Training evaluation - European Central Bank

Opinion of 1 July 2009 on a notification for prior checking regarding training evaluation (Case 2009-220)

The processing of personal data under analysis relates to evaluation of in-house training courses that are delivered by external consultants and evaluation of external training activities attended by ECB staff members at an external institution. The purpose of the processing is to ensure good and constant quality management as well as to control the content of training delivered to ECB staff members.

The EDPS concluded that there was no reason to believe that there is a breach of the provisions of Regulation 45/2001 providing certain recommendations are taken into account. As concerns information to be given to the data subject, a number of information items were missing in order to ensure compliance with the Regulation. As regards the retention of data, the ECB should consider adjusting the existing policy to the duration of the contracts and thus retain the relevant data for a reasonable period of three or four years. With regard to security measures, EDPS suggested that the ECB carries out an assessment on how the implemented security measures for this particular processing through the ERP information system suit the requisites provided in article 22.2 of Regulation (EC) 45/2001.