Implementing rules relating to Regulation (EC) No 45/2001 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data — Bureau decision of  22 June 2005
Date: 2005-06-22
Institutions: European Parliament
Subjects: European Parliament, European official, data protection, data transmission, personal data, regulations for civil servants

6.12.2005

EN

Official Journal of the European Union

C 308/1

I

(Information)

EUROPEAN PARLIAMENT

Implementing rules relating to Regulation (EC) No 45/2001 of the European Parliament and of the
Council on the protection of individuals with regard to the processing of personal data by the
Community institutions and bodies and on the free movement of such data

Bureau decision of 22 June 2005

(2005/C 308/01)

THE BUREAU,

DECIDES:

Having regard to the Treaty establishing the European Com-
munity and, in particular, Article 286 thereof,

Having regard to Regulation (EC) No 45/2001 of the European
Parliament and of the Council of 18 December 2000 on the
protection of
individuals with regard to the processing of
personal data by the Community institutions and bodies and
on the free movement of such data and, in particular, Article
24(8) thereof,

Having regard to Rule 22(2) of the European Parliament's Rules
of Procedure,

Whereas:

(1)

(2)

(3)

Regulation (EC) No 45/2001 (referred to hereinafter as
‘the Regulation’) lays down the principles and the rules
applicable to all the Community institutions and bodies
and provides
to be
appointed by each Community institution and body.

for a Data Protection Officer

the Regulation,

to Article 24(8) of

further
Pursuant
implementing rules shall be adopted by each Com-
munity institution or body in accordance with the provi-
sions set out in the Annex to the Regulation. The imple-
menting rules
the Data
shall concern in particular
Protection Officer's tasks, duties and powers.

The purpose of the implementing rules is to lay down
procedures which will enable data subjects to exercise
their rights and all persons within the Community insti-
tutions or bodies who are involved in the processing of
personal data to fulfil their obligations,

Article 1

Purpose

This Decision lays down the general rules governing the
1.
implementation of the Regulation in the case of the European
Parliament. In particular, it supplements the provisions set out
in the Regulation which relate to the tasks, duties and powers
of the European Parliament's Data Protection Officer(s).

2.
Furthermore, the Decision lays down the detailed rules
pursuant to which a data subject may exercise his or her rights,
the procedure for notifying a processing operation and the
procedure for obtaining access to the register of processing
operations kept by the Data Protection Officer.

Article 2

Appointment, statute and independence

1.
The Secretary-General shall appoint the Data Protection
Officer from amongst the officials of the Community institu-
tions and bodies on the basis of his or her personal and profes-
sional qualities and, in particular, his or her expert knowledge
of data protection. The Data Protection Officer
shall be
appointed in accordance with the procedure laid down in
Article 29 of the Staff Regulations.

The Secretary-General shall register the Data Protection

2.
Officer with the European Data Protection Supervisor.

C 308/2

EN

Official Journal of the European Union

6.12.2005

3.
For the purpose of performing his or her duties, the Data
Protection Officer shall be relieved of any other activity within
the European Parliament. He or she may perform other duties,
provided that they do not result in a conflict of interests with
the role of Data Protection Officer, particularly in relation to
the application of the provisions laid down in the Regulation.

The Data Protection Officer shall be appointed for a five-
4.
year period, renewable once. He or she may be dismissed from
his or her post only with the consent of the European Data
Protection Supervisor and only if he or she no longer fulfils the
conditions required for the performance of his or her duties.
The European Data Protection Supervisor shall be consulted in
writing and a copy sent to the Officer.

5.
The Data Protection Officer shall be independent in the
performance of his or her duties. In that regard, he or she may
not receive any instructions, in particular from the Appointing
Authority, the Secretary-General or any other source as regards
the internal application of the provisions laid down in the
Regulation or his or her cooperation with the European Data
Protection Supervisor. The Data Protection Officer shall refrain
from any act which is incompatible with the nature of his or
her duties.

6.
The Data Protection Officer shall inform the appropriate
European Parliament authorities of the number of staff and the
resources which he or she requires in order to carry out his or
her duties.
In addition, he or she may call upon specialist
outside staff to help him or her in the performance of his or
her duties.

