natgillin/translations-raw huggingface dataset:
I nogle tilfælde indebærer outsourcing af sundhedsydelser, at behandlingen falder uden for forordningens anvendelsesområde (men i disse tilfælde gælder den nationale lovgivning til gennemførelse af direktiv 95/46/EF).
A general conclusion from all of them is that the information in proper priorchecking cases is frequently not as concrete as concerns the data processing in the ex post cases.
I kategori 1 (lægejournaler) har der fundet en kontinuerlig anmeldelsesproces sted, og dette forventes at fortsætte i 2006, da mange procedurer vedrører lægejournalerne.
In proper priorchecking cases, procedural rules are a predominant aspect of the notification.
En række større sager er anmeldt på dette område, f.eks. vedrørende rekruttering af tjenestemænd, midlertidigt ansatte og kontraktansatte (EPSO-sager), som vedrører alle institutioner og organer.
In some cases, the outsourcing of medical services implies that the processing falls outside the scope of the regulation (but, in those cases, the national legislation transposing Directive 95/46/EC is applicable).
Med hensyn til kategori 3 (disciplinære procedurer) afventer EDPS anmeldelser fra institutionerne.
e ‘Compass case’ of the Court of Auditors dealt with the new evaluation procedure of staff members. e only recommendations to improve the system from a data protection point of view were the inclusion of the information foreseen in Articles 11(1)(f) and 12(1)(f) so as to enhance fairness, the adoption of security measures in communications and the limitation of access to data in the event of an appeal.
Personalebedømmelse er af indlysende grunde en almindelig behandlingstype i alle institutioner og organer.
Staff evaluation is a common processing operation in all institutions and bodies, for obvious reasons.
Et bredt udsnit af sager er blevet analyseret, lige fra udvælgelse af nyt personale til årlige bedømmelser, og de berører både fast og midlertidigt personale samt praktikanter.
A variety of cases have been analysed, from the selection of new personnel to the annual appraisal, affecting both permanent and temporary staff as well as trainees.
Bortset fra almindelige spørgsmål om dataindsamling, information osv. er formålsbegrænsningen blevet fremhævet: Ingen oplysninger, der er indsamlet med henblik på evaluering, kan anvendes til andre formål. Opbevaring af oplysninger i personaleregistre er også et relevant spørgsmål i forbindelse med disse behandlinger.
Apart from the common issues of data retention, information, etc., the purpose limitation has been underlined: no data collected for evaluation can be used for any incompatible use. e conservation of data in personal files is also a relevant issue in these operations.
I et konkret tilfælde af overvågning af telefonsamtaler var der trafikdata til stede i systemet, og derfor var artikel 37 også relevant.
In a particular case of monitoring of telephone calls, traffic data were present in the system and therefore Article 37 was also relevant.
Vedrørende kategori 4 (sociale tjenester) er der allerede modtaget anmeldelser (én fra Rådet og én fra Kommissionen).
e ‘Harassment case’ of the Court of Auditors concerned a system to deal with harassment situations.
Ligesom i sager vedrørende egentlig forudgående kontrol (jf. afsnit 2.3.5) har det været vigtigt at skelne mellem personaleregistre og registre over disciplinære/administrative undersøgelser for at sikre overholdelsen af opbevaringsperioden. Et af de større problemer er, at der synes at være modstrid mellem på den ene side princippet om begrænset dataopbevaring kombineret med princippet om sanktionsforældelse og på den anden side den nuværende fortolkning af artikel 10, nr. i), i bilag IX til tjenestemandsvedtægten.
In the ‘Internal administrative inquiries and disciplinary proceedings case’ of the Court of Auditors, the EDPS inter alia gave recommendations as to the processing of sensitive data as defined in Article 10 and to the rights of access and rectification (with specific meaning in this context). e main issue was the distinction of disciplinary files from personal files and the different rules applicable as to the conservation of data.
På dette område gælder det både, at der er behov for forudgående kontrol, og at der gør sig særlige forhold gældende i forbindelse med behandling af føl-
Administrative inquiries and disciplinary proceedings: three cases of ex post checking were carried out in this area.
