----

Implementing rules relating to Regulation (EC) No 45/2001 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data

Bureau decision of 22 June 2005

(2005/C 308/01)

THE BUREAU,

Having regard to the Treaty establishing the European Community and, in particular, Article 286 thereof,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data and, in particular, Article 24(8) thereof,

Having regard to Rule 22(2) of the European Parliament's Rules of Procedure,

Whereas:

DECIDES:

Article 1

Purpose

1.   This Decision lays down the general rules governing the implementation of the Regulation in the case of the European Parliament. In particular, it supplements the provisions set out in the Regulation which relate to the tasks, duties and powers of the European Parliament's Data Protection Officer(s).

2.   Furthermore, the Decision lays down the detailed rules pursuant to which a data subject may exercise his or her rights, the procedure for notifying a processing operation and the procedure for obtaining access to the register of processing operations kept by the Data Protection Officer.

Article 2

Appointment, statute and independence

1.   The Secretary-General shall appoint the Data Protection Officer from amongst the officials of the Community institutions and bodies on the basis of his or her personal and professional qualities and, in particular, his or her expert knowledge of data protection. The Data Protection Officer shall be appointed in accordance with the procedure laid down in Article 29 of the Staff Regulations.

2.   The Secretary-General shall register the Data Protection Officer with the European Data Protection Supervisor.

3.   For the purpose of performing his or her duties, the Data Protection Officer shall be relieved of any other activity within the European Parliament. He or she may perform other duties, provided that they do not result in a conflict of interests with the role of Data Protection Officer, particularly in relation to the application of the provisions laid down in the Regulation.

4.   The Data Protection Officer shall be appointed for a five-year period, renewable once. He or she may be dismissed from his or her post only with the consent of the European Data Protection Supervisor and only if he or she no longer fulfils the conditions required for the performance of his or her duties. The European Data Protection Supervisor shall be consulted in writing and a copy sent to the Officer.

5.   The Data Protection Officer shall be independent in the performance of his or her duties. In that regard, he or she may not receive any instructions, in particular from the Appointing Authority, the Secretary-General or any other source as regards the internal application of the provisions laid down in the Regulation or his or her cooperation with the European Data Protection Supervisor. The Data Protection Officer shall refrain from any act which is incompatible with the nature of his or her duties.

6.   The Data Protection Officer shall inform the appropriate European Parliament authorities of the number of staff and the resources which he or she requires in order to carry out his or her duties. In addition, he or she may call upon specialist outside staff to help him or her in the performance of his or her duties.

7.   The Data Protection Officer and his or her staff shall at all times be subject to the rules and provisions laid down in the Staff Regulations applicable to officials and the conditions of employment applicable to other servants.

8.   The Data Protection Officer and his or her staff (to whom Article 287 of the Treaty shall apply) shall maintain, including once they have ceased their duties, professional secrecy as regards any confidential documents or information which they obtain in the course of their duties.

Article 2a

Assistant Officers

1.   The Secretary-General may appoint Assistant Data Protection Officers, to whom Article 2(4), (5), (7) and (8) shall also apply.

2.   The Officer, the Assistant Officers and any support staff shall form an integral part of the Data Protection Department, which shall be run by the Officer.

3.   The Officer may be assisted in all of his or her tasks or be represented (in his or her absence or when otherwise engaged) by an assistant.

Article 3

Duties

1.   The Data Protection Officer shall ensure that the provisions laid down in the Regulation are applied within the European Parliament. He or she shall carry out his or her tasks in cooperation with the European Data Protection Supervisor.

2.   The Officer may be consulted at any time by any person and in particular by data subjects in respect of any matter relating to the application of the Regulation. Specifically, the Officer shall provide advice to the Registry department in order to ensure compliance with the provisions laid down in the Bureau decision of 28 November 2001 concerning public access to European Parliament documents.

3.   The Data Protection Officer shall represent the European Parliament's Secretariat in respect of any matter relating to data protection. He or she may in particular attend meetings of committees or relevant bodies at international level.

Article 4

Tasks

The Data Protection Officer's tasks shall be as follows:

Article 5

Powers

1.   In order to perform his or her tasks and in accordance with the conditions laid down in the Regulation, the Data Protection Officer may:

2.   The Data Protection Officer shall have access at all times to data which are being processed and to all offices, data-processing installations and data carriers.

