text: EDPS CoI Guidelines - 8 December 2014 2

text: Regulation 45/2001 of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, OJ L 8, 12.01.2001, p. 1. 2 Any reference to “independence” within these Guidelines with regard to EU institutions should be understood with regard to the specific tasks of the EU institution concerned. It mainly refers to objectiveness in fulfilling their tasks in the public interest and in the interest of the European Union, without prejudice to specific safeguards of independence expressly provided for by the Treaties or other founding acts for certain EU institutions. 3 Regulation No 31 (EEC), 11 (EAEC) laying down the Staff Regulations of Officials and Conditions of Employment of Other Servants of the Economic Community and the European Atomic Energy Community, OJ 45, 14.6.1962, p. 1385, as amended. The Staff Regulations apply to officials and the CEOS to contract and temporary agents, parliamentary assistants and special advisers. Any further refer to the Staff Regulations will include CEOS. See in this respect also the Public Service Principles for EU civil servants by the European Ombudsman, http://www.ombudsman.europa.eu/en/resources/publicserviceprinciples.faces. 5 The declaration of interest (DoI) covers only the interests of the person concerned and it is for the EU institution to evaluate the existence of any potential conflict of interests based on the information provided. It is not covered by the Staff Regulations. These guidelines cover DoI as well as declarations of conflict of interest (DcI), in which the person concerned declares whether he/she has a conflict of interest. DcI apply to staff under Staff Regulations (see for example Articles

text: and

text: a). Both categories aim at managing conflicts of interest.

text: EDPS CoI Guidelines - 8 December 2014 4

text: See the general principles highlighted by the Court of Justice in this respect: "the institutions are obliged to balance, before disclosing information relating to a natural person, the European Union’s interest in guaranteeing the transparency of its actions and the infringement of the rights recognised by Articles 7 and 8 of the Charter. No automatic priority can be conferred on the objective of transparency over the right to protection of personal data (...), even if important economic interests are at stake" (joined ECJ Cases

text: and

text: , Schecke and Eifert, para. 85). 7 See, e.g. Civil Service Tribunal

text: Case F-46/09

text: , V v. EP, paragraph 143. 8 DPOs were invited to discuss the Draft Guidelines also internally with relevant controllers and ethics officers.

text: EDPS CoI Guidelines - 8 December 2014 5

text: See the definition in Managing Conflict of Interest in the public service, OECD 2003, p. 24. 10

text: Article 11

text: a first paragraph of the Staff Regulations. 11 This category is used for the ease of reference, although many of the persons listed below are not in an employment relationship with EU institutions, but only performing work for EU institutions for a specific mandate, a specific expert opinion, project, etc. 12 Such persons are not subject to the Staff Regulations. 13 Some of these categories are covered by the Staff Regulations (officials, temporary agents, contract agents, parliamentary assistants, special advisers), while other are not (permanent staff of institutions that have their own staff rules - such as the European Central Bank,the European Investment Bank and certain agencies-, interim staff, seconded national experts, trainees).

text: EDPS CoI Guidelines - 8 December 2014 6

text: See EDPS Guidelines on administrative enquiries and disciplinary measures: https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Supervision/Guid elines/10-04-23_Guidelines_inquiries_EN.pdf. 15 These Guidelines only deal with the processing of conflict of interest forms, however, the same principles (data quality, necessity…) can often be applied when processing or notably publishing the Curriculum Vitae (“CV”) of persons working for EU institutions. 16 In addition to the grounds for lawfulness examined hereinafter, with regard to some experts the lawfulness of the processing could possibly also be based on

text: Article 5

text: (c) of the Regulation, if the processing is necessary for the performance of a contract to which the data subject is a party.

text: EDPS CoI Guidelines - 8 December 2014 7

text: See for example Article 37(1) of EFSA Founding Regulation (

text: Regulation (EC) No 178/2002 of 28 January 2002

text: laying down the principles and requirements of food law, establishing the European Food Safety Authority and laying down procedures in matters of food safety), OJ L31, 1 February 2002); Article 19(2) of ECDC Founding Regulation (

text: Regulation (EC) No 851/2004 of 21 April 2004

text: establishing a European centre for disease prevention and control, OJ L 142, 30 April 2004). 18 See for ex.

text: Article 37(2)

text: and (3) of EFSA Founding Regulation and

text: Article 19(2)

text: and (3) of ECDC Founding Regulation.

text: EDPS CoI Guidelines - 8 December 2014 8

text: If the obligation to submit DoI is included in the Founding Regulation of the Agency, it is a legal obligation under

text: Article 5

text: (b) of the Regulation. See above Section A.1. 20 See also

text: Article 11

text: second paragraph for gifts,

text: Article 12

text: b for outside activities and

text: Article 13

text: for the declaration of the gainful employment of a spouse. By contrast with Articles

text: and

text: second paragraph of the Staff Regulations (see above Section A.1.), these provisions do not include a legal obligation to submit DoI and therefore do not fall within the scope of

text: Article 5

text: (b) of the Regulation.

text: EDPS CoI Guidelines - 8 December 2014 9

text: Article 5

text: (b) of the Regulation. See above Section A.1.

text: EDPS CoI Guidelines - 8 December 2014 10

text: The risk with regard to those persons who do not have real influence on decisions for the EU institutions would be that they could leak information in case they have (current or past) relations with an entity which could create a conflict of interest. However in this context, it is important to underline that the conflict of interest rules are not aimed at preventing any potential leaks by such persons. All officials and agents are subject to the obligation of professional secrecy and must refrain from any unauthorised disclosure (Article 17 of the Staff Regulations and Articles 11 and 81 of the CEOS). The same principles also apply to other staff employed by the EU institutions (SNEs, trainees, etc.).

