Print

Opinions Prior Check and Prior Consultations

Some of the procedures that EU institutions put in place pose risks to the data protection rights and freedoms of individuals.

Under the old legal framework (Regulation (EC) 45/2001), EU institutions were obliged to notify us before putting in place risky data processing operations.

In general, our prior checking Opinions were public.

Regulation 2018/1725 builds on the old Regulation and mirrors the General Data Protection Regulation (EU) 2016/679 (GDPR) that applies to most organisations processing personal data in the Member States. Compared to the previous rules, Regulation 2018/1725 aligns documentation obligations more closely to the risks caused by processing personal data. This means for example that the documentation requirements for a EUI’s newsletter subscription will be lower than for a system using ‘intelligent CCTV’ covering publicly accessible space or a database profiling travellers for screening purposes.

Depending on the process at hand, EU institutions processing personal data ('controllers') may not have to go through all the steps below (these steps are described in the Accountability on the ground toolkit): 
• Generate basic documentation (called ‘records’) for all processes; 
• Check if the process is likely to result in high risks to the people whose data are processed and consult the DPO if it appears to do so; 
• If the EU institution needs to do a data protection impact assessment (DPIA), they analyse those risks in more detail and develop specific safeguards/controls to manage them; 
• If the results of the DPIA still indicate high residual data protection risks, the EU institution has to file a prior consultation with the EDPS (see Articles 40 and 90 of Regulation 2018/1725 respectively for administrative and operational personal data).

Article 39 of Regulation 2016/794 on Europol provides for an ad hoc prior consultation mechanism for new type of processing of operational data, namely data processed by Europol to support the Member States in preventing and combating serious crime and terrorism. Similarly, Article 72 of Regulation 2017/1939 on the European Public Prosecutor Office (EPPO) provides a specific prior consultation mechanism for the processing of operational data, namely data processed in the context of criminal investigations and prosecutions undertaken by the EPPO. Regulation 2018/1725, including the standard prior consultation mechanism, applies to Europol's and EPPO's processing of administrative data, which includes data on staff and visitors, for example.

Where an EU institution is unsure whether to notify us a data processing operation for prior consultation, their DPO can consult us for advice to confirm.

As for the old prior checking Opinions, in general the prior consultation Opinions are public, but we may delete sensitive elements where necessary, related to security for example. Some opinions, which are by nature sensitive, in particular in the police and justice area, may not be published. For the sake of transparency, these Opinions are summarised in our Annual Report.

Filters

27
Apr
2009

Medical data of children attending inter-institutional crèches - Commission

Opinion of 27 April 2009 on a notification for prior checking on the management of the medical data of children attending the inter-institutional crèches and kindergartens managed by the OIB (Case 2009-088)
On 27 April 2009, the EDPS adopted an opinion on the prior checking of the management of the medical data of children attending the inter-institutional crèches and kindergartens managed by the OIB. Given the particularly sensitive nature of the data being processed, the EDPS recommends that a specific legal basis should be put in place for the processing of data relating to health in the context of the crèches and kindergartens, and that at the very least the unambiguous consent of data subjects should be obtained to the medical monitoring of the children and the processing the data relating to their health by the medical service in the crèches and kindergartens. The EDPS also recommends that only data which is strictly necessary for the purposes of the processing operation should be collected, and therefore invites the medical service to re-evaluate whether the data collected on the medical form and during attendance at the crèches and kindergartens is proportionate. Regarding the storage of the medical files, the EDPS recommends that a storage period which is in proportionate to achieving the purposes of the processing operation should be adopted.

Available languages: English, French
22
Apr
2009

Junior experts in delegation - Commission

Opinion of 22 April 2009 on the notification for prior checking regarding "Junior Experts in Delegation" (Case 2008-754)

The purpose of the processing operation in this case is to examine the eligibility of candidates put forward by the Member States for the Junior Experts in Delegation (hereinafter "JED") programme, select JEDs, determine who will be offered a posting to a delegation, ensure proper implementation of all aspects of their two-year contract and evaluate their performance in discharging their duties within the delegation. This processing operation therefore falls within the scope of the prior checking procedure within the meaning of Article 27(2)(b) of Regulation (EC) No 45/2001.

Any person who submits an application for a JED post, any referees named by applicants or any person indicated by the JED as the person to contact in the event of an accident/emergency and, where applicable, the JED's spouse.

In its recommendations, the EDPS emphasised inter alia that the Commission should:

  • reword as soon as possible the sentence on the candidates' right of appeal against the decision of the selection panel, in order to indicate more clearly the available channels and procedures for appeal;
  • remove the requirement to submit a photograph with the application form without prejudice to the formal identification of the data subject at a later stage in the selection process; 
  • indicate that the sentence "Other elements to be taken into consideration" on the application form is optional and reword it so that it specifies that the information provided should be strictly relevant to the candidate's university and professional career;
  • insert a note in both the application form and in the information sheets stating that the data subjects themselves should inform their referees, the persons to be contacted in the event of an emergency and their spouses that their data might be processed in the course of the processing operation.
Available languages: English, French
1
Apr
2009

Early retirement - Economic and Social Committee

Opinion of 1 April 2009 on the notification for prior checking on the annual exercise for early retirement without reduction of pension rights (Case 2008-719)

The purpose of the processing operation is to implement annual exercises for early retirement without reduction of pension rights in compliance with Article 9 of Annex VIII to the Staff Regulations and the second and third subparagraphs of Article 39(1) of the CEOS. Implementation is based on Decisions No 271/07 A of 13 June 2007 and No 144/08 A of 4 April 2008 on the possibility of not applying the reduction in pension rights to officials and other servants who leave the service before the age of 63 and request that their retirement pension be paid immediately.

The proposed processing operation would not appear to involve any breach of the provisions of Regulation (EC) No 45/2001, provided that the European Economic and Social Committee ensures that applicants' family members and dependants whose data might be processed by the EESC have rights of access and rectification and that it reviews the content of the information supplied and the arrangements for supplying it.

Available languages: English, French
25
Mar
2009

Waiver of immunity from legal proceedings and inviolability of Commission premises and archives - Commission

Opinion of 25 March 2009 on the notification for prior checking concerning "the processing of requests for waiver of immunity from legal proceedings and of the inviolability of Commission premises and archives" (Case 2008-645)

The European Commission has entrusted the Investigation and Disciplinary Office of the Commission (IDOC) with the processing of data for the purpose of deciding, in response to a request from a national court or any other national body entitled to carry out an investigation, whether to authorise or refuse to authorise the appearance in court of an official or other servant and/or access to the premises and/or archives of the European Commission.

The EDPS recommends in particular that appropriate retention periods be established for files relating to requests for waiver of immunity in the light of developments, taking into account any discontinuation of disciplinary and/or dispute procedures or the data subject's acquittal in court.  As regards transfer of data to recipients other than Community institutions, the nature of the data exchanged requires that a list of such transfers be drawn up and the legal justification for them indicated.

Available languages: English, French