text: The role of the DPO has been analysed in the EDPS document "Position paper on the role of Data Protection Officers in ensuring effective compliance with

text: Regulation (EC) No 45/2001

text: . The DPOs are preparing a document on "Professional standards for Data Protection Officers of the EU institutions and bodies working under

text: Regulation (EC) 45/2001

text: ". When adopted, the document will be published on the EDPS website. Both documents provide useful information for drafting data protection implementing rules. 2 The document will also be subject to revision in due course. Revision should not be conducted annually but rather every five or ten years or whenever the institution/body considers it necessary (change in mandate, change in the core activities of the institution, etc.). The revision is subject to consultation under

text: Article 28.1

text: "1. Each Community institution and Community body shall appoint at least one person as data protection officer."

text: This is particularly true for the notions of controller/processor. The EDPS also recommends avoiding any mention of "processors within the agency". Implementing rules should preferably treat the processor's issue by focusing on external outsourcing.

text: "(a) ensuring that controllers and data subjects are informed of their rights and obligations pursuant to this Regulation;"

text: "(b) responding to requests from the European Data Protection Supervisor and, within the sphere of his or her competence, cooperating with the European Data Protection Supervisor at the latter's request or on his or her own initiative;"

text: "(d) keeping a register of the processing operations carried out by the controller, containing the items of information referred to in

text: Article 25(2)

text: "(e) notifying the European Data Protection Supervisor of the processing operations likely to present specific risks within the meaning of

text: Article 27

text: "The Data Protection Officer may be consulted by the Community institution or body which appointed him or her, by the controller concerned, by the Staff Committee concerned and by any individual, without going through the official channels, on any matter concerning the interpretation or application of this Regulation. Annex"

text: "on his or her own initiative or at the request of the Community institution or body which appointed him or her, the controller, the Staff Committee concerned or any individual, investigate matters and occurrences directly relating to his or her tasks and which come to his or her notice, and report back to the person who commissioned the investigation or to the controller,

text: "Other good practices to enhance compliance with the Regulation that can usefully be mentioned in the document:"

text: "In performing his or her duties, the Data Protection Officer shall have access at all times to the data forming the subject-matter of processing operations and to all offices, data-processing installations and data carriers"

text: "The Data Protection Officer may make recommendations for the practical improvement of data protection to the Community institution or body which appointed him or her and advise it and the controller concerned on matters concerning the application of data protection provisions, Annex"

text: "Every controller concerned shall be required to assist the Data Protection Officer in performing his or her duties and to give information in reply to questions (Annex)"  Controllers should give prior notice to the DPO of any processing operation. Information to be given is detailed in

text: Article 25.2

text: . Processing operations should be notified sufficiently well in advance to allow for prior checking by the EDPS (at least two months) because the operation cannot be implemented before the EDPS's opinion is issued;  Any change in the processing implying personal data should be notified promptly to the DPO;  Controllers should cooperate with the DPO to establish the inventory of processing operations referred to in

text: Article 4(2)

text: hereof;  Where appropriate, controllers should consult the DPO on the conformity of processing operations, in particular in the event of doubt as to conformity;  Controllers should prepare notifications to the DPO for all existing processing operations which have not yet been notified;  In case the controller outsources part(s) of the processing operations to a processor, this should be done in compliance with

text: Article 23

text: . Ideally, relevant parts of the article should be quoted.

publisher: Europeiska datatillsynsmannen

title: Tasks, duties and powers of the Data Protection Officer (Article 24.8)

serie: riktlinjer

text: Introduction and scope

text: Article 24.8 of Regulation 45/2001 (hereinafter "the Regulation") stipulates that further implementing rules concerning the Data Protection Officer should be adopted by each Community institution or body in accordance with the provisions in the Annex of the Regulation. The rules concern the implementation of the function of the DPO and, in particular his/her duties and powers .

text: The role of the controller and the rules pursuant to which a data subject may exercise his/her rights may be integrated in the document. This inclusive approach is recommended by the EDPS.

text: Further to Article 28.1 of the Regulation, Community institutions and bodies shall inform the EDPS when drawing up administrative measures relating to the processing of personal data. Therefore, draft implementing rules and revision of implementing rules should be submitted for consultation to the EDPS. The present guidelines are based on this consultation practice and designed to facilitate the drafting of implementing rules where these have not yet been adopted.

text: In general, the instrument should at least contain the principles established in Articles 24, 25, 26 and in the Annex of the Regulation. To the extent required, the document will adapt these principles to the institution/body concerned (size, administrative practices, hierarchy, etc). The document should be adopted in a long term perspective . Ideally, the document will also include best practices, some of which are

text: described in the present document. However, depending on the characteristics of the institution/body concerned and its necessities vis-à-vis the processing activities, other best practises could be envisaged.

text: Content

text: 1) Preamble and definitions

text: The preamble should at least make reference to:  Article 16 of the Treaty on the functioning of the European Union; 

text: Regulation (EC) No 45/2001

text: and in particular

text: Article 24.8

text: . and the Annex thereof.

text: If definitions are included in the document, the EDPS recommends not adapting the definitions already provided in the Regulation. Indeed, this may introduce confusion as to data protection terms and change their meaning .

text: 2) Appointment and status of the Data Protection Officer (

text: Article 24.1

text: . a)

text: The implementing rules shall contain information on:  the term of office of the DPO and in which circumstances he/she can be dismissed (

text: Article 24.4

text: );  the registration of his/her appointment with the EDPS (

text: Article 24.5

text: );  his/her professional qualities and specific knowledge of data protection (

text: Article 24.2

text: ); the document may also specify that the DPO should have a sound knowledge of the institution/body services if appropriate;  resources shall be provided to him/her to carry out his/her duties (

text: Article 24.6

text: ). In some cases a deputy DPO may be necessary. Every DPO should benefit from the possibility to be appropriately trained and have the opportunity to update his/her knowledge, mainly on data protection law and technical aspects;  the fact that his/her selection shall not result in a conflict of interest between his/her duties of DPO and any other official duties (

text: Article 24.3

text: ), to the extent required, the Data Protection Officer shall be relieved of other activities (Annex);  the fact that he/she should act in an independent manner while ensuring the internal application of the provisions of the Regulation (

text: Article 24.1

text: .c) and may not receive instructions with respect to the performance of his/her duties (

text: Article 24.7

text: ). In the case of a Deputy DPO, the same guarantees of independence must be enshrined in the document.

text: 3) Tasks, duties and powers of the DPO

text: Article 24

text: also includes a general principle which states that the DPO shall ensure that the rights and freedoms of the data subjects are unlikely to be adversely affected by the processing operations. In what follows, the EDPS develops the tasks and the duties of the DPO to ensure that processing operations are compliant with the Regulation, as well as the powers of the DPO to exercise his or her data protection function.

text: The DPO shall raise awareness on data protection issues and encourage a culture of protection of personal data within his/her institution/body. Controllers shall be informed of their obligations (see below point 6) and data subjects shall be made aware of their rights (see below point 7). This can take different forms:

text:  Training of staff members and controllers;  Making the register accessible also in electronic form as a tool to ensure transparency as regards the processing operations in place in the institution/body (see below);  Assistance given by the DPO to the controllers in notifying processing operations, which may also be formalised in the rules (see below);  Contribution of the DPO to the Annual Activity Report of the institution/body, as this is a good tool to raise awareness on data protection issues internally but also externally.

