Print

Opinions Prior Check and Prior Consultations

Some of the procedures that EU institutions put in place pose risks to the data protection rights and freedoms of individuals.

Under the old legal framework (Regulation (EC) 45/2001), EU institutions were obliged to notify us before putting in place risky data processing operations.

In general, our prior checking Opinions were public.

Regulation 2018/1725 builds on the old Regulation and mirrors the General Data Protection Regulation (EU) 2016/679 (GDPR) that applies to most organisations processing personal data in the Member States. Compared to the previous rules, Regulation 2018/1725 aligns documentation obligations more closely to the risks caused by processing personal data. This means for example that the documentation requirements for a EUI’s newsletter subscription will be lower than for a system using ‘intelligent CCTV’ covering publicly accessible space or a database profiling travellers for screening purposes.

Depending on the process at hand, EU institutions processing personal data ('controllers') may not have to go through all the steps below (these steps are described in the Accountability on the ground toolkit): 
• Generate basic documentation (called ‘records’) for all processes; 
• Check if the process is likely to result in high risks to the people whose data are processed and consult the DPO if it appears to do so; 
• If the EU institution needs to do a data protection impact assessment (DPIA), they analyse those risks in more detail and develop specific safeguards/controls to manage them; 
• If the results of the DPIA still indicate high residual data protection risks, the EU institution has to file a prior consultation with the EDPS (see Articles 40 and 90 of Regulation 2018/1725 respectively for administrative and operational personal data).

Article 39 of Regulation 2016/794 on Europol provides for an ad hoc prior consultation mechanism for new type of processing of operational data, namely data processed by Europol to support the Member States in preventing and combating serious crime and terrorism. Similarly, Article 72 of Regulation 2017/1939 on the European Public Prosecutor Office (EPPO) provides a specific prior consultation mechanism for the processing of operational data, namely data processed in the context of criminal investigations and prosecutions undertaken by the EPPO. Regulation 2018/1725, including the standard prior consultation mechanism, applies to Europol's and EPPO's processing of administrative data, which includes data on staff and visitors, for example.

Where an EU institution is unsure whether to notify us a data processing operation for prior consultation, their DPO can consult us for advice to confirm.

As for the old prior checking Opinions, in general the prior consultation Opinions are public, but we may delete sensitive elements where necessary, related to security for example. Some opinions, which are by nature sensitive, in particular in the police and justice area, may not be published. For the sake of transparency, these Opinions are summarised in our Annual Report.

Filters

17
Oct
2007

Disciplinary proceedings and administrative investigations - Ombudsman

Opinion of 17 October 2007on the notification for prior checking regarding the "disciplinary proceedings and administrative investigations" dossier (Case 2007-413)

The European Ombudsman has adopted general implementing provisions (GIP) governing disciplinary proceedings and administrative investigations relating to disciplinary proceedings and they became applicable as from 1 May 2004.

The EDPS has examined the personal data processing and has concluded that it does not appear to involve any infringement of the provisions of Regulation (EC) No 45/2001 provided that a number of recommendations are taken into account, specifically that: a general instruction is adopted to ensure that only adequate and necessary data are processed in the course of administrative investigations and disciplinary proceedings; a procedure is clearly established for the conduct of any tapping of electronic communications; anyone receiving and processing data in the context of an administrative investigation or disciplinary proceedings within the European Ombudsman's Office processes them solely within the framework of administrative investigations or disciplinary proceedings; the period of storage of data in the personal file and in the disciplinary file is reviewed in the light of Article 4(1)(e) of the Regulation; right of access and right of rectification are also granted to all persons mentioned in the investigation report or disciplinary file, within the limits of the exemptions set out in Article 20; and provision is made for the supply of general information on the processing of personal data in the context of administrative investigations and disciplinary proceedings and for the supply of specific information on the processing of data in the context of a specific administrative investigation or specific proceedings within the limits of Article 20 of Regulation No 45/2001.

Available languages: English, French
12
Oct
2007

Criminal assistance cases - OLAF

Opinion of 12 October 2007 on a notification for prior checking on criminal assistance cases (Case 2007-203)

The activities of OLAF in criminal assistance cases aim at facilitating and coordinating investigations carried out by the relevant national authorities in order to protect the Community's financial interests. In these cases, the competent authorities of a Member State, candidate country or third country carry out criminal investigations and request OLAF's assistance or OLAF offers its assistance. During these activities OLAF processes personal data of individuals.
 
