Print

Opinions Prior Check and Prior Consultations

Some of the procedures that EU institutions put in place pose risks to the data protection rights and freedoms of individuals.

Under the old legal framework (Regulation (EC) 45/2001), EU institutions were obliged to notify us before putting in place risky data processing operations.

In general, our prior checking Opinions were public.

Regulation 2018/1725 builds on the old Regulation and mirrors the General Data Protection Regulation (EU) 2016/679 (GDPR) that applies to most organisations processing personal data in the Member States. Compared to the previous rules, Regulation 2018/1725 aligns documentation obligations more closely to the risks caused by processing personal data. This means for example that the documentation requirements for a EUI’s newsletter subscription will be lower than for a system using ‘intelligent CCTV’ covering publicly accessible space or a database profiling travellers for screening purposes.

Depending on the process at hand, EU institutions processing personal data ('controllers') may not have to go through all the steps below (these steps are described in the Accountability on the ground toolkit): 
• Generate basic documentation (called ‘records’) for all processes; 
• Check if the process is likely to result in high risks to the people whose data are processed and consult the DPO if it appears to do so; 
• If the EU institution needs to do a data protection impact assessment (DPIA), they analyse those risks in more detail and develop specific safeguards/controls to manage them; 
• If the results of the DPIA still indicate high residual data protection risks, the EU institution has to file a prior consultation with the EDPS (see Articles 40 and 90 of Regulation 2018/1725 respectively for administrative and operational personal data).

Article 39 of Regulation 2016/794 on Europol provides for an ad hoc prior consultation mechanism for new type of processing of operational data, namely data processed by Europol to support the Member States in preventing and combating serious crime and terrorism. Similarly, Article 72 of Regulation 2017/1939 on the European Public Prosecutor Office (EPPO) provides a specific prior consultation mechanism for the processing of operational data, namely data processed in the context of criminal investigations and prosecutions undertaken by the EPPO. Regulation 2018/1725, including the standard prior consultation mechanism, applies to Europol's and EPPO's processing of administrative data, which includes data on staff and visitors, for example.

Where an EU institution is unsure whether to notify us a data processing operation for prior consultation, their DPO can consult us for advice to confirm.

As for the old prior checking Opinions, in general the prior consultation Opinions are public, but we may delete sensitive elements where necessary, related to security for example. Some opinions, which are by nature sensitive, in particular in the police and justice area, may not be published. For the sake of transparency, these Opinions are summarised in our Annual Report.

Filters

7
Sep
2007
Opinions Prior Check and Prior Consultations

Security clearance - European Central Bank

Opinion of 7 September 2007 on a notification for prior checking related to the application of the security clearance rules (Case 2007-371)

This prior check concerns the data processing activities which the ECB carries out in the context of running security clearance procedures in order to ascertain whether or not a person is eligible for a security clearance. Towards this end, the ECB collects and further processes the legal/criminal history related to those who are subject to such procedures which include those selected for employment at the ECB, non-staff members and unescorted visitors who have to move within the premises of the ECB. 
 
In his opinion, the EDPS concluded that the ECB has substantially followed all the principles of the Regulation. Nevertheless the EDPS recommended that the ECB:
  • Redefines the nomenclature (mainly with respect to the "certificate of good conduct"), and its definition in order to prevent the collection of information that goes beyond the recollection of criminal convictions.
  • Includes a limit in the first question of the self-declaration form so that individuals are not required to provide information on crimes that would not be included in a criminal record. Also, in this question, delete the reference to imprisonments and consider rephrasing the question as suggested in this Opinion.
  • Amends the self-declaration form so that traffic offences are excluded from the scope of the question (which asks whether there are criminal cases pending against the individualSets up a system to ensure the effective application of the rectification right and data quality and conservation principles as far as the certificates of good conduct are concerned.
  • Amends the privacy statement as recommended in the Opinion.
Available languages: English, French
Topics
Privacy in the EU Institutions
Security & Access to Premises
4
Sep
2007
Opinions Prior Check and Prior Consultations

Assessment of the third language - EPSO

Opinion of 4 September 2007 on the notification for prior checking on the "Assessment of the ability to work in a third language (application of Article 45(2) of the Staff Regulations" (Case 2007-88)

Article 45(2) of the Staff Regulations, which entered into force on 1 May 2004, provided for a process of assessment of staff's ability to work in a third language before the first promotion after recruitment. "Officials shall be required to demonstrate before their first promotion the ability to work in a third language among those referred to in Article 314 of the EC Treaty. The institutions shall adopt common rules by agreement between them for implementing this paragraph (…)."  The common rules laying down the procedure for implementing Article 45(2) of the Staff Regulations were adopted by all institutions at the end of December 2006. The assessment, based on tests or on certificates/diplomas, is carried out by EPSO in conjunction with assessment committees or by processors.

The EDPS made a number of recommendations in his opinion on EPSO's assessment of the ability to work in a third language; these chiefly concern the transfer -of data, the wording of contracts between EPSO and processors, and reviewing automated individual decisions.

Available languages: English, French
Topics
Privacy in the EU Institutions
Staff Evaluation
3
Aug
2007
Opinions Prior Check and Prior Consultations

Staff assessment - Ombudsman

Opinion of 3 August 2007 on the notification for prior checking regarding staff assessment (Case 2007-406)

The appraisal procedure is a processing operation intended to evaluate the ability, efficiency and conduct of the statutory personnel in line with Article 43 of the Staff Regulations and Article 15.2 of the Conditions of employment of other servants of the EC.
 
In his prior checking opinion, the EDPS basically approved the new procedure as foreseen by the European Ombudsman (that shall replace the current procedure dating of 2001). However,  the EDPS made some recommendation, in particular concerning the storage of the appraisal reports in the personal files, as well as the information to be provided to the persons concerned.
Available languages: English, French
Topics
Privacy in the EU Institutions
Staff Evaluation
3
Aug
2007
Opinions Prior Check and Prior Consultations

Medical records and time management - European Investment Bank

Opinion of 3 August 2007 on a notification for prior checking on the modification of the data processing operations concerning "gestion du temps" and "medical records" (Case 2007-373)

In order to monitor staff health and with a focus on early prevention of health risks, it is planned that the physician at the Occupation Health Centre (OHC) of the EIB would have access to all data related to uncertified sick leave kept in the "time management" tool. Leaves without medical certificates can last up to a maximum of three consecutive days, and at present no data relating to them are accessible by the physician.
 

In his opinion, the EDPS expressed that the EIB would be in breach of certain provisions of the Regulation (lawfulness of the processing, data quality principle, processing of special categories of data) unless it ensures that staff members are requested to provide their freely given, unambiguous consent to the OHC physician's access to data regarding their uncertified medical leave. When requesting consent, it must be ensured that the staff member clearly understands that consent can be withheld or subsequently withdrawn at any time, without any justification, and with no adverse consequences. It must also be made clear that providing this information will only serve the purposes of prevention.

Available languages: English, French
Topics
Privacy in the EU Institutions
Health Data in the Workplace