text: EDPS CoI Guidelines - 8 December 2014 11

text: Regulation (EC) No 1049/2001 of 30 May 2001

text: of the European Parliament and of the Council regarding public access to European Parliament, Council and Commission documents, OJ L145, 31.5.2001. 24 ECJ

text: Case C-28/08

text: P, Bavarian Lager, at para. 63. 25 Published on the EDPS website: https://secure.edps.europa.eu/EDPSWEB/webdav/shared/Documents/EDPS/Publications/Papers/Ba ckgroundP/11-03-24_Bavarian_Lager_EN.pdf. 26 See notably joined ECJ Cases

text: and

text: , Schecke and Eifert, §§72-88.

text: EDPS CoI Guidelines - 8 December 2014 12

text: EDPS CoI Guidelines - 8 December 2014 13

text: For example, civil servants on a national regulatory agency could be seen as lower risk than researchers receiving funding from medical companies. 28 See also EDPS Background Paper on "Public access to documents containing personal data after the Bavarian Lager ruling"(see footnote 25). 29 See in this context

text: Article 16

text: paragraph 3 of the Staff Regulations prohibits in principle former senior officials, during the 12 months after leaving the service, from engaging in lobbying or advocacy vis-à-vis staff of their former institution for their business, clients or employers on matters for which they were responsible during the last three years in the service, and

text: Article 16

text: paragraph 4 adds that the institutions shall "publish annually information on the implementation of the third paragraph, including a list of the cases assessed". See on this matter the draft Recommendation of the EU Ombudsman of 22 September 2014: http://www.ombudsman.europa.eu/en/cases/draftrecommendation.faces/en/56216/html.bookmark

text: EDPS CoI Guidelines - 8 December 2014 14

text: However, it might be necessary to give public access to a declaration of interest upon request for public access to documents on the basis of Regulation 1049/2001 under the conditions provided therein. 31 See WP29 Opinion 15/2011 on the definition of consent, adopted on 13 July 2011 and WP29 Opinion 8/2001 on the processing of data in the employment context, adopted on 13 September 2001.

text: EDPS CoI Guidelines - 8 December 2014 15

text: Article 10(1) of the Regulation establishes that "the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and of data concerning health or sex life, are prohibited". 33 See above Section 2. Lawfulness of the data processing operations.

text: EDPS CoI Guidelines - 8 December 2014 16

text: EDPS CoI Guidelines - 8 December 2014 17

text: As far as persons covered by the Staff Regulations are concerned, Article 13 of the Staff Regulations only covers spouses. 36

text: Article 4(1)

text: (d) of the Regulation.

text: EDPS CoI Guidelines - 8 December 2014 18

text: The EDPS has for instance accepted a conservation period of 5 years after the end of mandate or contract. 38 See also EDPS Guidelines on the rights of individuals with regard to the processing of personal data, 25 February 2014. (https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Supervision/Guid elines/14-02-25_GL_DS_rights_EN.pdf).

text: EDPS CoI Guidelines - 8 December 2014 19

text: See footnote 25.

text: EDPS CoI Guidelines - 8 December 2014 20

text: See footnote 25. 41 Article 18 of the Regulation.

text: EDPS CoI Guidelines - 8 December 2014 21

text: Regarding compelling legitimate grounds, see pp. 24-25 of EDPS Guidelines on the rights of individuals with regard to the processing of personal data, 25 February 2014. (https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Supervision/Guid elines/14-02-25_GL_DS_rights_EN.pdf). 43 The French version of

text: Article 27(2)

text: (b) reinforces this approach, by referring to “des aspects de la personnalité” (“aspects of the personality”).The German version refers to the “Persönlichkeit” i.e. the personality of the data subjects to be evaluated.

text: EDPS CoI Guidelines - 8 December 2014 22

text: In case such procedures provide for instance for the exclusion of an expert from participating from any funding in the future, also

text: Article 27(2)

text: (d) of the Regulation can be a basis for prior checking.

text: EDPS CoI Guidelines - 8 December 2014 23

identifier: EDPS riktlinjer (2014)

amnesord:
Privacy in the EU Institutions
Conflicts of Interest

publisher: Europeiska datatillsynsmannen

sprak: en

title: Conflicts of Interest

serie: riktlinjer

text: 8 December 2014

type: stycke

text: Guidelines on the processing of personal data with regard to the management of conflicts of interest in EU institutions and bodies

type: rubrik

text: Executive summary

text: These Guidelines focus on the processing of personal data with regard to declarations relating to the management of conflicts of interests. The information provided and processed for that purpose may affect individuals' private lives. The objective of these Guidelines is to provide EU institutions and bodies with practical guidance on respecting the data protection rules and find a balance between the public interest for transparency and the individual's rights to privacy and data protection. Data protection principles may considerably strengthen the management and prevention of conflicts of interest.

text: The Guidelines cover declarations relating to the management of conflicts of interest by all persons working for EU institutions and bodies or appointed to high political and management posts, including, where applicable, their household members. They highlight the need to have an appropriate legal basis for such processing activities. The EDPS encourages the EU institutions and bodies as controllers to ensure the lawfulness of the processing.

text: The necessity for such processing may differ according to the different groups of individuals concerned (notably high management and political posts, persons employed by the EU institutions or external experts). Depending on the tasks of these persons, it can sometimes be necessary to publish those declarations to allow control by the public and peers. Such analysis must be made case-by-case, taking notably into account the tasks and responsibilities of the individual concerned.

text: The Guidelines also underline the right of information and the right to object to certain processing, in particular to publication. Furthermore, specific safeguards need to be provided for sensitive data that might be processed in this context. Finally, the Guidelines clarify that the processing of declarations relating to the management of conflicts of interest is not subject to prior checking by the EDPS.

text: 1. Introduction

text: These guidelines (“Guidelines”) are issued by the European Data Protection Supervisor (“EDPS”) in the exercise of the powers conferred on him in Articles 41(2) and 46(d) of

text: Regulation (EC) No 45/2001

text: on the protection of personal data by European institutions and bodies (“the Regulation”).