When OLAF considers whether to open a criminal assistance case or not, it evaluates the initial information received to determine whether it relates to the protection of the EU's financial interest. This evaluation may involve the assessment of individual involvements. Once a criminal assistance case is open, the assistance provided by OLAF includes organising meetings, gathering and forwarding information and facilitating the execution of mutual (administrative and legal) assistance requests. 
 
After scrutinising the data processing activities in the light of the data protection requirements of Regulation 45/2001, the EDPS made a number of recommendations. Those concern, among others, the way to ensure respect for the data quality principle, the requirements for transfer of data, the right of access and rectification of the data subjects and the right to receive appropriate information about the processing operation.
Available languages: English, French
11
Oct
2007

Absences due to illness - Commission

Opinion of 11 October 2007 on the notification for prior checking regarding the "Checks on absences due to illness - Brussels, Luxembourg" case (Case 2004-226)

The purpose of the procedure for checks on absences due to illness by the Brussels and Luxembourg Medical Services is to ensure that an absence due to illness is justified and that its duration is in proportion to the nature of the illness.

The criteria for checks are: absences totalling 20 days or more over a two-month period, in the light of the diagnosis (if recorded in the medical certificate); and the proportionality of the absence to the nature of the illness. These criteria for checks are used to produce SERMED extracts.

The examining doctor examines situations on a case-by-case basis to decide whether a medical examination is warranted. During the medical examination, the examining doctor examines the data subject (where an examination is warranted by the medical condition alleged) and asks him questions. At the end of the examination, a document is signed by the examining doctor and the data subject and sent by secure means to the HRD. If the data subject considers the conclusions of the examining doctor to be unjustified, he may request that the matter be referred to arbitration by an independent doctor.

An Excel table is created and managed by the examining doctor for the medical monitoring on an individual and global basis of the population concerned. The table can be accessed by the medical officer and his secretariat only.

The EDPS has concluded that the processing operation does not appear to involve any infringement of the provisions of Regulation (EC) No 45/2001 provided that certain recommendations are taken into account, in particular:

  • as regards data entered in SERMED and, specifically, the "comments" box, steps should be taken to ensure that no personal notes made by the doctor himself appear in the "comments" box unless such notes are necessary to enable the examining doctor to monitor absences. In this event, only the examining doctor should have access to the box in question.
  • that the Commission give consideration to how long medical examination files for the purposes of checks should be kept in the light of the purposes of the processing operation.
  • that the Commission look into the possibility of giving the data subject access to the Excel file without this entailing access to data relating to other persons or the doctor's personal notes.
Available languages: English, French
9
Oct
2007

Sysper 2 : promotion - Commission

Opinion of 9 October 2007 on the notification for prior checking on "SYSPER 2: promotion" (Case 2007-192)
The Promotion module of SYSPER 2 is the IT tool the Commission uses to manage the annual promotion exercise and implement the provisions of Article 45 of the Staff Regulations of Officials of the European Communities, which provide that the Appointing Authority shall select officials eligible for promotion, after comparative consideration of their merits.
The main recommendations made by the EDPS in his opinion on the promotion procedure managed by the Promotion module of Sysper 2 concern data quality, data retention and information to be given to data subjects.

Available languages: English, French
4
Oct
2007

Special allowances at the JRC - Commission

Opinion of 4 October 2007 on the notification for prior checking regarding the case "Verification of the declarations concerning special allowances at the Joint Research Centre" (Case 2007-328)
Le Centre Commun de Recherche (CCR) utilise le système d'indemnités spéciales prévu par le statut des fonctionnaires des Communautés européennes aux articles 56, 56 bis, 56 ter, 56 quater. Afin de contrôler les attributions de ces indemnités, le CCR a mis en place un système de vérification des déclarations des personnes concernées par les indemnités spéciales. Si le CEPD est globalement satisfait du traitement proposé, il a émis deux recommandations à propos de l'information des personnes concernées. Il a demandé que la finalité concernant la vérification des déclarations des indemnités spéciales et la base juridique du traitement soient clairement indiquées dans la déclaration de confidentialité.

Available languages: English, French