Opinions Prior Check and Prior Consultations

Avis du 29 mai 2008 sur la notification d'un contrôle préalable à propos du dossier de l'attribution et la réservation de places de parking aux personnes à mobilité réduite (PMR) (Dossier 2007-753)
Le traitement a pour finalité de mettre en place une procédure pour octroyer des places de parking aux PMR afin de faciliter l'accès des PMR aux bâtiments du SGC et d'assurer la sécurité et le bien-être des PMR au travail. Le traitement sera effectué par le service de prévention du Secrétariat Général du Conseil.

D'après la procédure, des données à la fois administratives et relatives à la santé seront collectées, notamment le nom du demandeur PMR, le prénom, le numéro de matricule, la dénomination du bâtiment, l'avis médical du médecin-conseil du service médical du Conseil (autorisation temporaire, autorisation permanente ou refus), la localisation d'emplacement, le numéro d'immatriculation éventuellement (sur consentement de la personne concernée), la date d'octroi et la fin d'attribution.

L'attribution d'une place ne sera octroyée à la PMR que sur base d'un examen médical par le service médical du Conseil. Des données relatives à la santé seront ainsi traitées dans le cadre du traitement. C'est pourquoi, ce traitement entre dans le champ d'application de la procédure de contrôle préalable sur la base de l'article 27.2.a) du règlement 45/2001.

Dans le cadre de ses recommandations, le CEPD a notamment souligné que le Conseil rappelle à toute l'équipe du service de prévention de traiter les données relatives à la santé à la lumière des principes de la confidentialité médicale et qu'elle est soumise à une obligation de secret professionnel équivalente à d'un praticien de la santé. En outre, il a été recommandé que l'ensemble des informations contenues dans les articles 11 et 12 du règlement 45/2001, tant obligatoires que facultatives, soit l'objet de la Communication au personnel relative au traitement en l'espèce qui sera disponible, d'après la pratique habituelle sur le site intranet du Conseil. La Décision du Conseil du 13 septembre 2004 devra également être mentionnée dans la dite Communication.

Opinion of 26 May 2008 on a notification for prior checking on assignment of ALER flats to statutory staff of JRC Ispra and the European School in Varese (Case 2008-144)
The purpose of processing is to attribute free ALER flat to statutory staff of JRC Ispra site and the dependants of the European School in Varese taking into consideration new arrivals, family size and social aspects (such as a family with a handicap person in charge).

The attribution procedure is the following:

• publication of free ALER (Azienda Lombarda per l'edilizia residenziale provincia di Varese) flats;
• collection of applications;
• preparation of evaluation sheets;
• convocation of the Joint Housing Committee (CPA);
• decision on basis of neutralised (without name) tables of evaluation. The evaluation is based on the attribution criteria listed in the file "Scheda individuale per assegnazioni alloggi";
• after the selection (decision of the Joint Housing Committee) the candidates are informed by post sealed in a closed envelope either by internal post to JRC staff in Ispra or by registered letter to European school staff;
• ALER is informed about attribution of apartments to the respective candidates, the name, the work-address (JRC or European school) and the work-place phone number are indicated in order to protect the information about their private address.

Opinion of 23 May 2008 on a notification for prior checking regarding the processing operations on personal data concerning "JRC-IRMM Childcare Facility (Crèche) in Geel" (Case 2008-152)
The purpose of the Childcare Facility ("crèche") of the Institute for Reference Materials and Measurements is to ensure that staff arriving in Geel, often far from their place of origin, have easy access to day-care facilities for young children. The purpose of the processing of personal data is to calculate the financial contribution to be paid by the parents of children enrolled at the Childcare Facility each month and to know whom to contact in case of an emergency.

The EDPS recommendations provided in this opinion aim to ensure the full compliance of the processing with Regulation 45/2001 and concern, in particular, the storage periods the data protection aspects in the contract between the controller and the processor, the status of medical data, as well as the information to be provided to the data subjects (parents, contact persons).

Opinion of 20 May 2008 on a notification for prior checking on the evaluation of staff's capacity to work in a third language (Case 2008-159)
EMCDDA is engaged in the processing of personal data of its staff for the purposes of evaluating their capacity to work in a third language in the context of the application of Article 45.2 of the Staff Regulations.

The EDPS prior check suggests that EMCDDA carries out various measures to ensure the full implementation of Regulation (EC) No 45/2001, including

• Anonymising the data that will be used for statistical purposes during the first year of storage.
• Ensuring that a contract is signed between EMCDDA and the contractor that organises language courses pursuant to which the contractor undertakes, among others, to adopt appropriate technical and organisational security measures to protect the personal data received from EMCDDA.
• Ensure that staff concerned have access to the data held by the contractor, mainly the results of the language tests.
• Amend the privacy policy.

Opinion of 19 May 2008 on the notification for prior checking regarding OLAF's CCTV system (Case 2007-634)
This prior checking opinion concerns the closed-circuit television system (CCTV system) operated by the European Anti-Fraud Office (OLAF) within its premises in Brussels for security purposes. The case is the first among the EDPS opinions involving video-surveillance and constitutes a true prior checking case where the EDPS issued his opinion before OLAF started to operate the system.

On the whole, the EDPS was satisfied with the proportionality of the CCTV system and the data protection safeguards implemented by OLAF.

The positive outcome of the EDPS proportionality analysis was based primarily on the grounds that (i) the purposes of the system are clearly delineated, relatively limited, and legitimate and (ii) the location, field of coverage and resolution, and other aspects of the set-up of the CCTV system appear to be adequate, relevant and not excessive in relation to achieving the specified purposes, taking into consideration also the sensitivity of the information held by OLAF.

In particular, the main purpose of OLAF’s CCTV system is protection against unauthorized physical access, in particular, to sensitive operational information and IT equipment. Cameras are only located near exit and entry points to the OLAF secure area and at certain other strategic locations such as certain unattended IT rooms and the OLAF Document Management Centre.

None of the cameras monitor areas where staff would be continuously present and there are no instances where a staff member working in a certain area would be constantly in the field of vision of a camera. There are also no cameras in individual offices, in the cafeteria/kitchen areas, near or in restrooms, or in other areas where staff members and visitors would expect a high degree of privacy. Neither is the cameras' field of vision directed towards parts of the Commission building occupied by others than OLAF. Finally, the cameras' field of vision is also not directed to any areas outside the building on Belgian territory, with a view of neighbouring streets, buildings or other private or public areas.

Nevertheless, the EDPS made important recommendations. First and foremost, it recommended OLAF to reconsider the planned conservation period to ensure that data are kept no longer than necessary for the purposes initially contemplated.

In addition, although OLAF made significant efforts to set appropriate data protection safeguards, improvements could still be made, primarily in the way these safeguards are documented and communicated to data subjects. Importantly, the EDPS recommended that OLAF adopts an internal document describing its CCTV system and providing for appropriate data protection safeguards.

Finally, whereas the EDPS also welcomed OLAF's efforts to provide a layered notice in a user-friendly manner, he further encouraged OLAF to provide more specific and accurate information to data subjects regarding some items listed under Article 12 of the Regulation.