EDPS bør normalt afgive udtalelse forud for påbegyndelsen af en behandling, så den registreredes rettigheder og frihedsrettigheder sikres lige fra begyndelsen. Dette er tanken bag artikel 27. Parallelt
As in the proper prior-check cases (see paragraph 2.3.5), the distinction between personal files and disciplinary/administrative inquiry files has been most important in guaranteeing the respect for retention periods.
Årsberetning for 2005 kan i sidste ende føre til disciplinære procedurer.
— e processing of health-related data by the administrative services of the institution or body is subject to prior checking under Article 27(2)(a).
Her blev muligheden for telefonaflytning analyseret, og en restriktiv fremgangsmåde blev anset for tilladelig.
e same issues were at stake in the ‘Internal administrative inquiries case’ of the European Central Bank. ese inquiries can eventually lead to disciplinary proceedings. ere, the possibility of telephone interception was analysed and a restrictive approach was considered admissible.
Man nåede frem til en logisk fortolkning af begrænsningen i forbindelse med opbevaring af kommunikationstrafikdata ved en sammenhængende fortolkning af forordningens artikel 37 og 20.
A logical interpretation of the limitation of the conservation of communication traffic data was reached, by interpreting jointly Articles 37 and 20 of the regulation.
Høringer med behandlingen af sager vedrørende efterfølgende kontrol blev der anmeldt fire sager vedrørende »egentlig« (8) forudgående kontrol til EDPS i 2005.
— If the services are provided by a private company, the regulation does not apply and the national legislation transposing Directive 95/46/EC is relevant. erefore there should be no prior checking by the EDPS.
Hvis DPO’en skulle være i tvivl om nødvendigheden af forudgående kontrol, kan denne høre EDPS i sagen (artikel 27, stk. 3).
Should the DPO have any doubts as to the need for prior checking, he or she has to consult the EDPS on the case (Article 27(3)).
I 2005 hørte DPO’erne EDSP om adskillige emner.
In 2005, DPOs consulted the EDPS on several subjects.
EDPS har præciseret, at følgende tilfælde hører under reglerne om forudgående kontrol:
e EDPS has clarified that the following cases are subject to prior checking:
— e-overvågning af trafikdata i institutionerne og organerne (kategori 5 for efterfølgende kontrol), da det drejer sig om vurdering af enkeltpersoners optræden
— e-monitoring of traffic data in the institutions and bodies (Category 5 for the ex post prior checks) since it deals with the evaluation of the conduct of individuals;
— systemer til imødegåelse af problemet med mobning på arbejdspladsen, med samme begrundelse
— systems intended to address the problem of harassment at work, on the same grounds;
— behandlinger med henblik på faglig nyorientering af personale, der udføres af en gruppe bestående af en læge, en socialrådgiver mv.
— processing operations aimed at professional reorientation of personnel, carried out by a group comprising a doctor, a social assistant, etc.;
— nye forfremmelsesprocedurer.
— new procedures for promotion.
I andre tilfælde blev forudgående kontrol ikke anset for at være nødvendig:
In other cases, prior checking was not deemed to be necessary:
I første omgang påberåbte man sig, at den »uformelle« fase af den procedure, som Revisionsretten havde indført, ikke var underlagt forordningen, da der ikke var tale om lagring af de indsamlede personoplysninger.
From another perspective, to be operative, umbrella systems are not being prior checked in themselves, even if they include sub-systems falling under Article 27.
EDPS var af den opfattelse, at det er af største betydning, at den uformelle fase er omfattet af forordningen, så der sikres fuld anvendelse af garantierne med hensyn til behandlingen af personoplysninger.
In those cases, the notification of the general system has been used as a background and context information for the checking of the sub-system.
På grund af spørgsmålenes følsomme karakter blev der givet henstillinger på mange områder (retsgrundlag, oplysninger til de registrerede, formålsbegrænsning osv.).
A clear example is Sysper 2 of the Commission, which embeds such processing operations as CDR/REC (career development review system of the staff members), obviously subject to prior checking.
— screening med henblik på, om der eventuelt kan udøves en ret, modtages en ydelse eller opnås en kontrakt, da artikel 27, stk. 2, litra d), kun henviser til udelukkelse (præklusion); dog hører tilfældet ind under artikel 27, stk. 2, litra b), hvis der finder en vurdering sted
— screening with a view to granting or not granting a right, benefit or contract, because Article 27(2)(d) refers only to exclusion (debarment); however, if an evaluation takes place, the case falls under Article 27(2)(b);
— ernarbejde, medmindre der er indført vurderingsmekanismer i systemet
— teleworking, unless evaluation mechanisms are introduced in the system;
Det var de samme spørgsmål, der var omhandlet i sagen om interne administrative undersøgelser ved Den Europæiske Centralbank.
