EN Official Journal of the European Union C 222/5

Executive Summary of the Opinion of the European Data Protection Supervisor on the Commission Proposal for a Regulation of the European Parliament and of the Council on a European network of Employment Services, workers' access to mobility services and the further integration of labour markets

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

2014/C 222/05

1. INTRODUCTION

1.1. Consultation of the EDPS

1. On 17 January 2014, the Commission adopted a proposal for a Regulation of the European Parliament and of the Council on a European network of Employment Services, workers' access to mobility services and the further integration of labour markets (‘the Proposal’) (1). On the same day, the Commission sent the Proposal to the EDPS for consultation.

2. We welcome the fact that we were consulted on this Proposal prior to its adoption and that we were given the possibility to provide informal comments to the Commission. The Commission took into account several of these comments. As a result, the data protection safeguards in the proposed Regulation have been strengthened. We also welcome the reference in the preamble to the consultation of the EDPS.

1.2. Objective and scope of the Proposal

3. The objective of the Proposal is to ‘enhance access of workers to intra-EU labour mobility support services, thus supporting fair mobility and increasing access to employment opportunities throughout the Union’ (2).

4. The Proposal aims at providing a revised and updated legal framework for the functioning of the EURES job mobility portal (3), which has already been in place for some time. The proposed rules will also fundamentally change the way how the portal currently works.

5. As it stands now, the portal offers a tool to help jobseekers find employers and employers find jobseekers across the EU directly through the portal, much like other, privately operated, job search sites. Jobseekers can register and post their résumés on the portal. Potential employers, in turn, can access, browse and search the site for matching profiles when they are looking to fill vacancies. The EURES job portal is managed by the Commission and hosted on Commission servers.

6. The changes proposed include measures to help increase the number of job vacancies as well as the pool of candidates available in EURES. Further, they also increase the capabilities of the portal to automatically match job vacancies with job applications.

7. To this end the current system of direct registration of CVs and job vacancies will be replaced/complemented by a system where public employment services and other ‘authorised’ employment services (so-called ‘EURES-partners’) will make available via EURES a limited and select set of ‘matchable’ and codified data obtained from the CV and job vacancy databases they hold.

8. To illustrate, these would include data categories such as the occupation or skill concerned, level of academic achievement, language skills, driving licence, the number of years of work experience, the nature of the contract (permanent or temporary) and the location of employment. Making these data available to EURES, on the applicant side (data derived from CV data), will be subject to explicit consent of the individuals concerned.

9. The list of organisations systematically feeding data into the system will include not only ‘public employment services of the Member States’, but also other ‘authorised’ EURES partners. In other words: participation in the EURES network will be open to all employment services, whether public or private, which fulfil a specified minimum set of criteria (set forth in Annex 1 of the Proposal).

10. Thanks to its matching tool, it is expected that the Regulation will enable the EURES portal to ‘carry out a good automated matching between job vacancies and CVs across Member States, translating in all EU languages and understanding skills, competencies, occupations and qualifications acquired at national and sectoral level’ (4).

11. The process leading to a match can be initiated by any of the EURES partners. If a match is positive, the organisation requesting the match will receive a list of matching applicant profiles (5). However, as a rule, the list will not contain the names, the actual CVs or any other personal data of the applicants concerned. These can be obtained, on request, from the EURES partner that made the data available to the EURES portal (6).

3. CONCLUSIONS

38. We welcome the careful consideration by the Commission of the right to the protection of personal data when drafting the Proposal. In particular, the Proposal requires explicit consent from the workers concerned and takes due account of the rights of data subjects, including their right to access and correct their data. In addition, the Proposal does not specifically require or encourage web-crawling and indeed raises relevant data protection concerns in this regard in the Explanatory Memorandum.

39. In the present Opinion we recommend certain further improvements: — a recital could be added to explain what is meant by the granularity of consent under Article 14(3), — in Article 15(3) after the words ‘job applications, and CVs made available on the EURES portal’ the words ‘in accordance with Article 14’ could be added; — Article 17(4) should refer to ‘access to information’ rather than ‘access to general information’, — a specific substantive provision or a recital could be added to the draft Regulation, requiring that the principle of data protection by design be applied for the development of the EURES portal. In addition, it could also be helpful to provide some further guidance in substantive provisions or at least in recitals, as outlined in this Opinion, — the Regulation should more clearly specify who can have access to the database and subject to what safeguards, — there should also be further clarification in the text of the Regulation on how the automated matching works. In any event, the Regulation should specify that — unless a worker choses to make his/her entire CV available on EURES — those searching the EURES portal will not have direct access to the names, CVs or any other directly identifiable personal data of the applicants, only to the list of a limited and select set of ‘matchable’ and codified data obtained from the CV databases they hold', — finally, the purpose of the processing and the acceptable range of further use of the data should be clearly specified in the proposed Regulation.

Done at Brussels, 3 April 2014 Giovanni BUTTARELLI Assistant European Data Protection Supervisor

(1) COM(2014) 6 final.

(2) Explanatory Memorandum, Section 1.1.

(3) See https://ec.europa.eu/eures/home.jsp?lang=en.

(4) Explanatory Memorandum, Section 1.4.

(5) As noted in para 8, profiles will include data categories such as the occupation or skill concerned, level of academic achievement, language skills, driving licence, the number of years of work experience, the nature of the contract (permanent or temporary) and the location of employment will be accessible in EURES.

(6) With that said, it appears that applicants can also decide to make available their entire CVs to the portal. Further, they can also add information in a free-text field to accompany the codified standard information that will appear in the results when the matching tool is used.