text:  The obligation to cooperate with the EDPS should be formalised in the document. The cooperation may be described further: provision of additional information about a notification for prior checking, cooperation in the frame of a complaint, implementation of EDPS recommendations and responding to request from the EDPS, etc.;

text:  The register may be kept in electronic and paper format (see above);  The DPO could maintain an inventory of all processing operations on personal data of the institution/body to better identify processing operations to be notified. An inventory of processing operations has proved to be an useful tool to ensure compliance with Article 25 of the Regulation and to provide a basis for further implementation of the Regulation;  The assistance given by the DPO to the Controllers in notifying processing operations may also be formalised in the document;

text:  The DPO shall determine whether the processing operation presents specific risks in the sense of

text: Article 27

text: and is thus subject to prior checking. The DPO should consult the responsible controller if necessary. The possibility to consult the EDPS in case of doubt as to the need for prior checking may also be mentioned with reference to

text: Article 27.3

text:  The advisory role is of importance and should be formalised in the instrument following the administrative practices of the institution/body;

text:  The DPO has the duty to investigate matters and occurrences directly relating to his or her tasks and therefore "investigative powers" should be elaborated in the document (see point below);

text:  The DPO may keep an anonymous inventory of the written requests from data subjects for the exercise of the rights referred to in Articles

text: and

text: 18 of the Regulation. This documentation could then be used to conduct an analysis to measure compliance with the Regulation and to allow the DPO to identify weaknesses of the systems;  An annual work programme and an annual report may be submitted by the DPO on his/her activities. A work programme of the DPO should define its priorities and show which results the DPO wants to achieve in terms of raising awareness, inventory, notifications, prior checking and register, etc;

text:  Although not explicitly mentioned in the Regulation, the EDPS encourages the handling of queries or complaints by the DPO, where appropriate. Indeed, the handling of queries and complaints at a local level can help in most cases to solve problems.

text:  It is good practice to elaborate on the investigation powers of the DPO. The procedural aspects should be defined: delay for the DPO to respond to the person who commissioned the investigations (written reply), obligation and deadline for the controller in charge of the processing operation at stake to respond to the DPO (written reply), obligation of confidentiality, obligation to conduct the enquiry in full independence, etc;

text:  The DPO should be involved whenever his/her institution/body elaborates internal rules related to the protection of personal data; the DPO should be an actor of the institutional framework (see below).

text: 4) Sources of information of the DPO

text: Implementing rules are also a tool to formalise the cooperation with the DPO within the institution/body, notably with:

text:  Internal Auditor, IT services, Local Information Security Officer (LISO) may request DPO's observations and conversely;  The DPO should be informed whenever the institution/body consults the EDPS under Article

text: or

text: .d. (and more widely, be informed of any correspondence with the EDPS), he/she should be informed of direct interactions between the controllers of the institution/body and the EDPS;

text:  The DPO should be informed / consulted before any opinion, document or internal decision on matters related to data protection provisions is adopted by his/her institution or body.  The DPO should be informed when the controller receives a request for access, rectification, deletion, etc., as well as of any complaint related to data protection matters.

text: 5) Role and duties of the Controllers

text: 6) Rights of the data subject

text:  Data subjects should be properly informed of the processing of their personal data in compliance with Articles 11 and 12 of the Regulation;  The document may also explain how the data subjects may exercise their rights pursuant to

text: Article 13

text: to 19 of the Regulation (whom to address, request in writing, deadlines, etc.).

text: Concluding remarks

text: Regulation (EC) No 45/2001

text: provides for a prescriptive and detailed frame for the implementing rules concerning the tasks, duties and powers of the DPO. However, the

text: EDPS recommends that other parts of the Regulation are also further developed in the instrument adopted by every institution/body, taking into account its own characteristics.

text: The scope of the instrument should be extended to the role and the duties of the controller and to the rights of the data subject as developed above. The instrument should also be the occasion to better integrate the role of the DPO into the institutional framework of each institution/body.

type: vagledning

utgivare: edps


text: Regulation 45/2001 of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, OJ L 8, 12.01.2001, p. 1. 2 Regulation No 31 (EEC), 11 (EAEC) laying down the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Economic Community and the European Atomic Energy Community (OJ P 45, 14.6.1962, p. 1385). 3 Guidelines concerning the processing of personal data in administrative inquiries and disciplinary proceedings by European institutions and bodies, 23 April 2010

text: Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 63 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Supervision/Priorchec ks/11-02-08_Notification_form_EN.pdf

text: Article 5

text: (a) stipulates two elements to be taken into account to determine whether the processing operations comply with the Regulation: 1) First, whether the fight against harassment is a task carried out in the public interest on the basis of the Treaty or other legal instruments adopted on the basis thereof; 2) And second, whether the processing operations are indeed necessary for the performance of this task.

text: Article 5

text: (a) of the Regulation stipulates that personal data may be processed only if the “processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties or other legal instrument adopted on the basis thereof, or in the legitimate exercise of official authority vested in the institutions or bodies." Recital 27 of the Regulation further specifies that this "includes the processing of personal data necessary for the management and functioning of those institutions and bodies". 6

text: Article 12

text: (a) of the Staff Regulations stipulates: (§1) "Officials shall refrain from any form of psychological or sexual harassment". (§3) "Psychological harassment' means any improper conduct that takes place over a period, is repetitive or systematic and involves physical behaviour, spoken or written language, gestures or other acts that are intentional and that may undermine the personality, dignity or physical or psychological integrity of any person". (§4) “Sexual harassment” means conduct relating to sex which is unwanted by the person to whom it is directed and which has the purpose or effect of offending that person or creating an intimidating, hostile, offensive or disturbing environment. Sexual harassment shall be treated as discrimination based on gender.". 7 Article 11 of the CEOS stipulates: (§1) The provisions of

text: Articles 11

text: to 26 of the Staff Regulations, concerning the rights and obligations of officials, shall apply by analogy. 8 The Civil Service Tribunal has interpreted "legal instrument" as any act of normative value (see Vinci v. ECB,

text: , §119).

text: For the applicable law see

text: Article 4 of Directive 95/46/EC

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. See also the recent Art. 29 Opinion n. 8/2010 on applicable law, adopted on 16 December 2010 (

text: WP 179

text: , in http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2010/wp179_en.pdf).

text: As set out in Article 6 of Annex III to the Staff Regulations: "The proceedings of the Selection Board shall be secret".

text: Article 20.1

text: (c) of the Regulation reads as follows: “The Community institutions and bodies may restrict the application of

text: Article 4(1)

text: Article 11

text: Article 12(1)

text: Articles 13

text: to 17 and

text: Article 37(1)

text: where such restriction constitutes a necessary measure to safeguard: (c) the protection of the data subject or of the rights and freedoms of others”.

identifier: EDPS riktlinjer (2011)

amnesord:
Privacy in the EU Institutions
Anti-harassment

sprak: en

title: Anti-harassment procedures in European institutions and bodies

text: February 2011

type: stycke

text: Guidelines concerning the processing of personal data during the selection of confidential counsellors and the informal procedures for cases of harassment in European institutions and bodies

text: INTRODUCTION

text: These guidelines (“Guidelines”) are issued by the European Data Protection Supervisor ("EDPS") in the exercise of the powers conferred on him in

text: Article 41 (2) of Regulation (EC) No 45/2001

text: on the protection of personal data by European institutions and bodies ("the Regulation").

