Some of the procedures that EU institutions put in place pose risks to the data protection rights and freedoms of individuals.
Under the old legal framework (Regulation (EC) 45/2001), EU institutions were obliged to notify us before putting in place risky data processing operations.
In general, our prior checking Opinions were public.
Regulation 2018/1725 builds on the old Regulation and mirrors the General Data Protection Regulation (EU) 2016/679 (GDPR) that applies to most organisations processing personal data in the Member States. Compared to the previous rules, Regulation 2018/1725 aligns documentation obligations more closely to the risks caused by processing personal data. This means for example that the documentation requirements for a EUI’s newsletter subscription will be lower than for a system using ‘intelligent CCTV’ covering publicly accessible space or a database profiling travellers for screening purposes.
Depending on the process at hand, EU institutions processing personal data ('controllers') may not have to go through all the steps below (these steps are described in the Accountability on the ground toolkit):
• Generate basic documentation (called ‘records’) for all processes;
• Check if the process is likely to result in high risks to the people whose data are processed and consult the DPO if it appears to do so;
• If the EU institution needs to do a data protection impact assessment (DPIA), they analyse those risks in more detail and develop specific safeguards/controls to manage them;
• If the results of the DPIA still indicate high residual data protection risks, the EU institution has to file a prior consultation with the EDPS (see Articles 40 and 90 of Regulation 2018/1725 respectively for administrative and operational personal data).
Article 39 of Regulation 2016/794 on Europol provides for an ad hoc prior consultation mechanism for new type of processing of operational data, namely data processed by Europol to support the Member States in preventing and combating serious crime and terrorism. Similarly, Article 72 of Regulation 2017/1939 on the European Public Prosecutor Office (EPPO) provides a specific prior consultation mechanism for the processing of operational data, namely data processed in the context of criminal investigations and prosecutions undertaken by the EPPO. Regulation 2018/1725, including the standard prior consultation mechanism, applies to Europol's and EPPO's processing of administrative data, which includes data on staff and visitors, for example.
Where an EU institution is unsure whether to notify us a data processing operation for prior consultation, their DPO can consult us for advice to confirm.
As for the old prior checking Opinions, in general the prior consultation Opinions are public, but we may delete sensitive elements where necessary, related to security for example. Some opinions, which are by nature sensitive, in particular in the police and justice area, may not be published. For the sake of transparency, these Opinions are summarised in our Annual Report.
Avis du 17 janvier 2008 sur la notification d'un contrôle préalable à propos du dossier "Gestion des dossiers médicaux des enfants fréquentant la Crèche du Secrétariat Général du Conseil (SGC)" (Dossier 2007-491)
Avis du 17 janvier 2008 sur la notification d'un contrôle préalable à propos du dossier "appel d'offre et passation d'un contrat avec un traducteur freelance" (Dossier 2007-327)
Opinion of 11 January 2008 on a notification for prior checking concerning the "Staff evaluation / assessment exercise" (Case 2007-334)
ii) the preparation of a note referring clearly to all elements provided in Articles 11 and 12 of the Regulation and making sure that the data subjects are informed of this note before the exercises of the probationary period assessment and of the staff's annual appraisal begin.
Opinion of 11 January 2008 on a notification for prior checking on the Call center technology (Case 2007-583)
The EDPS recommendations provided in this opinion aim to ensure the full compliance with the Regulation 45/2001, in particular, as regards the storage periods, the scope of the right of access and the requirements for data transfers to service providers established in non-adequate countries.
Opinion of 10 January 2008 on a notification on e-Tendering application covering the Council's public procurement procedures (Case 2007-573)
Some of the recommendations made by the EDPS are the following: It was underlined that a set of predefined data should be kept in the light of the duration of each long term contract awarded in each case. Thus, depending on the duration of the contract, data should be erased immediately after they are no longer in use. Moreover, a precise period for the conservation of registered data should be adopted; it should not be excessive to the purpose for which they will further be processed. In the declaration on "personal data protection", it was pointed out, inter alia, that the obligation of the economic operators to inform their employees or subcontractors about their rights related to Article 11 and 12 of the Regulation should be mentioned. The economic operators should make sure that all relevant information, which will be published on the site of the Council, can be accessible to them. It should also be indicated in the Confidentiality agreement that the experts have a legal obligation to process data in conformity with the principles of data protection as provided in Regulation 45/2001.