When the EDPS delivers an opinion on the case submitted to him for prior checking or when a case is analysed to decide on the need for prior checking and some critical aspects appear to deserve correcting measures, the opinion issued by the EPDS may contain a series of recommendations which must be taken into account in order to make the processing operation comply with the regulation.
Disse undersøgelser
Should the controller not comply with these recommendations,
) Dvs. tilfælde vedrørende behandlinger, der endnu ikke er iværksat.
— outsourcing the tasks of emergency help teams (since the selection of the team members is the complete responsibility of a private entity).
Årsberetning for 2005 ne helt og holdent hører ind under den private enheds ansvarsområde).
ANNUAL REPORT 2005
Hvis den registeransvarlige ikke efterlever disse henstillinger, kan EDPS gøre brug af de beføjelser, han har fået tildelt i henhold til forordningens artikel 47.
Conclusions and future the EDPS may exercise the powers granted to him under Article 47 of the regulation. e EDPS may in particular refer the matter to the Community institution or body concerned.
— Hvis sundhedsydelser outsources til andre europæiske institutioner eller organer, skal den forudgående kontrol finde sted hos sidstnævnte og ikke hos den, der outsourcer.
e year 2005 saw intense activity in the domain of prior checking. e results are quite satisfactory, although several institutions and bodies have not sent notifications in the priority matters of ex post checking. e year 2006 must be the decisive year to obtain this information and to complete the analysis of the processing operations in all institutions and bodies in those fields. is process should be finalised no later than spring 2007. e EDPS will make all efforts to achieve that goal.
— Hvis ydelserne leveres af en privat virksomhed, gælder forordningen ikke, og national lovgivning til gennemførelse af direktiv 95/46/EF er relevant. Derfor bør EDPS ikke foretage forudgående kontrol.
New bodies, as well as institutions in existence for a longer period, must revise their personal data-processing operations in all fields, but especially in the priority matters, to make sure they comply with that deadline.
Endvidere kan EDPS træffe afgørelse om, at anmodninger om udøvelse af bestemte rettigheder i forbindelse med oplysningerne skal efterkommes (når sådanne anmodninger er blevet nægtet i strid med artikel 13-19), eller han kan rette en advarsel eller en påtale til den registeransvarlige.
Furthermore, the EDPS may order that requests to exercise certain rights in relation to the data be complied with (if such requests have been refused in breach of Articles 13 to 19), or may warn or admonish the controller.
Han kan også træffe afgørelse om berigtigelse, blokering, sletning eller tilintetgørelse af alle oplysninger eller midlertidigt eller definitivt forbyde en behandling.
He may also order the rectification, blocking, erasure or destruction of all data or impose a temporary or definitive ban on processing.
Hvis EDPS’ afgørelser ikke efterleves, har han ret til at anlægge sag ved De Europæiske Fællesskabers Domstol på de vilkår, der er fastsat i EF-traktaten.
Should the decisions of the EDPS not be complied with, he has a right to refer the matter to the Court of Justice of the European Communities under the conditions provided for in the EC Treaty.
— Oplysninger om helbredsforhold var også det udslagsgivende element, som gjorde, at en behandling, der havde til formål at tage hensyn til handicap blandt medarbejderne med henblik på nødsituationer og at give dem særlige parkeringsfaciliteter, blev anset for at falde ind under anvendelsesområdet for forudgående kontrol.
As the e-moni-toring for traffic and budgetary purposes, including the verification of authorised use, as decided by each institution and body, is subject to prior checking under Article 27(2)(b), DPOs are expected to send the relevant notifications of existing systems as soon as the EDPS has issued his paper on the subject. is includes the list referred to in Article 37(2).
Alle sager vedrørende forudgående kontrol har givet anledning til henstillinger.
All priorchecking cases have led to recommendations.
