Opinion of 12 December 2008 on a notification for prior checking on the conduct of investigations by the Security Office (Case 2008-0410)
Opinion of 3 November 2008 on the notification for prior checking on "Traffic violations with official vehicles of the Commission managed by the Infrastructure and Logistics Office - Brussels (OIB)" (Case 2008-395)
Within the European Commission, the Mobility and Supplies Unit, which is responsible for managing the car pool, deals with offences against the highway code committed by the drivers of official Commission vehicles managed by the OIB. The purposes of the processing operation are to examine whether, when traffic violations are committed by the drivers of official Commission vehicles, the immunity granted by the Protocol on Privileges and Immunities can be invoked, and to provide administration and follow-up.
The proposed data processing operation complies with Regulation (CE) No 45/2001, if the Commission:
Opinion of 2 October 2008 on a notification for prior checking on security investigations (Case 2007-736)
The ADMIN/DS/RA section of the Commission is empowered to take measures in response to criminal acts concerning the buildings occupied by the Commission, the people who work in or for various reasons have access to those buildings, and any other acts which may be harmful to the institution. This includes collecting and keeping evidence and taking various investigative steps to gather such evidence, technical reporting, and collecting statements from victims, complainants, witnesses and where appropriate the perpetrators of acts.
The EDPS has examined the processing of personal data in the procedure for security investigations, and has concluded that it does not appear to breach the provisions of Regulation (EC) No 45/2001 so long as certain recommendations are followed, in particular that the department responsible should assess the proportionality of its processing activities on a case‑by‑case basis; that it should provide adequate safeguards during its activities; that it should ensure that transfers of data are legal and necessary; that it should improve the procedures relating to the rights of access to and rectification of data, and should provide the requisite information to the data subjects concerned by the investigations.
Opinion of 31 July 2008 on a notification for prior checking on the Security investigations at Joint Research Centre ISPRA (Case 2007-507)
The Security Service of JRC Ispra C7 performs investigations related to security related incidents such as traffic accidents, vandalism theft, unauthorised access, etc. in the context of which personal data are processed. The outcome of the investigation is reflected in a report describing the occurrence. This prior check analyses whether this data processing is in line with Regulation (EC) No 45/2001. The Opinion concludes by giving some recommendations to data controller towards ensuring full compliance with Regulation (EC) No 45/2001. Among others, the EDPS suggests amending the privacy statement and setting up a procedure to give the privacy statement directly to individuals, confirming the competences of the Security Service of JRC to perform investigations, etc.
Opinion of 7 April 2008 on a notification for prior checking on coordination cases (Case 2007-699)
OLAF engages in processing of personal data when it opens a Coordination case. These are cases that could be the subject of OLAF external investigations, but where OLAF’s role is to contribute to investigations being carried out by other national or Community services by, among other things, facilitating the gathering and exchange of information and ensuring operational synergy among the relevant national and Community services. The main investigative input is provided by other authorities. OLAF's role includes facilitating contacts and encouraging the responsible authorities to work together. The type of personal information processed by OLAF in these cases includes identification, professional data and information concerning activities related to matters which are the subject of coordination.
The EDPS has issued an opinion on the processing of personal data in the context of OLAF's Coordination cases. The Opinion concludes that on a general basis the data processing complies with the principles established in the data protection Regulation. However the EDPS did make some recommendations. Among others, the EDPS asked OLAF to ensure that individuals whose data are processed by OLAF are informed of the data processing that takes place in the context of Coordination cases. It also suggested some amendments to the privacy statement and asked OLAF to conduct a preliminary evaluation of the necessity of the 20 years conservation period vis-à-vis the purpose of such conservation.