text: Background

text: EU institutions and bodies (hereinafter for the ease of reference jointly referred to “EU institutions”), like other public authorities, must establish policies, take decisions or grant funds. The EU institutions must be able to demonstrate that they have been acting impartially and objectively; they are accountable vis-à-vis the EU citizens. Their capacity to demonstrate their independence to act in the interest of the EU will influence public trust in EU institutions.

text: The Staff Regulations (including the Conditions of Employment of Other Servants or “CEOS”) as well as other legislative instruments and ethics rules provide for independence, impartiality, objectivity and loyalty of staff members and other persons working for the EU institutions. EU institutions have set up procedures such as the management of conflicts of interest to comply with these legal obligations.

text: These procedures entail the processing of personal data. To fill in declarations relating to the management of conflicts of interests (hereinafter "DoI" and/or "DcI") , individuals are required to provide personal information about their professional and private life such as their name, past/present/future employment or professional activities, shareholdings in companies or functions in associations/organisations or the professional activities of their spouse, partner or household members.

text: In some cases, the publication of those declarations is essential to safeguard the independence of the individuals and their acting in the interest of the EU. Publication may be necessary to allow control by the public and/or peers in fields which require

text: specific expertise and market knowledge, in particular in agencies, where it might need to rely on additional checks-and-balances by other experts in this field. In other cases, publication may be necessary to encourage public trust by showing the public that persons appointed to high political and management posts have no conflicts of interest.

text: These Guidelines explain how to apply the data protection principles in this specific context which may affect individuals' private lives. They provide EU institutions and their Data Protection Officers ("DPO"s) with practical guidance when they process or have to consider processing of personal data in these areas. In particular they provide guidance on how to strike the balance between the public interest for transparency and the individual’s rights to privacy and data protection in this specific context . Finally, the Guidelines will clarify that the processing of declarations relating to the management of conflicts of interest is not subject to prior checking.

text: The Guidelines build on previous EDPS decisions and Opinions (on administrative consultations and prior checks). Therefore, respecting the Guidelines gives a reasonable assurance that the controller is not in breach of the Regulation. On the other hand, any unlawful processing of personal data with regard to such declarations not only triggers a breach of the Regulation and the applicability of the relevant remedies and sanctions, but may also affect the validity of specific acts or administrative decisions where based on the unlawful or unfair processing of personal data. Finally, the Guidelines also explain the EDPS’ policy on issues that have not been specifically dealt with so far in his previous Opinions, or which are still open to interpretation.

text: The Guidelines also show that the data protection principles may considerably strengthen the management and prevention of conflicts of interest. Thus, the application of these principles does not weaken the obligations incumbent on EU institutions or make the procedures of declarations of interest devoid of substance.

text: It should also be noted that this document only deals with the aspects relating to the processing of personal data in the context of declarations relating to the management of conflicts of interest and not with the policies on conflicts of interest or ethic rules in general.

text: The DPOs and the European Ombudsman were consulted on these Guidelines prior to their adoption.

text: Scope

text: The Guidelines focus on declarations where information on shareholdings, memberships, former employments, etc. is processed. However, the principles described for such processing can – where appropriate in view of their common features – also be applied to other types of ethics declarations such as authorisations of outside activities, authorisations of occupational activities of staff members after leaving EU institutions (“revolving doors”), and authorisations to receive a gift. All these processing operations aim at avoiding conflicts of interest or a breach of any other ethic rules.

text: A "conflict of interest" involves an actual, apparent or potential conflict between the public duty and private interests of public officials, in which they have privatecapacity interests which could improperly influence the performance of their official duties and responsibilities. The Staff Regulations define a conflict of interest as a situation where persons deal in the performance of their duties for the EU institutions with a matter in which, directly or indirectly, they have a personal interest such as to 10 impair their independence, and in particular, family and financial interests . The same shall apply to other persons working for EU institutions, notably external experts.

text: There are three main groups of persons (hereinafter jointly referred to as "persons working for the EU institutions") covered by these Guidelines:

text: - Persons appointed to high management and political posts (such as Members of the College of Commissioners or the Court of Auditors, Members of the Management Board of agencies, members of management or supervisory boards/committees of agencies, boards of directors or other control or supervisory bodies) and Members of the European Parliament; hereinafter jointly referred to as "High management and political posts and Members of Parliament" ;

text: - Persons employed by EU institutions (notably officials, temporary agents, contract agents, parliamentary assistants, special advisers–interim staff, seconded national experts ("SNEs"), or trainees); hereinafter jointly referred to as "Persons 13 employed by the EU institutions" ;

text: - External advisors working occasionally for EU institutions, i.e. external experts, members of scientific or other advisory boards, boards of regulators, panels or committees, special advisors; hereinafter jointly referred to as "External experts".

text: It should be noted that the information required from these persons may also relate to their household members and thus also involve persons who have no direct relationship with an EU institution.

text: In terms of processing operations, two different activities can be distinguished:

text: A. the collection and assessment of personal data in the declarations within

text: an EU institution, and

text: B. the publication of declarations on the internet or in public registers.

text: The Guidelines only cover the processing of personal data in DoI/DcI (either in a form or ad hoc). The procedure launched in the event of a failure to respect the conflict of interest rules is not covered by these Guidelines (for example, disciplinary procedure , scientific misconduct procedure).

text: 2. Lawfulness of the data processing operations

text: The processing of personal data in DoI/DcI like any processing of personal data 15 16 would require an appropriate legal basis in line with Article 5 of the Regulation.

text: A. Collection and assessment of declarations

text: A.1. Legal obligation (

text: Article 5

text: (b) of the Regulation)

text: Under

text: Article 5

text: (b) of the Regulation, a data processing is lawful when the processing is "necessary for compliance with a legal obligation to which the controller is subject".

text: Article 5

text: (b) applies in cases where a legal obligation requires the EU institutions to process personal data without leeway in its implementation. This implies that institutions have no choice as to whether or not fulfilling the legal obligation but also that the obligation itself must be sufficiently specific as to the processing of personal data it requires.