Som angivet ovenfor (i punkt 2.3.4 og 2.3.5), vedrører de fleste henstillinger oplysninger i forbindelse med de registrerede, dataopbevaringsperioder, formålsbegrænsning og ret til indsigt og berigtigelse.
As explained above (in paragraphs 2.3.4 and 2.3.5), most recommendations concern information relating to data subjects, data conservation periods, purpose limitation and the rights of access and rectification.
Institutionerne og organerne er indstillede på at følge disse henstillinger, og hidtil har der ikke været behov for udøvelse af beføjelser.
Institutions and bodies are willing to follow these recommendations and, to date, there has been no need for executive decisions. e time for implementing those measures varies from case to case.
Tiden til gennemførelse af foranstaltningerne varierer fra sag til sag. I 2005 er seks sager blevet afsluttet, da
During 2005, six cases have been closed as all recommendations have been implemented (9).
10 alle henstillinger er gennemført (9
In one case (10
) Rådet: 2004/319. Europa-Parlamentet: 2004/13 og 2004/126.
) Council of the European Union: 2004/319.
Kommissionen: 2004/95 og 2004/96. KHIM: 2004/174.
European Commission:
Ud fra et andet synspunkt bliver paraplysystemer for at være operative ikke i sig selv underlagt forudgående kontrol, selv ikke hvis de omfatter undersystemer, der falder ind under artikel 27.
Support for newly appointed DPOs and a timetable of bilateral revisions of the notification process with all DPOs, with a view to accomplishing the above objectives, should be developed.
I sådanne tilfælde er anmeldelsen af det generelle system blevet anvendt som baggrunds- og kontekstinformation til kontrol af undersystemet.
A policy paper with an update on the practices and conclusions of prior checking will be an important tool in that context.
Konklusioner og fremtid
Introduction examined by the EDPS.
I den forbindelse vil et politikpapir med en ajourføring af praksis for og konklusioner vedrørende forudgående kontrol være et vigtigt redskab.
Furthermore, four decisions were adopted by the EDPS concerning complaints introduced in 2004. ese will also be briefly examined below.
I året 2005 blev der udvist intens aktivitet på området forudgående kontrol.
As mentioned above, for some cases, although filed in 2004, the EDPS took his decision in 2005.
Resultaterne er ret tilfredsstillende, selv om flere institutioner og organer ikke har indsendt anmeldelser vedrørende de prioriterede områder inden for efterfølgende kontrol.
In accordance with Articles 32(2), 33 and 46(a) of the regulation, any natural person may lodge a complaint to the EDPS, with no conditions of nationality or place of residence (11).
Året 2006 bør være det afgørende år med hensyn til indsamling af disse oplysninger og afslutning af analyserne af behandlinger i alle institutioner og organer på dette område.
Complaints are only admissible if they emanate from a natural person and concern the breach of the regulation by an EU institution or body when processing personal data in the exercise of activities all or part of which fall within the scope of Community law.
Denne proces bør være bragt til ende senest i foråret 2007. EDPS vil gøre alt for at nå dette mål.
As we will see below, a number of complaints filed to the EDPS were declared inadmissible by reason of the EDPS not being competent.
I henhold til artikel 32, stk. 2, artikel 33 og artikel 46, litra a), i forordningen kan enhver fysisk person indgive en klage til EDPS, uanset nationalitet eller bopælssted (11).
One complaint received in 2004 (2004-111) concerned the disclosure of personal data of persons involved in a competition case. e Commission can decide about the (non-)confidentiality of some personal data collected in competition cases. e complainant challenged the decision made concerning her.
Klagerne kan kun antages, hvis de er indgivet af en fysisk person og vedrører en overtrædelse af forordningen foretaget af en EU-institution eller et EU-organ som led i behandling af personoplysninger under udøvelse af aktiviteter, der helt eller delvis henhører under fællesskabslovgivningen.
Although the complainant raised interesting questions, she did not provide the EDPS with the information needed to pursue the case. e EDPS was therefore not able to issue a decision.
Når EDPS modtager en klage, sender han en kvittering for modtagelsen til klageren, hvori han tager forbehold med hensyn til klagens antagelighed, medmindre klagen helt åbenlyst er uantagelig og ikke fordrer yderligere undersøgelse. EDPS vil også anmode
Another complaint pending from 2004 (2004-329) concerned the collection of data needed for the reimbursement of travel expenses for an expert who participated in a meeting organised by the European Commission (Article 4 of the regulation: data quality). e EDPS made a request to the Commission and as a result found the collection of personal data relevant, adequate and not excessive.
