full
12.10.2012 EN Official Journal of the European Union C 308/8 Decision of the High Representative of the Union for Foreign Affairs and Security Policy of 8 December 2011 on the rules regarding data protection 2012/C 308/07 THE HIGH REPRESENTATIVE, Having regard to the Council Decision of 26 July 2010 establishing the organisation and functioning of the European External Action Service (2010/427/EU) (‘the EEAS Council Decision’), in particular Article 11(3) thereof, HAS ADOPTED THIS DECISION: SECTION 1 GENERAL PROVISIONS Article 1 Subject matter and scope This Decision lays down the implementing rules concerning Regulation (EC) No 45/2001 of the European Parliament and of the Council (‘the Regulation’) as regards the European External Action Service (‘EEAS’), in accordance with Article 24(8) thereof. Article 2 Definitions For the purpose of this Decision and without prejudice to the definitions provided by the Regulation: (a) ‘controller’ shall mean the EEAS, its managing-directors, directors, or heads of services of an equivalent size or function, as well as the heads of Union Delegations, which, alone or jointly with others, determines the purposes and means of the processing of personal data; (b) ‘data protection coordinator’ shall mean an AD EEAS staff member designated to coordinate and assist with data protection matters at the levels of directorates or services of an equivalent size or function, as well as in Union Delegations if required; (c) ‘processor’ shall mean a member of the EEAS staff or contracted entities entrusted with data processing tasks by the controller; (d) ‘EEAS staff’ shall mean, in accordance with Article 6 of the EEAS Council Decision, those officials and other servants of the European Union working for the EEAS, including personnel from the diplomatic services of the Member States appointed as temporary agents, and specialised seconded national experts. SECTION 2 THE DATA PROTECTION OFFICER Article 3 Appointment and status of the Data Protection Officer (DPO) 1. The Chief Operating Officer (COO) shall select and appoint the DPO, in accordance with Article 24(2) of the Regulation, and register him/her with the European Data Protection Supervisor (‘EDPS’). The DPO shall be directly attached to the COO. 2. The term of office of the DPO shall be five years and is renewable once. 3. With respect to the performance of his/her duties, the DPO shall act in an independent manner and in cooperation with the EDPS. In particular, the DPO may not receive any instructions from the Appointing Authority of the EEAS or from anyone else regarding the internal application of the provisions of the Regulation and of this Decision or his/her cooperation with the EDPS. The DPO shall attend data protection training sessions in regular intervals and the COO shall take the necessary measures to this effect. 4. The COO shall evaluate the performance of the DPO's tasks and duties on a yearly basis, notably on the basis of the DPO’s annual report, after consultation of the EDPS as appropriate. The DPO may be dismissed from his/her post only with the consent of the EDPS, if he/she no longer fulfils the conditions required for the performance of his/her duties. 5. Without prejudice to the procedure foreseen for his/her appointment, the DPO shall be informed of all contacts with external parties relating to the application of the Regulation and of this Decision, notably with regard to interaction with the EDPS. 6. Without prejudice to the relevant provisions of the Regulation, the DPO and his/her staff shall be subject to the rules and regulations applicable to officials and other servants of the European Union. Article 4 Duties The DPO shall: (a) ensure that controllers, data protection coordinators and data subjects are informed of their rights and obligations pursuant to the Regulation and to this Decision and that the rights and freedoms of data subjects are unlikely to be adversely affected by processing operations. In the discharge of this task, he/she shall in particular establish information and notification forms, consult interested parties and raise the general awareness of data protection issues; (b) respond to requests from the EDPS and, within the sphere of his/her competence, cooperate with the EDPS at the latter's request or on his/her own initiative; (c) ensure in an independent manner the internal application of the provisions of the Regulation and of this Decision in the EEAS; (d) keep a register of all processing operations carried out by the EEAS and grant access to it to any person directly or indirectly through the EDPS, in accordance with Articles 14 and 15; such register may also be maintained in electronic format; (e) notify the EDPS of the processing operations likely to present specific risks referred to in Article 27(2) of the Regulation. Article 5 Tasks 1. In addition to the duties to be fulfilled as set out in Article 4, the DPO shall: (a) act as an advisor to the Appointing Authority of the EEAS and to controllers on matters concerning the application of the Regulation and of this Decision. The DPO may be consulted by the Appointing Authority, the controllers and processors concerned, the Staff Committee and by any EEAS staff member, without going through the official channels, on any matter concerning the interpretation or application of the Regulation and of this Decision; (b) on his/her own initiative or on the initiative of the Appointing Authority, the controllers, the processors, the Staff Committee or any EEAS staff member, investigate matters and occurrences directly relating to his or her tasks and which come to his/her notice, and report back to the Appointing Authority or the person who commissioned the investigation. If deemed appropriate, all other parties concerned should be informed accordingly. If the complainant is an individual, or in case the complainant acts on behalf of an individual, the DPO must, to the extent possible, ensure confidentiality of the request, unless the data subject concerned gives his/her unambiguous consent to treat the request otherwise; (c) cooperate in the discharge of his/her functions with the Data Protection Officers of other European Union institutions, bodies, offices and agencies, in particular by exchanging experience and best practices; (d) represent the High Representative or the EEAS as appropriate on all data protection related issues at international level, without prejudice to the provisions of the Treaties, including in particular Article 218 of the Treaty on the Functioning of the European Union; (e) submit an annual report on his/her activities to the High Representative and make it available to EEAS staff. 