text: In this context, a legal obligation under

text: Article 5

text: (b) only exists for an EU institution if the processing of DoI/DcI is provided by a legal act of a higher order, e.g. the TFEU, the Staff Regulations or the Founding Regulations of an agency.

text: The legal basis may differ according to the type of person working for an EU institution.

text: a) High management and political posts and Members of Parliament

text: The Founding Regulation of an Agency sometimes provides for the obligation to make DoI for high management posts.

text: b) Persons employed by the EU institutions

text: A legal obligation exists in relation with persons employed by the EU institutions that are covered by the Staff Regulations. Indeed,

text: Article 11

text: third paragraph of the Staff Regulations provides that before recruitment, the EU institutions shall examine whether the candidate has any personal interest such as to impair his independence or any specific conflict of interest and that the candidate shall fill in a specific form to that end.

text: Article 16

text: second paragraph of the Staff Regulations provides for a similar obligation regarding former staff members who intend to engage in an occupational activity after leaving the service.

text: Similar obligations apply to temporary agents, contract agents and parliamentary assistants (Articles 11, 81 and 127 of the CEOS refer notably to Articles 11 and 16 of the Staff Regulations). For special advisers, Article 124 of the CEOS only refers to the obligation to make DCI under Article 11 of the Staff Regulations.

text: c) External experts

text: The Founding Regulation of an Agency sometimes provides for the obligation to make DoI for external experts.

text: A.2. Necessity for a task carried out in the public interest (

text: Article 5

text: (a) of the Regulation)

text: In the absence of a legal obligation under

text: Article 5

text: (b) of the Regulation, the main ground for processing personal data with regard to DoI/DcI will be

text: Article 5

text: (a) of the Regulation.

text: Article 5

text: (a) stipulates two elements to be taken into account to determine whether the processing operations comply with the Regulation:

text: - the processing activity (here the management of conflicts of interest or compliance with ethics rules) is a task carried out in the public interest on the basis of the Treaty or other legal instruments adopted on the basis thereof (see below Section A.2.1.); - the processing operations must be necessary for the performance of this task (see below Section A.2.2.).

text: Recital 27 of the Regulation further specifies that this "includes the processing of personal data necessary for the management and functioning of those institutions and bodies".

text: A.2.1 Legal basis

text: The first element of

text: Article 5

text: (a), a legal basis for the processing, is of key importance. Furthermore, sensitive data pursuant to Article 10 of the Regulation might also be processed (See Section 3 below), reinforcing the need for a solid legal basis.

text: A specific legal instrument (e.g. specific rules for conflicts of interest) should be adopted or rules in a general legal instrument (e.g. a General Policy/Decision on ethics and conflicts of interest) should cover the processing activities of personal data concerning DoI by these persons (and if applicable their household members).

text: A binding decision of an Agency (e.g. a decision of the governing board) sometimes provides for the obligation to make DoI for high management posts in the Agency. However, currently often only soft law provides for a regime for processing personal data in this context, notably in Codes of Conduct.

text: EU institutions should make sure that an adequate binding legal basis is adopted and that processing of personal data is not solely based on instruments of soft law.

text: For persons covered by the Staff Regulations, the latter provides for a legal basis for most of the processing activities (reinforced by Recital 27 of the Regulation), in particular

text: Article 11

text: a for declarations of interest of officials during employment.

text: Furthermore Article 57 of the Financial Regulations contains rules on DcI for financial actors and other persons involved in budget implementation and management.

text: For temporary agents, contract agents and parliamentary assistants, Articles 11, 81 and 127 of the CEOS refer to the respective Articles of the Staff Regulations. For special advisers, Article 124 of the CEOS refers to

text: Article 11

text: a of the Staff Regulations.

text: In addition, EU institutions have often adopted specific implementing rules, administrative measures or internal policies on conflicts of interest. These additional legal instruments provide for the modalities, the frequency and procedures for such declarations.

text: For all other persons employed by EU institutions who are not covered by the Staff Regulations, a specific legal basis is necessary to allow the processing of their personal data. This is notably the case for SNEs, interim staff or trainees employed by an EU institution, as well as for staff members employed by institutions that have their own staff rules. The provisions on the processing of their personal data in DoI/DcI can also be included in a general legal act (e.g. general Decision by the Executive Director of an Agency).

text: c) External experts

text: A specific legal instrument (e.g. specific rules on conflicts of interest) should provide for the management of conflicts of interest - and those of possible household members - with regard to DoI. This may be either a separate legal instrument for the processing of DoI which also covers such external experts or a specific instrument governing them .

text: A.2.2 Necessity

text: As far as the second element of

text: Article 5

text: (a) of the Regulation is concerned, the necessity for the processing of personal data has to be evaluated. The necessity will depend on the concrete functions of the persons working for an EU institution. The purpose of the processing is to safeguard the independence of the relevant EU institution by ensuring impartiality of the persons concerned. The processing operations supporting the procedure for DoI/DcI can be regarded in general as an important step to ensure such independence and therefore clearly serves a public interest.

text: However, a balance must be struck between the importance of ethics and independence obligations and the possible intrusion in the right to privacy of the persons concerned, who may not have a direct relationship with the EU institution. This balance will differ according to the type of persons concerned. Criteria such as the function, role and possible influence of the persons having such a direct relationship in the decision-making process are crucial. In this respect, institutions should be selective and only process personal data when it is justified depending on the responsibility of the persons concerned.

text: The position of these persons requires a high degree of impartiality in the performance of their duties which justifies the obligation to declare their interests. Necessity is therefore easily demonstrated. For such posts the submission of a DoI on a regular basis will also increase trust in EU institutions as the existence of procedures to screen conflict of interests indicates a culture of integrity.

text: The absence of a conflict of interest needs to be safeguarded during active employment for all persons employed by EU institutions who have decision-making power or the possibility to draft, influence or review legislation or decisions.

