Print

Opinions Prior Check and Prior Consultations

Some of the procedures that EU institutions put in place pose risks to the data protection rights and freedoms of individuals.

Under the old legal framework (Regulation (EC) 45/2001), EU institutions were obliged to notify us before putting in place risky data processing operations.

In general, our prior checking Opinions were public.

Regulation 2018/1725 builds on the old Regulation and mirrors the General Data Protection Regulation (EU) 2016/679 (GDPR) that applies to most organisations processing personal data in the Member States. Compared to the previous rules, Regulation 2018/1725 aligns documentation obligations more closely to the risks caused by processing personal data. This means for example that the documentation requirements for a EUI’s newsletter subscription will be lower than for a system using ‘intelligent CCTV’ covering publicly accessible space or a database profiling travellers for screening purposes.

Depending on the process at hand, EU institutions processing personal data ('controllers') may not have to go through all the steps below (these steps are described in the Accountability on the ground toolkit): 
• Generate basic documentation (called ‘records’) for all processes; 
• Check if the process is likely to result in high risks to the people whose data are processed and consult the DPO if it appears to do so; 
• If the EU institution needs to do a data protection impact assessment (DPIA), they analyse those risks in more detail and develop specific safeguards/controls to manage them; 
• If the results of the DPIA still indicate high residual data protection risks, the EU institution has to file a prior consultation with the EDPS (see Articles 40 and 90 of Regulation 2018/1725 respectively for administrative and operational personal data).

Article 39 of Regulation 2016/794 on Europol provides for an ad hoc prior consultation mechanism for new type of processing of operational data, namely data processed by Europol to support the Member States in preventing and combating serious crime and terrorism. Similarly, Article 72 of Regulation 2017/1939 on the European Public Prosecutor Office (EPPO) provides a specific prior consultation mechanism for the processing of operational data, namely data processed in the context of criminal investigations and prosecutions undertaken by the EPPO. Regulation 2018/1725, including the standard prior consultation mechanism, applies to Europol's and EPPO's processing of administrative data, which includes data on staff and visitors, for example.

Where an EU institution is unsure whether to notify us a data processing operation for prior consultation, their DPO can consult us for advice to confirm.

As for the old prior checking Opinions, in general the prior consultation Opinions are public, but we may delete sensitive elements where necessary, related to security for example. Some opinions, which are by nature sensitive, in particular in the police and justice area, may not be published. For the sake of transparency, these Opinions are summarised in our Annual Report.

Filters

12
Nov
2008
Opinions Prior Check and Prior Consultations

Selection of managers - OHIM

Avis du 12 novembre 2008 sur la notification de conctrôle préalable concernant le recrutement de directeurs (Dossier 2008-435)
OHIM organises and manages the selection process of managers in order to select the best suited candidates for a particular position (internal and candidates). The data processing operations towards the selection of candidates are carried out by the Selection Committee, by its Secretariat and by the Internal Mobility and Recruitment of Managers Section of the Human Resources Department. The Prior Check Opinion gives recommendations to ensure full compliance with Regulation 45/2001, in particular, among others, it suggests that OHIIM (I) sets up a procedure for providing access rights; (II) Updates the processor contract to reflect the application of national law to the security measures that must be implemented by processors; (III) Amends the privacy policy and uploads it in a visible place on web site.

Available languages: English, French
Topics
Privacy in the EU Institutions
Recruitment
11
Nov
2008
Opinions Prior Check and Prior Consultations

Expert database - EFSA

Avis du 11 novembre 2008 sur la notification de contrôle préalable à propos de la base de données d'experts (Dossier 2008-455)

The Notification concerns EFSA’s Expert Database. This database contains professional data of external scientific experts who may be called upon to carry out advisory work for EFSA (and for national authorities in Member States with a similar mandate to EFSA). The Notification also covers EFSA's procedure to select external scientific experts from the database for its specific scientific projects. 

The EDPS, in general, was satisfied with the data protection safeguards provided by EFSA. To further improve EFSA's data protection compliance, he recommended that the end-users' attention should be specifically called to the limited nature of the validity check that EFSA carries out, suggesting that they use the database as a pool of applications, rather than as a pool of experts whose skills and reliability have already been carefully checked by EFSA in each case.

To ensure the accuracy and up-to-datedness of the profiles kept in the database, he further recommended that automatic reminders should be sent to experts who failed to update their profiles (or confirm their old profiles) with a warning that failure to respond (after a number of reminders) would entail the automatic deletion of their profiles. EFSA was also requested to provide for an appropriate conservation period for processing data during the selection procedure for specific assignments.