7.
The Data Protection Officer and his or her staff shall at
all times be subject to the rules and provisions laid down in the
Staff Regulations applicable to officials and the conditions of
employment applicable to other servants.

8.
The Data Protection Officer and his or her staff (to whom
Article 287 of the Treaty shall apply) shall maintain, including
once they have ceased their duties, professional secrecy as
regards any confidential documents or information which they
obtain in the course of their duties.

Article 2a

Assistant Officers

1.
The Secretary-General may appoint Assistant Data Protec-
tion Officers, to whom Article 2(4), (5), (7) and (8) shall also
apply.

2.
The Officer, the Assistant Officers and any support staff
shall form an integral part of the Data Protection Department,
which shall be run by the Officer.

3.
The Officer may be assisted in all of his or her tasks or be
represented (in his or her absence or when otherwise engaged)
by an assistant.

Article 3

Duties

1.
The Data Protection Officer shall ensure that the provi-
sions laid down in the Regulation are applied within the Euro-

pean Parliament. He or she shall carry out his or her tasks in
cooperation with the European Data Protection Supervisor.

2.
The Officer may be consulted at any time by any person
and in particular by data subjects in respect of any matter
relating to the application of the Regulation. Specifically, the
Officer shall provide advice to the Registry department in order
to ensure compliance with the provisions laid down in the
Bureau decision of 28 November 2001 concerning public
access to European Parliament documents.

The Data Protection Officer shall represent the European
3.
Parliament's Secretariat in respect of any matter relating to data
protection. He or she may in particular attend meetings of
committees or relevant bodies at international level.

Article 4

Tasks

The Data Protection Officer's tasks shall be as follows:

— Provision of information: the Officer shall inform the Euro-
pean Parliament's data controllers and data subjects of their
rights and obligations under the Regulation,
for which
purpose he or she shall provide the necessary information
concerning the legislation in force, current procedures and
existing notified files, and he or she shall facilitate the exer-
cise of those rights and the fulfilment of those obligations.

— Requests from the European Data Protection Supervisor:
the Officer shall respond to requests from the European
Supervisor.

— Cooperation with the European Data Protection Supervisor:
within his or her area of responsibility, the Officer shall
cooperate with the European Supervisor at
the latter's
request or on his or her own initiative, particularly as
regards dealing with complaints and carrying out inspec-
tions.

— Provision of information to the European Data Protection
inform the European Super-
Supervisor: the Officer shall
the European
visor regarding any new development at
Parliament which has a bearing on the protection of
personal data.

— Register of processing operations:

shall,
pursuant to Article 26 of the Regulation, keep a register of
the processing operations carried out by the data controllers
and shall ensure that that register may be inspected by any
individual.

the Officer

— Notification of processing operations which are likely to
present specific risks: the Officer shall notify the European
Data Protection Supervisor of any processing operation
which is likely to present specific risks within the meaning
of Article 27 of the Regulation. Should there be any doubt
regarding the need for a prior check, the Data Protection
Officer shall consult the European Data Protection Super-
visor.

6.12.2005

EN

Official Journal of the European Union

C 308/3

— Upholding data subjects' rights and freedoms:

the Data
Protection Officer shall ensure that processing operations
do not undermine the rights and freedoms of data subjects
and that no person suffers loss or damage for having
brought to the Data Protection Officer's attention a matter
which in the view of that person constitutes an infringe-
ment of the Regulation.

Article 6

Procedure for notifying processing operations

Article 5

Powers

1.
In order to perform his or her tasks and in accordance
with the conditions laid down in the Regulation, the Data
Protection Officer may:

— on his or her own initiative, make recommendations to the
data controllers or
to the Secretary-General on issues
concerning the application of the provisions relating to
data protection or included in these implementing rules;

— consider issues and facts (on his or her own initiative or at
the request of the data controller, the European Parliament's
Staff Committee or any individual) which relate directly to
his or her powers and responsibilities and which have been
brought to his or her knowledge. He or she shall consider
them in accordance with the principle of impartiality and
with due regard to the rights of the data subject. The Data
Protection Officer shall forward his or her findings to the
person who submitted the request and to the data
controller;

Before processing any data (and in sufficiently good time
1.
to enable any prior check within the meaning of Article 27(3)
of the Regulation to be carried out), the data controller shall
notify the Data Protection Officer thereof, for which purpose
he or she may use the notification form available on the Euro-
pean Parliament's Intranet. In any event, the notification shall
comply with the provisions laid down in paragraph 3. The
notification shall be signed by the data controller and be
despatched to the Data Protection Department by internal post,
e-mail or fax. Where the notification is sent by e-mail or fax,
the signed original paper copy shall reach the Data Protection
Department within ten calendar days of the date of despatch.

