Some of the procedures that EU institutions put in place pose risks to the data protection rights and freedoms of individuals.
Under the old legal framework (Regulation (EC) 45/2001), EU institutions were obliged to notify us before putting in place risky data processing operations.
In general, our prior checking Opinions were public.
Regulation 2018/1725 builds on the old Regulation and mirrors the General Data Protection Regulation (EU) 2016/679 (GDPR) that applies to most organisations processing personal data in the Member States. Compared to the previous rules, Regulation 2018/1725 aligns documentation obligations more closely to the risks caused by processing personal data. This means for example that the documentation requirements for a EUI’s newsletter subscription will be lower than for a system using ‘intelligent CCTV’ covering publicly accessible space or a database profiling travellers for screening purposes.
Depending on the process at hand, EU institutions processing personal data ('controllers') may not have to go through all the steps below (these steps are described in the Accountability on the ground toolkit):
• Generate basic documentation (called ‘records’) for all processes;
• Check if the process is likely to result in high risks to the people whose data are processed and consult the DPO if it appears to do so;
• If the EU institution needs to do a data protection impact assessment (DPIA), they analyse those risks in more detail and develop specific safeguards/controls to manage them;
• If the results of the DPIA still indicate high residual data protection risks, the EU institution has to file a prior consultation with the EDPS (see Articles 40 and 90 of Regulation 2018/1725 respectively for administrative and operational personal data).
Article 39 of Regulation 2016/794 on Europol provides for an ad hoc prior consultation mechanism for new type of processing of operational data, namely data processed by Europol to support the Member States in preventing and combating serious crime and terrorism. Similarly, Article 72 of Regulation 2017/1939 on the European Public Prosecutor Office (EPPO) provides a specific prior consultation mechanism for the processing of operational data, namely data processed in the context of criminal investigations and prosecutions undertaken by the EPPO. Regulation 2018/1725, including the standard prior consultation mechanism, applies to Europol's and EPPO's processing of administrative data, which includes data on staff and visitors, for example.
Where an EU institution is unsure whether to notify us a data processing operation for prior consultation, their DPO can consult us for advice to confirm.
As for the old prior checking Opinions, in general the prior consultation Opinions are public, but we may delete sensitive elements where necessary, related to security for example. Some opinions, which are by nature sensitive, in particular in the police and justice area, may not be published. For the sake of transparency, these Opinions are summarised in our Annual Report.
Opinion of 20 November 2007 on a notification for prior checking regarding the recruitment procedure of Seconded national experts (Case 2007-567)
Opinion of 29 November 2007 on the notification for prior checking regarding the "Invalidity procedure - Medical service in Brussels and Luxembourg" case (Case 2007-125)
On the basis of Article 59(4) of the Staff Regulations of Officials of the European Communities, the European Commission has established a procedure to obtain a decision from the Invalidity Committee as to whether a member of staff should be granted invalidity or should resume professional activities. The procedure not only concerns officials, but also temporary and contract staff on all the European Commission's sites (including offices), as well as European agencies via a Service Level Agreement type of arrangement.
Under this procedure, an application to launch an invalidity procedure may be made at the request of the person concerned or of the department in which the person is working, or by the Medical Service. This procedure involves referral to an Invalidity Committee which has a threefold task, namely to establish fitness or unfitness to work, to determine the reason for unfitness to work, and to decide whether follow-up examinations are required and if so, how frequently they should be carried out.
The EDPS' conclusion is that there is no infringement of Regulation (EC) No 45/2001, if account is taken of the various recommendations he has made on matters including the long-term storage of sensitive data; compliance with the rules on the transfer of data to a country not covered by Directive (EC) No 95/46; and the inclusion in the privacy statement of the rules for providing information to data subjects and of a reference to the destruction of medical files after the 30-year storage period.
Avis du 29 novembre 2007 sur la notification d'un contrôle préalable à propos du dossier "Examen ophtalmologique de suivi des personnes travaillant sur écran" (Dossier 2007-303)
Opinion of 29 November 2007 on a notification for prior checking on "Dosimetry data at JRC-IRMM in Geel" (Case 2007-325)
Opinion of 20 November 2007 on a notification for prior checking on "Council Regulation (EC) 1469/95" (Case 2007-215)