Die Verordnung (EU) 2018/1725 legt die Datenschutzverpflichtungen für die Organe, Einrichtungen und Agenturen der EU fest, wenn sie personenbezogene Daten verarbeiten und neue Strategien entwickeln. Darüber hinaus führt die Verordnung die Pflichten des EDSB auf. Diese umfassen seine Aufgaben als unabhängige Kontrollbehörde für die Organe und Einrichtungen der EU, wenn diese personenbezogene Daten verarbeiten, die Beratung zu politischen Maßnahmen und Rechtsvorschriften, die sich auf den Schutz der Privatsphäre auswirken, und die Zusammenarbeit mit vergleichbaren Behörden zur Gewährleistung eines kohärenten Datenschutzes.
Hier finden sich die EDSB-Dokumente über Privatsphäre und Datenschutz in Bezug auf die Verarbeitung personenbezogener Daten durch die Einrichtungen und Organe der EU, z. B. bei Mitarbeiterbewertung, Akkreditierung externer Besucher oder Zugangskontrolle.
Opinion of 3 October 2007 on the notification for prior checking concerning the attestation procedure (Case 2007-435)
The Court of Justice adopted the implementing rules for the attestation procedure by decision of the Court's Administrative Committee on 15 June 2005. Officials employed in categories C and D on 1 May 2004 are likely to have promotions capped at grades AST 7 and 5 respectively. These ceilings may be abolished, however, by an "attestation" procedure. This procedure is based on criteria relating to seniority, experience, merit and level of training and depends on the availability of posts in the AST function group.
The main recommendations made by the EDPS in his opinion on the attestation procedure concern data storage and the provision of information to data subjects.
Opinion of 17 September 2007 on a notification for prior checking regarding the selection of senior officials (Case 2007-193)
DG ADMIN organises and manages the selection process of senior officials in the Commission in order to select the best suited candidates for a particular position. The positions are open to internal candidates and in some cases vacancies are also open to external candidates. In order to select the best suited candidates, applicants have to follow various procedures (prior eligibility tests, interviews with pre-selection panel, analysis and opinion of the Consultative Committee on Appointments, etc). Such procedures entail the collection and further processing of candidates' personal data for the purposes of evaluating their competences for a given position.
In his opinion, the EDPS concluded that the DG ADMIN has substantially followed all the principles of the Regulation. Nevertheless the EDPS recommended, among others, that DG ADMIN:
Clarifies and reconsiders the storage periods.
Limits the amount of information transferred during the first phase of the procedure
Ensures that applicants have access to their file.
Ensure that access to the data held by the sub-contractor is not limited to an "oral feedback ".
Amend the privacy policy as recommended in the Opinion.
Raise awareness among DG ADMIN A5 and DG ADMIN CCN-Proc regarding the need to ensure the confidentiality of the information.
Implement as soon as possible the security measures intended to enhance the security of the information held and exchanged electronically.
Opinion of 13 September 2007 on the notification for prior checking regarding pre-employment and annual medical check-ups (Case 2007-348) At the EMCDDA, the medical check-ups (pre-employment medical check ups and annual medical check ups) are carried out by a qualified medical doctor, carrying out the medical examination on behalf of the EMCDDA. The results of these medical check ups are communicated by the doctor to the medical officer, member of staff at the EMCDDA. The medical files are kept by the EMCDDA medical officer.
The pre-employment medical check-up is carried out only after the candidate has already received a formal offer of employment. To this effect these candidates receive a standard letter convening them to a pre-employment medical examination with the medical doctor carrying out the examination on behalf of the EMCDDA. A medical questionnaire is attached to this letter, to be completed in part by the candidate and duly signed by him/her. In addition, the medical doctor carrying out the medical examination on behalf of the EMCDDA, performs a direct physical examination and completes the medical overview form. The results of the medical exam are communicated to the person concerned and to the medical officer of the EMCDDA. The HR Management sector only receives a medical certificate stipulating the person's ability or inability or ability with a reserve clause.
As in the case of the pre-employment medical check-up, during the annual medical check-up, the medical doctor carries out a direct physical examination. Should a member of the staff decide to have the annual medical check-up performed by a doctor of his choice he will receive the list of exams to be carried out from HR and go for the tests and the visit. The staff member is requested to send a copy of the outcome to the EMCDDA, not the results of the specific tests that remain with him/her. The only information circulated to the financial services is the list of the exams and the relative costs as invoiced for the tests.
After examining the case, the EDPS concluded that there is no reason to believe that there is a breach of the provisions of Regulation 45/2001 providing that certain considerations are fully taken into account. Notably certain data in the medical questionnaire must be re-assessed in the light of the principles of adequacy, relevance, and proportionality for purposes of assessment of fitness for service and assistance in determination of limitations with respect to death or invalidity benefits for the first five years of service; the EMCDDA evaluates to what extent and for what purposes the content of a medical file needs to be kept and determines a conservation period concerning data relating to persons who have been submitted to a medical exam, but who then refuse employment; and that the EMCDDA reconsiders the procedure of communication of data relating to the medical exams undertaken with a private doctor to the financial services with the aim of reconciling the data subject's right to privacy and the obligations of the financial services.
Opinion of 11 September 2007 on a notification for prior checking on verification of lack of conflict of interest of special advisers and its publication on Europa website (Case 2007-294)
The European Commission can engage a special adviser who, by reason of his/her special qualifications, assists the Commission either regularly or for a specified period. Before the engagement, the Commission analyses the activities of special advisers in order to avoid conflict of interest with their future activity as special advisers. Then, the special advisers' name, CV, photo, mandate as well as the declaration on honour will be published on the Europa website.
The EDPS has issued an opinion on the verification of lack of conflict of interest of special advisers and on publication of their personal data on Europa website. The EDPS concludes that on a general basis the procedure complies with the principles established in the data protection regulation. However the EDPS did make some recommendations mainly as concerns raising awareness regarding the publication of potentially sensible personal data on the Europa website. The EDPS suggested that the publication of the special advisers' photo should be optional and that the Commission staff should verify, before the publication on the Europa website, if the data included by the special adviser in his/her Curriculum Vitae are not irrelevant or excessive in relation to the purpose of the processing.
