# CA2020124EN.01000101.xml

| 17.4.2020 | EN | Official Journal of the European Union | CA 124/1 |
| --- | --- | --- | --- |

17.4.2020

EN

Official Journal of the European Union

CA 124/1

---

VACANCY NOTICE ECA/2020/6 — Data Protection Officer

(one post – AD function group, grade AD 9 – AD 12)

(2020/C 124 A/01)

WHO WE ARE

The European Court of Auditors (ECA) is the European Union’s external auditor. Established in 1975, the ECA is one of the EU’s seven institutions. We are based in Luxembourg and employ around 900 audit, support and administrative staff of all EU nationalities.

The ECA operates as a collegiate body of 27 Members, one from each EU Member State. Our auditors check that the EU keeps good accounts and correctly applies its financial rules, and that its policies and programmes achieve their intended objectives and deliver value for money.

Through our work, we contribute to improving the EU’s financial management and promote accountability and transparency. We warn of risks, provide assurance, indicate shortcomings and successes and offer guidance to EU policymakers and legislators. We present our observations and recommendations to the European Parliament, the Council of the EU, and national governments and parliaments, as well as the general public.

In accordance with the Data Protection Regulation (EU) 2018/1725 of the European Parliament and of the Council (1), the Data Protection Officer (DPO) has an independent function and is directly appointed by the Court.

WHAT WE ARE OFFERING

The Court has decided to launch a recruitment procedure to appoint a Data Protection Officer (grade AD9-AD12) and to draw up a reserve list of suitable candidates on the basis of Article 29(2) of the Staff Regulations of Officials of the European Union (hereinafter ‘the Staff Regulations’). This exceptional recruitment procedure, which concerns a post requiring special qualifications, will run in parallel with the internal and interinstitutional recruitment procedures, in accordance with Article 29(1)(a) to (c) of the Staff Regulations, with a view to broadening the Appointing Authority’s choice of candidates.

The role, mandate and responsibilities of the DPO are laid down in Regulation (EU) 2018/1725 and ECA’s Implementing rules for the DPO. The DPO ensures, in an independent manner, that the Institution correctly applies the law protecting natural persons with regard to the processing of personal data by the Court.

Under the authority of the President of the Court, the DPO will be responsible, but not limited, for:

| — | ensuring in an independent manner that ECA respects its data protection obligations pursuant to Regulation (EU) 2018/1725; |
| --- | --- |

—

ensuring in an independent manner that ECA respects its data protection obligations pursuant to Regulation (EU) 2018/1725;

| — | informing, advising and raising awareness of the Court and the ECA staff on Personal Data Protection issues; |
| --- | --- |

—

informing, advising and raising awareness of the Court and the ECA staff on Personal Data Protection issues;

| — | advising on general administrative measures which may impact on the protection of personal data, in particular in the field of new technologies; |
| --- | --- |

—

advising on general administrative measures which may impact on the protection of personal data, in particular in the field of new technologies;

| — | ensuring that controllers and data subjects are informed of their rights and obligations pursuant to Regulation (EU) 2018/1725; |
| --- | --- |

—

ensuring that controllers and data subjects are informed of their rights and obligations pursuant to Regulation (EU) 2018/1725;

| — | providing opinions and advice to ECA services on processing personal data at ECA and also in the change management approval process; |
| --- | --- |

—

providing opinions and advice to ECA services on processing personal data at ECA and also in the change management approval process;

| — | keeping a register and inventory of the personal data processing operations carried out by ECA; |
| --- | --- |

—

keeping a register and inventory of the personal data processing operations carried out by ECA;

| — | keeping a register on personal data breaches; |
| --- | --- |

—

keeping a register on personal data breaches;

| — | keeping an anonymous register for the exercise of data subjects rights; |
| --- | --- |

—

keeping an anonymous register for the exercise of data subjects rights;

| — | hearing and examining complaints and other requests from data subjects and conduct inquiries in response to complaints or on his/her own initiative in his/her area of responsibility; |
| --- | --- |

