Regulation (EU) 2018/1725 lays down the data protection obligations for the EU institutions, bodies and agencies when they process personal data and develop new policies. This regulation also defines the obligations of the EDPS, including his role as an independent supervisory authority of EU institutions and bodies when they process personal data, and to advise on policies and legislation which affect privacy and cooperate with similar authorities to ensure consistent data protection.
Letter of 13 October 2008 in reply to a notification for prior checking concerning the "Recording of emergency calls at the JRC ISPRA site" (Case 2008-492)
Guidelines concerning the processing operations in the field of staff recruitment
Opinion of 9 October 2008 on a notification for prior checking on the Trainee selection procedure and management of trainees at the Joint Research Centre (JRC) (Case 2008-136)
The purpose of the processing is the recruitment of trainees at the JRC by the Human resources Unit (HR) Ispra or the Institute Management Support Unit (MSU) for other JRC sites, namely Petten, Karlsruhe, Sevilla, Geel. During the selection phase, candidates make a request for a traineeship by filling in an application form for a training period at the JRC.
The Institute concerned will rank the applicants according to the needs of the Institute/Directorate. Trainees are chosen by a selection committee. Selected candidates must also provide results of medical tests. For all trainees the site Security Service needs to ascertain the good conduct of the person in question. The Security Service asks for a recent 'Police Record' from the country of usual residence. Requests for security clearance ("Zuverlässigkeitsüberprüfung") are also required for all persons executing job related tasks at the Karlsruhe site.
The EDPS makes several recommendations, in particular regarding the quality of collected data, data retention, medical data, access to files. The EDPS is also requesting detailed information on security measures adopted.
Opinion of 9 October 2008 on a notification for prior checking regarding the recruitment procedure for contract agents at the Joint Research Centre (Case 2008-142)
This prior-check is part of several opinions adopted by the CEPD this day in the field of recruitment at JRC.
The processing concerns the selection and recruitment of JRC's contractual staff referred to in Title IV of the Conditions of Employment of other servants of the European Communities. The main purpose of the processing is the constitution and management of Contract Agent recruitment files. The recruitment files collect all the information needed in order to start, process and finalize the recruitment procedure, which, at different stages, involves DG JRC Institutes/Directorates (Management Support Units –"MSUs"- and scientific staff), the Human Resources Unit of the Resource Management and the candidates concerned.
The EDPS concludes that on a general basis the procedure complies with the principles established in the data protection regulation. However the EDPS did make number of recommendations mainly as concerns data quality, transfer of data, rights of access and rectification, information of the data subject. The EDPS is also requesting detailed information on security measures adopted.
Opinion of 9 October 2008 on the notification for prior checking regarding the "Management of recruitment files for officials at the JRC (transfers and laureates of open competitions)" (Case 2008-140)
The processing concerns the constitution and management of recruitment files for officials (transfers and laureates of open competitions). The recruitment files collect all the information needed in order to start, process and finalize the recruitment procedure, which, at different stages, involve DG JRC Institutes/Directorates (Management Support Units (MSUs) and scientific staff), the other DGs of the Commission in case of transfers, the Human Resources Unit of the Resource Management Directorate and the candidates concerned.
The EDPS made recommendations in particular relating to data quality (in particular replace the collection of certificates of good conduct by other tools that only demonstrate the prior criminal behaviour by carrying out a case by case analysis of the content of the national extracts of the police register, so as to collect only relevant data in the light of the Staff Regulation requirements), data retention period, data transfer, rights of access and rectification (have access to their file, including the assessment notes concerning them drafted by the panel members) and information to data subjects (in particular mention of medical services and security services as recipients).