Privacy in the EU Institutions

Opinion of 19 May 2009 on the notification for prior checking regarding the processing of personal data in DG ENTR Entreprise Data Warehouse (Case 2008-487)

The DG ENTR Data Warehouse (EDW) is a system in charge of retrieving data from multiple data sources (ABAC, COMREF, SYSLOG and DG ENTR's in-house financial data). The main goal is to provide managers with powerful reports presenting metrics of performance, like the 'Scoreboard' report, at destination of the Head of Units, Directors and Director General.

The EDPS examined the processing in the light of the legal requirements of Regulation (EC) 45/2001 and concluded that there was no breach of the Regulation provided certain recommendations are taken into account and notably:

• The Data Warehouse should be limited to the use of data specified in the current notification and require further authorisation if other databases where to be added as database sources;
• The data minimization principles, the accuracy of data and the necessity to transfer them should be assessed and evaluated;
• DG ENTR should implement specific security measures relating to the planned system's specifications.

Opinion of 18 May 2009 on a notification for prior checking regarding trainee applications and recruitment (Case 2008-730)
The prior check concerned the processing of personal data in the collection of trainee selection and recruitment. The EDPS examined the processing in the light of the legal requirements of Regulation (EC) 45/2001 and concluded that there was no breach of the Regulation provided certain recommendations are taken into account and notably as concerns requests made to the medical service in case of requests for a disability allowance by the trainees. The Personnel and Budget Sector should limit its request to the medical service to disability related data which is strictly necessary for making a decision about the needs of the trainee and the amount of the additional grant to be supplied to disabled trainees and persons in charge of handling that data in the Personnel sector should be made aware that they are processing sensitive information and they should respect the confidentiality requirement.

Opinion of 18 May 2009 on the notification for prior checking concerning the promotion and regrading procedure case (Case 2009-018)

The prior checking relates to the processing of personal data in the context of the Translation Centre's promotion/regrading procedure.  The procedure is based on an individual promotion/regrading form which is circulated between the different groups of users concerned.  The promotion/regrading forms might also be transferred to other Community institutions and agencies if an official/temporary staff member transfers, or applies for a transfer, to another institution/agency.  There is also a promotion file composed of individual promotion/regrading forms, the list of officials and temporary staff members eligible for promotion/regrading and the list of officials promoted.  The promotion files are kept until officials/temporary staff members (or their dependants) have exhausted all channels of appeal after termination of service and for no longer than ten years as from the last pension payment.

After examining the case, the EDPS reached the conclusion that only relevant data should be stored in the data subject's personal file; that only relevant data should be transferred to another institution in the event of the data subject's transfer there; and that the specific information note should include the general information headings.

Answer to a consultation regarding the launch of new research projects at the European Agency for Fundamental Rights (FRA) (Case 2008-777)

Opinion of 18 May 2009 on the notification for prior checking on the "Mediation Service of the European Commission" (Case 2009-010)

The European Commission has a Mediation Service which provides impartial advice to each official, servant or department that consults it. That Service intervenes if a case is submitted to it by an individual or a Commission department and may hear the persons concerned and request information from the Commission departments concerned. The role of the Mediation Service is to reconcile the administration and the staff. It makes recommendations and gives opinions, but has no power of decision.

The EDPS has examined the processing of personal data in managing absences owing to illnesses and has concluded that it does not seem to involve any infringement of the provisions of Regulation (EC) No 45/2001, provided that certain recommendations are implemented, in particular that the competent department checks the appropriateness of the transfer on a case by case basis and ensures that only relevant data are transferred; reminds data recipients that they may process the data they receive only for the purposes for which they are transmitted; applies the right of access and rectification to anyone whose personal data are processed; makes the specific confidentiality statement available on the Commission intranet site, and, if necessary, informs other persons whose data are being processed.