Print

Opinions Prior Check and Prior Consultations

Some of the procedures that EU institutions put in place pose risks to the data protection rights and freedoms of individuals.

Under the old legal framework (Regulation (EC) 45/2001), EU institutions were obliged to notify us before putting in place risky data processing operations.

In general, our prior checking Opinions were public.

Regulation 2018/1725 builds on the old Regulation and mirrors the General Data Protection Regulation (EU) 2016/679 (GDPR) that applies to most organisations processing personal data in the Member States. Compared to the previous rules, Regulation 2018/1725 aligns documentation obligations more closely to the risks caused by processing personal data. This means for example that the documentation requirements for a EUI’s newsletter subscription will be lower than for a system using ‘intelligent CCTV’ covering publicly accessible space or a database profiling travellers for screening purposes.

Depending on the process at hand, EU institutions processing personal data ('controllers') may not have to go through all the steps below (these steps are described in the Accountability on the ground toolkit): 
• Generate basic documentation (called ‘records’) for all processes; 
• Check if the process is likely to result in high risks to the people whose data are processed and consult the DPO if it appears to do so; 
• If the EU institution needs to do a data protection impact assessment (DPIA), they analyse those risks in more detail and develop specific safeguards/controls to manage them; 
• If the results of the DPIA still indicate high residual data protection risks, the EU institution has to file a prior consultation with the EDPS (see Articles 40 and 90 of Regulation 2018/1725 respectively for administrative and operational personal data).

Article 39 of Regulation 2016/794 on Europol provides for an ad hoc prior consultation mechanism for new type of processing of operational data, namely data processed by Europol to support the Member States in preventing and combating serious crime and terrorism. Similarly, Article 72 of Regulation 2017/1939 on the European Public Prosecutor Office (EPPO) provides a specific prior consultation mechanism for the processing of operational data, namely data processed in the context of criminal investigations and prosecutions undertaken by the EPPO. Regulation 2018/1725, including the standard prior consultation mechanism, applies to Europol's and EPPO's processing of administrative data, which includes data on staff and visitors, for example.

Where an EU institution is unsure whether to notify us a data processing operation for prior consultation, their DPO can consult us for advice to confirm.

As for the old prior checking Opinions, in general the prior consultation Opinions are public, but we may delete sensitive elements where necessary, related to security for example. Some opinions, which are by nature sensitive, in particular in the police and justice area, may not be published. For the sake of transparency, these Opinions are summarised in our Annual Report.

Filters

3
Jul
2009
Opinions Prior Check and Prior Consultations

Hearings of the Commissioners-designate - Parliament

Opinion of 3 July 2009 on a notification for prior checking on the processing of personal data in the hearings of the Commissioners-designate (Case 2009-0332)

On 3 July 2009, the EDPS issued a prior checking opinion focusing on the processing of personal data in the hearings at the European Parliament of the Commissioners-designate.

During the hearings, the appropriate committee or committees shall invite the Commissioner-designate to make a statement and answer questions. The hearings shall be organised in such a way as to enable Commissioners-designate to disclose to Parliament all relevant information. All hearings will be web-streamed on the website of the EP. An indexed video recording of the hearings shall be made available for the public record within twenty-four hours. All CVs and additional documents will be part of the meeting documents of the committee and published on the EP website and available in the meeting room. The period of conservation of the data is five years. The data are subsequently transmitted to the central archives (CARDOC) for indefinite conservation.

In his opinion, the EDPS underlined that data could be kept after the initial conservation period for historical purposes, but that there should be a selection and verification process on the basis of criteria determined at an institutional level so as to only retain data of historical value. Appropriate safeguards must be put into place to ensure that the data kept on the basis of their historical value are not processed for any other purposes or used in support of measures or decisions regarding a particular individual. As for data which, after selection, are not considered as of historical value, they may only be stored for longer than the initial 5 year period of retention, if they are made anonymous or, if this is not possible, with the identity of the data subjects encrypted. Furthermore, although the Commissioners-designate are probably aware of the public nature of the data provided and the fact that the hearings will be made public notably through web-streaming, in order to ensure fairness of the processing further information could be provided on this in the Privacy statement.  The EDPS also invited the Parliament to ensure that the integrity of the data transmitted from the Council is respected.

Available languages: English, French
Topics
Privacy in the EU Institutions
Recruitment
22
Jun
2009
Opinions Prior Check and Prior Consultations

Time and absence management - ECDC

Opinion of 22 June 2009 on the notification for prior checking concerning "Time and absence management" (Case 2009-072)
On 22 June 2009, the EDPS adopted an opinion on time and absence management at the European Center for Disease Prevention and Control (ECDC). The EDPS considers that the processing is lawful to the extent that it is limited to the purpose of time and absence management and that it does not lead to monitor on a regular basis the staff to evaluate personal aspects of the data subject, such as his/her ability, efficiency or conduct. Specific guarantees should be implemented as regards the processing of sensitive data, and in particular the ECDC should ensure that certificates containing medical data are sent by data subjects to an external medical service. The EDPS stresses that the right of an individual to access and rectify personal data concerning him or her should be ensured to all data subjects whom data are processed including trainees and family members, whatever the format in which such data are processed. The EDPS insists that ECDC must determine appropriate periods for the conservation of personal data.

Available languages: English, French
Topics
Privacy in the EU Institutions
Working Conditions
17
Jun
2009
Opinions Prior Check and Prior Consultations

Selection of middle management and advisers - Commission

Opinion of 17 June 2009 on a notification for prior checking regarding the selection of middle management staff and advisers in the Commission (Case 2008-751)

DG ADMIN organizes and manages the selection process of middle management staff and advisers in the Commission in order to select the best suited candidates for a particular position.   In order to select the best suited candidates, applicants have to follow various procedures (interviews with pre-selection panel, interview of shortlisted with the Director General and the Rapporteur, in some cases, opinion of the Consultative Committee on Appointments, etc). Such procedures entail the collection and further processing of candidates' personal data for the purposes of evaluating their competences for a given position.

In his opinion, the EDPS concluded that the DG ADMIN has substantially followed all the principles of the Regulation. Nevertheless the EDPS recommended, among others, that DG ADMIN:

  • Ensures that no data related to closed disciplinary proceedings is collected and further processed.
  • Reconsiders the storage periods.
  • Limits the amount of information transferred during the second phase.
  • Provides an information notice to applicants for all middle management and adviser posts, including those published at level AD 9 / AD 14.
Available languages: English, French
Topics
Privacy in the EU Institutions
Recruitment