Print

Opinions Prior Check and Prior Consultations

Some of the procedures that EU institutions put in place pose risks to the data protection rights and freedoms of individuals.

Under the old legal framework (Regulation (EC) 45/2001), EU institutions were obliged to notify us before putting in place risky data processing operations.

In general, our prior checking Opinions were public.

Regulation 2018/1725 builds on the old Regulation and mirrors the General Data Protection Regulation (EU) 2016/679 (GDPR) that applies to most organisations processing personal data in the Member States. Compared to the previous rules, Regulation 2018/1725 aligns documentation obligations more closely to the risks caused by processing personal data. This means for example that the documentation requirements for a EUI’s newsletter subscription will be lower than for a system using ‘intelligent CCTV’ covering publicly accessible space or a database profiling travellers for screening purposes.

Depending on the process at hand, EU institutions processing personal data ('controllers') may not have to go through all the steps below (these steps are described in the Accountability on the ground toolkit): 
• Generate basic documentation (called ‘records’) for all processes; 
• Check if the process is likely to result in high risks to the people whose data are processed and consult the DPO if it appears to do so; 
• If the EU institution needs to do a data protection impact assessment (DPIA), they analyse those risks in more detail and develop specific safeguards/controls to manage them; 
• If the results of the DPIA still indicate high residual data protection risks, the EU institution has to file a prior consultation with the EDPS (see Articles 40 and 90 of Regulation 2018/1725 respectively for administrative and operational personal data).

Article 39 of Regulation 2016/794 on Europol provides for an ad hoc prior consultation mechanism for new type of processing of operational data, namely data processed by Europol to support the Member States in preventing and combating serious crime and terrorism. Similarly, Article 72 of Regulation 2017/1939 on the European Public Prosecutor Office (EPPO) provides a specific prior consultation mechanism for the processing of operational data, namely data processed in the context of criminal investigations and prosecutions undertaken by the EPPO. Regulation 2018/1725, including the standard prior consultation mechanism, applies to Europol's and EPPO's processing of administrative data, which includes data on staff and visitors, for example.

Where an EU institution is unsure whether to notify us a data processing operation for prior consultation, their DPO can consult us for advice to confirm.

As for the old prior checking Opinions, in general the prior consultation Opinions are public, but we may delete sensitive elements where necessary, related to security for example. Some opinions, which are by nature sensitive, in particular in the police and justice area, may not be published. For the sake of transparency, these Opinions are summarised in our Annual Report.

Filters

5
Nov
2008
Opinions Prior Check and Prior Consultations

Radiation exposure - Commission

Opinion of 5 November 2008 on the notification for prior checking regarding occupational radiation exposure data (Case 2007-0383)

In order to ensure the legitimate performance of radiological surveillance and the implementation of fundamental principles governing operational protection of exposed workers the DG TREN Health Protection Cell (DG TREN H4) is processing personal data of staff members who are occupationally exposed to ionising radiation in the course of their work. Under special service contracts, approved laboratories deliver the results of occupational protection monitoring concerning staff members classified as occupationally exposed to ionising radiation.
 
The radiological surveillance and occupational monitoring data are entered manually into the Microsoft ACCESS bases Personal Dosimetry database of DG TREN H4. Data relevant to the personal radiology protection and surveillance are registered in individual radiation pass books. Following an occupational health examination, the medical service of the Commission submits information (yes/no) concerning the individual physical fitness of the staff members.
 
The EDPS delivered a prior checking opinion considering that there is no reason to believe that there is a breach of the provisions of the Regulation provided notably that the right of access and rectification of personal data of the persons concerned is not conditioned to "specific circumstances"; information is provided on the categories of recipients and right to have recourse to EDPS at any time; individuals receive the information listed in Article 12 (privacy statement) before the processing operation is launched; and that the confidentiality and security of communications is guaranteed when information is transferred between subcontractors and the DG TREN-H4, and between DG TREN-H4 and the national competent authorities.
Available languages: English, French
Topics
Privacy in the EU Institutions
Health Data in the Workplace
3
Nov
2008
Opinions Prior Check and Prior Consultations

Traffic violations - Commission

Opinion of 3 November 2008 on the notification for prior checking on "Traffic violations with official vehicles of the Commission managed by the Infrastructure and Logistics Office - Brussels (OIB)" (Case 2008-395)

Within the European Commission, the Mobility and Supplies Unit, which is responsible for managing the car pool, deals with offences against the highway code committed by the drivers of official Commission vehicles managed by the OIB. The purposes of the processing operation are to examine whether, when traffic violations are committed by the drivers of official Commission vehicles, the immunity granted by the Protocol on Privileges and Immunities can be invoked, and to provide administration and follow-up.

