Print

Opinions Prior Check and Prior Consultations

Some of the procedures that EU institutions put in place pose risks to the data protection rights and freedoms of individuals.

Under the old legal framework (Regulation (EC) 45/2001), EU institutions were obliged to notify us before putting in place risky data processing operations.

In general, our prior checking Opinions were public.

Regulation 2018/1725 builds on the old Regulation and mirrors the General Data Protection Regulation (EU) 2016/679 (GDPR) that applies to most organisations processing personal data in the Member States. Compared to the previous rules, Regulation 2018/1725 aligns documentation obligations more closely to the risks caused by processing personal data. This means for example that the documentation requirements for a EUI’s newsletter subscription will be lower than for a system using ‘intelligent CCTV’ covering publicly accessible space or a database profiling travellers for screening purposes.

Depending on the process at hand, EU institutions processing personal data ('controllers') may not have to go through all the steps below (these steps are described in the Accountability on the ground toolkit): 
• Generate basic documentation (called ‘records’) for all processes; 
• Check if the process is likely to result in high risks to the people whose data are processed and consult the DPO if it appears to do so; 
• If the EU institution needs to do a data protection impact assessment (DPIA), they analyse those risks in more detail and develop specific safeguards/controls to manage them; 
• If the results of the DPIA still indicate high residual data protection risks, the EU institution has to file a prior consultation with the EDPS (see Articles 40 and 90 of Regulation 2018/1725 respectively for administrative and operational personal data).

Article 39 of Regulation 2016/794 on Europol provides for an ad hoc prior consultation mechanism for new type of processing of operational data, namely data processed by Europol to support the Member States in preventing and combating serious crime and terrorism. Similarly, Article 72 of Regulation 2017/1939 on the European Public Prosecutor Office (EPPO) provides a specific prior consultation mechanism for the processing of operational data, namely data processed in the context of criminal investigations and prosecutions undertaken by the EPPO. Regulation 2018/1725, including the standard prior consultation mechanism, applies to Europol's and EPPO's processing of administrative data, which includes data on staff and visitors, for example.

Where an EU institution is unsure whether to notify us a data processing operation for prior consultation, their DPO can consult us for advice to confirm.

As for the old prior checking Opinions, in general the prior consultation Opinions are public, but we may delete sensitive elements where necessary, related to security for example. Some opinions, which are by nature sensitive, in particular in the police and justice area, may not be published. For the sake of transparency, these Opinions are summarised in our Annual Report.

Filters

19
Jun
2008

Recruitment - European Medicines Agency

Opinion of 19 June 2008 on the notification for prior checking regarding EMEA's "Access" recruitment database and selection and recruitment procedures (Case 2007-422)

This opinion concerns the selection and recruitment organized at the EMEA. The recommendations of the EDPS include the following:

Regarding proportionality, the questions relating to past convictions should be limited in time to those which actually appear on the applicant's criminal record at the time of applying for the position. As for optional data entries, EMEA should more clearly indicate on the application form the provision of what information is optional. Concerning psychometric testing, should EMEA continue to use psychometric testing as part of its selection procedures, it should submit this aspect of the recruitment procedure for prior checking by the EDPS. As regards the conservation of the data, EMEA should reconsider the conservation periods to ensure that data are kept no longer than necessary for the purposes initially contemplated. In particular, when data are conserved for budgetary discharge, control and audit purposes, personal data contained in supporting documents shall be deleted where possible when those data are not necessary for these purposes. Special attention should be paid to highly sensitive data such as information regarding disability and criminal records. As for rights of access, EMEA should revise its procedures to ensure that no access request is turned down merely because it is not submitted on the form specified. Further, EMEA should reconsider the restrictions it has put in place in order to preserve the confidentiality of the deliberations of the selection panel in view of reconciling this interest with the candidates’ right of access. Regarding information to data subjects, specific notice should be provided with respect to all items under Article 11 and 12 of the Regulation in a specific and clear manner, in addition to the availability of EMEA's general “Data Protection Declaration”.

Available languages: English, French
13
Jun
2008

Skills database - Parliament

Opinion of 13 June 2008 on the notification for prior checking regarding the Skills database (Case 2008-192)
This database contains career data on staff covering professional experience in and before joining the EP. The skills database constitutes an electronic processing operation that facilitates Human Resources management in mobility, careers advice, specialised staff search, filling vacant posts and planning competitions.

Some of the information contained in the database is entered by the data subject him or herself, some other elements are derived from other databases maintained by DG Personnel, such as STREAMLINE (Management of the recruitment, career, training, individual entitlements and reimbursement of expenses - e.g. missions - of staff), RAPNOT (Evaluation), and FORPRO (European Parliament training management, the data extracted from it comprising the list of training courses completed).

Available languages: English
9
Jun
2008

Selection and management of interim staff at JRC - Commission

Opinion of 9 June 2008 on a notification for prior checking regarding the selection and management of interim staff at JRC (Case 2008-139)
Management Support Units of each of the Institutes/Directorates of the JRC that use interims collect and further process information about potential candidates to interim positions for the purposes of selecting the most suitable candidates. The EDPS Opinion suggests that JRC, among others should, (a) replace the collection of certificates of good conduct by other tools that demonstrate the prior criminal behaviour (criminal records, for example) (b) ensure that applicants have access to their evaluation data including the assessment notes concerning them drafted by the selection committee and Human Resources staff of the relevant Management Units.

Available languages: English, French
4
Jun
2008

Medical check-ups - CPVO

Opinion of 4 June 2008 on the notification for prior checking regarding pre-employment and annual medical check-ups (Case 2007-176)

This opinion concerns the pre-employment and annual medical check-ups organized at the CPVO. The recommendations of the EDPS include the following:

Regarding data quality, the scope of data collected on the medical overview form and the information included on the certificate of fitness should be revised to comply with the principles of relevance and proportionality.  As to the conservation of the data, a reasonable, definite time frame must be established by the CPVO for the conservation of each category of employee and candidate medical data held by the CPVO. On information to data subjects, clear and specific information needs to be provided to data subjects regarding all items listed under Articles 11 and 12 of the Regulation. With respect to the pre-employment medical check-up, the EDPS also recommends the additional information on anti-discrimination referred to in point 3.8.4 of the Opinion. Finally, with regard to processing data on behalf of controllers, the service contracts concluded with the CPVO Physician and the CPVO Medical Centre should be modified to address data protection aspects pursuant to Article 23 of the Regulation. Instructions should be provided to the processors to comply with the minimum data protection safeguards recommended in this Opinion.

Available languages: English, French
Topics