Opinion of 18 December 2009 on the performance evaluation procedures of the European Medicines Agency (Case 2007-421)
The prior checking procedure covers the data protection aspects of the performance evaluation of EMEA's temporary staff.
Opinion of 18 May 2009 on a notification for prior checking regarding trainee applications and recruitment (Case 2008-730)
The prior check concerned the processing of personal data in the collection of trainee selection and recruitment. The EDPS examined the processing in the light of the legal requirements of Regulation (EC) 45/2001 and concluded that there was no breach of the Regulation provided certain recommendations are taken into account and notably as concerns requests made to the medical service in case of requests for a disability allowance by the trainees. The Personnel and Budget Sector should limit its request to the medical service to disability related data which is strictly necessary for making a decision about the needs of the trainee and the amount of the additional grant to be supplied to disabled trainees and persons in charge of handling that data in the Personnel sector should be made aware that they are processing sensitive information and they should respect the confidentiality requirement.
Opinion of 21 April 2010 on a notification for prior checking on the processing of personal data in administrative enquiries and disciplinary procedures (Case 2010-0047)
On 22 January 2010, the EDPS received notification for prior checking relating to the processing of personal data in the frame of administrative enquiries and disciplinary procedures from the European Medicines Agency (EMA).
The processing of personal data resulted from the implementation at EMA of Article 86 of the Staff Regulations of officials of the European Communities and Annex IX to the Staff Regulations. The procedures apply to agents and former agents, servants and former servants, other persons working to for the EMA such as persons employed under private law contracts, experts on secondment, trainees or other relevant persons. EMA is currently adopting implementing rules on the conduct of administrative inquiries and disciplinary procedures.
The EDPS found that there was no reason to believe that there was a breach of the provisions of Regulation 45/2001 provided that EMA respect the certain recommendations and notably that EMA staff in charge of the files are made aware of the restrictive rules which apply to the processing of special categories of data of the specific rules which apply to the processing of such data and that a procedure be clearly established for the conduct of any interference on communications of staff members (access to online consultations, access to email accounts...) taking into account of the new EU legal framework concerning the new right to data protection and the reinforced protection of fundamental rights. Recommendations were also made on the periods of conservation of data both in personal files and in the disciplinary files. The EDPS also stated that EMA should guarantee the confidentiality of the identity of whistleblowers in the frame of administrative inquiries and disciplinary proceedings in as much as this would not contravene national rules regulating judicial procedures.
Opinion of 19 June 2008 on the notification for prior checking regarding EMEA's "Access" recruitment database and selection and recruitment procedures (Case 2007-422)
This opinion concerns the selection and recruitment organized at the EMEA. The recommendations of the EDPS include the following:
Regarding proportionality, the questions relating to past convictions should be limited in time to those which actually appear on the applicant's criminal record at the time of applying for the position. As for optional data entries, EMEA should more clearly indicate on the application form the provision of what information is optional. Concerning psychometric testing, should EMEA continue to use psychometric testing as part of its selection procedures, it should submit this aspect of the recruitment procedure for prior checking by the EDPS. As regards the conservation of the data, EMEA should reconsider the conservation periods to ensure that data are kept no longer than necessary for the purposes initially contemplated. In particular, when data are conserved for budgetary discharge, control and audit purposes, personal data contained in supporting documents shall be deleted where possible when those data are not necessary for these purposes. Special attention should be paid to highly sensitive data such as information regarding disability and criminal records. As for rights of access, EMEA should revise its procedures to ensure that no access request is turned down merely because it is not submitted on the form specified. Further, EMEA should reconsider the restrictions it has put in place in order to preserve the confidentiality of the deliberations of the selection panel in view of reconciling this interest with the candidates’ right of access. Regarding information to data subjects, specific notice should be provided with respect to all items under Article 11 and 12 of the Regulation in a specific and clear manner, in addition to the availability of EMEA's general “Data Protection Declaration”.
Opinion of 26 November 2012 on the notification for prior checking from the Data Protection Officer of the European Commission concerning the selection procedure for the position of a member of the Management Board of the European Medicines Agency (EMA) and for the position of a member of the following scientific committees of EMA: Committee for Advance Therapies, Committee for Orphan Medicinal Products, Paediatric Committee and Pharmacovigilance Risk Assessment Committee (Case 2011-1166)
Opinion of 1 April 2008 on a notification for prior checking on part time requests (Case 2007-500)
The European Medicines Agency (EMEA) manages part-time applications of the staff. The data processing operations are both automated and manual. A staff member fills in a form which is collected in hard copies and subsequently the data of each staff member are entered in the COMPEL Database. Data subjects include temporary and contractual agents at the EMEA. In exceptional circumstances, the family members of staff can also be concerned.
The EDPS has issued an opinion concerning part time requests in EMEA. The EDPS concludes that on a general basis the procedure complies with the principles established in the data protection regulation. However the EDPS did make some recommendations mainly as concerns the need to modify the "Personal Data Access Request Form", to amend the information provided in the data protection declaration as well as to remind all EMEA internal recipients of their obligation not to use the data for any further purpose beyond the purposes communicated to the data subjects.
Opinion of 7 January 2008 on a notification for prior checking on recording of the leave of temporary, auxiliary and contract agents, national experts and trainees (Case 2007-420)
Various categories of personal data are being processed in connection with recording of leave granted to the EMEA staff members. In particular, health related data are being processed in relation with sick leave, leave for medical appointments, maternity leave, as well as certain types of special leave (such as in case of leave for a serious illness of a family relative). In addition, personal data revealing religious beliefs may be processed in case of exchange of EMEA public holidays for the respective traditional or religious holidays.
The EDPS recommendations provided in this opinion aim to ensure the full compliance with the Regulation 45/2001 and concern, in particular, the information to be provided to the data subjects, the modalities of exercise of rights of access and rectification, as well as recall the necessity to observe the data protection principles.
Opinion of 14 April 2008 on a notification for prior checking concerning the "Family leave / Compel personnel database / Electronic document management system (EDMS)" (Case 2007-498)
Health-related personal data of family members are being processed in connection with family leave that can be granted upon application in case of medically certified serious illness or handicap of certain family relatives.
The respective medical certificates are being validated by the EMEA Personnel & Budget Sector staff and/or may be reviewed by an UK based external medical contractor.
The EDPS recommendations provided in this opinion aim to ensure the full compliance of the processing with Regulation 45/2001 and concern, in particular, data transfers, the modalities of exercise of rights of access and rectification, as well as the information to be provided to the data subjects.
Opinion of 7 September 2009 on a notification for prior checking regarding the EudraVigilance database (Case 2008-402)
EMEA manages the EudraVigilance database whose originates from National Competent Authorities, Market Authorization Holders and sponsors of clinical trials. The purpose of the database is to evaluate suspected adverse reactions to medicinal products for human use. The EDPS considers that the processing is lawful to the extent that EMEA follows the recommendations included in the Opinion, particularly those regarding the data quality principle.
The EDPS recommended, among others, that EMEA:
|Register Number||Case Number||Institution||Description||Opinion date||Opinion|
Spontaneous CV (withdrawn)
|Register Number||Case Number||Institution||Description||Opinion date||Opinion|
Medical data of staff