—

hearing and examining complaints and other requests from data subjects and conduct inquiries in response to complaints or on his/her own initiative in his/her area of responsibility;

| — | investigating issues and facts upon request or on his/her own initiative related with possible breach of the provisions laid down in the Regulation and report accordingly; |
| --- | --- |

—

investigating issues and facts upon request or on his/her own initiative related with possible breach of the provisions laid down in the Regulation and report accordingly;

| — | drafting guidelines and procedures related with best practices in data protection promoting the applicability of the principles on privacy-by-design and by default; |
| --- | --- |

—

drafting guidelines and procedures related with best practices in data protection promoting the applicability of the principles on privacy-by-design and by default;

| — | cooperating on performing the privacy impact assessments for the personal data processing operations with the controller; |
| --- | --- |

—

cooperating on performing the privacy impact assessments for the personal data processing operations with the controller;

| — | responding to requests from the European Data Protection Supervisor (EDPS) and, within the sphere of his/her competence, cooperate with the European Data Protection Supervisor at the latter’s request or on his/her own initiative; |
| --- | --- |

—

responding to requests from the European Data Protection Supervisor (EDPS) and, within the sphere of his/her competence, cooperate with the European Data Protection Supervisor at the latter’s request or on his/her own initiative;

| — | notifying the European Data Protection Supervisor (EDPS) of the processing operations likely to present specific risks; and |
| --- | --- |

—

notifying the European Data Protection Supervisor (EDPS) of the processing operations likely to present specific risks; and

| — | regularly attending meetings within the data protection field work, engaging in inter-institutional cooperation and establishing a mutual exchange of information with other EU Institutions and bodies. |
| --- | --- |

—

regularly attending meetings within the data protection field work, engaging in inter-institutional cooperation and establishing a mutual exchange of information with other EU Institutions and bodies.

The grading of the successful candidates will be determined based on their relevant professional experience: at least 9 years for grade AD9, 12 years for grade AD10, 15 years for grade AD11 and 18 years for grade AD12.

The basic monthly salary for grades AD9 and AD12 (step 1) is respectively 8 002,30 and 11 590,57 euros.

Under the conditions laid down in the Staff Regulations, and depending on individual circumstances and household composition, certain allowances may be added to this basic salary, which is subject to EU tax and exempt from national tax.

The EU institutions offer their own pension plan and social security system, based on contributions deducted from salaries at source.

Children of staff may enrol free of charge at the European School.

WHAT WE ARE LOOKING FOR

I.   ELIGIBILITY CRITERIA

This recruitment procedure is open to applicants who meet the following eligibility criteria by the application deadline:

1.   Legal requirements

In accordance with Article 28 of the Staff Regulations:

| — | be a national of one of the Member States of the European Union; |
| --- | --- |

—

be a national of one of the Member States of the European Union;

| — | enjoy their full rights as a citizen; |
| --- | --- |

—

enjoy their full rights as a citizen;

| — | have fulfilled any obligations imposed on them by the recruitment laws concerning military service; |
| --- | --- |

—

have fulfilled any obligations imposed on them by the recruitment laws concerning military service;

| — | meet the character requirements for the duties involved. |
| --- | --- |

—

meet the character requirements for the duties involved.

2.   Qualifications

In accordance with Article 5 of the Staff Regulations:

| — | a level of education which corresponds to completed university studies attested by a diploma when the normal period of university education is four years or more, or |
| --- | --- |

—

a level of education which corresponds to completed university studies attested by a diploma when the normal period of university education is four years or more, or

| — | a level of education which corresponds to completed university studies attested by a diploma and appropriate professional experience of at least one year when the normal period of university education is at least three years. |
| --- | --- |

—

a level of education which corresponds to completed university studies attested by a diploma and appropriate professional experience of at least one year when the normal period of university education is at least three years.

Only qualifications that have been awarded in EU Member States or that are subject to the equivalence certificates issued by the authorities in said EU Member States shall be taken into consideration.

3.   Professional experience

At least nine (9) years of proven full-time professional experience from which five (5) years relevant to the duties as a DPO after the award of the qualification certifying the completion of the study levels required as a condition of eligibility listed above.

