Print

Privacy in the EU Institutions

Regulation (EU) 2018/1725 lays down the data protection obligations for the EU institutions, bodies and agencies when they process personal data and develop new policies. This regulation also defines the obligations of the EDPS, including his role as an independent supervisory authority of EU institutions and bodies when they process personal data, and to advise on policies and legislation which affect privacy and cooperate with similar authorities to ensure consistent data protection.

 

 

 

Filters

11
Jan
2008
Opinions Prior Check and Prior Consultations

Call center technology - OHIM

Opinion of 11 January 2008 on a notification for prior checking on the Call center technology (Case 2007-583)

OHIM monitors the incoming calls at OHIM's switchboard, information centre and help desk. The monitoring takes place through the use of an off the shelf software program referred to as “Call Centre Technology”.  The monitoring provides information about the volume of the calls received, duration, number of calls attended and rejected, etc.  The content of the calls is not monitored. This Notification refers to the data processing that occurs in the context of the monitoring of these calls. 
 

The EDPS recommendations provided in this opinion aim to ensure the full compliance with the Regulation 45/2001, in particular, as regards the storage periods, the scope of the right of access and the requirements for data transfers to service providers established in non-adequate countries.

Available languages: English, French
Topics
Privacy in the EU Institutions
Staff Evaluation
10
Jan
2008
Opinions Prior Check and Prior Consultations

e-Tendering - Council

Opinion of 10 January 2008 on a notification on e-Tendering application covering the Council's public procurement procedures (Case 2007-573)

The e-Tendering processing operation, carried out by the Council, is an electronic procurement service which collects data with the purpose of awarding contracts to the selected economic operators. It intends to replace in the long term the current manual processing operation related to public procurement procedures which has already been prior-checked (Opinion of 19 July 2007, case 2007-275). The main purpose of introducing this system is to increase the efficiency and transparency of the procurement process.
 
Considering that the categories of data collected within the e-Tendering application as well as the purpose are identical to those described and analysed at the Council's "public procurement procedures", already prior-checked by the EDPS, Articles 27(2)(a) and 27(2)(b) are applicable following the same line of arguments already exposed in the Opinion of 19 July 2007. 
 

Some of the recommendations made by the EDPS are the following: It was underlined that a set of predefined data should be kept in the light of the duration of each long term contract awarded in each case. Thus, depending on the duration of the contract, data should be erased immediately after they are no longer in use. Moreover, a precise period for the conservation of registered data should be adopted; it should not be excessive to the purpose for which they will further be processed. In the declaration on "personal data protection", it was pointed out, inter alia, that the obligation of the economic operators to inform their employees or subcontractors about their rights related to Article 11 and 12 of the Regulation should be mentioned. The economic operators should make sure that all relevant information, which will be published on the site of the Council, can be accessible to them. It should also be indicated in the Confidentiality agreement that the experts have a legal obligation to process data in conformity with the principles of data protection as provided in Regulation 45/2001.

Available languages: English
Topics
Privacy in the EU Institutions
Procurements, Grants, Experts
10
Jan
2008
Opinions Prior Check and Prior Consultations

AGS-EDV Database at JRC-ITU in Karlsruhe - Commission

Opinion of 10 January 2008 on a notification for prior checking on "AGS-EDV Database at JRC-ITU in Karlsruhe" (Case 2007-378)
The Radioprotection Service of the JRC Institute for Transuranium Elements (ITU) in Karlsruhe processes health related data of occupationally exposed workers and visitors in accordance with the respective legal obligations laid down in the German Ionising Radiation Protection Regulation implementing Euratom Directives 96/29 and 90/641. The processing operations concern the handling of personal radiation data coming from internal and external dosimetry measurements by two external research centres, as well as the management of the respective database set to detect overexposure to the ionising radiation risks. 

 

The EDPS recommendations provided in this opinion aim to ensure the full compliance with the Regulation 45/2001 and concern, in particular, the information to be provided to the data subjects, as well as the necessity to comply with the confidentiality and security obligations by all subjects involved in this data processing.

Available languages: English, French
Topics
Privacy in the EU Institutions
Health Data in the Workplace