2. Without prejudice to Articles 4(b), Article 5(1)(b), and (c) and Article 15, the DPO and his/her staff shall not divulge information or documents which they obtain in the course of the exercise of their duties and tasks. Article 6 Powers In performing his or her tasks and duties the DPO: (a) shall have access at all times to the data forming the subject-matter of processing operations and to all offices, data-processing installations and data carriers; (b) may request legal opinions from the EEAS Legal Affairs Division; (c) may call on the services of external information technology experts upon prior agreement of the Authorising Officer in accordance with the Financial Regulation (Regulation (EC, Euratom) No 1605/2002) and its implementing rules; (d) may, without prejudice to the EDPS's duties and powers, propose administrative measures and issue general recommendations on the appropriate application of the Regulation and of this Decision; (e) may make, in specific cases, any other recommendation for the practical improvement of data protection to the EEAS hierarchy and/or to all other parties concerned; (f) may bring to the attention of the Appointing Authority of the EEAS any failure of a staff member to comply with the obligations under the Regulation and this Decision and suggest an administrative investigation being launched in view of the possible application of Article 49 of the Regulation. Article 7 Resources The DPO shall be provided with adequate staff and resources necessary to carry out his or her duties and tasks. SECTION 3 RIGHTS AND OBLIGATIONS OF ACTORS IN THE FIELD OF DATA PROTECTION Article 8 Appointing Authority 1. In case of a complaint within the meaning of Article 90 of the Staff Regulations relating to a violation of the Regulation or of this Decision, the Appointing Authority shall consult the DPO, who should deliver his/her opinion in writing no later than 15 days after receipt of the request. If, after the end of this period, the DPO has not provided his/her opinion to the Appointing Authority, it is no longer required. The Appointing Authority shall not be bound by the DPO's opinion. 2. The DPO shall be informed whenever an issue is under consideration which has, or might have, data protection implications. Article 9 Controllers 1. The controllers are responsible for ensuring that all processing operations under their control comply with the Regulation and the provisions of this Decision. They may as required entrust data processing tasks to EEAS staff members working under their responsibility or to contracted entities, in accordance with Article 23 of the Regulation. 2. In particular, the controllers shall: (a) give prior notice to the DPO of any processing operation or set of such operations intended to serve a single purpose or several related purposes, as well as of any substantial change of an existing processing operation; (b) assist the DPO and the EDPS in performing their respective duties, in particular by giving information in reply to their requests within 30 days, at the latest; (c) cooperate with the data protection coordinators to establish the inventory of existing processing operations on personal data; (d) implement appropriate technical and organisational measures and give adequate instructions to the processors to ensure both the confidentiality of the processing and a level of security appropriate to the risks represented by the processing; (e) where appropriate, consult the DPO on the conformity of processing operations with the Regulation and this Decision, and in particular when they have reason to believe that certain processing operations are incompatible with Articles 4 to 10 of the Regulation. They may also consult the DPO and/or internal information technology security experts on issues relating to the confidentiality of the processing operations and on the security measures taken pursuant to Article 22 of the Regulation. Article 10 Coordinators 1. Each managing-director or director or head of a service of equivalent size or function, or the head of a Union Delegation as required, shall designate a data protection coordinator working under his/her responsibility. Without prejudice to the responsibilities of the DPO, each coordinator shall: (a) assist in keeping an inventory of all existing processing of personal data and cooperate with the DPO for the purpose of establishing and updating the inventory of existing processing operations of personal data; (b) assist in identifying the respective controllers and processors; (c) have the right to obtain from the controllers, the processors and from EEAS staff adequate and necessary information required for the accomplishment of his/her administrative tasks. This shall not include the right of access to personal data processed under the responsibility of the controller; (d) endorse corporate notifications on types or categories of data processing operations to the DPO. 2. Without prejudice to the responsibilities of the controllers, the coordinators shall: (a) assist the controllers in complying with their obligations; (b) where