EUROPEAN COMMISSIONPRIVACY STATEMENT
Processing operation: Environment and Emergencies Forum 2023
Data Controller: European Commission, DG ECHO, Unit B.2. Prevention and Disaster
Risk Management
Record reference: DPR-EC-1063.1

Table of Contents
1. Introduction
2. Why and how do we process your personal data?
3. On what legal ground(s) do we process your personal data?
4. Which personal data do we collect and further process?
5. How long do we keep your personal data?
6. How do we protect and safeguard your personal data?
7. Who has access to your personal data and to whom is it disclosed?
8. What are your rights and how can you exercise them?
9. Contact information
10. Where to find more detailed information?

1. Introduction
The European Commission (hereafter ‘the Commission’) is committed to protect yourpersonal data and to respect your privacy. The Commission collects and further processes
personal data pursuant to Regulation (EU) 2018/1725 of the European Parliament and of
the Council of 23 October 2018 on the protection of natural persons with regard to theprocessing of personal data by the Union institutions, bodies, offices and agencies and on
the free movement of such data (repealing Regulation (EC) No 45/2001).
This privacy statement explains the reason for the processing of your personal data in thecontext of the event ‘Environment and Emergencies Forum 2023’, organised by theEuropean Commission. It explains the way we collect, handle, and ensure protection of all
personal data provided, how that information is used and what rights you have in relation
to your personal data. It also specifies the contact details of the responsible Data Controller
with whom you may exercise your rights, the Data Protection Officer and the European
Data Protection Supervisor.
The information in relation to the processing of personal data linked to the Environment
and Emergencies Forum 2023 organised by the DG ECHO Unit B.2. Prevention andDisaster Risk Management of the European Commission is presented below.

2. Why and how do we process your personal data?
Purpose of the processing operation: the European Commission collects and further
processes your personal data to provide you with information about the specific meetingor event (before, during and after), to process your application for participation in thatmeeting or event and to ensure that we can identify and reach participants in case an
infection of the new coronavirus COVID-19 occurs.
Live web-streaming and audio-visual recording of the entire conference will takeplace. The recordings may be used for the creation of post-event material and publishedon web pages in relation to the event, on social media platforms and on the Commission
website.
If you come to the event in person, your data will be used by a third-party contractor(Uniglobe Travel) for the purpose of organising your travel and accommodation.
Your personal data will not be used for any automated decision-making including
profiling.
Photographs of the event, including speakers and audience, will be taken and published in
the context of the Environment and Emergencies Forum 2023 on the event website,
European Commission website or official accounts on online platforms. The audience or
non-speaker participants may appear in panoramic photographs of the whole
event/audience and in individual photographs that may be taken during breaks, during
dinner and during any networking moments.
The data controller is processing your personal data under Regulation (EU) 2018/1725 forthe purposes of the Environment and Emergencies Forum 2023. If you decide to takephotographs/audio-visual recordings of participants of the meeting and/or publish them
online, you assume full responsibility for these actions. The same applies if you download2

the photographs that will be shared with participants or posted on the European
Commission online platforms and publish them on the Internet. The data controller shallnot be held accountable for any processing of personal data that you might carry out on
your own initiative during or after the event.
Participants that do not wish to be photographed have the possibility to object to processing
by sending an e-mail to ECHO-E1-ATTRIBUTION@ec.europa.eu. Those indicating that
do not wish to be photographed will be seated in the back rows.

3. On what legal ground(s) do we process your personal data?
The processing operations on personal data, linked to the organisation, management,
follow-up and promotion of the event Environment and Emergencies Forum 2023
(including photos) are necessary for the management and functioning of the Commission,as mandated by the Treaties. Those provisions are Article 11 of the Treaty on European
Union and Article 15 of the Treaty on the Functioning of the European Union.
Consequently, those processing operations are lawful under Article 5(1)(a)(b)(d) ofRegulation (EU) 2018/1725.
We process your personal data, because:(a) processing is necessary for the performance of a task carried out in the public interest
or in the exercise of official authority vested in the Union institution or body;(b) the data subject has given consent to the processing of his or her personal data for one
or more specific purposes;Your consent is required for the following actions during the Environment andEmergencies Forum 2023:▪ the processing of your personal data for managing your registration to the event;▪ organising your travel and accommodation for this event;▪ the sharing of the meeting or event participants list containing your name,affiliation and email address with other participants for networking purposes. In
addition, further information will be given if there are specific purposes for such
sharing (e.g. for the purpose of future collaboration);▪ where relevant (if concerned): publication on the event website and on DG ECHO
website of the agenda with your name as speaker/moderator/rapporteur;▪ where relevant (if concerned): publication of audio-video live stream andrecordings of the event on the website of the organisers, including on social media
platforms;▪ the processing of your personal data for inviting you to future events the data
controller may organise.
The European Commission will publish the agenda of the event on its official website andon the event website with the personal data (name and title) of the speakers, rapporteurs,
moderators. However, the agenda will be published without the personal data or the data
will be redacted where consent is not received.
If you opt-in, you are giving us your explicit consent under Article 5(1)(d) of Regulation(EU) 2018/1725 to process your personal data for those specific purposes. You can give3

