European Data Protection Supervisor
European Data Protection Supervisor

Procurement and external experts

Procurement and external experts

What you should know about public procurement and external experts

EU institutions often need to make use of external service providers for goods and services. To ensure the best use of EU financial resources, external contractors and experts have to be selected and their performance evaluated according to the criteria provided for in EU financial regulations.

Any procedure launched by a call for tender or expression of interest involves the processing of personal data (also known as personal information) of the applicants (or their representatives/members of staff when those bidding are legal persons) to evaluate their efficiency, professional and technical capacity according to pre-defined criteria.


What are the main data protection issues?

Data quality - It is important not to process more personal data than necessary. How? By ensuring that only the relevant information necessary to complete a procedure is collected in the first place. For example, in a procedure to select experts for projects in a given field the collection of financial data such as bank account numbers may be considered excessive for the purposes of selecting experts to include on a reserve list. Such data should only be collected at a later stage and only if and when the experts are selected for a particular service.

Retention period - Organisations must often keep personal information on file for certain purposes. However, it is against the law to keep such information indefinitely, so organisations must make sure that information contained in supporting documents is not kept on their files for longer than necessary for budgetary discharge, control or audit purposes. Personal information of successful applicants may be kept on file for a number of years after the signature of a contract or at the end of a particular programme, whereas the personal information of unsuccessful applicants may be kept only to allow for possible appeals.

Right of access - The right of access of the person concerned applies to both factual data (contact details, qualifications, experience, etc.) and evaluation data. However, access is likely to be restricted to aggregated evaluation results as any access to evaluation results of other applicants or to the individual opinions of the members of the evaluation committee would undermine their respective rights.

The right of rectification is limited to factual information and may be exercised only while the tender period remains open in order to ensure transparency and equal treatment of those bidding.

Since it is impossible to rectify evaluation data because they are by nature subjective, the person(s) concerned must make use of the official appeal procedures.


More information

The following non-exhaustive list is a selection of documents for further reading:

EDPS Guidelines:
EDPS Guidelines on the processing of personal data in the context of public procurement, grants as well as selection and use of external experts

EDPS Guidelines on the processing of personal data with regard to the management of conflicts of interest in EU institutions and bodies

EDPS prior-check Opinion:
EDPS opinion on the model notification on public procurement at the European Commission of 15 April 2010 (2009-0570)


Related topics:

Prevention of conflict of interest