text: Article 12

text: (a) of the Staff Regulations provides that "Officials shall refrain from any form of psychological or sexual harassment" . Institutions and bodies must set up procedures to prevent harassment and to guarantee a work environment free of any form of psychological or sexual harassment among their staff. In this respect, institutions and agencies set up informal anti-harassment procedures which involve the intervention of confidential counsellors. Any formal investigation on a harassment case dealt with in the frame of disciplinary procedures is not the object of the Guidelines. Indeed, the formal procedure falls into the field of "classic" administrative inquiries and Guidelines have already been issued by the EDPS on this theme . The scope of these guidelines is therefore limited to the informal procedure and to the selection of confidential counsellors. To the extent that the European institutions and bodies may process personal data relating to identified or identifiable persons in antiharassment procedures put in place, they are subject to the respect of the Regulation as an instrument of primary legislation.

text: The content of the Guidelines is based on the ten EDPS Opinions issued so far regarding the selection of confidential counsellors and the conducting of the informal procedure in cases of harassment (see annex). The objective is to present in a clear

text: and concise way the outcome of the EDPS positions and recommendations

text: regarding each fundamental principle of the Regulation and to underline particular issues.

text: Processing operations involving personal data in informal anti-harassment procedures are subject to prior-checking in conformity with

text: Article 27(2)

text: (b) and possibly (a) of the Regulation, since they involve: - for the selection of confidential counsellors, an evaluation of the applicants' ability to perform the function, and possibly processing operations related to health; - for the informal procedure, an evaluation of the data subjects' conduct and possibly processing operations related to their health.

text: The Guidelines should serve as basis for notification for institutions and bodies which have not notified their procedure, and provide for guidance to those which have. Procedures may slightly vary from the one described below. If doubts arise as to the application of the data protection principles, this should be reflected in the cover letter attached to the notification.

text: The EDPS recommends to:

text:  Use the Guidelines as a practical guidance when dealing with processing

text: of personal data relating to harassment;

text:  When notifying anti-harassment processing operations, make "

text: Article 27

text: notifications" clear, precise and as complete as possible in the light of the issues raised in the Guidelines and of the document providing instructions for completing the notification

text: Article 27

text: , available on the EDPS website ;

text:  Attach a cover letter to the notification describing the discrepancies in

text: terms of data protection.

text: The selection of confidential counsellors is not compulsory; certain institution do not develop a specific role of counsellor in their procedure.

text: The data processing operations which take place in the context of selecting and appointing confidential counsellors can be summarized as follows. Further to the receipt of applications, the eligibility of the candidates is checked by the dedicated staff (usually from the HR Department). A selection panel/jury assesses then the eligible candidates during personal interviews. The appointing authority (usually the Director) finally accepts or rejects proposed appointments; a reserve list may be elaborated. Laureates may be asked to attend compulsory training modules. The final list of confidential counsellors is circulated to all staff and specifies information which may be of interests for the alleged victim's selection of a counsellor (gender, nationality, spoken languages, etc.).

text: The data processing operations which take place in the context of the informal procedure can be summarized as follows. Individuals which consider themselves as a victim of psychological or sexual harassment may request for assistance by contacting a confidential counsellor of their choice, or the Human Resources who will recommend them to the network of confidential counsellors. The role of the counsellor is first dedicated to listen to the alleged victim. Secondly, if necessary and with the consent of the alleged victim, a mediation is launched so as to reach an informal agreement between the parties. In

text: case of failure of conciliation, the alleged victim may engage in a formal procedure. The data are contained in the personal notes of the confidential counsellors (including all documents relevant for the case) and in possible opening and closure forms (including data such as reference numbers, date of first contact and further meetings, closing date, type of issue, contacts with other departments, reasons given for complaint or actions undertaken).

text: GUIDELINES

text: 1. Lawfulness of the processing operation

text: Pursuant to the Regulation, any processing of data which relates to an identified or identifiable person must find a legal basis in

text: Article 5

text: to be considered as lawful. As for the selection of confidential counsellors and the informal procedure, two specific legal bases could be considered as relevant, paragraph (a) and complementary paragraph (d).

text: 1) As far as the first element is concerned, the specific legal basis for the selection of confidential counsellors and for them to conduct the informal procedure will usually

text: be found in

text: Article 12

text: (a) of the Staff Regulations and Article 11 of the Conditions of Employment of Other Servants (hereinafter "CEOS" ). In addition, Articles 1 and 31 (1) of the EU Charter of Fundamental Rights complement the

text: legal basis. The Charter states that every worker has the right to working conditions which respect his or her dignity.

text: The two procedures under analysis are usually put in place to combat psychological and sexual harassment, a task obviously carried out in the public interest of every European institution or body. The processing operations put in place therefore contribute to their management of resources and functioning of the institution.

text: The Staff Regulations define psychological and sexual harassment and prohibits such behaviour. However, on this basis the procedure ensuring working conditions free from harassment needs to be developed by each institution or body.

text: The EDPS enjoins the institutions and bodies to:

text:  Further detail the modalities of both procedures in more specific rules of

text: normative value (policy, communication, decision), restrictively applicable to their internal staff.

text: 2) As far as the second element is concerned, the necessity of the processing of personal data has to be evaluated in the light of their purposes, on a case by case basis. As regard harassment, processing operations supporting the procedure for the protection of the dignity of the person and the prevention of psychological and sexual harassment can be regarded as necessary, for example, in order to create a good working environment.

text: Article 5

text: (d) can be seen as complementary legal basis of the processing of harassment related data, according to which the processing must be based on the "unambiguous consent" of the data subject. In the terms of

text: Article 2

text: (h) of the Regulation, the data subject's consent is "any freely given specific and informed [...] agreement".

text: Finally, in rare circumstances the processing operations can be considered lawful if they are necessary to protect the vital interests of the data subject (

text: article 5

text: (e) of the Regulation).

text: 2. Processing of special categories of data

text: The Regulation provides for specific rules for categories of data considered by their nature of infringing fundamental rights and freedoms. Article 10(1) of the Regulation establishes that "the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and of data concerning health or sex life, are prohibited". The prohibition is lifted if justifying grounds can be found in Articles 10(2) or 10(3) of the Regulation.

text: In cases of harassment, the intention of the European institutions or bodies concerned is usually not the collection of special categories of data.

text: However, during the selection of confidential counsellors, the possibility that applicants provide for sensitive data in their application forms and/or any other

text: attached documents (especially CV or motivation letter) cannot be excluded, this possibly without any data having been requested.

text: Article 10(2)

text: (a) of the Regulation permits the processing of special categories of data where "the data subject has given his/her consent to the processing of such data". In case of spontaneous communication of sensitive data, it should be therefore considered that candidates have given their express consent to the collection of these data and to their further processing.

text: Example

text: When motivating his/her application to the function of confidential counsellor, the candidate reveals for example that: - he/she has been himself/herself harassed because of his/her sexual orientation, - he/she has been himself/herself harassed because of his/her handicap.