Article 6

Procedure for notifying processing operations

1.   Before processing any data (and in sufficiently good time to enable any prior check within the meaning of Article 27(3) of the Regulation to be carried out), the data controller shall notify the Data Protection Officer thereof, for which purpose he or she may use the notification form available on the European Parliament's Intranet. In any event, the notification shall comply with the provisions laid down in paragraph 3. The notification shall be signed by the data controller and be despatched to the Data Protection Department by internal post, e-mail or fax. Where the notification is sent by e-mail or fax, the signed original paper copy shall reach the Data Protection Department within ten calendar days of the date of despatch.

2.   The data controller shall, in accordance with the notification procedure laid down in paragraph 1, immediately notify processing operations which were already under way on the date of entry into force of the Regulation (1 February 2002).

3.   The information to be provided shall include at least the following:

4.   The data controller shall immediately inform the Data Protection Officer of any change affecting the information referred to in paragraph 3.

Article 7

Register of processing operations

1.   The Data Protection Officer shall keep a register of the processing operations notified pursuant to Article 6. The register shall detail all the notified processing operations which have been carried out at the European Parliament and shall indicate in particular the department responsible for the processing, the data processed and the intended purpose.

The register may be inspected by any person and shall also facilitate the exercise of the recognised rights of the data subject which are laid down in Articles 13 to 19 of the Regulation.

2.   The register shall contain the information referred to in Article 6(3)(a) to (g) of this Decision.

3.   If the Officer deems it necessary, he or she may take action to rectify the data contained in the register, with a view to ensuring that they are accurate.

Article 8

General rules governing the exercise of rights by data subjects

1.   The rights of access, rectification, blocking, erasure and objection may be exercised by the data subject or his or her duly authorised representative only.

2.   Requests to exercise one of those rights shall be addressed to the data controller. A form shall be available in electronic form on the European Parliament's Intranet. The request shall contain:

The request may be submitted by internal or external post, e-mail or fax in such a way that the submission and receipt of the request may be certified. Should the request contain any errors or omissions, the data controller may ask for additional information. The data controller shall verify the applicant's credentials.

3.   The data controller shall respond to any request to exercise the rights, even in the absence of the personal data processed in the file. An acknowledgement of receipt shall be sent to the applicant within five working days of the receipt of the request. However, the data controller shall not be required to send an acknowledgement of receipt if a substantial reply to the request is provided within the same time limit of five working days. The reply shall be sent by the same means of communication as was used by the data subject.

4.   The data controller shall notify the data subject of his or her right to lodge a complaint with the European Data Protection Supervisor if that person considers that the rights granted to him or her under Article 286 of the Treaty were infringed when the personal data relating to him or her were processed.

5.   The data subject may exercise any of these rights free of charge.

6.   Requests to exercise a right may be rejected in the cases referred to in Article 20 of the Regulation, subject to application of Article 17 of this Decision.

Article 9

Right of access

1.   The data subject shall have the right to obtain, without constraint, at any time within three months from the receipt of the request and free of charge from the data controller:

2.   The data subject may access his or her personal data by any of the following means:

Article 10

Right of rectification

1.   The data subject shall have the right to obtain from the data controller the rectification without delay of inaccurate or incomplete personal data.

2.   Requests for rectification shall specify the data to be rectified and the correction to be made. Where appropriate, a request may be accompanied by supporting documents.

3.   If a request for rectification is accepted, it shall be acted upon immediately and the data subject notified thereof. Should a request for rectification be rejected, the data controller shall have 15 working days within which to inform the data subject by means of a letter stating the grounds for the rejection.

Article 11

Right to have data blocked

1.   The data subject shall have the right to obtain from the data controller the blocking of data where:

2.   Requests for blocking shall specify the data to be blocked. A data subject who has requested and obtained the blocking of data shall be informed thereof by the data controller. He or she shall also be informed of the fact that data are to be unblocked at least 15 working days before they are unblocked.

3.   The data controller shall take a decision within 15 working days of receiving a request for data to be blocked. If the request is accepted, it shall be acted upon within 30 working days and the data subject notified thereof. Should the request for blocking be rejected, the data controller shall have 15 working days within which to inform the data subject by means of a letter stating the grounds for the rejection.

4.   In automated filing systems, blocking shall be ensured by technical means. The fact that personal data are blocked shall be indicated in the system in such a way as to make it clear that the data may not be used.

5.   Personal data blocked pursuant to this Article shall, with the exception of their storage, only be processed for purposes of proof, or with the consent of the data subject or for the purpose of protecting the rights of third parties.