your consent/not give your consent via a clear affirmative/negative act by ticking thebox(es) on the online registration form.
Your consent for these services can be withdrawn at any time by sending an email at:
ECHO-E1-ATTRIBUTION@ec.europa.eu

4. Which personal data do we collect and further process
The following personal data may be processed in the context of the meeting or event:•contact details (function/title, first name, last name, name of organisation, country,
e-mail address, telephone number);•travel details (city of departure and return);•

connection details in case you are a remote speaker using a video-conferencing tool
to attend the event;•connection details in case you are a remote participant following the livestreamingof the event;•information about your organisation;•nationality, passport or identity card number and its date of issue and expiry date
may be collected, so that the data subjects may obtain access to the premises where
the meeting/event is held or in order to issue travel documents;•

dietary requests (if any) or specific access requirements.

The Commission has obtained personal data from a.) data subject (and/or) previous events;b.) publicly accessible sources.
The provision of personal data is mandatory to meet the necessary requirements forregistration and participation in the event. If you do not provide your personal data, theCommission will not be able to grant you access to the premises/platform of the event.

5. How long do we keep your personal data?
The Data Controller only keeps your personal data for the time necessary to fulfil the
purpose of collection or further processing.
For each of the categories of personal data that may be processed, please find below theretention details and the reference to the relevant record of processing:▪
▪

Personal data related to the organisation and management of the meeting or event(this includes the information given during the registration, before, during or after
the event) will be kept for five years after the meeting or event.
In case of audio-visual recording of the meeting or event, the recordings will be
kept for 3 months after the meeting or event before being deleted. More
4

▪

▪

information is available in the Record of Processing DPR-EC-01937 (Audio-visual
recording of meetings).
Personal data shared with the controller for future mailing purposes (e.g., forreceiving newsletters or invitations to similar events) are processed in line with the
Record of Processing DPR-EC-03928 (Management of subscriptions to receive
information) and the specific privacy statement prepared by the organising
Commission service.
Selected service providers for organisational purposes (such as event management
organisations, venues, caterers and/or travel agents) are contractually bound toprocess personal data on behalf of and in line with the instructions of the data
controller, keep confidential any data they process and protect it from unauthorised
access, use and retention.

6. How do we protect and safeguard your personal data?
All personal data in electronic format (e-mails, documents, databases, uploaded batches ofdata, etc.) are stored on the servers of the European Commission and of its contractors. Allprocessing operations are carried out pursuant to Commission Decision (EU, Euratom)
2017/46 of 10 January 2017 on the security of communication and information systems in
the European Commission.
To protect your personal data, the Commission has put in place a number of technical andorganisational measures. Technical measures include appropriate actions to address online
security, risk of data loss, alteration of data or unauthorised access, taking into
consideration the risk presented by the processing and the nature of the personal data being
processed. Organisational measures include restricting access to personal data solely toauthorised persons with a legitimate need to know for the purposes of this processing
operation.
The Commission’s processors/contractors are bound by a specific contractual clause forany processing operations of your personal data on behalf of the Commission, and by theconfidentiality obligations deriving from the transposition of the General Data Protection
Regulation in the EU Member States (‘GDPR’ Regulation (EU) 2016/679). The
processors/contractors have to put in place appropriate technical and organisational
measures to ensure the level of security, required by the Commission.