text: Likewise, as regard the informal procedure, processing of data concerning health or sex life of the data subjects for instance cannot be excluded during the collection of information by the confidential counsellor.

text: Article 10(2)

text: (b) of the Regulation states that the processing of special categories of data may be justified if "necessary for the purposes of complying with the specific rights and obligations of the controller in the field of employment law insofar as it is authorized by the Treaties or other legal instruments adopted thereof". The legal basis which is relevant in the case (

text: Article 12

text: (a) of the Staff Regulations) imposes an obligation on the European institutions and bodies to prevent harassment and to guarantee a work environment free of any form of psychological or sexual harassment among their staff. Therefore, the processing of special categories of data can be regarded as necessary for complying with this obligation, inasmuch as those data are relevant for the case.

text: Article 10(2)

text: (a) of the Regulation detailed above may also be relevant when the alleged victim or harasser, or other witnesses and third parties, requesting assistance or providing information, possibly provide sensitive data without having been requested to. In this case, it should be considered that they have given their express consent to the processing of these data.

text: Article 10(2)

text: (a) and (b) being exceptions to a more general prohibition, they must be interpreted strictly. Thus, the processing of sensitive data is permissible only in so far as it is relevant for the specific purposes described above. Second, as the data processing has to be necessary, there are additional constraints when applying

text: Article 4(1)

text: (c) of the Regulation, as will be explained in the point 3 on data quality below.

text: 3. Data quality

text: Adequacy, relevance and proportionality. According to

text: Article 4(1)

text: (c) of the Regulation, personal data must be "adequate, relevant and not excessive in relation to the purposes for which they have been collected and/or further processed".

text: As regard the selection of confidential counsellors, the immediate purpose of collecting data on candidates is to best evaluate their aptitude and competences,

text: regarding the specific tasks as confidential counsellors to conduct informal procedures in cases of harassment. The data collected must reflect the specific nature of their function.

text: The EDPS therefore recommends to

text:  Adopt selection and eligibility criteria in order to guarantee the principle

text: of data quality.

text:  Present these criteria explicitly in the call for interests.

text: As regard the informal procedure, the EDPS first distinguishes between:

text: - Data qualified as "hard" or "objective", i.e. administrative and identification data, usually collected directly from the data subjects (possibly by means of opening and closing forms). The collection of "hard" data aims at the identification of the person, the management of historical records and most importantly at the identification of recurrent and multiple cases. - Data qualified as "soft" or "subjective", i.e. allegation and declaration based upon the subjective perceptions of data subjects, usually collected by means of the personal notes of the counsellors.

text: The distinction between "soft" and "hard" data will also play a role in the exercise of the right of rectification of the data subject (see point 6 on rights of access and rectification below).

text: The selection of hard data the collected through the forms and communicated to the HR should therefore allow the identification of recurrent and multiple cases and should not be excessive in relation to that purpose.

text: The collection of soft data does not follow systematic rules as to the type of data processed; it is not possible to determine a priori the type of data collected. This does not mean that the collection may be random. The data collected by the counsellors must be adequate, relevant and not excessive in relation to the fight against harassment. This analysis must be conducted on a case by case basis by the counsellors.

text: As regard the collection of both data, the EDPS enjoins the institutions and agencies to:

text:  Ensure that the "hard" data collected in the forms are adequate, relevant

text: and not excessive in relation to the purpose of their collection (the management of historical records and most importantly at the

text: identification of recurrent and multiple cases). This necessity test should

text: be re-evaluate in a few years time in relation to the purpose.

text:  Guarantee the respect of the principle of data quality during their

text: collection; the counsellors should conduct his/her analysis on a case by case basis.

text: Lastly, with regard to the possible collection of data for statistical purposes (through a statistical report/form), the EDPS insists on the nature of the data collected; they should not allow the identification of the data subject. Indeed, the ability of identifying data subjects might arise for example by means of statistical inferences, especially within small European entities.

text: The EDPS recommends:

text:  To prove the necessity of collecting each single data for statistical

text: purposes in advance.

text:  In any events, to keep data collected for statistical or historical purposes

text: in anonymous form only (see point 4 on conservation of data below).

text: Accuracy and Update. According to

text: Article 4(1)

text: (d) of the Regulation, personal data must be “accurate and where necessary kept up to date", while “every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified.”.

text: As to the selection of confidential counsellors, the system itself ensures the accuracy and the update of the data. Data subjects supplying voluntarily most of the data during the selection process, it is to be assumed that the candidate considers that his/her data are accurate. However, other information is not provided directly by the individual but generated by the selection panel. In this regard, as further developed below, it is important for the data subjects to be able to exercise the right of access and rectification insofar as it enables individuals to control whether the data held about them is accurate.

text: As for the informal procedure, the requirement of accuracy cannot appertain to the facts or subjective perception provided by data subjects (so called "soft" data), but to the fact that a statement has been made by the data subject and rightly annotated. In this regard, effective rights of access and rectification of the data subject enable individuals to control whether the data reflect the facts and perceptions they wanted to transmit and, in that sense, whether these are accurate and as complete as possible (see also point 6 on the right to access and rectification below).

text: 4. Conservation of data

text: Pursuant to

text: Article 4(1)

text: (e) of the Regulation, personal data must be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed".

text: The EDPS invites institutions and bodies to:

text: into account that: (i) a shorter time limit should be adopted for non selected counsellors (for instance a limited period of time during which it is possible to challenge the data or the decision taken on the basis of the data for the non-selected persons); (ii) any further data required for

text: As regard the informal procedure, data are usually stored by the HR Department as well as by the confidential counsellors.

text: The EDPS recommends to:

text:  To set beforehand precisely the time they are allowed to keep the data, in

text: particular after the closure of the harassment case.

text:  To ensure that data stored for a longer period (usually for statistical

text: 5. Data transfer

text: Articles 7, 8 and 9 of the Regulation set forth certain obligations which should apply when data controllers transfer personal data to third parties. Transfers of harassment related data might take place, first, within or between different EU institutions or bodies (internal transfers:

text: Article 7

text: ); and second, between EU institutions or bodies and third recipients (external transfers: Article

text: and

text: ). In the latter case it has to be determined whether the recipient is subject to national law adopted pursuant to Directive

text: or not .

text: 5.1. Internal transfers

text: Internal transfers are in accordance with the Regulation if they are "necessary for the legitimate performance of tasks covered by the competence of the recipient" (Article 7(1) of the Regulation).

text: As to the selection of confidential counsellors, personal data may be transmitted to the services of internal audit, to the Court, to the European Ombudsman or to the EDPS.

text: The EDPS underlines that transfers of data should only be based on Articles

text: and

text: and not on the consent of the data subject. Therefore, the exception of

text: Article 20(1)

text: (c) does not apply to data transfers.

text: As far as internal transfers are concerned, structural (automatic), and ad hoc (case by case) transfers should be distinguished.

text: As regard specifically the informal procedure, with regard to cases of structural transfers the EDPS considers that the HR Department may also be the recipient of the data processed. Indeed, due to the sensitive nature of the informal procedure, the

text: counsellors' network is in charge of the core activity of the procedure whereas the HR Department plays a role of administrative support. The HR Department may therefore be considered as the recipient when receiving information from the confidential counsellors' network. These transfers to HR Department should be limited to the data necessary for the legitimate performance of their tasks (administrative support) as foreseen in

text: Article 7(1)

text: . In this respect, only hard data should be transferred. In addition, the EDPS welcomes the involvement of a so called "contact person" or "coordinator" within the HR Department, usually in charge of the networks of the confidential counsellors and possibly of certain security facilities (keys, lock boards containing the files, list of passwords or USB sticks). Transfers of harassment related hard data to him/her are allowed under the same modalities as to the HR Department; and the same limitations apply as regard the processing of "soft" data.

