verarbeitet werden. Die Verordnung 2018/1725, einschließlich des Standardmechanismus für die vorherige Konsultation, ist für die Verarbeitung von verwaltungstechnischen Daten durch Europol und die EuStA anwendbar, wozu beispielsweise auch Daten über Mitarbeiter und Besucher gehören.

Wenn eine EU-Institution unsicher ist, ob sie uns eine Verarbeitung zwecks vorheriger Konsultation melden muss, kann ihr DSB uns in dieser Frage konsultieren.

Wie auch bei den früheren Stellungnahmen zur Vorabkontrolle sind die Stellungnahmen im Allgemeinen öffentlich. Allerdings können wir sensible Elemente erforderlichenfalls, wie etwa im Zusammenhang mit Sicherheitsaspekten, löschen. Einige Stellungnahmen, die naturgemäß sensibel sind, insbesondere im Bereich Polizei und Justiz, werden gegebenenfalls nicht veröffentlicht. Aus Gründen der Transparenz enthält unser Jahresbericht eine Zusammenfassung dieser Stellungnahmen.

Filters

14
Jun
2007
Opinions Prior Check and Prior Consultations

Medical file (Luxembourg) - Parliament

Opinion of 14 June 2007 on a notification for prior checking regarding the "Medical Files - Luxembourg" case (Case 2004-203)

The prior checking refers to medical files at the European Parliament (EP) in Luxembourg, in particular monitoring health at work including pre-recruitment medical examinations and annual check-ups; medical emergencies at the workplace, preventive health care and various consultations.
 
The pre-recruitment medical examination carried out includes a medical questionnaire to be filled in by the candidate and a series of medical examinations. The doctor enters a summary of the examination and the conclusions in the medical questionnaire. He then sends the department concerned a declaration stating that the person is either fit or unfit to work.
 
The annual medical check-up is an administrative requirement for all officials and other staff in active employment. The annual medical check-up may be carried out either by one of the EP's Medical Officers or by a doctor chosen by the person concerned. In the latter case, the doctor must send the Medical Service as soon as possible the report on the medical check-up and the results of the examinations carried out.
 
The Medical Service ensures that medical check-ups are carried out. The Medical Service uses administrative follow-up files for medical files to keep track of annual medical check-ups..
 
The EDPS has carried out a prior check on these activities and has concluded that the proposed processing operation does not appear to infringe the provisions of Regulation (EC) No 45/2001, provided that account is taken of certain recommendations, in particular:
  • that, in general terms, the EP should undertake a thorough reassessment of the questions put in the questionnaire for the pre-recruitment medical examination and annual medical check-up in the light of the principles of adequacy, relevance and proportionality, for the purposes of judging fitness for service;
  • that it should consider the period of storage of medical data in the light of the recommendations made by the EDPS on 26 February 2007
  • that the EP introduce a procedure for non-recruited persons in respect of whom medical information has been recorded, so that they too have a right of access under Article 13 of Regulation (EC) No 45/2001;
  • that the EPrender data anonymous or, failing that, encrypt them before they are used for historical, scientific or statistical purposes;
  • that the EP supplement the information provided in the waiting rooms
Verfügbare Sprachen: Englisch, Französisch
Topics
Privacy in the EU Institutions
Health Data in the Workplace
14
Jun
2007
Opinions Prior Check and Prior Consultations

Medical file (Brussels) - Parliament

Opinion of 14 June 2007 on a notification for prior checking regarding the "Camed-Brussels" (Case 2004-205)

The prior checking refers to the activities of the Medical Service at the European Parliament (EP) in Brussels – CAMED; monitoring health at work, in particular pre-recruitment medical examinations and annual check-ups; medical emergencies at the workplace, preventive health care and various consultations.
 
The pre-recruitment medical examination carried out includes a medical questionnaire to be filled in by the candidate and a series of medical examinations. The doctor enters a summary of the examination and the conclusions in the medical questionnaire. He then sends the department concerned a declaration stating that the person is either fit or unfit to work.
 
