Investigations

Opinion of 4 October 2007 on five notifications for prior checking on external investigations (Cases 2007-47, 2007-48, 2007-49, 2007-50, 2007-72)

The European Anti-Fraud Office (OLAF) conducts external investigations outside the Community organs. Those investigations are performed for the purpose of detecting fraud or other irregular conduct of legal and natural persons affecting the financial interests of the European Communities. OLAF carries out on-the-spot inspections and checks on economic operators in the Member States and in third countries, and is empowered to request oral information, to ask any person for information and to make written requests for information. OLAF collects personal data of individuals during external investigations, uses those data for the assessment of the behaviour of the individual(s) concerned and further transfers or stores those data.

After analysing the data processing activities, the EDPS made a number of recommendations to OLAF.  These concern for example: ensuring the right of access and rectification as a main rule to data subjects, and that any restriction on those rights should meet a necessity test and be applied only on a case-by-case basis; respecting the confidentiality of whistleblowers and informants; drafting of standard letters/clauses with including the appropriate information to the data subjects.

Opinion of 3 October 2007 on a notification for prior checking on non-cases and prima facie non-cases (Case 2007-205)

Opinion of 24 July 2007 on a notification for prior checking on the Custom Information System (Case 2007-177)

Opinion of 19 July 2007 on a notification for prior checking on regular monitoring of the implementation of the investigative function (Case 2007-73)

Opinion of 11 July 2007 on a notification for prior checking on monitoring cases (Case 2006-548)

The EDPS has issued an opinion on the processing of personal data in the context of OLAF's Monitoring cases. The Opinion concludes that on a general basis the data processing complies with the principles established in the data protection Regulation. However the EDPS did make some recommendations. Among others, the EDPS asked OLAF to ensure that individuals whose data are processed by OLAF are informed of the data processing that takes place in the context of Monitoring cases. It also suggested some amendments to the privacy statement and asked OLAF to conduct a preliminary evaluation of the necessity of the 20 years conservation period vis-à-vis the purpose of such conservation.