text: The EDPS reminds institution and bodies that:

text:  The HR should only provide for an administrative support to the core

text:  In this regard, the HR might keep in its facilities the electronic or paper

text: files containing "hard" and "soft" data, so as to safeguard best security and confidentiality of all data (see point 8 on Security).

text:  However, while processing of "hard" data by the HR is allowed so as to

text: perform its administrative tasks, consultation and processing of "soft" data shall be excluded for reasons of confidentiality (in particular to the personal notes of the counsellors).

text: Ad hoc transfers of harassment related data (be hard or soft data) may take place, for example, to the DPO, the appointing authority, the Directors (in the event of recurrent cases) or the internal audit of the European institution or body concerned. Data may also be transmitted to the Court of the European Union, the EDPS or the Ombudsman. Such transfers may be considered as legitimate if they are necessary for the legitimate execution of the tasks of those recipients. If the transfer follows a request from the recipient, then both the controller and the recipient shall bear the responsibility of the legitimacy of this transfer in accordance with

text: Article 7 (2)

text: . The controller should verify the competence of the recipient and evaluate the necessity for the transfer of the data. If doubts arise as to the necessity, the controller shall seek further information from the recipient.

text: Recipients should process the data received only for the purposes for which they were transmitted (Article 7(3) of the Regulation), i.e. within the strict framework either of the selection procedure, or of the informal procedure.

text: The EDPS recommends that:

text:  Transfer of "soft" data can not be structural (except for security and

text: confidentiality purposes and only under the conditions explained above).

text:  In case of transfer of data, each paragraph of

text: Article 7

text: must be taken into

text: account.

text:  Compliance with Article 10 of the Regulation (see point 2 on the

text: processing of special categories of data above) must be ensured.

text:  To take into account the principle of data accuracy (as exposed in point 3

text: on data quality above), as additional information might be necessary to enable the recipient to assess and/or understand the personal notes of the counsellors. Indeed, data are collected in a context where the data subject is expected absolute confidentiality. Statements of the alleged victim have to be considered as such and not as verified facts. When transferring the data this difference must be made clear to the recipient.

text: 5.2. External transfers

text: External transfers are in accordance with the Regulation if, according to

text: Article 8

text: , they are "necessary for the performance of a task carried out in the public interest or subject to the exercise of public authority" (paragraph a) or "if the recipient established the necessity of having the data transferred and if there is no reason to assume that the data subject's legitimate interests might be prejudiced" in cases of recipients subject to national law adopted pursuant to Directive

text: (paragraph b).

text: As to the informal procedure, in exceptional circumstances, external transfers may take place, for example, when data are transferred to third actors who have to play a role in the harassment procedure (social advisors/psychologists) or to judicial national authorities. As reminded above, confidentiality plays a crucial role in the informal procedure. The necessity for transferring data must be carefully analysed beforehand, in compliance with

text: Article 8

text:  Decide on a case by case basis the transfer of which documents

text: (containing personal data) are relevant and necessary to the third party recipients in compliance with

text: Article 8

text:  Comply with Article 9 of the Directive

text: in case of transfers to

text: recipient not subject to the same Directive.

text: Example

text: In case the data subject needs the help of a psychologist, prefer a solution where the data subjects directly address the psychologist, rather than have a transfer of data from the European entities concerned.

text: 6. Right of Access and Rectification

text: According to Article 13 of the Regulation, "the data subject shall have the right to obtain without constraint from the controller, communication in an intelligible form

text: of the data undergoing processing and of any available information as to their source" (paragraph c). In addition, Article 14 of the Regulation provides the data subject with a "right to obtain from the controller the rectification of inaccurate or incomplete personal data".

text: As to the selection of confidential counsellors specifically, the EDPS is aware that a limitation to the right of access of the data subject to the overall final assessment of the selection process is possible, in accordance with the principle of the secrecy of 10 selection committee's proceedings .

text: This principle should nevertheless be read in the light of

text: Article 20(1)

text: (c) of the Regulation, according to which "The community institutions and bodies may restrict the application of [...]

text: articles 13

text: to 17 [...] where such restriction constitutes a necessary measure to safeguard the protection of the data subject or of the rights and freedoms of others". As to the right of rectification of the data processed by the panel during its selection, it is obvious that only objective and factual data may be rectified, and not appreciations done by the members of the selection's panel as those are the result of a subjective appreciation inherent to the selection procedure.

text: Furthermore,

text: Article 20(1)

text: (c) may in certain cases also be applied to protect the right of other applicants. Indeed, in cases where comparative data is involved, the European institution or body may assess on a case by case basis whether full access to the data should be granted to the data subjects or whether certain restrictions should be applied in order to protect the rights and interests of others.

text: In addition, the EDPS notes that limitations to the right of rectification of candidate's data, after the deadline for the sending of documents regarding a given selection, may be necessary for different reasons, including those of a practical nature. In this regard, the EDPS considers that these limitations can be seen as necessary to ensure objective, certain and stable conditions for the selection, and as essential to the fairness of processing. Thus it can be recognized as a necessary measure under

text: Article 20(1)

text: (c) of the Regulation for the protection of the rights and freedoms of others.

text: The EDPS enjoins the European institutions and bodies:

text:  To guarantee the right of access and rectification of the data subject;  To provide the data subject with general information about the

text: restrictions to the right of rectification (see point 7);

text:  To foresee the modalities of exercising a right to block and to erase data;  To specify the duration needed for blocking or erasing personal data.

text: As to the informal procedure The European institutions and bodies should distinguish objective ("hard") and subjective ("soft") data in granting the right of rectification. If

text: inaccurate hard data should be rectified following

text: Article 14

text: , the notion of inaccurate soft data, as explained above, refers to the fact that specific statements have been made by the data subject. In the case of soft data, the data subject may also ask to add his/her opinion to the file to ensure the completeness of the file in accordance with

text: Article 14

text: Examples

text: - The exercise of the rights of access and rectification may be ensured by the possibility given to individuals to make contact by means of a specific functional mailbox, allowing written requests and discretion.

text: - The data subject may request his/her file to be complete - i.e. he or she may request that further information such as additional evaluations (in the case of selection of confidential counsellors) or additional testimonies (in the case of the informal procedure) are added to his/her individual file.

text: Article 20(1)

text: (c) of the Regulation provides for certain restrictions to this right, in particular where necessary to safeguard "the rights and freedoms of an identified third party override the access of the data subject to the information".

text: In this case, data subjects may have their right of access restricted.

text: Example

text: The alleged harassers may experience a limitation to his/her right of access pursuant to this provision, in order to protect the alleged victim.

text: Article 20.3

text: must also be taken into account: "If a restriction provided for by paragraph 1 is imposed, the data subject shall be informed, in accordance with Community law, of the principal reasons on which the application of the restriction is based and of his or her right to have recourse to the European Data Protection Supervisor".