4.   Knowledge of languages

As English and French are the official working languages of the Court, a sound knowledge of one of these languages (minimum level C1 in understanding, speaking and writing) and a good knowledge of the other language (minimum level B1 in the same categories) are required.

To assess your foreign language skills, see:

http://europass.cedefop.europa.eu/en/resources/european-language-levels-cefr

II.   SPECIAL REQUIREMENTS

1.   Knowledge in the field

| — | Proven professional experience in applying personal data protection legislation, preferably working with/within the European Institutions, Agencies or Bodies or a related service within the National Administration of an EU Member State; |
| --- | --- |

—

Proven professional experience in applying personal data protection legislation, preferably working with/within the European Institutions, Agencies or Bodies or a related service within the National Administration of an EU Member State;

| — | knowledge of information technologies including technical security aspects. |
| --- | --- |

—

knowledge of information technologies including technical security aspects.

2.   Assets

| — | A University Degree in Law, IT, or any of the areas relevant to the duties described above; |
| --- | --- |

—

A University Degree in Law, IT, or any of the areas relevant to the duties described above;

| — | a DPO certification issued by a certification body described in Articles 42-43 of the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council (2) or by an International data protection association. |
| --- | --- |

—

a DPO certification issued by a certification body described in Articles 42-43 of the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council (2) or by an International data protection association.

3.   Soft skills

| — | Capacity to deliver quality and making the most effective use of available resources as well as demonstrating an open and accessible approach, courtesy and impartiality; |
| --- | --- |

—

Capacity to deliver quality and making the most effective use of available resources as well as demonstrating an open and accessible approach, courtesy and impartiality;

| — | proven capacity to analyse complex information, to consider options in a clear and structured way, to propose and implement recommendations and to make sound decisions; |
| --- | --- |

—

proven capacity to analyse complex information, to consider options in a clear and structured way, to propose and implement recommendations and to make sound decisions;

| — | proven capacity to work under pressure and with tight deadlines, to make timely decisions, to reprioritize tasks responding to changes in a rapidly evolving environment; |
| --- | --- |

—

proven capacity to work under pressure and with tight deadlines, to make timely decisions, to reprioritize tasks responding to changes in a rapidly evolving environment;

| — | excellent analytical capabilities, problem-solving and conflict-resolution skills; |
| --- | --- |

—

excellent analytical capabilities, problem-solving and conflict-resolution skills;

| — | strong negotiation skills and the ability to defend data protection principles and rights vis-à-vis senior management within ECA, auditees and service providers; |
| --- | --- |

—

strong negotiation skills and the ability to defend data protection principles and rights vis-à-vis senior management within ECA, auditees and service providers;

| — | excellent interpersonal and communication skills. |
| --- | --- |

—

excellent interpersonal and communication skills.

PROCEDURE

The selection committee will pre-select eligible candidates on the basis of their knowledge and/or experience in the field and their assets, as mentioned under the special requirements in section II above. A maximum of ten candidates (3) will be chosen in this way, and invited for an interview, which will be complemented by a written competency test.

The interview and the competency test shall assess the candidate’s soft skills, as mentioned under the special requirements in section II above, as well as their technical competencies.

At the end of this procedure, the selection committee will draw up a reserve list comprising a maximum of five candidates who best meet the requirements of the present vacancy notice. The successful candidates will be ranked in alphabetical order.

Inclusion on the reserve list does not, in any way, constitute an entitlement to recruitment. The ECA’s Appointing Authority is responsible for any offers of employment. The list will remain valid until 31 December 2021 and may be renewed.

APPLICATIONS

Deadline for applications is midday on 22 May 2020 (CET).