Article 12

Right of erasure

1.   The data subject shall have the right to obtain from the data controller the erasure of data if the processing thereof is unlawful.

2.   Requests for erasure shall specify the data to be erased. Where the data controller disputes that the processing is unlawful, he or she shall provide proof that it is lawful.

3.   The data controller shall reply within 15 working days of receiving a request for erasure. If the request is accepted, it shall be acted upon immediately. If the data controller deems the request unjustified, he or she shall have 15 working days within which to inform the data subject by means of a letter stating the grounds for the decision.

4.   Erasure entails the physical disappearance of the data without its being necessary to replace them by a code or by the creation of an alternative file containing the data erased. If erasure proves impossible for technical reasons, the data controller shall block the data immediately. The data subject shall be duly informed of this procedure.

Article 12a

Notification to third parties

The data subject shall have the right to obtain from the data controller the notification to third parties to whom the data have been disclosed of any rectification, erasure or blocking pursuant to Articles 10 to 12, unless this proves impossible or involves a disproportionate effort. In the event of a refusal to notify a third party on the grounds of impossibility or disproportionate effort, the data controller shall have 15 working days within which to inform the data subject by means of a letter stating the grounds for the refusal.

Article 13

Right to object

1.   The data subject shall have the right to object at any time, on compelling legitimate grounds relating to his or her particular situation, to the processing of data relating to him or her, except in the cases covered by Article 5(b), (c) and (d) of the Regulation.

2.   The data subject shall have the right to be informed before personal data are disclosed for the first time to third parties or used on their behalf for the purposes of direct marketing and shall be expressly offered the right to object free of charge to such disclosure or use.

3.   Requests to make an objection shall specify the datum or data concerned.

4.   The data controller shall reply to the data subject within 15 working days of receiving a request to make an objection. If the data controller deems the request unjustified, he or she shall inform the data subject by means of a letter stating the grounds for the decision.

5.   In the event of a justified objection the data in question may not be subjected to the processing referred to in paragraph 1.

Article 14

Monitoring procedure

1.   Any data controller concerned shall assist the Data Protection Officer in the performance of his or her duties and provide him or her with any information which he or she requests within 20 working days. In performing his or her duties, the Data Protection Officer shall have access at all times to the data being processed and to all offices, data-processing installations and data carriers.

2.   The Data Protection Officer may decide to carry out any other type of monitoring at any time in order to ensure that the Regulation is being properly applied by the European Parliament.

Article 15

Remedies

1.   Any person employed by the European Parliament may lodge a complaint pursuant to Article 33 of the Regulation with the European Data Protection Supervisor. Lodging such a complaint shall not have the effect of stopping time running for the purposes of lodging a complaint pursuant to Article 90 of the Staff Regulations.

2.   Irrespective of the right referred to in paragraph 1, any person employed by the European Parliament may lodge with the Appointing Authority a complaint pursuant to Article 90 of the Staff Regulations in respect of a matter relating to the processing of personal data. In that case, the Data Protection Officer shall be consulted by the relevant departments.

Article 16

Restrictions

1.   The data controller may restrict the rights laid down in Articles 9 to 13 of this Decision on the grounds set out Article 20(1) of the Regulation. He or she shall consult the Data Protection Officer in advance.

2.   If a restriction is imposed, the data controller shall, in accordance with Community law, inform the data subject of the principal reasons for the restriction and of his or her right to refer the matter to the European Data Protection Supervisor and the Court of Justice.

3.   The data controller shall respond immediately to requests relating to the application of restrictions on the exercise of rights and shall give the reasons for any decision taken to that effect.

Article 17

Data controllers

1.   By means of a specific decision, the Secretary-General may appoint an authority subordinate to him or her as the data controller, within the meaning of Article 2(d) of the Regulation.

2.   The data controller shall be responsible for ensuring that processing operations carried out under his or her supervision are in accordance with the Regulation. In particular, he or she shall be responsible for:

Article 17a

Access to documents

1.   The register of processing operations shall be public and accessible in electronic form. Any person may inspect it directly and request an authenticated copy of the entry for a specific processing operation from the Data Protection Officer. Indirect access shall also be possible via the European Data Protection Supervisor.

2.   Documents produced by the Data Protection Officer and his or her staff shall be subject to Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents.

Article 18

Entry into force

This Decision shall come into force on the day following its publication in the Official Journal of the European Union.

----