Print

Opinions Prior Check and Prior Consultations

Some of the procedures that EU institutions put in place pose risks to the data protection rights and freedoms of individuals.

Under the old legal framework (Regulation (EC) 45/2001), EU institutions were obliged to notify us before putting in place risky data processing operations.

In general, our prior checking Opinions were public.

Regulation 2018/1725 builds on the old Regulation and mirrors the General Data Protection Regulation (EU) 2016/679 (GDPR) that applies to most organisations processing personal data in the Member States. Compared to the previous rules, Regulation 2018/1725 aligns documentation obligations more closely to the risks caused by processing personal data. This means for example that the documentation requirements for a EUI’s newsletter subscription will be lower than for a system using ‘intelligent CCTV’ covering publicly accessible space or a database profiling travellers for screening purposes.

Depending on the process at hand, EU institutions processing personal data ('controllers') may not have to go through all the steps below (these steps are described in the Accountability on the ground toolkit): 
• Generate basic documentation (called ‘records’) for all processes; 
• Check if the process is likely to result in high risks to the people whose data are processed and consult the DPO if it appears to do so; 
• If the EU institution needs to do a data protection impact assessment (DPIA), they analyse those risks in more detail and develop specific safeguards/controls to manage them; 
• If the results of the DPIA still indicate high residual data protection risks, the EU institution has to file a prior consultation with the EDPS (see Articles 40 and 90 of Regulation 2018/1725 respectively for administrative and operational personal data).

Article 39 of Regulation 2016/794 on Europol provides for an ad hoc prior consultation mechanism for new type of processing of operational data, namely data processed by Europol to support the Member States in preventing and combating serious crime and terrorism. Similarly, Article 72 of Regulation 2017/1939 on the European Public Prosecutor Office (EPPO) provides a specific prior consultation mechanism for the processing of operational data, namely data processed in the context of criminal investigations and prosecutions undertaken by the EPPO. Regulation 2018/1725, including the standard prior consultation mechanism, applies to Europol's and EPPO's processing of administrative data, which includes data on staff and visitors, for example.

Where an EU institution is unsure whether to notify us a data processing operation for prior consultation, their DPO can consult us for advice to confirm.

As for the old prior checking Opinions, in general the prior consultation Opinions are public, but we may delete sensitive elements where necessary, related to security for example. Some opinions, which are by nature sensitive, in particular in the police and justice area, may not be published. For the sake of transparency, these Opinions are summarised in our Annual Report.

Filters

2
May
2007
Opinions Prior Check and Prior Consultations

Stress at work - OHIM

Opinion of 2 May 2007 on a study on stress at work (Case 2006-520)

In order to comply with Spanish Law OHIM is launching a study designed at assessing stress at work. One phase of this study consists in the design and launching of a survey on stress at work, on a voluntary and anonymous basis, in the form of a questionnaire and interviews with staff members. This questionnaire is designed by an external consulting company (MAPFRE).
The results of the questionnaires and interviews will be analysed per post and task and will lead to the drawing up of graphs and comparative tables per department and at a global level made available to the Occupational Risk Prevention Sector, the Staff Committee and the Management Committee of the OHIM.
 
In his opinion, the EDPS has held that although designed to process data on an anonymous basis, the processing operation could involve the processing of personal data in the terms of Regulation 45/2001. Some of the data requested in the questionnaire, notably the age of the person, the sex, the number of years spent at the OHIM and the department to which the person belongs, together with additional information on a person's social and family life, health, working and employment conditions, and taking into account the size of the agency and of some of the departments under analysis, imply that quite a few respondents must be considered as reasonably identifiable, in any case for those involved in the OHIM. In this respect therefore, the EDPS considers that the principles and obligations provided for in Regulation 45/2001 should apply.
 
The EDPS has recommended that the controller make use of Article 20 §2 to limit the rights laid down in Articles 13 to 16 of the Regulation as regards the questionnaire to be filled in on the Websurveyor as the data are "kept in personal form for a period which does not exceed the period necessary for the sole purpose of compiling statistics". Providing the data subjects with a right of access to the data notably implies that the controller should be able to trace the questionnaire according to the identity of the person and this is something the EDPS would like to avoid so as to ensure the anonymity of the persons concerned.
 

To avoid identification of staff filling in the questionnaire, the EDPS further recommends that the box for free text is removed so as to avoid that staff members introduce data leading to their identification.

Available languages: English, French
Topics
Privacy in the EU Institutions
Working Conditions
30
Apr
2007
Opinions Prior Check and Prior Consultations

Welfare assistance - Parliament

Opinion of 30 April 2007 on a notification for prior checking regarding "Welfare assistance and guidance in the event of dependance" (Case 2006-269)

The European Parliament assists its staff and their families with personal and family problems, problems of dependence, and difficulties of any other type. Assistance takes the form of economic aid (aid for disabled persons, home help, loans and gifts). The institution's social services also provide individuals and families with information, advice and guidance to help them adjust better and to respond to their economic, social and cultural needs.
 

In order to comply with Regulation (EC) No 45/2001, the Parliament must implement the recommendations of the EDPS regarding the information to be given to data subjects, data storage, the rights of access and rectification accorded to data subjects, data quality (data must be adequate, relevant and not excessive), and the transfer of data between the institution's social services and external agencies.

Available languages: English, French
Topics
Privacy in the EU Institutions
Working Conditions
26
Apr
2007
Opinions Prior Check and Prior Consultations

Attestation procedure - Parliament

Opinion of 26 April 2007 on a notification for prior checking on the attestation procedure (Case 2007-110)

The EDPS prior checked the attestation procedure of the European Parliament. Officials in service before 1 May 2004 in categories C and D are in a career stream allowing promotion only up to grade AST 7 and 5, respectively. Once they are 'attested', they can be promoted without any restriction up to grade AST 11. The attestation procedure involves analysis of formal criteria (e.g. seniority) but also evaluation of the officials' conduct and their professional experience, along with personal aspects of the official. The procedure has to be prior checked by the EDPS on this ground.
 

In his prior checking opinion the EDPS found that the procedure as implemented by the European Parliament is in general in compliance with the provision of the Regulation EC No 45/2001. The EDPS nevertheless made some recommendations, especially on the retention period of data and on the right of access to documents processed in the framework of the attestation procedure.

Available languages: English, French
Topics
Privacy in the EU Institutions
Working Conditions