Print

Privacy in the EU Institutions

Regulation (EU) 2018/1725 lays down the data protection obligations for the EU institutions, bodies and agencies when they process personal data and develop new policies. This regulation also defines the obligations of the EDPS, including his role as an independent supervisory authority of EU institutions and bodies when they process personal data, and to advise on policies and legislation which affect privacy and cooperate with similar authorities to ensure consistent data protection.

 

 

 

Filters

13
Sep
2007
Opinions Prior Check and Prior Consultations

Medical check-ups - EMCDDA

Opinion of 13 September 2007 on the notification for prior checking regarding pre-employment and annual medical check-ups (Case 2007-348)
At the EMCDDA, the medical check-ups (pre-employment medical check ups and annual medical check ups) are carried out by a qualified medical doctor, carrying out the medical examination on behalf of the EMCDDA. The results of these medical check ups are communicated by the doctor to the medical officer, member of staff at the EMCDDA. The medical files are kept by the EMCDDA medical officer.

The pre-employment medical check-up is carried out only after the candidate has already received a formal offer of employment. To this effect these candidates receive a standard letter convening them to a pre-employment medical examination with the medical doctor carrying out the examination on behalf of the EMCDDA. A medical questionnaire is attached to this letter, to be completed in part by the candidate and duly signed by him/her. In addition, the medical doctor carrying out the medical examination on behalf of the EMCDDA, performs a direct physical examination and completes the medical overview form. The results of the medical exam are communicated to the person concerned and to the medical officer of the EMCDDA. The HR Management sector only receives a medical certificate stipulating the person's ability or inability or ability with a reserve clause.
 
As in the case of the pre-employment medical check-up, during the annual medical check-up, the medical doctor carries out a direct physical examination. Should a member of the staff decide to have the annual medical check-up performed by a doctor of his choice he will receive the list of exams to be carried out from HR and go for the tests and the visit. The staff member is requested to send a copy of the outcome to the EMCDDA, not the results of the specific tests that remain with him/her. The only information circulated to the financial services is the list of the exams and the relative costs as invoiced for the tests.
 

After examining the case, the EDPS concluded that there is no reason to believe that there is a breach of the provisions of Regulation 45/2001 providing that certain considerations are fully taken into account. Notably certain data in the medical questionnaire must be re-assessed in the light of the principles of adequacy, relevance, and proportionality for purposes of assessment of fitness for service and assistance in determination of limitations with respect to death or invalidity benefits for the first five years of service; the EMCDDA evaluates to what extent and for what purposes the content of a medical file needs to be kept and determines a conservation period concerning data relating to persons who have been submitted to a medical exam, but who then refuse employment; and that the EMCDDA reconsiders the procedure of communication of data relating to the medical exams undertaken with a private doctor to the financial services with the aim of reconciling the data subject's right to privacy and the obligations of the financial services.

Available languages: English, French
Topics
Privacy in the EU Institutions
Health Data in the Workplace
11
Sep
2007
Opinions Prior Check and Prior Consultations

Conflict of interest of special advisers - Commission

Opinion of 11 September 2007 on a notification for prior checking on verification of lack of conflict of interest of special advisers and its publication on Europa website (Case 2007-294)

The European Commission can engage a special adviser who, by reason of his/her special qualifications, assists the Commission either regularly or for a specified period. Before the engagement, the Commission analyses the activities of special advisers in order to avoid conflict of interest with their future activity as special advisers. Then, the special advisers' name, CV, photo, mandate as well as the declaration on honour will be published on the Europa website.
 
The EDPS has issued an opinion on the verification of lack of conflict of interest of special advisers and on publication of their personal data on Europa website. The EDPS concludes that on a general basis the procedure complies with the principles established in the data protection regulation. However the EDPS did make some recommendations mainly as concerns raising awareness regarding the publication of potentially sensible personal data on the Europa website. The EDPS suggested that the publication of the special advisers' photo should be optional and that the Commission staff should verify, before the publication on the Europa website, if the data included by the special adviser in his/her Curriculum Vitae are not irrelevant or excessive in relation to the purpose of the processing.
Available languages: English, French
Topics
Privacy in the EU Institutions
Procurements, Grants, Experts
Conflicts of Interest
10
Sep
2007
Opinions Prior Check and Prior Consultations

Medical service - Commission

Opinion of 10 September 2007 on the notification for prior checking on the "Management of the activities of the Medical Service in Brussels and Luxembourg, in particular via the SERMED computer application" (Case 2004-232)

The Medical Services in Brussels and Luxembourg use the SERMED database for the day-to-day management of their activities. This database supports the management of medical activities in the fields of preventive and occupational medicine as well as medical check-ups. SERMED can be used to record certain information necessary for the procedures which the Medical Service must carry out: medical examinations, the management of medical absences and check-ups, invalidity procedures and occupational accidents. This information is sorted into lists over a certain period of time (the "reporting" module). As well as SERMED, the Medical Service in Brussels uses another application (DREC) to follow up requests for the reimbursement of additional tests and other medical expenses.

The EDPS concluded in his prior checking that the proposed processing operation does not appear to involve any infringement of the provisions of Regulation (EC) No 45/2001 provided account is taken of the comments made below. In particular, this implies that the Commission:

  • having regard to the particularly sensitive nature of the information included in SERMED, should remind persons having access to SERMED of the confidentiality requirement;
  • should point out to SERMED users that the field "comment" must contain only administrative data;
  • should remove the reference to the doctor's specialisation as indicated on the medical certificate in SERMED;
  • should keep the EDPS informed of the introduction of the module facilitating access to information relating to the person concerned.
Available languages: English, French
Topics
Privacy in the EU Institutions
Health Data in the Workplace
7
Sep
2007
Opinions Prior Check and Prior Consultations

Security clearance - European Central Bank

Opinion of 7 September 2007 on a notification for prior checking related to the application of the security clearance rules (Case 2007-371)

This prior check concerns the data processing activities which the ECB carries out in the context of running security clearance procedures in order to ascertain whether or not a person is eligible for a security clearance. Towards this end, the ECB collects and further processes the legal/criminal history related to those who are subject to such procedures which include those selected for employment at the ECB, non-staff members and unescorted visitors who have to move within the premises of the ECB. 
 
In his opinion, the EDPS concluded that the ECB has substantially followed all the principles of the Regulation. Nevertheless the EDPS recommended that the ECB:
  • Redefines the nomenclature (mainly with respect to the "certificate of good conduct"), and its definition in order to prevent the collection of information that goes beyond the recollection of criminal convictions.
  • Includes a limit in the first question of the self-declaration form so that individuals are not required to provide information on crimes that would not be included in a criminal record. Also, in this question, delete the reference to imprisonments and consider rephrasing the question as suggested in this Opinion.
  • Amends the self-declaration form so that traffic offences are excluded from the scope of the question (which asks whether there are criminal cases pending against the individualSets up a system to ensure the effective application of the rectification right and data quality and conservation principles as far as the certificates of good conduct are concerned.
  • Amends the privacy statement as recommended in the Opinion.
Available languages: English, French
Topics
Privacy in the EU Institutions
Security & Access to Premises