Commission Physical Access Control System (PACS)

Opinion of 8 September 2011 on the "Commission Physical Access Control System (PACS): PSG Projet de Sécurisation Globale" (Case 2010-0427)

The system under analysis aims at the implementation of a unique and coherent physical access control system (PACS) for the whole Commission, by performing all the required physical security functions. The system is based on the use of biometric data, which present specific risks to the rights and freedoms of data subjects, due to some inherent characteristics of this type of data.

The EDPS notes that the European Commission has developed a privacy friendly approach to the implementation of the processing operations at stake by involving the EDPS at a very early stage of the notification procedure, by developing a pilot project phase and by considering all relevant data protection aspects at an early stage of its work.

Through this collaboration between the two institutions, the implementation of data protection requirements was facilitated.  Among others aspects of the PACS, the EDPS focused his analysis on the biometric enrolment, the categories of data subjects concerned, the existence of fallback procedures and the security measures established.