The data controller shall, in accordance with the notifica-
2.
tion procedure laid down in paragraph 1, immediately notify
processing operations which were already under way on the
date of entry into force of the Regulation (1 February 2002).

The information to be provided shall include at least the

3.
following:

(a) the name and address of the data controller and an indica-
tion of the European Parliament departments which are
entrusted with the processing of personal data for a par-
ticular purpose;

(b) the purpose or purposes of the processing;

— report any breach of the provisions laid down in the Regu-

lation to the Secretary-General;

(c) a description of the category or categories of data subjects

and of the data or categories of data relating to them;

— regularly attend meetings with the European Data Protec-
tion Supervisor and/or the Data Protection Officers of the
other institutions and bodies with a view to establishing a
mutual exchange of information, engaging in interinstitu-
tional cooperation and harmonising the application of the
procedures in force;

— draw up an annual activity report for the Secretary-General
and the European Data Protection Supervisor concerning
activities relating to the protection of data within the Euro-
pean Parliament. He or she shall make the report accessible
to Parliament's staff;

— issue an opinion on the lawfulness of actual or proposed
processing operations, on the measures required in order to
ensure that such operations are lawful and on the suitability
or inadequacy of data or of security measures. The opinion
may in particular relate to any issue concerning the notifi-
cation of data-processing operations.

(d) the legal basis of the processing operation for which the

data are intended;

(e) the recipients or categories of recipient to whom the data

might be disclosed;

(f) a general

indication of the time limits for blocking and

erasure of the various categories of data;

(g) the proposed transfers of data to third countries or interna-
tional organisations and recipients who are subject to the
law of a Member State;

(h) a general description allowing a preliminary assessment to
be made of the appropriateness of the measures taken
pursuant to Article 22 of the Regulation in order to ensure
that processing is secure.

2.
The Data Protection Officer shall have access at all times
to data which are being processed and to all offices, data-
processing installations and data carriers.

The data controller shall

4.
immediately inform the Data
Protection Officer of any change affecting the information
referred to in paragraph 3.

C 308/4

EN

Official Journal of the European Union

6.12.2005

Article 7

working days. The reply shall be sent by the same means of
communication as was used by the data subject.

Register of processing operations

The Data Protection Officer shall keep a register of the
1.
processing operations notified pursuant
to Article 6. The
register shall detail all the notified processing operations which
have been carried out at the European Parliament and shall
indicate in particular the department responsible for the proces-
sing, the data processed and the intended purpose.

4.
The data controller shall notify the data subject of his or
her right to lodge a complaint with the European Data Protec-
tion Supervisor if that person considers that the rights granted
to him or her under Article 286 of the Treaty were infringed
when the personal data relating to him or her were processed.

The data subject may exercise any of these rights free of

5.
charge.

The register may be inspected by any person and shall also
facilitate the exercise of
the data
subject which are laid down in Articles 13 to 19 of the Regu-
lation.

the recognised rights of

6.
Requests to exercise a right may be rejected in the cases
referred to in Article 20 of the Regulation, subject to applica-
tion of Article 17 of this Decision.

The register shall contain the information referred to in

2.
Article 6(3)(a) to (g) of this Decision.

If the Officer deems it necessary, he or she may take
3.
action to rectify the data contained in the register, with a view
to ensuring that they are accurate.

Article 8

General rules governing the exercise of rights by data
subjects

1.
The rights of access, rectification, blocking, erasure and
objection may be exercised by the data subject or his or her
duly authorised representative only.

2.
Requests to exercise one of those rights shall be addressed
to the data controller. A form shall be available in electronic
form on the European Parliament's Intranet. The request shall
contain:

— the name, first name and contact details of the data subject;

— an indication of the right to be exercised;

Article 9

Right of access

1.
The data subject shall have the right to obtain, without
constraint, at any time within three months from the receipt of
the request and free of charge from the data controller:

— confirmation as to whether or not data related to him or

her are being processed;

— information at least as to the purposes of the processing
operation, the categories of data concerned, and the recipi-
ents or categories of recipients to whom the data are
disclosed;

— communication in an intelligible form of the data under-
going processing and of any available information as to
their source;

— knowledge of the logic involved in any automated decision

process concerning him or her.