text: The persons covered by the Staff Regulations are obliged to declare any conflict of interest on their own initiative according to

text: Article 11

text: a of the Staff Regulations. In such case, where the initiative comes from the person concerned, there is no margin of manoeuver for the EU institution as to the necessity of the processing. The purpose of the procedure is not to assess that the person is independent and/or impartial but rather that he/she had no past/current activities or interests that could impair his/her independence and if he/she has, to allow the Appointing Authority to take appropriate measures.

text: For the other persons employed by the EU institutions but not covered by the Staff Regulations (such as SNEs, staff employed by EU institutions that have their own staff rules), the obligation to regularly submit a DoI/DcI (e.g. on a yearly basis) and the subsequent processing of personal data by the EU institutions could be justified for functions where there is a particular risk of a conflict of interest. The assessment of necessity for a declaration and its processing by the EU institutions at regular intervals ultimately depends on the function of the persons concerned or on the core business of the EU institution in question. Necessity must be demonstrated for all categories of employees requested to make such a regular declaration. Notably it is doubtful whether those who have no influence on a decision or a scientific opinion in general should be requested to fill in DoI/DcI regularly. For functions within EU institutions without any real decision-making power or power to influence decisions or scientific opinion in their official tasks (such as secretaries, administrative support functions, library staff or HR officers), the submission of a regular DoI/DcI does not in general appear necessary.

text: c) External experts

text: External experts may have significant influence and powers within the EU decisionmaking process notably by providing expert opinions and scientific advice. This is particularly true for those working for committees or panels which authorise or approve certain products or services for some Agencies (e.g. in the field of pharmaceuticals or food). Therefore for such experts the submission of DoI on a regular basis (e.g. annually, at the beginning of each expert meeting, etc.) appears justified. The fact that an EU institution has a procedure to screen conflicts of interests in this context is an indication of a culture to foster integrity and public trust.

text: B. Publication

text: In some cases, the publication of declarations might be necessary to ensure that EU institutions are working in the interest of the European Union. This gives rise to specific issues which will be discussed below.

text: Furthermore, EU institutions might also be faced with requests for public access to 23 documents on the basis of Regulation No. 1049/2001 (e.g. by journalists, companies concerned by the decision taken by the EU institution) for such DoI, DcI or decisions based thereon. As such declarations contain personal data relating to the persons working for the EU institutions and possibly of others, the EU institutions have to assess the exception pursuant to

text: Article 4(1)

text: (b) of Regulation No. 1049/2001 and the data protection rules become applicable in their entirety. With regard to such requests for public access, please see the EDPS Background Paper on Public access to documents containing personal data after the Bavarian Lager ruling.

text: B.1. Legal obligation (

text: Article 5

text: (b) of the Regulation)

text: The publication of declarations may be based on a legal obligation pursuant to

text: Article 5

text: (b) of the Regulation. A legal obligation under

text: Article 5

text: (b) only exists for an EU institution if the publication of personal data is provided by a legal act of a higher order (e.g. the TFEU or the Founding Regulations of an agency). This can notably be the case for positions of key importance, such as the Management Board, the Board of Regulators, and the Members of the Scientific Boards, Committees or Panels of an Agency. In these cases, in principle, the legislator has the duty to balance the interests at stake .

text: The Staff Regulations do not provide for publication of DcI.

text: In case the publication is based on

text: Article 5

text: (b) of the Regulation, the data subject concerned does not have a right to object to the publication based on Article 18 of the Regulation (see Section 8).

text: B.2. Necessity for a task carried out in the public interest (

text: Article 5

text: (a) of the Regulation)

text: In the absence of a legal obligation, publication of personal data may be authorised, in accordance with

text: Article 5

text: (a) of the Regulation, to the extent that it is necessary for the performance of a task carried out in the public interest (See below Section B.2.2) on the basis of the Treaties establishing the EU or other legal instruments adopted on the basis thereof (See below Section B.2.1).

text: B.2.1 Legal basis

text: An adequate legal instrument (e.g. a decision or policy adopted at appropriate level) should explicitly define the reasons and modalities to publish declarations and provide for a legal basis of the publication. This is particularly relevant as publications are likely to more deeply affect the private lives of the individuals concerned. In general, the legal basis for the mere existence of procedures linked to declarations relating to the management of conflicts of interest described above (Section A.2.1) may also include the legal basis for publication, provided it is adopted at appropriate level and of sufficient legal quality. In effect, similar considerations apply here as in the case of a legal obligation.

text: B.2.2 Necessity

text: Moreover, the mere fact of having a legal basis for such publication does not suffice. The publication must also be truly necessary to be in line with

text: Article 5

text: (a) of the Regulation. This would be the case when the purpose of the publication is to safeguard the independence of EU institutions by allowing control by the public. The EU institutions have to assess the balance between the different interests at stake. In such an assessment, the principle of openness as well as the principles of good governance, as enshrined in the Treaties shall be taken into account (see notably

text: Article 15

text: TFEU). At the same time, the fundamental rights to privacy and data protection enshrined in Articles 7 and 8 of the EU Charter and

text: Article 16

text: TFEU must be respected.

text: An important part of this assessment is the consideration of any possible alternatives. It could be necessary for certain posts to allow control by peers and the public whereas for other posts the publication of their personal data would not be proportionate. Therefore, the necessity for the publication pursuant to

text: Article 5

text: (a) of the Regulation should be assessed for each category and function of persons working for the EU institutions. The EU institutions need to balance the interests at stake, notably the need for independence as well as for public trust, and the necessity to protect the data subjects’ rights to privacy (see also the considerations on data quality - involving necessity and proportionality - in Section 4).

text: When there is a legal obligation (

text: Article 5

text: (b) of the Regulation) for an institution to publish DoI of certain categories of persons, the institution that wishes to extend the obligation to other categories should make an even more careful analysis of the necessity requirement under

text: Article 5

text: (a) of the Regulation. Indeed, in such case, there is a presumption that publication is not necessary, unless the institution can demonstrate that publication is required, for example in view of the tasks or the main job of the category of persons in question .