appropriate, facilitate communication between the DPO and the controllers. Article 11 EEAS staff 1. All EEAS staff shall contribute to the application of the confidentiality and security rules for the processing of personal data as provided for in Articles 21 and 22 of the Regulation. No member of EEAS staff with access to personal data shall process them other than on instructions from the controllers, unless required to do so by national or Union law. 2. Any member of EEAS staff may lodge a complaint with the EDPS regarding an alleged breach of the provisions of the Regulation or of this Decision governing the processing of personal data, without acting through official channels, as specified by the rules set by the EDPS. Article 12 Data subjects 1. Further to the data subjects' right to be appropriately informed about any processing of personal data relating to themselves, in accordance with Articles 11 and 12 of the Regulation, the data subjects may approach the controller concerned to exercise their rights according to Articles 13 to 19 of the Regulation, as specified in Section 5 of this Decision. 2. Without prejudice to any judicial remedy, every data subject may lodge a complaint with the EDPS if he/she considers that his/her rights under the Regulation or this Decision have been infringed as a result of the processing of his/her personal data by the controllers, as specified by the rules set by the EDPS. 3. No data subject shall suffer prejudice on account of a complaint lodged with the EDPS or of a matter brought to the attention of the DPO alleging a breach of the provisions of the Regulation. SECTION 4 REGISTER OF NOTIFIED PROCESSING OPERATIONS Article 13 Notification procedure 1. Controllers shall notify to the DPO any processing operation of personal data on the basis of a notification form made accessible on the EEAS and Union Delegations Intranet site (under ‘Data Protection’). The notification shall be transmitted to the DPO electronically. A confirmatory notification shall be sent to the DPO by written note within 10 working days. Upon receipt of the confirmatory notification, the DPO shall publish it in the Register. 2. The notification shall include all information specified in Article 25(2) of the Regulation. Any change affecting this information shall be notified promptly to the DPO. 3. Further rules and procedures regarding the notification procedure to be followed by the controllers shall form part of the general recommendations issued by the DPO. Article 14 Content and the purpose of the Register 1. The DPO shall keep a Register of processing operations performed upon personal data, which shall be set up on the basis of the notifications received from the controllers. 2. The Register shall contain at least the information referred to in Article 25(2)(a) to (g) of the Regulation. However, the information entered in the Register by the DPO may exceptionally be limited when it is necessary to safeguard the security of a specific processing operation. 3. The Register shall serve as a repertory of the personal data processing operations conducted by the EEAS. It shall be accessible by data subjects in order to facilitate the exercise of their rights as set out in Articles 13 to 19 of the Regulation and in this Decision. Article 15 Access to the Register 1. Appropriate measures shall be taken by the DPO to ensure that any data subject may have access to the Register, either directly or indirectly through the EDPS. In particular, the DPO shall provide information and assistance to data subjects how and where applications for access to the Register can be made. 2. Except where online access is granted, applications for access to the Register may be made in any written form, including electronically, in one of the languages referred to in Article 342 of the Treaty on the Functioning the European Union and in a sufficiently precise manner to enable the DPO to identify the concerned processing operations. An acknowledgement of receipt shall be sent to the applicant without delay. 3. If an application is not sufficiently precise, the DPO shall ask the applicant to clarify the application and shall assist the applicant in doing so. In the event of an application relating to a very large number of processing operations, the DPO may confer with the applicant informally, with a view to finding a fair solution. 4. Any data subject may request from the DPO a copy of the information which is available in the Register on any notified processing operation. SECTION 5 PROCEDURE FOR DATA SUBJECTS TO EXERCISE THEIR RIGHTS Article 16 General provisions 1. The data subjects' rights specified in this Section may only be exercised by the individuals concerned or, in exceptional cases, on behalf of the individuals with proper authorisation. Requests shall be addressed in writing to the controller concerned with a copy to the DPO. If necessary, the DPO shall assist the data subject in identifying the controller concerned. The DPO shall make specific forms available. Controllers shall grant the request only if the form has been filled in completely and the applicant's identity has been verified properly. The exercise by data subjects of their rights shall be free of charge. 2. The controller concerned shall send to the applicant an acknowledgement of receipt within five working days from the registration of the application. Unless otherwise provided, the controller shall reply to the request at the latest within 15 working days from the registration of the request and shall either give satisfaction or state in writing the reasons for the total or partial refusal, in particular in cases where the applicant is not considered as data subject. 