text: Article 20.4

text: must also be taken into account: "If a restriction provided for by paragraph 1 is relied upon to deny access to the data subject, the European Data Protection Supervisor shall, when investigating the complaint, only inform him or her of whether the data have been processed correctly and, if not, whether any necessary corrections have been made".

text: Information may be obtained directly by the data subject ("direct access") or, in other circumstances, by a public authority ("indirect access", usually exercised by an authority in charge of data protection, in the present cases by the EDPS).

text: Example

text: The right of indirect access will come into play, when, for instance, the data subject has been informed of the existence of the processing operations, or is aware of them, but has a restricted right of access under Article 20 of the Regulation.

text: Finally,

text: Article 20.5

text: provides that: "Provision of the information referred to under paragraphs 3 and 4 may be deferred for as long as such information would deprive the restriction imposed by paragraph 1 of its effect". It may be necessary to defer provision of information in order to protect the victim.

text: As a general rule to restrictions, the EDPS recommends to:

text:  Examine any restriction on a case by case basis and in the light of the

text: principle of proportionality, and if necessary after the consultation of the DPO.

text: 7. Information to the data subject

text: Articles 11 and 12 of the Regulation provide for "certain information to be supplied to the data subjects" in order to ensure the transparency and fairness of the processing of personal data.

text: Article 11

text: is applicable if the data have been obtained from the data subject, while

text: Article 12

text: foresees certain requirements in case the data have not been obtained directly from the data subject. These provisions list a series of mandatory and facultative items, for which the latter applies inasmuch as, considering the particular circumstances of the processing under analysis, they are necessary so as to ensure a fair data processing as regard the data subject.

text: The EDPS recommends, given the character of the data being processed, that the data controller uses adequate means to ensure the data subject receives the information.

text: Ideally, the information is provided in a general text (by means of general privacy statement available to all staff members, recalling the provisions of Articles

text: and

text: ); as well as in each specific case (to the alleged victim, and the alleged harasser if the alleged victim agrees to it).

text: It may be necessary in certain cases not to specifically inform the alleged harasser or to defer his/her information, in order not to prejudice the procedure (see

text: Article 20(1)

text: (c) of the Regulation discussed above in point 6).

text: Article 20(5)

text: must also applied in specific circumstances. In the case in point, an alleged harasser will usually be informed by the confidential counsellor, with the prior consent of the victim, of the existence of an informal procedure relating to him. In case the victim does give his/her consent, attention has to be given to this exception.

text: As regards both procedures, the EDPS recommends:

text:  To provide for general information in an exhaustive privacy statement,

text: specific to the European institution or body (including the restriction to

text: the right of rectification in case of the selection of counsellors), at best published on the website or on the intranet of the entity.

text:  To ensure the easy access to this statement.  Provides specific information in case of a harassment procedure to the

text: persons concerned when appropriate.

text: Examples

text: A link to the specific privacy statement or declaration of confidentiality on the web referring to the processing of harassment related data would contribute to ensure its visibility and accessibility and to provide pro-active information. The EDPS considers such linking as a good practice.

text: As for the selection of confidential counsellors, the link could accompany the

text: publication of the call for interests or be joined to the application form at the disposal of the candidates.

text: As for the informal procedure, the link could appear on the web page informing on

text: the network of confidential counsellors and their contact details. During the initial meeting with the confidential counsellor, the privacy statement could be given to the data subject.

text: 8. Security

text: According to Articles 22 and 23 of the Regulation, the controller and the processor must implement the appropriate technical or organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected. Due to the sensitive nature of harassment related data, all processing operations therefore deserve careful consideration in the light of data protection principles. In this context the EDPS highlights the need to put in place appropriate security measures in order to effectively prevent data from being accessed by non-authorised persons. This is particularly true in cases where the confidential counsellors cannot store their personal notes in their office due to the absence of keys or lock boards. The procedure put in place should allow the confidential counsellors to store their documents in the HR Department while ensuring that the personal notes cannot be accessed by anyone else (see point 5 on transfers).

text: These measures should as a minimum include:

text:  The verification of the security policy in place. It should cover the risks of

text: the procedure, taking into account in particular: - the assets under protection (i.e. the paper and/or electronic files), in particular the data processing procedures related to them, and the security measures adopted; - the identification of risks and the list of the security measures adopted to mitigate these risks; - the roles and responsibilities, as well as respective access rights, of all persons involved in the processing as well as the management of the access right (the policy should also be documented).

text:  The use of codes of conduct or confidentiality declarations for all persons

text: involved in the processing.

text: Example

text: The declaration of confidentiality within the informal procedure ideally includes:

text: - an emphasize on the delicate nature and sensibility of personal data the counsellors will have to deal with.  The establishment of appropriate physical access control measures in all

text: areas where paper files are processed.

text: Example

text: Within the informal procedure, all written exchanges shall be in hard copy in

text: sealed envelopes marked "staff matters and confidential" and be delivered by hand. Paper files shall be conserved in locked cupboards, whose keys are only kept either by the confidential counsellors or the contact person/administrator in the HR Department.

text: Annex: List EDPS prior checking opinions relating to the processing of harassment related data

text: 1) Opinion of 29 July 2010 on a notification for Prior Checking received from the Data Protection Officer of the European Aviation Safety Agency (EASA) regarding "EASA policy on protecting the dignity of the person and preventing psychological harassment and sexual harassment" (Case 2010-318).

text: 2) Avis du 6 octobre 2010 sur la notification d'un contrôle préalable reçue du délégué à la protection des données du Comité des régions à propos du dossier "le harcèlement moral et sexuel au travail (procédure contre l'harcèlement)" (Dossier 2010-485).

text: 3) Opinion of 10 February 2010 on a notification for Prior Checking received from the Data Protection Officer of the EU Agency for Fundamental Rights regarding the selection procedures for the selection of Confidential Counsellors (Case 2009-857).

text: 4) Avis du 29 avril 2008 sur la notification d'un contrôle préalable reçue du délégué à la protection des données (DPD) de la Commission européenne à propos du dossier "Sélection des personnes de confiance dans le cadre de la lutte contre le harcèlement moral et le harcèlement sexuel à la Commission européenne" (Dossier 2008-060).

text: 5) Opinion of 18 May 2009 on a notification for Prior Checking received from the Data Protection Officer of the European Parliament regarding "Prevention of harassment" (Case 2008-477).

text: 6) Avis du 30 septembre 2008 sur la notification d'un contrôle préalable reçue du délégué à la protection des données de la Commission européenne à propos du dossier "Mise en œuvre par le service gestionnaire et le réseau des personnes de confiance de la procédure informelle de lutte contre le harcèlement moral et le harcèlement sexuel à la Commission européenne (procédure contre l'harcèlement)" (Dossier 2008-062).

text: 7) Avis du 4 octobre 2007 sur la notification d'un contrôle préalable reçue du délégué à la protection des données de la Cour de justice des Communautés européennes à propos du dossier "procédure de harcèlement" (Dossier 2007-440).

text: 8) Opinion of 28 July 2010 on a notification for Prior Checking received from the Data Protection Officer of the European Economic and Social Committee regarding "The implementation of the informal procedure for treating case of psychological and sexual harassment in the Committee" (Case 2010-321).