With respect to rights of access, the EDPS recommended that EFSA should provide procedural safeguards to ensure that access rights are granted in a timely manner and without undue constraints (including access to certain internal documents). These may include a time-limit established for response to the request by EFSA, and the obligation for the controller to request the advice of the DPO in case of doubt whether a request can be granted. Finally, as regards information to data subjects, the EDPS noted that certain additional information needed to be provided.

Available languages: English, French
Topics
Privacy in the EU Institutions
Procurements, Grants, Experts
11
Nov
2008
Opinions Prior Check and Prior Consultations

Absence owing to illness or accident

Opinion of 11 November 2008 on a notification for prior checking on the procedure in the event of absence owing to illness or accident (Cases 2008-271 et 2008-283)

At the Council, absences owing to illnesses are managed by a specific Medical Absences Management Department, responsible for officials, temporary staff, contract staff and detached national and military experts working at the Council.  Various data processing operations are carried out by this department, for the purpose of ensuring compliance with all statutory and other regulations concerning absence owing to illness or accident and to prevent unjustified medical absences (obtaining medical certificates, checking medical absences, etc.).

The EDPS has examined the processing of personal data in the context of the management of absences owing to illness and has concluded that it does not appear to involve any infringement of the provisions of Regulation (EC) No 45/2001 provided that certain recommendations are followed, and in particular that the department responsible for the processing changes the data retention period, puts in place a procedure to be followed in respect of applications for access to or rectification of data and informs data subjects in accordance with Articles 11 and 12 of the Regulation.

Available languages: English, French
Topics
Privacy in the EU Institutions
Health Data in the Workplace
10
Nov
2008
Opinions Prior Check and Prior Consultations

Internet monitoring - Court of Auditors

Opinion of 10 November 2008 on a notification for prior checking related to Internt monitoring (Case 2008-284)

The Court of Auditors engages in the monitoring of the Court's of its Internet infrastructure for the following purposes: (i) to ensure the functionality of the network and avoid security breaches and also (ii) to verify whether Court's users employ the Internet in accordance with the allowed uses laid down in the Internet Security Policy.

The EDPS has issued an opinion relating to Court of Auditors Internet monitoring practices which assesses  the extent to which such monitoring  complies with Regulation 45/2001.  The EDPS concludes that the intended data processing activities give rise to doubts about their compatibility with necessity and proportionality principles laid down in Regulation 45/2001. To address this problem, the EDPS recommends, among others, the following:

(i) In the absence of an adequate suspicion, to abstain from monitoring URLs of visited Web sites unless there is a justified reason for such an activity, namely, in case of extremely long URLs, and  dangerous sites as specified in SANS, CERT, and similar publications; (ii) To consider using other indicators (volume of data downloaded, time spent, and other off line indicators) to discover abuse.

The Opinion contains other recommendations regarding other aspects of the data processing (provision of information, security, transfers of information, etc).

Available languages: English, French
Topics
Privacy in the EU Institutions
IT at Work
7
Nov
2008
Opinions Prior Check and Prior Consultations

Promotion of Officials and Regrading of Temporary Agents - OHIM

Opinion of 7 November 2008 on the notification for prior checking regarding the Internal Promotion of Officials and Regrading of Temporary Agents (Case 2008-095)

The purpose of the processingis to conduct the yearly internal promotion/regrading exercise for members of staff. At the beginning of each yearly exercise, the lists of the staff members eligible for promotion and regrading are published on the OHIM's Intranet. A database of staff members to whom promotion/regrading points may be awarded is set up containing administrative data synchronised from a human resources module. The database is made accessible for the respective Directors for a limited period of time so that they can attribute the promotion/regrading points. The members of the Management Committee have to agree on a proposal of points to be awarded. An individual notification of the proposed points is sent to the staff members concerned who may lodge an appeal against the notification within ten working days to the Joint Evaluation and Promotion Committee (JEPC). Before the Appointing Authority takes a formal decision concerning promotions, the JEPC shall examine and issue an opinion on the list of candidates for promotion. It shall also issue an opinion on the overall awarding of promotion points. Wherever relevant, it shall formulate recommendations to the Appointing Authority. The final promotion/regrading points are awarded by the Appointing Authority and notified to the staff member concerned. The lists of promoted/regraded staff members are published on OHIM's Intranet.
 
The EDPS examined the procedure and concluded that there is no reason to believe that there is a breach of the provisions of Regulation (EC) 45/2001 provided that certain considerations are taken into account notably that the conservation period be reassessed after the first ten years based on practical experience; the recipients be made aware that they shall process the personal data they receive in the course of the promotions procedure only for that purpose; and that information is provided on categories of data processed, notably in the data base, and the recipients of the data other than the Management Committee and the HRD's Personnel Administration Sector.
Available languages: English, French
Topics
Privacy in the EU Institutions
Staff Evaluation