3. In case of irregularities or obvious misuse by the data subject in exercising his/her rights and where the processing is alleged to be unlawful by the data subject, the controller must consult the DPO on the request and/or refer the data subject to the DPO, who will decide on the eligibility of the request and the appropriate follow-up to be given. 4. Any data subject may consult the DPO with regard to the exercise of his/her rights in a specific case. Without prejudice to any judicial remedy, every data subject may lodge a complaint with the EDPS, if he/she considers that his/her rights under the Regulation have been infringed as a result of the processing of his/her personal data. Article 17 Right of access The data subject shall have the right to obtain from the controllers, without constraint, at any time within three months from the receipt of the request, the information referred to in points (a) to (d) of Article 13 of the Regulation, either by consulting these data on the spot, or by receiving a copy, including, where appropriate, a copy in an electronic form, according to the applicant's preference. Article 18 Right of rectification Each data subject's request for the rectification of inaccurate or incomplete personal data shall specify the data concerned as well as the rectification to be made. It shall be dealt with by the controller without delay. Article 19 Right of blocking The controller concerned shall treat any request for the blocking of data under Article 15 of the Regulation without delay. The request shall specify the data concerned as well as the reasons for blocking them. The controller shall inform the data subject who made the request before the data are unblocked. Article 20 Right of erasure The data subject may request the controllers to erase data without delay in case of unlawful processing, particularly where the provisions of Articles 4 to 10 of the Regulation have been infringed. The request shall specify the data concerned and shall provide the reasons or evidence of the unlawfulness of the processing. In automated filing systems, erasure shall in principle be ensured by all appropriate technical means, excluding the possibility of any further processing of the erased data. If erasure is not possible for technical reasons, the controller concerned, after consultation of the DPO and of the interested person, shall proceed to the immediate blocking of such data. Article 21 Notification to third parties In case of any rectification, blocking or erasure following a request made by the data subject, he/she may obtain from the controllers the notification to third parties to whom his/her personal data have been disclosed, unless this proves impossible or involves a disproportionate effort. Article 22 Right to object The data subject may object to the processing of data relating to him/her and to the disclosure or use of his/her personal data, in conformity with Article 18 of the Regulation. The request shall specify the data concerned and shall provide the reasons justifying the request. Where the objection is justified, the processing in question shall no longer involve those data. Article 23 Automated individual decisions The data subject is entitled not to be the subject of automated individual decisions in the meaning of Article 19 of the Regulation, unless the decision is explicitly authorised pursuant to national or Union legislation, or by an EDPS decision safeguarding the data subject's legitimate interests. In either case, the data subject shall have the opportunity to make known his or her point of view in advance and to consult the DPO. Article 24 Exceptions and restrictions 1. To the extent that legitimate reasons as specified in Article 20 of the Regulation clearly justify it, the controllers may restrict the rights referred to in Articles 17 to 21 of this Decision. Except in case of absolute necessity, the controller concerned shall first consult the DPO, whose opinion shall not bind the EEAS. The controller shall reply to requests relating to the application of exceptions or restrictions to the exercise of rights without delay and shall substantiate this decision. 2. Any data subject concerned may request the EDPS to apply Article 47(1)(c) of the Regulation. SECTION 6 INVESTIGATION PROCEDURE Article 25 Practical modalities 1. Requests for an investigation shall be addressed to the DPO in writing by using a specific form made available by him/her. In the case of obvious misuse of the right to request an investigation, for example where the same individual has made an identical request only recently, the DPO is not obliged to report back to the requester. 2. Within 15 days upon receipt, the DPO shall send acknowledgement of receipt to the Appointing Authority or the person who commissioned the investigation and verify whether the request is to be treated as confidential. 3. The DPO shall request from the controller who is responsible for the data processing operation in question a written statement on the issue. The controller shall provide his/her response to the DPO within 15 days. The DPO may request complementary information from other EEAS services, such as the Security and Security of Information (Infosec) Department of the EEAS. If appropriate, he/she may request an opinion on the issue from the EEAS Legal Affairs Division. The DPO shall be provided with the information or opinion within 30 days. 4. The DPO shall report back to the Appointing Authority and the person who made the request no later than three months following its receipt. SECTION 7 FINAL PROVISIONS Article 26 In the event of any inconsistency between the provisions of this Decision and the Regulation, the latter shall prevail. Article 27 This Decision shall be made available to the EEAS staff through appropriate means, notably through publication on the EEAS and Union Delegations Intranet site (under ‘Data Protection’). Article 28 Effect This Decision shall take effect on the day of its adoption. Done at Brussels, 8 December 2011. The High Representative C. ASHTON