text: 9) Opinion of 21 December 2010 on a notification for Prior Checking received from the Data Protection Officer of the European Union Agency for Fundamental Rights (FRA) regarding "FRA policy on protecting the dignity of the person and preventing psychological harassment and sexual harassment" (Case 2010-722).

text: 10) Opinion of 7 February 2011 on a notification for prior checking received from the DPO from EMA regarding the processing operation "listening points/informal procedure" (case 2010-598).


text: As listed in Annex I, as well as available on the EDPS website (www.edps.europa.eu). 2 As well as the corresponding procedures at the European Central Bank (ECB) and European Investment Bank (EIB) in accordance with the respective provisions of the ECB Conditions of Employment or the EIB Staff Regulations.

text: Permanent officials, contract agents, temporary agents, as well as external staff members such as freelance translators. 4 The actual legal provisions are listed in Annex II.

text: Read together with Articles 11(1) and 81 of the Conditions of Employment of Other Servants. 6 Or the last pension payment. 7 Without the supporting documents that should be destroyed in one month after the publication of the list of successful applicants.

text: In detail cf. EDPS Opinion in case 2006-396 on the EAS and EPSO involvement in the certification. 9 Subjected to the national law implementing the Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

text: Cf. in detail below (point 9).

text: In detail cf. EDPS Opinion in case 2006-396 on the EAS and EPSO involvement in certification as already referred to in footnote 6.

amnesord:
Privacy in the EU Institutions
Staff Evaluation

title: Staff Evaluation

text: July 2011

text: Guidelines concerning the processing of personal data in the area of staff evaluation

text: INTRODUCTION

text: These guidelines are issued by the European Data Protection Supervisor

text: 46(d) of the Regulation 45/2001. They are based on the existing 'EDPS jurisprudence' in the area of staff evaluation consisting of 76 opinions on the respective data processing operations by several EU institutions, bodies and agencies . They address the following procedures: - staff evaluation stricto sensu, also referred to as staff performance

text: assessment, staff appraisal or career development review/report (CDR),

text: Conditions of Employment of Other Servants - CEOS), including the

text: possible use of performance indicators for the purpose of such evaluation,

text: ‐ probationary reports, also referred to as establishment of officials or

text: initial staff evaluation, based on Article 34 of the Staff Regulations (and/or Articles 14 and 84 CEOS), as well as management probationary reports in terms of Articles 44 - 46 of the Staff Regulations,

text: ‐ promotion of officials based on Article 45 of the Staff Regulations

text: (including the evaluation of ability to work in a third EU language within the first promotion and/or renewal of a contract for an indefinite period in terms of Article 85(3) CEOS),

text: enabling appointment of an AST official to a job in the AD function group by means of a compulsory vocational training by European Administrative

text: Staff Regulations allowing former C and D officials in service before 1st May 2004 to become full members of the AST function group ('administrative assistants') .

text: These processing operations are subject to prior checking on a basis of Article 27(2)(b) of Regulation 45/2001 since they are intended to evaluate personal

text: aspects relating to the data subject; namely, the ability, efficiency and conduct of the respective staff members .

text: The objective of the Guidelines is to offer practical guidance and assistance to all Data Protection Officers and controllers in their task of notifying the existing and/or future evaluation related data processing to the EDPS. The DPO network has been consulted on the draft Guidelines in May 2011.

text: Their aim is to present in a clear and concise way the EDPS positions and recommendations regarding the data protection principles enshrined in Regulation 45/2001, as well as to provide information about existing best practices.

text: In each section below, issues common to several procedures are outlined first, before possible procedure specific aspects are addressed.

text: 1. LAWFULNESS OF PROCESSING

text: Article 5(a) of Regulation 45/2001 provides that personal data may be processed only if the processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties or other legal instruments adopted on the basis thereof. Recital 27 further specifies that processing of personal data for the performance of tasks carried out in public interest by the EU institutions and bodies includes the processing necessary for their management and functioning.

text: As it has been already outlined above, the legal bases for the respective data processing operations can be found in the Staff Regulations (Articles 34, 43, 45 - 46, as well as Article 10(3) of Annex XIII), the Conditions of Employment of Other Servants (Articles 14, 81, 84 and 87) , as well as in the respective

text: implementing rules adopted on a basis of Article 110 of the Staff

text: Regulations.

text: Given the fact that the processing of personal data is considered as necessary for the execution of the (initial) evaluation, promotion, regrading, attestation and certification procedures provided for in the Staff Regulations, the processing of personal data carried out in this context can be considered as lawful.

text: The use of performance indicators related data for annual evaluation could be considered legitimate provided it is used only as a support tool, as well as based on an appropriate legal instrument outlining adequate guarantees for

text: rectification of inaccurate data and justification of certain figures by the staff member concerned.

text: 2. PROCESSING OF SPECIAL CATEGORIES OF DATA

text: According to Article 10 of Regulation 45/2001, processing of certain sensitive data is prohibited unless in certain predefined circumstances.

text: In the framework of the probation procedure, data concerning health may be

text: The processing of such data may be justified in terms of Article 10(2)(b) of Regulation 45/2001 as it is necessary to comply with the controller's obligations in the area of employment law as foreseen by the Staff Regulations.

text: Furthermore, within the staff evaluation as such, data revealing trade union membership may be collected. These data may consist of information

text: spontaneously provided in the self-assessment part of CDRs ('additional duties'), such as information about membership in the joint committees.

text: The processing of such data may be justified on the basis of Article 10(2)(a), (b) and/or (d) of Regulation 45/2001 since it would be considered either necessary for the employer's compliance with specific rights and legal obligations and/or concern data already manifestly made public by the data subject him or herself or eventually be based on a freely given, specific and informed indication of his or her wishes (consent of the data subject).

text: 3. DATA QUALITY

text: Pursuant to Article 4(1)(a), (c) and (d) of Regulation 45/2001, personal data must be processed fairly and lawfully, be adequate, relevant and not excessive in relation to the purpose for which they are collected and further processed, as well as accurate.

text: Proportionality: The administrative and evaluation data processed in this

text: context must be necessary for accomplishment of the respective procedure.

text: In this respect, the collection of the following administrative data may be considered excessive for the purpose of staff appraisal: nationality, date of birth, details concerning previous education and career, as well as contact details of previous reporting officer(s).

text: Also, the collection of medical data within the respective probation reports is deemed unnecessary for the purpose of completion of the particular

text: procedure. It is recommended that the reason for the extension of the probationary period (sickness, maternity or accident) is provided in a separate note and that no information about the actual diagnosis is processed within the probation procedure.

text: Accuracy: The data processed must be accurate, and where necessary, kept

text: up to date, whereas every reasonable step must be taken to ensure that inaccurate or incomplete data are erased or rectified.

text: The accuracy of the administrative data processed in this context can be

text: ensured by the nature of the procedure itself. In fact, part of the data is provided by the data subjects themselves (in the self-assessment part of the CDR, as well as the applications for certification and attestation). Also, the yearly repetition of appraisal and promotion procedures enables to ensure that the data processed are up to date.

text: The accuracy of the evaluation data processed is difficult to establish due to

text: their subjective nature. In fact, the evaluation of the staff performance constitutes largely subjective judgements by the hierarchical superiors against specified predefined criteria. In any case, data subjects must be provided with a possibility to add their comments directly on the respective reports.