The data subject may access his or her personal data by

2.
any of the following means:

— on-site consultation;

— where appropriate, supporting documents relating to the

request;

— issue of a certified copy drawn up by the data controller;

— the category or categories of the data concerned;

— issue of an electronic copy;

— the applicant's signature and the date of the request.

The request may be submitted by internal or external post, e-
mail or fax in such a way that the submission and receipt of
the request may be certified. Should the request contain any
errors or omissions, the data controller may ask for additional
information. The data controller shall verify the applicant's
credentials.

— other means available to the data controller and suited to

the configuration of the file.

Article 10

Right of rectification

The data controller shall respond to any request to exer-
3.
cise the rights, even in the absence of
the personal data
processed in the file. An acknowledgement of receipt shall be
sent to the applicant within five working days of the receipt of
the request. However, the data controller shall not be required
to send an acknowledgement of receipt if a substantial reply to
the request is provided within the same time limit of five

1.
The data subject shall have the right to obtain from the
data controller the rectification without delay of inaccurate or
incomplete personal data.

2.
Requests for rectification shall specify the data to be recti-
fied and the correction to be made. Where appropriate, a
request may be accompanied by supporting documents.

6.12.2005

EN

Official Journal of the European Union

C 308/5

3.
If a request for rectification is accepted, it shall be acted
upon immediately and the data subject notified thereof. Should
a request for rectification be rejected, the data controller shall
have 15 working days within which to inform the data subject
by means of a letter stating the grounds for the rejection.

Article 11

Right to have data blocked

The data subject shall have the right to obtain from the

1.
data controller the blocking of data where:

(a) their accuracy is contested by the data subject, for a period
to verify the accuracy,

enabling the data controller
including the completeness, of the data, or

(b) the data controller no longer needs them for the accom-
plishment of his or her tasks but they must be maintained
for purposes of proof, or

(c) the processing is unlawful and the data subject opposes

their erasure and demands their blocking instead.

2.
Requests for blocking shall specify the data to be blocked.
A data subject who has requested and obtained the blocking of
data shall be informed thereof by the data controller. He or she
shall also be informed of the fact that data are to be unblocked
at least 15 working days before they are unblocked.

is accepted,

The data controller shall

3.
take a decision within 15
working days of receiving a request for data to be blocked. If
the request
it shall be acted upon within 30
working days and the data subject notified thereof. Should the
request for blocking be rejected, the data controller shall have
15 working days within which to inform the data subject by
means of a letter stating the grounds for the rejection.

Requests for erasure shall specify the data to be erased.
the processing is

2.
Where the data controller disputes that
unlawful, he or she shall provide proof that it is lawful.

The data controller shall reply within 15 working days of
3.
receiving a request for erasure. If the request is accepted,
it
shall be acted upon immediately. If the data controller deems
the request unjustified, he or she shall have 15 working days
within which to inform the data subject by means of a letter
stating the grounds for the decision.

4.
Erasure entails the physical disappearance of the data
without its being necessary to replace them by a code or by the
creation of an alternative file containing the data erased. If
the data
erasure proves
controller shall block the data immediately. The data subject
shall be duly informed of this procedure.

impossible for

technical

reasons,

Article 12a

Notification to third parties

The data subject shall have the right to obtain from the data
controller the notification to third parties to whom the data
have been disclosed of any rectification, erasure or blocking
pursuant to Articles 10 to 12, unless this proves impossible or
involves a disproportionate effort. In the event of a refusal to
notify a third party on the grounds of impossibility or dispro-
portionate effort, the data controller shall have 15 working
days within which to inform the data subject by means of a
letter stating the grounds for the refusal.

In automated filing systems, blocking shall be ensured by
4.
technical means. The fact that personal data are blocked shall
be indicated in the system in such a way as to make it clear
that the data may not be used.

Article 13

Right to object

5.
Personal data blocked pursuant to this Article shall, with
the exception of their storage, only be processed for purposes
of proof, or with the consent of the data subject or for the
purpose of protecting the rights of third parties.

