This Opinion relates to the European Court of Auditors (‘the Court of Auditors’) consultation on the legal basis for personal data transfers to the European University Institute.
Informal consultation from an EU Agency on whether a particular number of data subjects concerned by a processing should be considered as “large scale” in the sense of Article 39(3)(b) of the Regulation.
The EDPS notes that the Regulation itself does not define what constitutes “large-scale”, analyses existing guidance on the matter and concludes that in the case of the processing underlying the informal consultation, the proportion of the relevant population as well as the nature of the personal data processed and possible resulting risks cumulatively advocate for conducting a DPIA in the case at hand.
Réponse du CEPD à la consultation informelle du délégué à la protection des données du Fonds européen d'investissement sur les demandes d'accès large.
Consultation from an European Institution on the relationship with its contractor for providing travel agency services. The contractor considers that it should be a separate controller; the EDPS analyses the relationship at hand, the consequences of different legal constructions, and concludes that a controller-processor relationship is the most appropriate arrangement.
Arrangement involving transfers of personal data from an EUI to an International organisation