text: In addition, data subject rights of access, rectification and/or appeal contribute to the accuracy of the data processed (as outlined below).

text: 4. DATA RETENTION

text: According to Article 4(1)(e) of Regulation 45/2001, personal data may be kept in a form enabling the identification of data subjects for no longer than necessary for the purposes for which they were collected or further processed. Further storage of data for historical, statistical or scientific

text: purpose is possible in anonymous form only.

text: The following evaluation related documents containing personal data are

text: being kept in personal files in line with Article 26 of the Staff Regulations

text: for up to ten years after the termination of employment : - career development reports, - probation reports, - promotion/regrading decisions, as well as letters confirming the final award of the respective points, - certification files of successful applicants (application , training attendance and exam results),

text: - attestation decisions.

text: The necessity for such a lengthy conservation period may be questionable as it does not correspond to the specific purposes for which the data were collected and/or further processed, i.e. the accomplishment of the respective evaluation exercise. In this respect, in certain cases, the storage of evaluation reports for up to five years after the end of a particular evaluation procedure would be considered appropriate.

text: This is especially true as concerns evaluation reports which need not necessarily still be relevant during the whole career of the person concerned. Evaluators should be able to consult previous reports to assess the progress made by the member of staff but appropriate time limits should be established as to how far back the reports can go.

text: Promotion, certification, attestation decisions would in principle need to be kept during the career of the member of staff, but not all related documents should be kept after a certain period.

text: Also, further storage of lists published on the Intranet within promotion and certification procedures for five years is considered as appropriate for audit purposes.

text: Finally, the files of unsuccessful applicants for certification and attestation can be kept until all appeal channels have been exhausted, including the time limits for appeals before the Civil Service Tribunal.

text: 5. COMPATIBLE USE / CHANGE OF PURPOSE

text: Pursuant to Article 4(1)(b) of Regulation 45/2001, personal data should be collected for specified, explicit and legitimate purpose and not further processed in a way incompatible with those purposes. Possible change of purpose is only permissible if explicitly allowed by the internal rules of the EU institution or body, as provided for in Article 6(1) of Regulation 45/2001.

text: In this respect, the following processing operations have been considered fully compatible with the original purpose in terms of Article 4(1)(b) of the Regulation: - processing of data collected within the probationary report for the preparation of the first evaluation report (CDR) and the follow-up of the individual training, - processing of data collected within evaluation report (CDR) for subsequent career development, promotion or regrading, renewal of contracts, as well as follow up of individual training.

text: 6. DATA TRANSFERS

text: Internal transfers: Data processed within evaluation procedures are mainly

text: transferred to recipients within the same or to other institution, body or agency. As outlined in Article 7 of Regulation 45/2001, such transfers have to be necessary for the legitimate performance of tasks covered by the competence of the recipient who cannot process the data for any other purpose than for which they were transmitted.

text: Transfers to the respective hierarchical superiors (reporting officers, countersigning officers, appeal assessors and appointing authority), responsible Human Resources staff members, as well as members of the respective joint committees may be considered necessary for the accomplishment of the particular (initial) evaluation, promotion or regrading procedure.

text: In addition, within the certification procedure, transfers of applicants' files to the European Administration School (EAS) and the European Personnel Selection Office (EPSO), as well as data transfers from EPSO to the body managing the internal network and the computer system storage and hosting environment (DG DIGIT) can be considered as necessary for the accomplishment of this particular procedure .

text: Furthermore, the transfers to internal auditors, Legal Service, Civil Service Tribunal, EDPS and European Ombudsman can be considered necessary in certain cases for the performance of the respective supervisory, advisory or judicial task.

text: Finally, transfers of administrative and evaluation data contained in the personal files to responsible services in other EU institutions, bodies or agencies can be considered necessary in case of the transfer of a specific staff member.

text: In order to ensure full compliance with Regulation 45/2001, the EDPS recommends that all internal recipients are reminded of the purpose limitation obligation in terms of Article 7(3) of the Regulation.

text: External transfers: According to Article 8(a) of Regulation 45/2001,

text: transfers to external recipients established in the EU have to be necessary for the performance of a task carried out in the public interest or subject to the exercise of public authority.

text: So, in the present context, external subjects would need to act on behalf of a particular EU institution, body or agency, i.e. as processors within the meaning of Article 2(e) of the Regulation .

text: Accordingly, the data transfers to the external instructors involved in compulsory training on behalf of the EAS, as well as to the external assessors sitting on the Examination Boards on behalf of the EPSO can be

text: considered necessary for the provision of the respective training, as well as the assessment of the concerned officials within the certification procedure.

text: 7. RIGHTS OF DATA SUBJECTS

text: The data subjects' rights of access and rectification are enshrined in

text: Articles 13 and 14 of Regulation 45/2001.

text: In principle, within the evaluation procedures, data subjects are provided with a copy of their reports and are invited to make comments on them, as foreseen in Articles 34 and 43 of the Staff Regulations, as well as Articles 14 and 84 CEOS. They can also obtain access to all the documents in their personal file even after leaving the service as provided for in Article 26 of the Staff Regulations, as well as Articles 11(1) and 81 of the CEOS.

text: The rectification of the factual data processed is possible upon request to the controller, whereas the (by nature subjective) evaluation data can be rectified

text: within the respective appeal procedures. In any case, it should be ensured

text: that the revised reports are being added to the personal file.

text: 8. INFORMATION TO DATA SUBJECTS

text: In order to ensure transparency and fairness of the processing, the following information listed in Articles 11 and/or 12 of Regulation 45/2001 should be provided to data subjects: ‐ identity of the controller, ‐ purpose of the processing, ‐ data categories, ‐ whether replies to the questions are obligatory or voluntary, as well as possible consequences of failure to reply, ‐ possible data recipients, ‐ existence of rights of access, rectification and recourse to the EDPS, ‐ legal basis of the processing, ‐ applicable data retention periods.

text: Due to the fact that this information should be provided either at the collection of data or before their first disclosure to a third party, the following

text: communication means were considered as appropriate for the particular procedure: ‐ data protection clause in the respective report form, application form or messages sent to data subjects, and ‐ specific privacy statement made available on the Intranet.

text: 9. PROCESSOR

text: As already mentioned above, the external instructors and assessors taking part in certification on behalf of EAS/EPSO, as well as DG DIGIT managing the internal network and the computer system storage and hosting environment for EPSO have to be considered as data processors in terms of Article 2(e) of Regulation 45/2001 since they are processing personal data of staff members taking part in the EAS compulsory training and exams on behalf of the Office.

text: Pursuant to Article 23 of Regulation 45/2001, a contract or legal act binding the processor to the controller should be established which stipulates, in particular, that the processor can act only on instructions from the controller and that he has to comply with obligations of confidentiality and security as set out in Articles 21 and 22 of the Regulation, unless he is already subject to these obligations outlined in the respective national law transposing Articles

text: and

text: of Directive 95/46/EC.

text: Accordingly, the training instructors and members of the Examination Boards

text: are obliged to sign a 'confidentiality note' at their first certification related meeting, whereas a service contract between the EPSO and the DG DIGIT

text: concerning the storage and hosting of personal data processed within the certification procedure has been established . All these legal documents should provide for an explicit reference to the applicable national data protection legislation.