text: In all cases, the EU institutions should document how they have balanced publication against data protection considerations (motivated decisions, etc.).

text: A higher degree of openness is assumed for public figures and political posts acting in a public capacity or relating solely to the professional activities of the person concerned such as Commissioners, Members of the Court of Auditors, Members of Parliament and Executive Directors of Agencies. The same applies to Management and Supervisory Boards of Agencies. The publication of declarations of such persons appears necessary and proportionate to ensure public trust.

text: In this respect, the EU institutions should develop adequate legal instruments defining the policies and creating a presumption of openness for personal data concerning persons in such posts.

text: The necessity of publication of declarations for all persons employed by an EU institution (e.g. on the internet page of the EU institution or in a public register accessible on the EU institution's premises) is doubtful. The EU institution needs to assess the necessity of publication for each category and function as well as with regard to its core activities. In this context, the balancing of interests might be in favour of publication of DoI, DcI or decisions based thereon for some posts with decision making power, for example regarding former senior staff members who take positions in the private sector or persons from the private sector who take up a senior post in the institutions ("revolving doors") . For regular officers and administrators and staff with no influence on the decision making process or on (scientific) advice for the EU institution, such as administrative support staff, HR officers and other

text: administrative tasks without operational functions, the publication of declarations 30 does not seem to be proportionate.

text: c) External experts

text: The EU institution itself might sometimes not have the necessary expert knowledge to identify a potential conflict of interest and therefore needs to rely on additional outside screening. External experts – notably in agencies – often take or influence decisions on the authorisation of certain products or measures, the granting of EU funding, the selection of projects, etc. In view of their important tasks and powers, the balance of interests might be in favour of publishing their DoI to allow control of their independence by the public and by their peers. Persons working in the same field of expertise as those experts thus often provide a necessary check or counter-balance and an additional safeguard with regard to the experts’ independence and thus ultimately the soundness of the decision taken by the EU institution.

text: Furthermore, many external experts work only occasionally for the EU institutions, they also have other parallel occupational activities in their area of expertise which could potentially influence their work for the EU institutions. Therefore, the risk of a conflict of interest could be perceived as being higher.

text: Finally, because the decisions influenced by the work of these advisors and experts may have direct consequences for European citizens (health, food, safety, etc.), the publication of names of experts involved may contribute to ensuring the trust of the public in the European decision making process. However, it has to be assessed caseby-case and depending on the tasks of the experts whether such publication is proportionate.

text: B.3. Consent (

text: Article 5

text: (d) of the Regulation)

text: The application of

text: Article 5

text: (d) of the Regulation (data subject’s unambiguous consent) as a legal basis for the publication of data related to declarations relating to the management of conflicts of interests is not a viable option. In the terms of

text: Article 2

text: (h) of the Regulation, the data subject's consent is "any freely given specific and informed [...] agreement". Consent is doubtful in an employment context, as it can 31 often not be considered freely given. Therefore, for persons employed by the EU institutions, consent is not recommended as an appropriate ground for processing. In the case of external experts, it is equally questionable whether consent is freely given as there is not a real choice in case the person wants to be eligible as an expert.

text: 3. Processing of special categories of data

text: The personal data processed with regard to declarations relating to the management of conflicts of interests may involve special categories of data. Information on outside activities or previous employments could for instance include work for a political party, activities in a trade association or a local church. These personal data could reveal political opinions, religious or philosophical beliefs or trade union membership. Furthermore, some declaration forms also request information on the professional activities of the spouse, partner or other household members including their names. In this respect, such information might, apart from necessarily affecting their private life, also reveal the sexual orientation of the persons concerned.

text: The Regulation provides for specific rules for categories of data considered by their nature of infringing fundamental rights and freedoms. The prohibition is lifted if justifying grounds can be found in Articles 10(2) or 10(3) of the Regulation.

text: Consent pursuant to

text: Article 10(2)

text: (a) of the Regulation cannot be a valid legal basis for the processing of the special categories of data (see above Section B.3.).

text: Article 10(2)

text: (b) of the Regulation states that the processing of special categories of data may be justified if "necessary for the purposes of complying with the specific rights and obligations of the controller in the field of employment law insofar as it is authorised by the Treaties or other legal instruments adopted thereof". The legal obligation under

text: Article 5

text: (b) of the Regulation or the legal basis under

text: Article 5

text: (a) of the Regulation (depending on the circumstances ) which are relevant in this case imposes an obligation on these persons to declare their interests and to provide the information to assess any potential conflict of interest to their Appointing Authority, hierarchy or boards. In this context, the processing of special categories of data can be necessary for complying with this obligation.

text: B. Publication

text: Whereas it seems necessary for EU institutions to process sensitive data for this purpose if relevant for the assessment of any potential conflict of interest internally, a stricter standard should apply for the publication of such sensitive data on the Internet or in a public register.

text: Only the processing of such sensitive data which is strictly necessary for the purposes of complying with this employment law obligation is exempted from the general prohibition to process such data pursuant to Article 10(1) of the Regulation. This generally does not include the external publication of such data unless explicitly provided for by the legal basis and proportionate. The EU institutions should thus redact a version of the DoI/DcI or decisions based thereon for publication taking out

text: such sensitive personal data to avoid publicly revealing it unless necessary for the purposes of control by the public and after balancing the interests at stake (position of the person working for an EU institution, sensitivity of the post, etc.).

text: 4. Data quality

text: A.1. Adequacy, relevance and proportionality

text: EU institutions should limit the information processed in DoI/DcI to that which is strictly necessary. This is the best way to ensure that information will be adequate, relevant and not excessive.

text: EU institutions often use specific forms for DoI/DcI. These forms sometimes need to be filled in at regular intervals (e.g. annually). In these forms, the existence of precise questions for the different interests avoids the disclosure of non-relevant data by the person working for an EU institution. Open and too general questions can lead to excessive information provided by or on behalf of the data subjects.

