Opinion of 28 July 2011 on a notification for prior checking regarding requests for a part-time work at the Community Plant Variety Office (Case 2011-0299)
The purpose of the processing implemented by the CPVO is to manage the part-time applications of the CPVO staff members, allowing them to work part-time under the conditions laid down in the Staff Regulations. The processing operations were already in place at the CPVO before the EDPS was notified
In his recommendations, the EDPS requested, among others, that all persons within Human Resources who are responsible for handling part-time requests sign a declaration of confidentiality that they are subject to an obligation of professional secrecy equivalent to that of a health professional. He also asked to remind each of the recipients to only process personal data for the legitimate purpose for which they have been disclosed to them
Opinion of 20 February 2009 on a notification for prior checking regarding the engagement and use of temporary agents (Case 2008-315)
The CPVO engages long term and short-term temporary agents (TAs) for certain tasks. Personal data of applicants are used and processed during the recruitment procedure of temporary agents in order to evaluate and select the candidates for vacant TA posts. According to the internal Decision on TAs, the selection procedure for recruiting TAs for vacant posts in the CPVO can be carried out in two ways: firstly, upon request of the CPVO, the European Personnel Selection Office (EPSO) organises a selection procedure following the same standards as for competitions for officials, and secondly the CPVO itself can also organise the selection procedure. In the second case, the CPVO requests the candidates to submit the application form and various supporting documents and sets up a Selection Committee to assess the competences and knowledge of the candidates.
As a result of scrutinising the selection process from a data protection perspective, the EDPS made a number of recommendations, among those on the handling of personal information collected in the application process, on the data retention period, revision of the text and display of privacy statement.
Opinion of 14 April 2008 on a notification for prior checking on the annual appraisal procedure (Case 2007-403)
The Community Plant Variety Office conducts an appraisal procedure every calendar year for each CPVO staff member concerned. The procedure is aimed at evaluating the staff members efficiency, abilities and conduct in service, identify training needs and is used as a career development tool which justifies the submission of the procedure to prior checking by the EDPS under Article 27 (2) (b) of Regulation 45/2001. The EDPS recommendations to be implemented by the CPVO includes, inter alia,
i) Adopt rules on retention of evaluation reports;
ii) Ensure that recipients are made aware that they shall process personal data only for the purposes they were transmitted for;
iii) Ensure that more specific and accurate information is provided to data subjects regarding the data transfer, right of data subjects, the right of recourse to EDPS and the data retention. The "CPVO appraisal guide" should therefore be amended.
Opinion of 28 July 2009 on a notification for prior checking concerning "Evaluation of the President and the Cice-President of the CPVO" (Cases 2009-355 and 2009-356)
The Community Plant Variety Office (CPVO) submitted to the EDPS two notifications for prior checking concerning annual appraisal, probationary period and management trial period of the President of the CPVO and of the Vice-President of the CPVO. Those appraisals are conducted by the reporting officers who are two members of the Administrative Council of the Office (AC) appointed by the AC.
The EDPS has examined the personal data processing involved in this processing and has concluded that it does not seem to entail any breach of the provisions of Regulation (EC) No 45/2001 provided that certain recommendations are followed, in particular that the service responsible should establish a shorter retention period for all paper and electronic files, remind all recipients of data of their obligation not to use the data received for any further purpose beyond the purposes stated in the relevant CPVO Decisions and provide appropriate information to the persons concerned.
Joint opinion of 28 March 2011 on two notifications for Prior Checking concerning "Management of leave" and "Management of Leave on Personal Grounds and Unpaid Leave" at the Community Plant Variety Office (CPVO) (Cases 2010-0073 and 2010-0075)
The CPVO has implemented an automated system, the "Centurio Congé" database, for managing the annual and special leave entitlements of staff, while the processing of leave on personal grounds and unpaid leave is done manually in paper. In his prior checking opinion, the EDPS recommends that the handling of health-related data by HR staff, such as the processing of medical certificates, is subject to their signing of specific declarations of confidentiality that they are subject to an obligation of professional secrecy equivalent to that of a health professional. The EDPS reminds the CPVO that health data should only be processed by a health professional and therefore recommends that the CPVO instructs its staff to provide medical information directly to a health professional. The EDPS further recommends that the CPVO adopts appropriate time limits for the retention of personal data processed in paper.
Opinion of 2 February 2007 on a notification for prior checking on recruitment procedure (Case 2006-351)
Les procédures de recrutement visant à évaluer les aspects personnels des candidats font l'objet d'un contrôle préalable du CEPD en vertu de l'article 27, paragraphe 2, du règlement. La première notification de contrôle préalable adressée par l'Office communautaire des variétés végétales (OCVV) portait sur la procédure de recrutement et sur le mode de gestion des candidatures spontanées. La base juridique du traitement se trouve dans le statut du personnel (articles 27 à 34) et, la participation à la procédure de recrutement n'étant pas obligatoire, dans l'article 5, point d), du règlement (consentement de la personne concernée). Dans ses recommandations, le CEPD a marqué son accord sur le fait que les candidats invités à un entretien puissent être tenus de produire un extrait de casier judiciaire ou un document équivalent, afin de démontrer qu'ils jouissent de tous leurs droits en tant que citoyens, comme l'exige le statut du personnel. Parallèlement, il a recommandé que certaines questions figurant dans le formulaire de candidature type ne requièrent plus obligatoirement une réponse (activités sociales ou sportives, raisons pour lesquelles le candidat a quitté ses emplois précédents, par exemple). Le CEPD a marqué son accord sur les périodes de conservation appliquées par l'OCVV, à savoir cinq ans en cas de candidature "normale" et deux ans pour les candidatures spontanées
Opinion of 4 June 2008 on the notification for prior checking regarding pre-employment and annual medical check-ups (Case 2007-176)
This opinion concerns the pre-employment and annual medical check-ups organized at the CPVO. The recommendations of the EDPS include the following:
Regarding data quality, the scope of data collected on the medical overview form and the information included on the certificate of fitness should be revised to comply with the principles of relevance and proportionality. As to the conservation of the data, a reasonable, definite time frame must be established by the CPVO for the conservation of each category of employee and candidate medical data held by the CPVO. On information to data subjects, clear and specific information needs to be provided to data subjects regarding all items listed under Articles 11 and 12 of the Regulation. With respect to the pre-employment medical check-up, the EDPS also recommends the additional information on anti-discrimination referred to in point 3.8.4 of the Opinion. Finally, with regard to processing data on behalf of controllers, the service contracts concluded with the CPVO Physician and the CPVO Medical Centre should be modified to address data protection aspects pursuant to Article 23 of the Regulation. Instructions should be provided to the processors to comply with the minimum data protection safeguards recommended in this Opinion.