The annual medical check-up is an administrative requirement for all officials and other staff in active employment pursuant to Article 59(6) of the Staff Regulations. It includes laboratory examinations, a clinical examination, including a medical questionnaire to be filled in on a voluntary basis by the person examined, and an objective clinical examination. The person concerned may also request that an HIV test be made when a blood sample is taken for the annual medical check-up. The person concerned is asked to give explicit consent in writing for this purpose. The annual medical check-up may be carried out either by one of the EP's Medical Officers or by a doctor chosen by the person concerned. In the latter case, the doctor must send the Medical Service as soon as possible the report on the medical check-up and the results of the examinations carried out.
 
An electronic application (CLINIDOC) enables medical acts and consultations concerning persons who came into contact with the Medical Service to be followed through.
 

The EDPS carried out a prior check on the activities mentioned by the European Parliament's Medical Service in Brussels and concluded that the proposed processing operation did not appear to infringe the provisions of Regulation (EC) No 45/2001, provided that account was taken of certain recommendations, in particular that the EP should not collect any other data than is necessary to determine fitness for service or to limit guaranteed benefits at the pre-recruitment medical examination; that, in general terms, the EP should undertake a thorough reassessment of the questions posed in the questionnaire for the pre-recruitment medical examination and annual medical check-up in the light of the principles of adequacy, relevance and proportionality, for the purposes of judging fitness for service; that it should consider the period of storage of medical data in the light of the recommendations made by the EDPS on 26 February 2007 in response to the consultation with the Board of Heads of Administration concerning the latter's proposal for a 30‑year storage period for medical documents; that the EP introduce a procedure for non-recruited persons or other persons (visitors, parliamentary assistants, freelances, staff of outside firms, etc.), concerning whom medical information has been recorded so that they too enjoy right of access under Article 13 of Regulation (EC) No 45/2001; and that the EP supplement the information provided in the waiting rooms in particular by giving details on theEuropean Parliament's Intranet site. In addition, this notice could be enclosed with the letter of invitation to the pre-recruitment examination or annual check-up.

Verfügbare Sprachen: Englisch, Französisch
Topics
Privacy in the EU Institutions
Health Data in the Workplace
13
Jun
2007
Opinions Prior Check and Prior Consultations

Competence inventory - European Training Foundation

Opinion of 13 June 2007 on a notification for prior checking regarding ETF's competence inventory (Case 2006-437)

This opinion is on the "competence inventory" exercise of the European Training Foundation (ETF) was issued. This complex exercise serves to create a very detailed database listing all relevant competences of each employee. It involves self-assessment, peer-review and moderation by a panel to ensure consistency throughout the ETF. The primary purpose is to obtain aggregate data for strategic management purposes such as to identify competence gaps and adjust recruitment and training polices accordingly.

The EDPS concluded that there are doubts on the proportionality of the establishment of the database and the data quality. For these reasons, the EDPS recommended that ETF reconsiders the necessity of carrying out the competence inventory exercise and look for less intrusive alternatives.

In any event, the EDPS insisted that the database should not result in a parallel performance evaluation system and ETF's management must clearly and explicitly recognise the limitations of the reliability of the data to inform decisions that individually affect data subjects, for example, assessment of applications for internal mobility. Therefore, the data should never be used for pre-selection or exclusion, but only as one of several sources to inform decision-making. Similarly, the competence inventory should not be used for performance appraisal, promotion or assessing contract renewal. Moreover, use of the database should not lead to dismissal, exclusion when tasks are allocated or team leaders and managers are selected, or to similar prejudices to staff members.

Verfügbare Sprachen: Englisch, Französisch
Topics
Privacy in the EU Institutions
Staff Evaluation
12
Jun
2007
Opinions Prior Check and Prior Consultations

Financial irregularities panel - Parliament

Opinion of 12 June 2007 on a notification for prior checking concerning the "Financial Irregularities Panel" (Case 2007-139)
By Bureau Decision of 10 March 2004 the European Parliament set up a specialised financial irregularities panel. The role of the panel, which functions independently, is to issue to the Appointing Authority - or, where appropriate, to the authority empowered to conclude contracts of employment - opinions evaluating, in cases which have been referred to the panel, whether financial irregularities have occurred, how serious they are and what their consequences might be.
The main recommendations issued by the EDPS in his opinion on the financial irregularities panel relate to the quality of the data collected, their storage, the relations between the panel and OLAF, and information supplied to data subjects.

Verfügbare Sprachen: Englisch, Französisch
Topics
Privacy in the EU Institutions