Prior checking Opinion concerning ex-ante product quality audits (Case 2016-0477)
Organisations such as EUIPO ensure the quality of their output in different ways. One such way is checking the quality of decisions before it leaves the organization (ex-ante), recording the error rate and trends in the type and category of errors - and using a database to record this monitoring process.
As staff members remain identifiable in the process and are given feedback at individual level on the basis of this processing operation, this might lead to implications for their performance evaluation(on such processing operations, see EDPS Guidelines in the area of staff evaluation ). This is why the organization needs to comprehensively inform those concerned, grant all data subjects’ rights and ensure the accuracy of the data processed.
Summary of Case 2017-0969:
The Council established a network of first-aiders on the basis of the Staff Regulations and the rules in the area of well-being at work. Under Belgian law in that field, the employer keeps a register in which the employee who carries out a first-aid intervention must indicate particular information concerning his intervention. The Council decided to implement a staff first-aid intervention register (first-aider record book) and a register of first-aid intervention for the medical service for instances where the medical service intervenes (on site and/or after transport of the casualty to its premises). The data subjects must be duly informed about the protection of personal data. In the light of the sensitive nature of those data and the urgent nature of the work of the first-aider, it is also essential that appropriate measures be implemented in order to guarantee the security of the personal data contained in the first-aider record book.
Prior-checking Opinion regarding probation periods and the e-probation tool at the European Investment Fund (Case 2015-1107)
During the probation evaluation of a staff member and the adoption of the probation report, the EIF processes personal data of that staff member. To ensure transparency and fairness, information on this processing should be provided to the concerned individuals through a specific data protection notice. This notice should be made available on the Intranet. A link to the notice should also be added to the respective forms, reports and/or to the messages sent to the staff members in the different stages of probation evaluation. The notice should also clearly set out the procedures for granting individuals' rights, including also information on within which time limit a reaction can be expected from the EIF to the requests of the individuals. Staff members should be granted access to all their data kept in their personal file and in the electronic database, even after the end of employment. While letters containing probation decisions would need to be kept throughout the career of a staff member, probation reports may not necessarily remain relevant during the whole career. The retention of probation reports up to five years after the end of a particular appraisal procedure would be considered appropriate.
Opinion of 17 March 2014 on the notification for prior checking received from the Data Protection Officer of the European Court of Auditors concerning the ECA's Panel for Financial Irregularities (Case 2013-0846)
The Opinion regards the European Court of Auditors' Panel for Financial Irregularities ("PFI"), which is competent to examine any infringement by an official or other member of the ECA's staff of a provision of the Financial Regulation or of any rule relating to financial management or the audit of transactions. The EDPS noted with great regret that the processing operation had already been established, but highlighted that the recommendations made by the EDPS need to be adopted accordingly. These focus mainly on ensuring that data subjects concerned benefit from their rights by means of (i) a privacy statement containing all pieces of information required under Articles 11 and 12 of the Regulation and ensuring that every data subject receives the privacy statement when his/her personal data is first recorded or disclosed, (ii) a reference to the right of the person concerned to comment on the facts mentioned in the draft final report in the Rules of Procedure and (iii) rules to safeguard the rights of other data subjects to access and rectification under Articles 13 and 14 of the Regulation.
Opinion of 7 May 2014 on the notification for prior checking received from the Data Protection Officer of the Council of the European Union regarding the processing of personal data for restrictive measures with regard to the freezing of assets - Council (Case 2012-0724, 2012-0725, 2012-0726)
Prior check opinion regarding remuneration policies and credits to senior officials of significant entities supervised by the ECB (Case 2017-0358)
As part of its banking supervision role, the European Central Bank has to assess and approve significant supervised entities’ remuneration policies. This may result in adverse consequences to employees of significant supervised entities, possibly excluding them from rights under their employment contracts.
The ECB also has a role to play concerning loans of significant supervised entities to their own employees, which may also result in refusing loans to them, thus excluding them from a contract.