Personalbeurteilung

Opinion of 21 January 2009 on a notification for prior checking on the assessment of staff's capacity to work in a third language before first promotion (Case 2008-690)

The European Parliament has implemented a data processing to evaluate the capacity of officials and contractual agents in function group IV to work in a third language. Officials must demonstrate the capacity to work in a third language to be eligible for a first promotion, and contractual agents must prove their ability to work in a third language before the renewal of their contract for an indefinite period.

The EDPS recommends that appropriate data retention periods are defined for the conservation of these assessments, that a procedure is implemented ensuring the exercise by individuals of their right to access and rectify their assessment (in particular access and rectification to the tests organized by EPSO), that specific information concerning the processing of individuals' data for the purpose of the assessment of the capacity to work in a third language is provided to the persons concerned. The EDPS also outlines that the staff processing personal data should be reminded of their duty of confidentiality towards such data.

Opinion of 16 January 2009 on a notification for prior checking on the management of Central and Local Training SYSLOG Formation (Case 2008-481)

SYSLOG is the administrative management tool for training at the European Commission in three fields: informatics, language and general. It is managed by DG ADMIN. However, some data processing also takes place within each Directorate-General by its training manager (COFO) and informatics training manager (REFOI).

The EDPD considers that the data processing is in line with Regulation 45/2001 but advises DG ADMIN among others to: (1) Set up reasonable time limits for dealing with requests from data subjects exercising their right of access and, (2) Set up procedures to provide the privacy policy to staff members working for agencies/bodies with no access to SYSLOG.

Opinion of 9 January 2009 on the notification for prior checking on the "Annual exercise for early retirement without reduction of pension rights" (Case 2008-552)

The purpose of the processing is the implementation of the annual exercises for early retirement without reduction of acquired pension rights, in accordance with Article 9 of Annex VIII to the Staff Regulations and the second and third subparagraphs of Article 39(1) of the CEOS. Decision 100-2004 of 21 December 2004 laying down general implementing provisions on early retirement without reduction of pension rights implements this data processing operation.

The proposed processing operation would not appear to involve any breach of the provisions of Regulation (EC) No 45/2001, provided the Court of Auditors reconsiders the data storage period and reviews the content of the information supplied and the arrangements for supplying it, and also the rights of access and rectification.

Opinion of 24 November 2008 on a notification for prior checking concerning the "promotion procedure" (Case 2007-292)

On 19 November 2005 the Court of Auditors adopted a Decision (No 45/2005) on promotions, in application of Article 45 of the Staff Regulations of Officials of the European Communities.

The proposed processing operation does not appear to involve any infringement of Regulation (EC) No 45/2001 provided that the Court informs recipients that they may not use the data for other purposes, revises the content and form of information it provides, and clarifies the rights of access granted to data subjects.

Opinion of 15 December 2008 on the notification for prior checking regarding the optional "Leadership Feedback" procedure established by the European Administrative School ("EAS") in connection with its management courses (Case 2008-527)

This opinion concerns an optional "Leadership Feedback" procedure established by the EAS in connection with its management courses.

EAS, as part of its mandate, organizes management courses for Commission officials and officials of other European institutions and bodies. In connection with each management course, EAS offers participants an opportunity to receive anonymous feedback about their management skills from other participants.

EAS outsourced the provision of management courses to a private company established in a European Union Member State. This company, in turn, outsourced the organization of the Leadership Feedback procedure to another private company, also established in a European Union Member State. EAS has, itself, no access to any data processed during the procedure. The outsourced processor organizes and manages the feedback procedure. In particular, it makes available to participants a secure website tool to collect feedback, aggregates feedback into reports (while the anonymity of those providing feedback is ensured), and provides each participant with a report regarding the group's feedback on his/her own management skills. Participants, if they so wish, may also complete a questionnaire assessing their own management skills and may also allow access to the feedback information to their trainers.

The recommendations of the EDPS include the following:

The contract between EAS and its direct subcontractor, which already contains a data protection clause, should also include that (i) subcontractor is obliged to ensure that all its direct and indirect subcontractors will undertake the same obligations in writing and that (ii) the choice of the subcontractor’s direct or indirect subcontractors is subject to the approval of EAS, which can be withheld in case the security of the data or maintenance of other data protection safeguards are not ensured.

In addition to the detailed privacy statement on the EAS website, at least the following minimum information should also be provided among the printed materials in the information package: (i) the feedback procedure is entirely optional and anonymous, (ii) all data are processed solely for the purposes of providing feedback, (iii) data will be deleted within 2 months, and (iv) all data are processed by subcontractors and that EAS or others within the Institutions have no access to any data.