Print

Opinions Prior Check and Prior Consultations

Some of the procedures that EU institutions put in place pose risks to the data protection rights and freedoms of individuals.

Under the old legal framework (Regulation (EC) 45/2001), EU institutions were obliged to notify us before putting in place risky data processing operations.

In general, our prior checking Opinions were public.

Regulation 2018/1725 builds on the old Regulation and mirrors the General Data Protection Regulation (EU) 2016/679 (GDPR) that applies to most organisations processing personal data in the Member States. Compared to the previous rules, Regulation 2018/1725 aligns documentation obligations more closely to the risks caused by processing personal data. This means for example that the documentation requirements for a EUI’s newsletter subscription will be lower than for a system using ‘intelligent CCTV’ covering publicly accessible space or a database profiling travellers for screening purposes.

Depending on the process at hand, EU institutions processing personal data ('controllers') may not have to go through all the steps below (these steps are described in the Accountability on the ground toolkit): 
• Generate basic documentation (called ‘records’) for all processes; 
• Check if the process is likely to result in high risks to the people whose data are processed and consult the DPO if it appears to do so; 
• If the EU institution needs to do a data protection impact assessment (DPIA), they analyse those risks in more detail and develop specific safeguards/controls to manage them; 
• If the results of the DPIA still indicate high residual data protection risks, the EU institution has to file a prior consultation with the EDPS (see Articles 40 and 90 of Regulation 2018/1725 respectively for administrative and operational personal data).

Article 39 of Regulation 2016/794 on Europol provides for an ad hoc prior consultation mechanism for new type of processing of operational data, namely data processed by Europol to support the Member States in preventing and combating serious crime and terrorism. Similarly, Article 72 of Regulation 2017/1939 on the European Public Prosecutor Office (EPPO) provides a specific prior consultation mechanism for the processing of operational data, namely data processed in the context of criminal investigations and prosecutions undertaken by the EPPO. Regulation 2018/1725, including the standard prior consultation mechanism, applies to Europol's and EPPO's processing of administrative data, which includes data on staff and visitors, for example.

Where an EU institution is unsure whether to notify us a data processing operation for prior consultation, their DPO can consult us for advice to confirm.

As for the old prior checking Opinions, in general the prior consultation Opinions are public, but we may delete sensitive elements where necessary, related to security for example. Some opinions, which are by nature sensitive, in particular in the police and justice area, may not be published. For the sake of transparency, these Opinions are summarised in our Annual Report.

Filters

31
Jul
2007
Opinions Prior Check and Prior Consultations

Trainee recruitment - Parliament

Opinion of 31 July 2007 on a notification for prior checking on Trainee Recruitment (Case 2007-208)

The purpose of the processing is to recruit trainees to contribute to the European education and vocational training of citizens and give them an insight into the way the Institution functions.  Parliament offers several options for traineeships within its Secretariat, to provide opportunities for vocational training and for learning more about what the European Parliament is and does. The traineeships may be paid or unpaid and include a general option and a journalism option. 
 

In his Opinion the EDPS has recommended various actions in order to ensure that the data processing fully complies with Regulation (EC) No 45/2001.  In particular, among others, the EDPS has recommended certain periods for retaining different types of data about the trainee that the data controller must adopt and that the trainee is kept informed of these periods.  He has also recommended that it would be good practice to ensure that recipients are reminded when they receive the personal data of candidates that they should not use the data for any further purposes beyond that of trainee recruitment.

Available languages: English, French
Topics
Privacy in the EU Institutions
Recruitment
31
Jul
2007
Opinions Prior Check and Prior Consultations

Recruitment of translation trainees - Parliament

Opinion of 31 July 2007 on a notification for prior checking on the recruitment of translation trainees (Case 2007-324)

The purpose of the processing is to recruit translation trainees to contribute to the European education and vocational training of citizens and give them an insight into the way the Institution functions.  Parliament offers several options for translation traineeships within its Secretariat, to provide opportunities for vocational training and for learning more about what the European Parliament is and does.
 

In his Opinion the EDPS has recommended various actions in order to ensure that the data processing fully complies with Regulation (EC) No 45/2001.  In particular, among others, the EDPS has recommended certain periods for retaining different types of data about the trainee that the data controller must adopt and that the trainee is kept informed of these periods.  He has also recommended that it would be good practice to ensure that recipients are reminded when they receive the personal data of candidates that they should not use the data for any further purposes beyond that of recruitment of translation trainees.

