Opinion of 16 January 2009 on a notification for prior checking on the management of Central and Local Training SYSLOG Formation (Case 2008-481)
SYSLOG is the administrative management tool for training at the European Commission in three fields: informatics, language and general. It is managed by DG ADMIN. However, some data processing also takes place within each Directorate-General by its training manager (COFO) and informatics training manager (REFOI).
Opinion of 27 April 2009 on a notification for prior checking on the management of the medical data of children attending the inter-institutional crèches and kindergartens managed by the OIB (Case 2009-088)
On 27 April 2009, the EDPS adopted an opinion on the prior checking of the management of the medical data of children attending the inter-institutional crèches and kindergartens managed by the OIB. Given the particularly sensitive nature of the data being processed, the EDPS recommends that a specific legal basis should be put in place for the processing of data relating to health in the context of the crèches and kindergartens, and that at the very least the unambiguous consent of data subjects should be obtained to the medical monitoring of the children and the processing the data relating to their health by the medical service in the crèches and kindergartens. The EDPS also recommends that only data which is strictly necessary for the purposes of the processing operation should be collected, and therefore invites the medical service to re-evaluate whether the data collected on the medical form and during attendance at the crèches and kindergartens is proportionate. Regarding the storage of the medical files, the EDPS recommends that a storage period which is in proportionate to achieving the purposes of the processing operation should be adopted.
Opinion of 26 May 2010 on a notification for prior checking regarding the processing operation on personal data concerning the "Registration of a Data Subject in the Central Exclusion Database" (Case 2009-0681)
In view of protecting the financial interests of the institutions, on the basis of the Financial Regulation, the European Commission processes data which are contained in a central exclusion database and which may only be used for the purposes of excluding from any procurement or grant procedures funded with EU Funds or EDF Funds, entities which represent a threat to the European financial interests.
The EDPS conducted his analysis in full cooperation with the Institution from an early stage of the procedure and concludes that there is no reason to believe that there is a breach of the provisions of Regulation 45/2001. However, the EDPS made some recommendations regarding the prior information of candidates, tenderers and grant applicants to be provided in the call for proposals and call for tenders. Moreover, he underlines the necessity to ensure that in case of manifest error in the inclusion of an entity in the database or if an entity has been cleared, the procedure will entail no legal consequences to it.
Opinion of 29 July 2011 on a notification for prior checking on the processing operations related to the selection procedure for temporary agents organised by the European Commission (EC) for "posts other than supervision and advice without EPSO concours" (case 2011-0559)
Opinion of 10 July 2007 on a notification for prior checking related to management of the sickness insurance scheme (Case 2004-238)
Opinion of 4 June 2010 on the notification for prior checking regarding the temporary employee selection procedure (Case 2008-704)
A process for the data relating to the selection and management of temporary employees is implemented by the Commission in order to enable the Commission to select the applicants who are likely to fill positions as temporary employees, in order to satisfy temporary staffing requirements. This selection is carried out jointly with a temporary employment agency.
The EDPS concludes that the proposed processing does not imply breaches of the provisions stated in Regulation (EC) No. 45/2001, as long as certain observations are taken into account, and in particular that the retention of data for a 40-year period concerning selected applicants pertain only to the data that is necessary to piece together the career of said applicants; that the access be guaranteed, both during the selection procedure and during the supply of the service by the applicant selected to fill a position as a temporary employee of the institution; that the note pertaining to the protection of personal data be modified according to the recommendations set forth by the EDPS in its opinion; and that the Commission review the clause relating to the protection of personal data in its framework contract.
Opinion of 29 September 2009 on the notification for prior checking on the "Management of the Children's Centre (CPE) - day nursery and study centre: Loustic information system and medical files" (Luxembourg) (Case 2009-089)
The Commission's Office for Infrastructure and Logistics (OIL) is in charge of managing the CPE's day nursery and study centre in Luxembourg. In this context it has set up the manual and automatic processing of administrative data collected with a view to enrolment. It has also sub-contracted the Commission's medical service the management of the medical files of children for whom an application for enrolment has been made. As part of the prior check the EDPS has made the following recommendations: the EDPS recommends that (i) the medical data be transmitted only to persons subject to an obligation of secrecy equivalent to professional secrecy, (ii) access to the automated application by childcare staff and security staff be restricted to information they need to know, (iii) the data storage periods be reviewed according to the specific need for the data and files, (iv) data subjects' rights to obtain a copy of the administrative data concerning them without constraint, without delay and free of charge, and the right to have them rectified on simple request be guaranteed, (vi) parents be allowed to rectify data relating to their child's health upon presentation of medical evidence, and (vii) declarations of confidentiality informing the parents of the data processing be modified and communicated by all possible means in order to ensure that the parents are informed.
Opinion of 22 April 2009 on the notification for prior checking regarding "Junior Experts in Delegation" (Case 2008-754)
The purpose of the processing operation in this case is to examine the eligibility of candidates put forward by the Member States for the Junior Experts in Delegation (hereinafter "JED") programme, select JEDs, determine who will be offered a posting to a delegation, ensure proper implementation of all aspects of their two-year contract and evaluate their performance in discharging their duties within the delegation. This processing operation therefore falls within the scope of the prior checking procedure within the meaning of Article 27(2)(b) of Regulation (EC) No 45/2001.
Any person who submits an application for a JED post, any referees named by applicants or any person indicated by the JED as the person to contact in the event of an accident/emergency and, where applicable, the JED's spouse.
In its recommendations, the EDPS emphasised inter alia that the Commission should:
Opinion of 15 April 2010 on the model notification for prior checking concerning "Procurement procedures and Call for expression of interest for selection of experts" (Case 2009-570)
This opinion addressed to the Data Protection Officer of the European Commission deals with the model notification on public procurement and related expert selection procedures. It provides for recommendations in terms of retention period, purpose limitation and information to data subjects, as well as adapted follow up.
Opinion of 5 June 2009 on a notification for prior checking on documents provided during recruitment (Case 2008-755)
The European Commission obtains and processes various documents when recruiting officials and other staff. Those documents are obtained in order to check that the applicant meets the requirements in terms of the Staff Regulations and of the selection/competition notice; to determine the applicant's ranking; and to determine his or her pay entitlements and create an access badge.
The EDPS has examined the personal data processing involved in the handling of these documents and has concluded that it does not seem to entail any breach of the provisions of Regulation (EC) No 45/2001 provided that certain recommendations are followed, in particular that the department responsible should limit the obtention and storage of criminal record data and should limit the obtention of applicants' birth certificates.