text: In terms of scope of the information to be provided, it should be limited to activities which are in relation to the concrete tasks and competences of the EU institution concerned. Questions on previous employment could thus be limited to activities related to the competence of the EU institution or the relevant specific organisational entity of it or to the function and tasks of the person working for the EU institution. If questions on the different interests are left too open, non-relevant and unnecessary information could be provided about the data subjects and processed by the EU institutions contrary to the principle of data minimisation.

text: Depending on the function of the person working for an EU institution, relevant categories of data for DoI can be:

text: - name, - personnel number, - position, - professional contact details, - previous or current employments, - ownership or other investments including shares, - membership of a managing body or entity, - (research) funding received, - intellectual property rights, - membership, role or affiliation in organisations/bodies/clubs.

text: The following information is generally not relevant for the purposes of DoI/DcI and thus excessive:

text: - photo, - nationality,

text: - date and place of birth, - home address.

text: In line with the principle of data minimisation, for information to be provided on financial shareholdings and shares in companies, a minimum amount or proportion of shares held could be set in order to avoid disclosure of minor irrelevant shares or shares held through a general investment fund.

text: With regard to information on professional activities of a spouse or partner of a person working for an EU institution , it is generally not necessary to process information on the name of the spouse or partner. Furthermore, forms could refer to “household members” in order to avoid potentially revealing sensitive information on sexual orientation pursuant to Article 10(1) of the Regulation. A further way to limit processing of non-relevant data is the possibility to choose the nature of the activity in question from a drop-down list.

text: The same principles apply to oral DoI (e.g. experts at the beginning of a meeting of a Scientific Committee). EU institutions should ensure that if such declarations are recorded in the minutes of the meeting, the registered information is adequate, relevant and not excessive for the purpose of management of conflict of interests.

text: With regard to the temporal scope of the information to be provided, DoI/DcI often request information on past (professional) activities. For such interests, the EU institutions could also limit the information to be provided to a certain period (e.g. the previous 5 years) in order to avoid collecting too old and thus no longer relevant data.

text: A.2. Accuracy and timeliness

text: Personal data must be “accurate and where necessary kept up to date", while “every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified.” .

text: The persons working for the EU institutions generally provide the data. However, they should be able to rectify or delete data which is not accurate or incomplete at any time (see Section 6 below). In this respect, the fact that the persons working for EU institutions have a possibility to review their declarations annually or fill in a new declaration might also help in keeping the data up to date and accurate and thus improve data quality.

text: The assessment of the existence or not of a conflict of interest is facilitated if the data are accurate and kept up to date.

text: B. Publication

text: In the publication of DoI, DcI or decisions based thereon, the data published should be strictly limited to what is necessary for ensuring transparency. Notably contact information of the person working for EU institutions should not appear in the published versions. Furthermore, sensitive data should only be published if absolutely necessary in view of the nature of the function of the person working for an EU institution. With regard to activities of the spouse/partner such information should only be published if related to the professional activities of the persons working for an EU institution.

text: 5. Data retention

text: Personal data must be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed".

text: It is difficult to determine a priori for all the length of a standard retention period, as it also depends on the different functions and the need to justify decisions taken at a later stage (possibly even after the person concerned has left the EU institution). However, the length of the conservation period needs to be justified case-by-case by the purpose of the (initial or further) processing to be compliant with

text: Article 4(1)

text: (e) of the Regulation.

text: The necessary retention period will ultimately depend on the nature of the function and the sensitivity of the activity. The following criteria can be relevant when assessing the necessary retention period: the end of mandate or contract of a person working for the EU institutions, duration of the authorisation of a product where an expert was involved, possible legal actions against decisions taken by an external expert, audit and control purposes, or budgetary discharge.

text: For persons employed by the EU institutions, DoI/DcI generally become part of the personal file (in particular for declarations before recruitment). However, this should not mean that the same retention period as for the personal file should apply to these documents. As the relevance of a DoI/DcI at the entry into service might be limited in time, only a shorter retention period might be justified.

text: 6. Rights of Access and Rectification

text: Article 13 of the Regulation establishes a right of access and the arrangements for 38 exercising it upon request by the data subject .

text: Furthermore, data subjects have a right to rectify their inaccurate or incomplete personal data under Article 14 of the Regulation without delay.

text: The right of access pursuant to

text: Article 13

text: shall apply to all personal data processed for the purposes of DoI/DcI (in the declarations or in information from other sources). Such access shall be given upon request (unless the data is accessible electronically directly by the data subject). EU institutions can provide for a regular revision by data subjects in order to keep data up to date and to rectify inaccurate or incomplete data. For persons working for the EU institutions having online access to their DoI, the rights of access and rectification can to a large extent be exercised directly.

text: The EU institutions must also grant the rights of access and rectification to data subjects other than the persons working for an EU institution, notably their spouses, partners or household members whose personal data is processed in such declarations.

text: 7. Information to the data subject

text: As the processing of their personal data may affect individuals’ private lives, it is of the utmost importance that EU institutions provide comprehensive information to data subjects. In line with the proactive approach proposed by the EDPS, this would go beyond the information provided for by Articles 11 and 12 of the Regulation.

text: The EU institution should also inform data subjects about: a) the fact that personal data is processed and possibly published; b) the legal framework for such processing, including the modalities of the processing and the consequences of the declarations as well as the data subjects’ right to object to such processing (see Section 8 below).

text: Articles 11 and 12 of the Regulation provide for a list of mandatory items of which data subjects should be informed at the time of collecting the data in order to ensure the transparency and fairness of the processing. Article 11 of the Regulation is applicable if the data have been obtained from the data subject, while

text: Article 12

text: foresees certain requirements in case the data have not been obtained directly from the data subject.