Applications must be drafted in English or French and submitted
  only via the online form
  published for this vacancy notice at:

https://www.eca.europa.eu/en/Pages/JobOpportunities.aspx#page-search---index---lang---en_US

Applications must be accompanied by the following documents:

| — | a letter of motivation (maximum 3 pages); |
| --- | --- |

—

a letter of motivation (maximum 3 pages);

| — | an up-to-date CV (maximum 3 pages) created by using the Europass template and specifying exact dates (see: http://europass.cedefop.europa.eu/); |
| --- | --- |

—

an up-to-date CV (maximum 3 pages) created by using the Europass template and specifying exact dates (see: http://europass.cedefop.europa.eu/);

| — | for officials working outside the Court: in addition to the two above-mentioned elements, a document confirming your function group, grade and status as an official must be provided; |
| --- | --- |

—

for officials working outside the Court: in addition to the two above-mentioned elements, a document confirming your function group, grade and status as an official must be provided;

| — | successful candidates in open competitions or those placed on a reserve list must indicate the reference of the competition or reserve list in their application (CV/letter of motivation/application form). |
| --- | --- |

—

successful candidates in open competitions or those placed on a reserve list must indicate the reference of the competition or reserve list in their application (CV/letter of motivation/application form).

Please note that only the information provided in your CV and motivation letter will be taken into account in evaluating your application.

This information will be regarded as authentic and accurate and thus will engage the applicant’s liability.

The candidates have to be able, upon request, to produce written evidence of their qualifications, professional experience and current duties if deemed necessary.

Interested applicants should complete their online application in time. We strongly advise applicants not to wait until the last few hours to apply. Experience has shown that the system may become overloaded closer to the deadline for applications. It may therefore prove difficult to apply on time.

Applications failing to adhere strictly to these instructions will be rejected.

RECRUITMENT POLICY

In line with the Court’s equal opportunities policy and Article 1d of the Staff Regulations, the Court embraces diversity and promotes equal opportunities. The Court accepts applications without discrimination on any grounds and takes steps to ensure that recruitment is evenly balanced between men and women, as required by Article 23 of the Charter of Fundamental Rights of the European Union. The Court also takes measures to reconcile working life with family life.

If you require any special arrangements (for specific handicap or disability) in order to take part in this selection procedure, please send an email in good time to ECA-Recrutement@eca.europa.eu.

DATA PROTECTION

The Court is committed to ensuring that candidates’ personal data are processed in compliance with Regulation (EU) 2018/1725 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.

For more information, see the specific privacy statement for employment vacancies, which is available at the following address:

https://www.eca.europa.eu/Lists/ECADocuments/Specific_Privacy_Statement_vacancies/Specific_Privacy_Statement_vacancies_EN.PDF

REQUESTS FOR RECONSIDERATION — COMPLAINTS AND APPEALS — COMPLAINTS TO THE EUROPEAN OMBUDSMAN

If, at any stage in the selection procedure, you consider that a decision taken in your regard is wrong, the following options are available.

I.   Request for the selection committee to reconsider its decision

You may submit a written reasoned request for reconsideration of a decision taken by the selection committee. This request must be sent, within 10 days of notification of the decision, to ECA-Recours@eca.europa.eu.

II.   Complaints

Under Article 90(2) of the Staff Regulations, you may submit a complaint against the ECA’s decision to reject your application within three months of being notified thereof. This complaint should be sent to the following address:

| Secretary-General |
| --- |
| European Court of Auditors |
| 12, rue Alcide De Gasperi |
| L-1615 Luxembourg |
| LUXEMBOURG |

Secretary-General

European Court of Auditors

12, rue Alcide De Gasperi

L-1615 Luxembourg

LUXEMBOURG

III.   Judicial appeals

Under Article 91 of the Staff Regulations, you may appeal against a decision to reject your complaint, insofar as it adversely affects you, to the Court of Justice of the European Union. The action must be brought by a lawyer within three months of notification of the decision to reject the complaint.

IV.   Complaints to the European Ombudsman

If you believe that the handling of your application has involved maladministration by the European Court of Auditors, you may submit a complaint to the European Ombudsman, having first contacted the Court with the aim of settling the dispute. You must submit your complaint in writing within two years of discovering the relevant facts. An electronic complaints form is available on the European Ombudsman’s website. Complaining to the European Ombudsman will not suspend the above-mentioned appeal deadlines.

---

(1)  Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

(2)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

(3)  Provided there are sufficient candidates.

---