1.
The data subject shall have the right to object at any
time, on compelling legitimate grounds relating to his or her
particular situation, to the processing of data relating to him or
her, except in the cases covered by Article 5(b), (c) and (d) of
the Regulation.

Article 12

Right of erasure

The data subject shall have the right

2.
to be informed
before personal data are disclosed for the first time to third
parties or used on their behalf
for the purposes of direct
marketing and shall be expressly offered the right to object free
of charge to such disclosure or use.

1.
The data subject shall have the right to obtain from the
data controller the erasure of data if the processing thereof is
unlawful.

Requests to make an objection shall specify the datum or

3.
data concerned.

C 308/6

EN

Official Journal of the European Union

6.12.2005

4.
The data controller shall reply to the data subject within
15 working days of receiving a request to make an objection. If
the data controller deems the request unjustified, he or she
shall inform the data subject by means of a letter stating the
grounds for the decision.

5.
In the event of a justified objection the data in question
may not be subjected to the processing referred to in para-
graph 1.

Article 14

Monitoring procedure

Any data controller concerned shall assist

1.
the Data
Protection Officer in the performance of his or her duties and
provide him or her with any information which he or she
requests within 20 working days. In performing his or her
duties, the Data Protection Officer shall have access at all times
to the data being processed and to all offices, data-processing
installations and data carriers.

2.
The Data Protection Officer may decide to carry out any
other type of monitoring at any time in order to ensure that
the Regulation is being properly applied by the European
Parliament.

Article 15

Remedies

1.
Any person employed by the European Parliament may
lodge a complaint pursuant to Article 33 of the Regulation
with the European Data Protection Supervisor. Lodging such a
complaint shall not have the effect of stopping time running
for the purposes of lodging a complaint pursuant to Article 90
of the Staff Regulations.

Irrespective of the right referred to in paragraph 1, any
2.
person employed by the European Parliament may lodge with
the Appointing Authority a complaint pursuant to Article 90
of the Staff Regulations in respect of a matter relating to the
processing of personal data. In that case, the Data Protection
Officer shall be consulted by the relevant departments.

Article 16

Restrictions

1.
The data controller may restrict the rights laid down in
Articles 9 to 13 of this Decision on the grounds set out Article
20(1) of the Regulation. He or she shall consult the Data
Protection Officer in advance.

2.
in
If a restriction is imposed, the data controller shall,
accordance with Community law, inform the data subject of
the principal reasons for the restriction and of his or her right
to refer the matter to the European Data Protection Supervisor
and the Court of Justice.

3.
The data controller shall respond immediately to requests
relating to the application of restrictions on the exercise of
rights and shall give the reasons for any decision taken to that
effect.

Article 17

Data controllers

1.
By means of a specific decision, the Secretary-General
may appoint an authority subordinate to him or her as the
data controller, within the meaning of Article 2(d) of the Regu-
lation.

2.
The data controller shall be responsible for ensuring that
processing operations carried out under his or her supervision
are in accordance with the Regulation. In particular, he or she
shall be responsible for:

— assisting the Data Protection Officer and the European Data
Protection Supervisor in the performance of their respective
duties,
in particular by sending information to them in
reply to their requests within 20 working days at most;

— implementing appropriate

technical and organisational
measures and giving the members of the European Parlia-
ment's staff (or other persons under their authority) suitable
instructions for ensuring that processing is confidential and
providing an appropriate level of security in view of the
risks which processing entails;

— notifying the Data Protection Officer of any data-processing
operation before undertaking it, pursuant to Article 6 of
this Decision.

Article 17a

Access to documents

The register of processing operations shall be public and
1.
accessible in electronic form. Any person may inspect
it
directly and request an authenticated copy of the entry for a
specific processing operation from the Data Protection Officer.
Indirect access shall also be possible via the European Data
Protection Supervisor.

staff shall be subject

Documents produced by the Data Protection Officer and
2.
his or her
to Regulation (EC) No
1049/2001 of the European Parliament and of the Council of
30 May 2001 regarding public access to European Parliament,
Council and Commission documents.

Article 18

Entry into force

This Decision shall come into force on the day following its
publication in the Official Journal of the European Union.