Privatsphäre in den EU-Organen

Opinion of 9 January 2009 on the notification for prior checking on the "Annual exercise for early retirement without reduction of pension rights" (Case 2008-552)

The purpose of the processing is the implementation of the annual exercises for early retirement without reduction of acquired pension rights, in accordance with Article 9 of Annex VIII to the Staff Regulations and the second and third subparagraphs of Article 39(1) of the CEOS. Decision 100-2004 of 21 December 2004 laying down general implementing provisions on early retirement without reduction of pension rights implements this data processing operation.

The proposed processing operation would not appear to involve any breach of the provisions of Regulation (EC) No 45/2001, provided the Court of Auditors reconsiders the data storage period and reviews the content of the information supplied and the arrangements for supplying it, and also the rights of access and rectification.

Opinion of 24 November 2008 on a notification for prior checking concerning the "promotion procedure" (Case 2007-292)

On 19 November 2005 the Court of Auditors adopted a Decision (No 45/2005) on promotions, in application of Article 45 of the Staff Regulations of Officials of the European Communities.

The proposed processing operation does not appear to involve any infringement of Regulation (EC) No 45/2001 provided that the Court informs recipients that they may not use the data for other purposes, revises the content and form of information it provides, and clarifies the rights of access granted to data subjects.

Answer to a notification for prior checking concerning "Access Management System JRC-IE in Petten" (Case 2008-721)

Opinion of 15 December 2008 on the notification for prior checking regarding the optional "Leadership Feedback" procedure established by the European Administrative School ("EAS") in connection with its management courses (Case 2008-527)

This opinion concerns an optional "Leadership Feedback" procedure established by the EAS in connection with its management courses.

EAS, as part of its mandate, organizes management courses for Commission officials and officials of other European institutions and bodies. In connection with each management course, EAS offers participants an opportunity to receive anonymous feedback about their management skills from other participants.

EAS outsourced the provision of management courses to a private company established in a European Union Member State. This company, in turn, outsourced the organization of the Leadership Feedback procedure to another private company, also established in a European Union Member State. EAS has, itself, no access to any data processed during the procedure. The outsourced processor organizes and manages the feedback procedure. In particular, it makes available to participants a secure website tool to collect feedback, aggregates feedback into reports (while the anonymity of those providing feedback is ensured), and provides each participant with a report regarding the group's feedback on his/her own management skills. Participants, if they so wish, may also complete a questionnaire assessing their own management skills and may also allow access to the feedback information to their trainers.

The recommendations of the EDPS include the following:

The contract between EAS and its direct subcontractor, which already contains a data protection clause, should also include that (i) subcontractor is obliged to ensure that all its direct and indirect subcontractors will undertake the same obligations in writing and that (ii) the choice of the subcontractor’s direct or indirect subcontractors is subject to the approval of EAS, which can be withheld in case the security of the data or maintenance of other data protection safeguards are not ensured.

In addition to the detailed privacy statement on the EAS website, at least the following minimum information should also be provided among the printed materials in the information package: (i) the feedback procedure is entirely optional and anonymous, (ii) all data are processed solely for the purposes of providing feedback, (iii) data will be deleted within 2 months, and (iv) all data are processed by subcontractors and that EAS or others within the Institutions have no access to any data.