The proposed data processing operation complies with Regulation (CE) No 45/2001, if the Commission:

  • reminds anyone who receives or processes data in the context of the procedure for handling penalty notices that the data may not be used for other purposes;
  • complies with Articles 8 and 9 as regards the transfer of data to the competent authorities;
  • as well as publishing the privacy statement on the internet, sends it to all data subjects concerned by this processing operation at the same time as the document on the procedure for forwarding the penalty notice;
  • updates the "Information for the attention of drivers of official Commission vehicles" to make the necessary changes (name of the controller and details of the data recipients).
Available languages: English, French
Topics
Privacy in the EU Institutions
Investigations
22
Oct
2008
Opinions Prior Check and Prior Consultations

Quality checks - OHIM

Opinion of 22 October 2008 on the notification for prior checking regarding quality checks (Case 2008-437)

This prior checking notification followed upon staff complaints and was only submitted to the EPPS upon his specific request. It concerns a system of internal quality checks during which (i) the work products of OHIM's trademark examiners are reviewed and (ii) the results are reported in a database created for this purpose. The primary purpose of these systematic checks is to improve the overall quality of OHIM's work products. However, the results of the quality checks (i) are also used to evaluate the quality of work of each examiner and (ii) inform management decisions regarding measures that may individually affect the examiners, such as performance appraisals, promotion, contract renewals, disciplinary measures, or training.

The EDPS recommended the adoption of a clear and formal internal decision to strengthen the legal basis of the operation and provide much needed clarity and certainty to staff members. This decision should clearly describe the system of the ex-ante quality checks, including their intended purpose, and provide for appropriate data protection safeguards, as recommended in the Opinion. Instead of fragmental email-communications, the EDPS also urged OHIM to adopt a formal data protection notice and make it available permanently on OHIM's intranet site. In addition, the EDPS emphasised that all possible efforts should be made to improve the level of accuracy, reliability, and consistency of the data. In any event, data included in the database should only be used as one of several factors to be considered in the decision-making process. Whenever data stored in the database are used for purposes which may individually affect staff members, they must also be heard and be given the opportunity to put forward their positions.

Available languages: English, French
Topics
Privacy in the EU Institutions
Staff Evaluation
Procurements, Grants, Experts
22
Oct
2008
Opinions Prior Check and Prior Consultations

eHest training - Council

Opinion of 22 October 2008 on the notification for prior checking regarding eHEST training (Computer based Hostile Environment Security Training) (Case 2008-387)

The Directorate Security Office of the Council organises a specific training in order to raise the security awareness and to mitigate risks for all personnel deployed on EU-led missions outside the EU in an operational capacity under Title V of the EU Treaty.
 
The training, called "eHEST" is a web-based training application with an automated evaluation function. Users are required to submit their data as part of the online registration process. The eHEST training programme envisages three tests. Only if the two first tests are passed with success, the final test can be accessed. The final test leads to certification which is a condition to the deployment in some areas.
 

The EDPS has issued an opinion relating to the processing of personal data in the context of the eHEST training. The EDPS concludes that on a general basis the procedure complies with the principles established in the data protection regulation. However the EDPS did make some recommendations as concerns the conservation of data and the information of the data subjects.

Available languages: English, French
Topics
Privacy in the EU Institutions
Staff Evaluation
21
Oct
2008
Opinions Prior Check and Prior Consultations

Selection of EDPS and Assistant Supervisor - Parliament and Council

Opinion of 21 October 2008 on the selection of European Data Protection Supervisor and Assistant Supervisor (Cases 2008-280 and 2008-292)

In accordance with Article 42(1) of Regulation (EC) 45/2001 of the European Parliament and of the Council on the protection of personal data by Community institutions and bodies and on the free movement of such data, the European Parliament and the Council shall appoint by common accord, the EDPS for a term of five years on the basis of a list drawn up by the Commission following a public call for candidates. An Assistant Supervisor shall be appointed in accordance with the same procedure and for the same period.

The prior check opinion of the EDPS focused on the selection procedure of the EDPS and Assistant EDPS at the European Parliament and Council following the transmission of the shortlist of candidates by the European Commission.

The EDPS concluded that there is no reason to believe that there is a breach of the provisions of Regulation 45/2001 provided that information is provided to the candidates notably on the identity of the controller at the European Parliament and at the Council; on the categories of data processed; on the recipients or categories of recipients; on the existence of a right of access and of rectification for the data processed by the European Parliament or the Council and the possible restrictions to these rights and the conservation periods in each institution.

Available languages: English, French
Topics
Privacy in the EU Institutions
Recruitment