Print

Opinions Prior Check and Prior Consultations

Some of the procedures that EU institutions put in place pose risks to the data protection rights and freedoms of individuals.

Under the old legal framework (Regulation (EC) 45/2001), EU institutions were obliged to notify us before putting in place risky data processing operations.

In general, our prior checking Opinions were public.

Regulation 2018/1725 builds on the old Regulation and mirrors the General Data Protection Regulation (EU) 2016/679 (GDPR) that applies to most organisations processing personal data in the Member States. Compared to the previous rules, Regulation 2018/1725 aligns documentation obligations more closely to the risks caused by processing personal data. This means for example that the documentation requirements for a EUI’s newsletter subscription will be lower than for a system using ‘intelligent CCTV’ covering publicly accessible space or a database profiling travellers for screening purposes.

Depending on the process at hand, EU institutions processing personal data ('controllers') may not have to go through all the steps below (these steps are described in the Accountability on the ground toolkit): 
• Generate basic documentation (called ‘records’) for all processes; 
• Check if the process is likely to result in high risks to the people whose data are processed and consult the DPO if it appears to do so; 
• If the EU institution needs to do a data protection impact assessment (DPIA), they analyse those risks in more detail and develop specific safeguards/controls to manage them; 
• If the results of the DPIA still indicate high residual data protection risks, the EU institution has to file a prior consultation with the EDPS (see Articles 40 and 90 of Regulation 2018/1725 respectively for administrative and operational personal data).

Article 39 of Regulation 2016/794 on Europol provides for an ad hoc prior consultation mechanism for new type of processing of operational data, namely data processed by Europol to support the Member States in preventing and combating serious crime and terrorism. Similarly, Article 72 of Regulation 2017/1939 on the European Public Prosecutor Office (EPPO) provides a specific prior consultation mechanism for the processing of operational data, namely data processed in the context of criminal investigations and prosecutions undertaken by the EPPO. Regulation 2018/1725, including the standard prior consultation mechanism, applies to Europol's and EPPO's processing of administrative data, which includes data on staff and visitors, for example.

Where an EU institution is unsure whether to notify us a data processing operation for prior consultation, their DPO can consult us for advice to confirm.

As for the old prior checking Opinions, in general the prior consultation Opinions are public, but we may delete sensitive elements where necessary, related to security for example. Some opinions, which are by nature sensitive, in particular in the police and justice area, may not be published. For the sake of transparency, these Opinions are summarised in our Annual Report.

Filters

7
Sep
2009

EudraVigilance database - EMEA

Opinion of 7 September 2009 on a notification for prior checking regarding the EudraVigilance database (Case 2008-402)

EMEA manages the EudraVigilance database whose originates from National Competent Authorities, Market Authorization Holders and sponsors of clinical trials.  The purpose of the database is to evaluate suspected adverse reactions to medicinal products for human use. The EDPS considers that the processing is lawful to the extent that EMEA follows the recommendations included in the Opinion, particularly those regarding the data quality principle.

The EDPS recommended, among others, that EMEA:

  • Engages in an examination of the possibility to minimize the personal data recorded in ICRs as well as of the possibility to anonymise or pseudoanonymise personal information contained in ICRs;
  • Considers whether a  limited conservation period would fulfill the purposes sought by the data processing;
  • Adopts the security measures described in this Opinion.
Available languages: English, French
28
Jul
2009

Evaluation of the President and the Vice-President - CPVO

Opinion of 28 July 2009 on a notification for prior checking concerning "Evaluation of the President and the Cice-President of the CPVO" (Cases 2009-355 and 2009-356)

The Community Plant Variety Office (CPVO) submitted to the EDPS two notifications for prior checking concerning annual appraisal, probationary period and management trial period of the President of the CPVO and of the Vice-President of the CPVO. Those appraisals are conducted by the reporting officers who are two members of the Administrative Council of the Office (AC) appointed by the AC.

The EDPS has examined the personal data processing involved in this processing and has concluded that it does not seem to entail any breach of the provisions of Regulation (EC) No 45/2001 provided that certain recommendations are followed, in particular that the service responsible should establish a shorter retention period for all paper and electronic files, remind all recipients of data of their obligation not to use the data received for any further purpose beyond the purposes stated in the relevant CPVO Decisions and provide appropriate information to the persons concerned.

Available languages: English, French
27
Jul
2009

Part time - Committee of the Regions

Opinion of 27 July 2009 on a notification for prior checking regarding applications to work part time (Case 2009-396)

The EDPS performed a prior checking on the processing of data under the procedure for handling applications to work part time. The processing operation is subject to prior checking as it involves an evaluation of the data subject, insofar as the decision to grant part-time work is based on the interests of the service and takes into account the grounds given in support of the application, but also insofar as it is possible for part time work to be refused.

The EDPS took the view that the processing operation would not appear to involve any breach of the provisions of Regulation (EC) No 45/2001, provided that account is taken of certain observations. In particular, recipients should be reminded that they may only process personal data received in connection with the procedure for applying for part-time work for that specific purpose and that if authorisation to work part-time is refused and the opinion of the Joint Committee has to be obtained, the person concerned should be allowed access to the Joint Committee's opinion for the data concerning him.

Available languages: English, French
24
Jul
2009

Part time - European Economic and Social Committee

Opinion of 24 July 2009 on a notification for prior checking regarding applications to work part time (Case 2009-322)
On 24 July 2009, the EDPS adopted an opinion on the prior checking of the handling of applications to work part time at the European Economic and Social Committee (EESC). This was a true prior check, relating to the adoption by the EESC of a new procedure on part-time work. The EDPS notes the information notice drawn up by the EESC on the protection of the data of members of staff in connection with this application procedure for part-time work. He recommends that the notice should be amended, in particular to make reference to the new procedure for part-time work, and to lay down that the official/staff member should tell any family members whose data are communicated as justification for the application to work part-time that they have a right of access to the data concerning them. The EDPS also recommends that if authorisation to work part-time is refused and the opinion of the Joint Committee has to be obtained, the person concerned should be allowed access to the Joint Committee's opinion for the data concerning him or her.

Available languages: English, French
23
Jul
2009

Recruitment - Court of Auditors

Opinion of 23 July 2009 on the notification for prior checking regarding the "selection procedures for the recruitment of officials, temporary staff and contract staff" case (Case 2008-313)

On 23 July 2009 the EDPS adopted an opinion regarding the prior checking of selection procedures for the recruitment of officials, temporary staff and contract staff to the Court of Auditors of the European Communities. Since the data processing operation is intended to evaluate personal aspects relating to the data subject, including his or her ability, efficiency and conduct, it is subject to prior checking.

The competition unit of the Court of Auditors introduced a set of procedures for the recruitment of officials, temporary staff and contract staff. These selection procedures serve to establish lists of successful candidates in order to assist Court of Auditors departments in the recruitment of officials and other staff.

The EDPS considers that the proposed processing does not appear to involve any infringement of the provisions of Regulation (EC) No 45/2001 provided that certain comments are taken into account. In particular, it recommends that the Court review its data storage policy for the files of candidates who have not been selected and that it store reserve lists/lists of successful candidates in competitions and other selection procedures in compliance with Article 4(1)(e). The EDPS also stressed the importance of the information to be supplied to data subjects in the notices of competition/screening, as well as the need to make the communication of results intelligible.

Available languages: English, French