Available languages: English, French
Topics
Privacy in the EU Institutions
Recruitment
27
Jul
2007
Opinions Prior Check and Prior Consultations

Crèches and childcare facilities - Commission

Opinion of 27 July 2007 on a notification for prior checking on the "Management of crèches and childcare facilities" (Case 2007-148)

This dossier deals with the management of "crèches and after-school childcare services in Brussels", undertaken by the Commission's Crèche and Childcare Service. The persons concerned are the children of the staff of the European institutions, those children's parents and persons authorised to collect and drop off children.

Processing is the subject of a prior check since, as part of assessing and selecting children to be admitted to crèches and childcare services based on the criteria set out in internal regulations, the collection of health and administrative data constitutes information on the state of health of the person concerned and their personality.

One recommendation by the EDPS is that if, in future, a waiting list is drawn up for the childcare services, the Commission should guarantee that the medical record is collected only after the child has been admitted to the outdoor or after-school childcare facilities. A further recommendation is that, instead of inquiring about civil status, the Commission should ask whether the family is a one or two-parent family (one or both parents has/have responsibility for the child) or should, at least, inform the parents that data collection on their marital status is not relevant/necessary for the purpose of data processing. It was stressed that the Commission should guarantee protection of the rights of the persons concerned in this kind of processing by means of a clause to be added to the service contract concluded with the company which runs the two private crèches. The EDPS has also recommended that the contract concluded with the childcare company explicitly include provisions on the roles of the controller and the sub-contractor respectively and include provisions on the requirements governing the confidentiality and security of the processing.

Available languages: English, French
Topics
Privacy in the EU Institutions
Health Data in the Workplace
27
Jul
2007
Opinions Prior Check and Prior Consultations

Accidents and occupational disease insurance - Commission

Opinion of 27 July 2007 on a notification for prior checking related to Administration of the Accidents and Occupational Disease Insurance (Case 2007-157)

PMO.3 is responsible, among others, for the management of the Accidents and Occupational Disease Insurance Scheme for officials, temporary and contractual agents of EU institutions ("EU staff members"). This Scheme was established pursuant to Article 73 of the Staff Regulations. In the context of the management of the scheme, PMO 3 must process personal data of EU staff members, including information related to the insured parties' health (reports on accidents and occupational diseases).
 

The EDPS has issued an opinion on the management of the scheme which concludes that on a general basis the scheme complies with the principles established in the data protection regulation.  However the EDPS did make some recommendations mainly as concerns raising awareness among non-medical PMO.3 staff regarding medical secrecy, the need to make more visible the privacy statement in the appropriate web site so that EU staff members are properly informed of the processing of their personal data. The EDPS also suggested that the web site for the scheme should ask EU staff members to send medical reports in sealed envelopes marked with the terms 'confidential' and/or 'to be opened by addressee only' and that guidelines should be issued by PMO 3 in order to ensure that inadequate, irrelevant and non excessive information is not provided in medical reports.

Available languages: English, French
Topics
Privacy in the EU Institutions
Health Data in the Workplace
27
Jul
2007
Opinions Prior Check and Prior Consultations

'Asbestos' database - Commission

Opinion of 27 July 2007 on a notification for prior checking regarding the dossier "Asbestosis: screening and follow-up - 'Asbestos' database (Medical service and psychological/social measures BXL)" (Case 2004-227)

Le traitement des données médicales effectué dans le dossier "Dépistage et suivi des cas d'asbestose - Base des données 'Amiante' (Service Médical et interventions psychosociales BXL)" permet de fixer et de sauvegarder les intérêts personnels du personnel (identification potentielle d'une maladie professionnelle) ayant travaillé dans les bâtiments "Berlaymont" et "Guimard" avant l'évacuation de ces bâtiments (en raison de la présence d'amiante dans leur construction).
 
Le CEPD a émis certaines recommandations, notamment que la Commission :
  • spécifie que les personnes en charge du traitement ne puissent pas utiliser ces données à d'autres fins. Le même principe est applicable aux autres éventuels destinataires mentionnés. En plus, le CEPD recommande que dans le cadre de transferts à d'autres institutions, seules les personnes habilitées à connaître des données relatives à la santé, soumises au secret professionnel, soient destinataires des dossiers médicaux.
  • ne permette pas un refus général d'accès aux notes personnelles des médecins figurant dans le dossier médical.
  • autorise la personne concernée à demander que son dossier médical figurant dans la base de données "Asbestos" soit complet, en ce sens qu'elle puisse demander que soient ajoutées à son dossier des informations telles que l'avis contradictoire d'un autre médecin ou une décision de la Commission sur un élément du dossier médical, pour garantir la présence d'informations mises à jour. Par conséquent, le CEPD considère que la réponse à la question 5 de la "Déclaration de confidentialité" devrait ajouter cette possibilité.
Available languages: English, French
Topics
Privacy in the EU Institutions
Health Data in the Workplace