Print

Opinions Prior Check and Prior Consultations

Some of the procedures that EU institutions put in place pose risks to the data protection rights and freedoms of individuals.

Under the old legal framework (Regulation (EC) 45/2001), EU institutions were obliged to notify us before putting in place risky data processing operations.

In general, our prior checking Opinions were public.

Regulation 2018/1725 builds on the old Regulation and mirrors the General Data Protection Regulation (EU) 2016/679 (GDPR) that applies to most organisations processing personal data in the Member States. Compared to the previous rules, Regulation 2018/1725 aligns documentation obligations more closely to the risks caused by processing personal data. This means for example that the documentation requirements for a EUI’s newsletter subscription will be lower than for a system using ‘intelligent CCTV’ covering publicly accessible space or a database profiling travellers for screening purposes.

Depending on the process at hand, EU institutions processing personal data ('controllers') may not have to go through all the steps below (these steps are described in the Accountability on the ground toolkit): 
• Generate basic documentation (called ‘records’) for all processes; 
• Check if the process is likely to result in high risks to the people whose data are processed and consult the DPO if it appears to do so; 
• If the EU institution needs to do a data protection impact assessment (DPIA), they analyse those risks in more detail and develop specific safeguards/controls to manage them; 
• If the results of the DPIA still indicate high residual data protection risks, the EU institution has to file a prior consultation with the EDPS (see Articles 40 and 90 of Regulation 2018/1725 respectively for administrative and operational personal data).

Article 39 of Regulation 2016/794 on Europol provides for an ad hoc prior consultation mechanism for new type of processing of operational data, namely data processed by Europol to support the Member States in preventing and combating serious crime and terrorism. Similarly, Article 72 of Regulation 2017/1939 on the European Public Prosecutor Office (EPPO) provides a specific prior consultation mechanism for the processing of operational data, namely data processed in the context of criminal investigations and prosecutions undertaken by the EPPO. Regulation 2018/1725, including the standard prior consultation mechanism, applies to Europol's and EPPO's processing of administrative data, which includes data on staff and visitors, for example.

Where an EU institution is unsure whether to notify us a data processing operation for prior consultation, their DPO can consult us for advice to confirm.

As for the old prior checking Opinions, in general the prior consultation Opinions are public, but we may delete sensitive elements where necessary, related to security for example. Some opinions, which are by nature sensitive, in particular in the police and justice area, may not be published. For the sake of transparency, these Opinions are summarised in our Annual Report.

Filters

18
Feb
2009

Early retirement - Parliament

Opinion of 18 February 2009 on a notification for prior checking on the procedure for early retirement without reduction of pension rights (Case 2008-748)

The European Parliament has implemented a procedure allowing officials and temporary agents who meet the eligibility conditions to file an application in order to benefit from early retirement without reduction of their pension rights.

The EDPS finds that there is a breach of Articles 11 and 12 of Regulation (EC) No 45/2001, in particular in view of the fact that no specific notice containing all the relevant data protection information is provided to the members of the staff concerned concerning the data processing that is taking place. The EDPS further makes recommendations to the European Parliament with respect to the need to also inform third parties concerned whom data are processed (e.g. in cases of requests for early retirement for family reasons) about the data processing and their right to access, correct and block their own data.

Available languages: English, French
9
Feb
2009

ART: Audit Reconciliation Tool - Court of Auditors

Opinion of 9 February 2009 on a notification for prior checking regarding "ART: Audit Reconciliation Tool" (Case 2008-239)

The purpose of the processing operation is to facilitate individual auditors and their Heads of Unit to reconcile their time recorded in ASSYST (the Audit Management System) with EFFICIENT (the Flexitime system) through the so called ART tool.

A reconciliation of the records of ASSYST and EFFICIENT by staff allows them ensuring that their ASSYST records are complete and accurate for the current and the previous month.

The main recommendations of the EDPS related to, among others, the need to adopt a specific legal basis for the ART processing operation, the adoption of a privacy statement and the modification of the privacy statements of the two underlying databases.

Available languages: English, French
26
Jan
2009

Threats to European Commission interests in the areas of counter-intelligence and counter-terrorism - Commission

Opinion of 26 January 2009 on a notification for prior checking concerning "Threats to European Commission interests in the areas of counter-intelligence and counter-terrorism" (Case 2008-0440)
In the context of threat management in the areas of counter-espionage and counter-terrorism, the European Commission has set up the two separate procedures of security investigations and screening procedures in order to protect its interests and those of the Member States. The EDPS has examined the two procedures and issued recommendations including the following: establishment of a more detailed legal basis covering a broader scope spanning all the possibilities for launching a screening procedure and establishment of a procedure ensuring that data are stored no longer than necessary.  The EDPS also recommended revising the screening section of the privacy statement and pro-actively supplying data subjects of screening with the privacy statement.

Available languages: English, French
21
Jan
2009

Report on probation period - Parliament

Opinion of 21 January 2009 on a notification for prior checking concerning the report on probation period (Case 2008-604)

The European Parliament has implemented a data processing to evaluate newly recruited officials, temporary and contract agents during the initial period of their employment, which serves as a basis for the confirmation, dismissal or possible extension of the probation period of that person.

Amongst its recommendations, the EDPS in particular asked that the European Parliament ensures that no sensitive data relating to health is processed, that recipients of the data are reminded to use the data only for the purpose for which they were transmitted, and that data subjects are informed about the data retention periods and their rights of access and rectification which can be done by adding the necessary information in the Vade-mecum to newcomers and in the probation report form.

Available languages: English, French
21
Jan
2009

Capacity to work in a third language - Parliament

Opinion of 21 January 2009 on a notification for prior checking on the assessment of staff's capacity to work in a third language before first promotion (Case 2008-690)

The European Parliament has implemented a data processing to evaluate the capacity of officials and contractual agents in function group IV to work in a third language. Officials must demonstrate the capacity to work in a third language to be eligible for a first promotion, and contractual agents must prove their ability to work in a third language before the renewal of their contract for an indefinite period.

The EDPS recommends that appropriate data retention periods are defined for the conservation of these assessments, that a procedure is implemented ensuring the exercise by individuals of their right to access and rectify their assessment (in particular access and rectification to the tests organized by EPSO), that specific information concerning the processing of individuals' data for the purpose of the assessment of the capacity to work in a third language is provided to the persons concerned. The EDPS also outlines that the staff processing personal data should be reminded of their duty of confidentiality towards such data.

Available languages: English, French