7. Who has access to your personal data and to whom is it disclosed?
Access to your personal data is provided to the Commission staff responsible for carryingout this processing operation and to other authorised Commission staff according to the“need to know” principle. Such staff abide by statutory, and when required, additional
confidentiality agreements.
Where necessary, we may also share your information with service providers for the
purposes of organising the Environment and Emergencies Forum 2023.
••

For registration purposes: Tipik Communication Agency S.A., DG ECHO’s
sub-contractor
For survey reasons: EUSurvey (privacy policy)5••For travel arrangements: AXON-Uniglobe Travel
For accommodation: data will be shared with the relevant hotel

The personal data (name, surname, title, organisation) of the speakers, moderators,
rapporteurs and active participants in other capacities will be made public on the event
website.
Please note that pursuant to Article 3(13) of the Regulation, public authorities (e.g. Courtof Auditors, EU Court of Justice) which may receive personal data in the framework of aparticular inquiry in accordance with Union or Member State law shall not be regarded asrecipients. The processing of those data by those public authorities shall be in compliancewith the applicable data protection rules according to the purposes of the processing.
The information we collect will not be given to any third party, except to the extent andfor the purpose we may be required to do so by law.

Cookies
Cookies are short text files stored on a user’s device (such as a computer, tablet or phone)by a website. Cookies are used for the technical functioning of a website (functional
cookies) or for gathering statistics (analytical cookies).
Cookies that are active for the registration session are those which would allow an attendee
to resume the registration in case it was left incomplete, as well as the language cookie for
language selection.
Enabling these cookies is not strictly necessary for the website to work but it will provide
you with a better browsing experience. You can delete or block these cookies, but if you
do that, some features of the registration website may not work as intended. For viewing
the web streaming and video recordings it is necessary to enable all cookies.
When you visit the website(s) of the event Holocaust Remembrance Conference 2023 andwhen you register, we will keep your session log information for a maximum of 3 days.
This information will afterwards be deleted.
The cookie-related information is not used to identify data subjects personally. These
cookies are not used for any purpose other than those described here.
Should you wish to opt your personal data out of our anonymised, aggregated statistics,
you can do so on our cookies page. In particular, you can control and/or delete thosecookies as per your preference.

8. What are your rights and how can you exercise them?
You have specific rights as a ‘data subject’ under Chapter III (Articles 14-25) of Regulation(EU) 2018/1725, in particular the right to access, your personal data and to rectify them incase your personal data are inaccurate or incomplete. Where applicable, you have the rightto erase your personal data, to restrict the processing of your personal data, to object to theprocessing, and the right to data portability.
6You have the right to object to the processing of your personal data, which is lawfully
carried out pursuant to Article 5(1)(a) of Regulation (EU) 2018/1725 on grounds relating
to your particular situation.
The European Commission will ensure that the data subjects can exercise their right toobject to processing whenever possible by the organisers of the meeting/event (forexample, by deleting a picture from the virtual event).
You have consented to provide your personal data to for the present processing operation.
You can withdraw your consent at any time by notifying the Data Controller. The
withdrawal will not affect the lawfulness of the processing carried out before you havewithdrawn the consent.
You can exercise your rights by contacting the data controller, or in case of conflict theData Protection Officer. If necessary, you can also address the European Data Protection
Supervisor. Their contact information is given under Heading 9 below.
Where you wish to exercise your rights in the context of one or several specific processing
operations, please provide their description (i.e. their Record reference(s) as specified
under Heading 10 below) in your request.

9. Contact information▪

The Data Controller
If you would like to exercise your rights under Regulation (EU) 2018/1725, or if
you have comments, questions or concerns, or if you would like to submit acomplaint regarding the collection and use of your personal data, please feel free
to contact the Data Controller via ECHO-E1-ATTRIBUTION@ec.europa.eu▪

The Data Protection Officer (DPO) of the Commission
You may contact the Data Protection Officer (DATA-PROTECTIONOFFICER@ec.europa.eu) with regard to issues related to the processing of yourpersonal data under Regulation (EU) 2018/1725.

▪

The European Data Protection Supervisor (EDPS)
You have the right to have recourse (i.e. you can lodge a complaint) to the European
Data Protection Supervisor (edps@edps.europa.eu) if you consider that your rights
under Regulation (EU) 2018/1725 have been infringed as a result of the processingof your personal data by the data controller.

10. Where to find more detailed information?
The Commission Data Protection Officer (DPO) publishes the register of all processing
operations on personal data by the European Commission, which have been documented
and notified to him. You may access the register via the following link:
http://ec.europa.eu/dpo-register.
This specific processing operation has been included in the DPO’s public register with thefollowing Record reference: DPR-EC-1063.

7