text: In this area, mainly Article 11 of the Regulation will be relevant as most data come directly from the person working for an EU institution. However, with regard to personal data of spouses, partners or household members of persons working for the EU institutions, Article 12 of the Regulation applies. In such cases, the information pursuant to Article 12 of the Regulation must be given at the latest when the data are first disclosed.

text: Ideally, the information to persons working for the EU institutions is provided in a general privacy statement available to them comprising the list of information requested pursuant to Articles 11 and 12 of the Regulation. Such privacy statement should be accessible when filling in the form, attached to the policy, if relevant, or on the website of the institution. It can also be helpful to indicate the fact that a DoI/DcI

text: need to be filled out (which also might be published) in the vacancy notice, a call for interests or in first letters to experts.

text: When persons working for the EU institutions provide information on their spouse, partner or household members, the controller must also inform spouses, partner and household members of persons working for the EU institutions about the processing of their personal data.

text: However,

text: Article 12(2)

text: provides that the obligation to inform does not apply where providing such information would prove impossible or would constitute a disproportionate effort on the part of the data controller, e.g. in case of a high number of persons concerned, or where no contact information is available. In such case, a privacy notice could be published on the EU institution’s website instead of informing these data subjects directly. This could be accompanied by an instruction to persons working for the EU institutions in the declaration, to inform their spouses, partners or household members that the EU institution concerned will be processing data about them, and that further information is available at the website.

text: B. Publication

text: The persons working for the EU institutions whose declarations are published must be duly informed about the fact that their personal data in the declarations are being made public.

text: Therefore, pursuant to the EDPS’ proactive approach EU institutions should assess the possible public nature of the declarations and make it clear to data subjects as early as possible (i.e. before or at least at the moment they collect their data) the extent to which the processing might include its public disclosure.

text: Consequently, persons working for the EU institutions would need to be informed before the personal data is disclosed for the first time. Furthermore, they have the right to object to disclosure on compelling legitimate grounds pursuant to Article 18 of the Regulation (see Section 8 below).

text: 8. Right to object

text: A data subject shall have the right to object “at any time, on compelling legitimate grounds relating to his or her particular situation” to any processing of his/her 41 personal data. This right exists unless the processing takes place in order to comply with a legal obligation pursuant to

text: Article 5

text: (b) of the Regulation.

text: In view of the possible publication or giving access to personal data provided by persons working for EU institutions in DoI/DcI or decisions on conflict of interest, the right to object is of key importance in this area.

text: With regard to the publication, data subjects should be informed at an early stage –at the latest when data is collected from them– about the possible publication of their

text: data and their right to object to this on the basis of compelling legitimate grounds 42 pursuant to Article 18 of the Regulation . Information of the data subject before the information is disclosed to the public is an element of fair processing (

text: Article 4(1)

text: (a) of the Regulation). This allows the data subject to exercise his/her right to object pursuant to Article 18 of the Regulation.

text: In addition, partners, spouses and household members have the right to object to the publication of their personal data (notably information on their professional activity) pursuant to Article 18 of the Regulation as well.

text: 9. Necessity for prior checking

text: Article 27(1) of the Regulation provides that all “processing operations likely to present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purpose” are to be prior checked by the EDPS. According to

text: Article 27(2)

text: (b) of the Regulation “processing operations intended to evaluate personal aspects relating to the data subject, including his or her ability, efficiency and conduct” are likely to present such risks.

text: In the past, the EDPS has prior checked a number of processing operations of personal data with regard to DoI based on

text: Article 27(2)

text: (b) of the Regulation. In practice nevertheless, evidence showed that in most cases, processing operations are not intended to evaluate personal aspects relating to the data subject. Indeed, the declared purpose is to ensure the independence of the EU institutions. There is no intention to evaluate personal aspects of the persons concerned and the processing consists in an objective assessment of the potential conflict in question. It is therefore an evaluation of the nature of certain activities or situations and their compatibility with the position of the data subject within the EU institution or body

text: In this context, the notion of “personal aspects” must be interpreted restrictively. The scope of

text: Article 27(2)

text: (b) is limited to situations where there is an evaluation of aspects of the “personality” of the persons. The assessment of a potential conflict of interest in a DoI/DcI form is not an evaluation of the personality of the persons working for the EU institutions. In view of this interpretation, the processing of declarations relating to the management of conflicts of interests is in principle not subject to prior checking pursuant to

text: Article 27(2)

text: (b) of the Regulation.

text: Furthermore, as indicated above, procedures launched in the event of non-respect of the conflict of interest procedure (e.g. missing or incomplete DoI/DcI, noncompliance with mitigating measures for the conflict) are not within the scope of these Guidelines. Such misconduct by a person working for the EU institutions is in general dealt with in disciplinary procedures, scientific misconduct procedures, or other procedures provided for by the legal instrument containing the policy on

text: Finally, if other prior checkable procedures include also the processing of DoI/DcI (e.g. in the recruitment procedure), such processing should be described as part of that procedure (but is not subject to prior checking in its own right).

text: In conclusion, the processing operations on declarations relating to the management of conflicts of interests are generally not subject to prior checking. Based on the same reasoning, all other types of processing for the authorisation of outside activities, gifts or post-employment occupational activities are therefore also not prior checkable.

text: It can nevertheless not be excluded that EU institutions have a different approach. Indeed in cases where the actual purpose is the evaluation of the (current or past) conduct of a person, the processing operation should be subject to prior checking.

text: Furthermore, the processing of personal data in procedures in case of non-compliance with the conflict of interests rules in procedures such as disciplinary procedures, scientific misconduct procedures or similar procedures provided for by the legal instrument on the management of conflicts of interest for persons not subject to the Staff Regulations which are intended to evaluate personal aspects notably the conduct of a person will be subject to prior checking pursuant to

text: Article 27(2)

text: (b) of the Regulation.

text: In case a DPO notifies a processing operation within the scope of the Guidelines for prior checking, he should refer to the Guidelines. In addition to the notification form, a cover letter should set out the reasons why a notification is required and explain any differences vis-à-vis these Guidelines.