Procurements, Grants, Experts

The Notification concerns EFSA’s Expert Database. This database contains professional data of external scientific experts who may be called upon to carry out advisory work for EFSA (and for national authorities in Member States with a similar mandate to EFSA). The Notification also covers EFSA's procedure to select external scientific experts from the database for its specific scientific projects. 

The EDPS, in general, was satisfied with the data protection safeguards provided by EFSA. To further improve EFSA's data protection compliance, he recommended that the end-users' attention should be specifically called to the limited nature of the validity check that EFSA carries out, suggesting that they use the database as a pool of applications, rather than as a pool of experts whose skills and reliability have already been carefully checked by EFSA in each case.

To ensure the accuracy and up-to-datedness of the profiles kept in the database, he further recommended that automatic reminders should be sent to experts who failed to update their profiles (or confirm their old profiles) with a warning that failure to respond (after a number of reminders) would entail the automatic deletion of their profiles. EFSA was also requested to provide for an appropriate conservation period for processing data during the selection procedure for specific assignments.

With respect to rights of access, the EDPS recommended that EFSA should provide procedural safeguards to ensure that access rights are granted in a timely manner and without undue constraints (including access to certain internal documents). These may include a time-limit established for response to the request by EFSA, and the obligation for the controller to request the advice of the DPO in case of doubt whether a request can be granted. Finally, as regards information to data subjects, the EDPS noted that certain additional information needed to be provided.

This prior checking notification followed upon staff complaints and was only submitted to the EPPS upon his specific request. It concerns a system of internal quality checks during which (i) the work products of OHIM's trademark examiners are reviewed and (ii) the results are reported in a database created for this purpose. The primary purpose of these systematic checks is to improve the overall quality of OHIM's work products. However, the results of the quality checks (i) are also used to evaluate the quality of work of each examiner and (ii) inform management decisions regarding measures that may individually affect the examiners, such as performance appraisals, promotion, contract renewals, disciplinary measures, or training.

The EDPS recommended the adoption of a clear and formal internal decision to strengthen the legal basis of the operation and provide much needed clarity and certainty to staff members. This decision should clearly describe the system of the ex-ante quality checks, including their intended purpose, and provide for appropriate data protection safeguards, as recommended in the Opinion. Instead of fragmental email-communications, the EDPS also urged OHIM to adopt a formal data protection notice and make it available permanently on OHIM's intranet site. In addition, the EDPS emphasised that all possible efforts should be made to improve the level of accuracy, reliability, and consistency of the data. In any event, data included in the database should only be used as one of several factors to be considered in the decision-making process. Whenever data stored in the database are used for purposes which may individually affect staff members, they must also be heard and be given the opportunity to put forward their positions.