Elektronisk kommunikation vil blive genstand for særlig opmærksomhed i 2006.
After exchanges of information on this case, the Commission informed the EDPS that an IDOC inquiry will be opened.
EDPS er i gang med at udarbejde et dokument om emnet (jf. punkt 2.7).
e EDPS received 27 complaints in 2005.
Dette omfatter også den liste, der refereres til i artikel 37, stk. 2.
Of these cases, only five were declared admissible and further
) Artikel 32, stk. 2: »[…] den registrerede kan indgive en klage til den europæiske tilsynsførende for databeskyttelse, hvis han finder, at de rettigheder, traktatens artikel 286 tillægger ham, er blevet krænket som følge af en behandling af personoplysninger vedrørende ham selv i en fællesskabsinstitution eller et fællesskabsorgan«.
) According to Article 32 (2): ‘[…] every data subject may lodge a complaint to the European Data Protection Supervisor if he or she considers that his or her rights under Article 286 of the Treaty have been infringed as a result of the processing of his or her personal data by a Community institution or body’.
Artikel 33: »Enhver, der er ansat i en fællesskabsinstitution eller et fællesskabsorgan, kan uden om de officielle kanaler indgive en klage til den europæiske tilsynsførende for databeskyttelse om en påstået overtrædelse af bestemmelserne i [forordning (EF) nr. 45/2001]«.
Article 33: ‘Any person employed with a Community institution or body may lodge a complaint with the European Data Protection Supervisor regarding an alleged breach of the provisions of [Regulation (EC) No 45/2001], without acting through official channels’.
Artikel 46, litra a): Den europæiske tilsynsførende for databeskyttelse har til opgave »at modtage og undersøge klager og underrette den registrerede om resultatet inden for en rimelig frist«.
Article 46 (a) European Data Protection Supervisor shall ‘hear and investigate complaints, and inform the data subject of the outcome within a reasonable period’.
Opmærksomhed om det eventuelle behov for forudgående kontrol i designfasen for nye systemer er også et spørgsmål, der bør rejses.
A complaint was made against the European Parliament for the publication of the names of petitioners (2005-40).
Gennemførelsestidsplanen for nye projekter må tage hensyn til den periode, der er nødvendig, for at institutionen eller organet kan give DPO’en lejlighed til at indgive anmeldelse til EDPS, og for at EDPS kan fremkomme med sin udtalelse, så det bliver muligt at gennemføre EDPS’ henstillinger, før behandlingen sættes i gang.
It was questioned whether the processing was lawful (Article 5) and whether the level of information provided was sufficient, in order for consent to be a valid ground for processing/disclosure (Article 2). e main findings were that the processing was lawful, not on the grounds of unambiguous consent, but on the grounds of Article 5(a) and (b) — ‘tasks carried out in the public interest’ and ‘legal obligation’, respectively. e information given to
Årsberetning for 2005 klageren om at informere ham om eventuelle andre retssager ved en national retsinstans, EF-Domstolen eller Ombudsmanden (hvad enten de er verserende eller ej).
ANNUAL REPORT 2005 the data subjects was, however, not sufficient and the EDPS therefore suggested that the Secretariat of the Committee on Petitions amend the forms for filing a petition, so that the consequences were made more visible. e EDPS also suggested that the possibility to opt out from disclosure on compelling and legitimate grounds be introduced.
ger i Sysper 2 (Kommissionens informationssystem) i modstrid med forordningens artikel 21 (sikkerhed). Efter udvekslinger af oplysninger om denne sag meddelte Kommissionen EDPS, at der vil blive indledt en IDOC-undersøgelse.
A complaint was submitted to the EDPS (2005-377) in respect of certain information published in the press, concerning a disciplinary procedure against two EU officials. e aim of the complaint was to establish how this information could have been made known outside the European Commission. e EDPS has decided not to open any investigation, due to lack of sufficient evidence.
Hvis klagen kan antages, vil EDPS gå i gang med at undersøge sagen, bl.a. ved at kontakte den pågældende institution eller det pågældende organ eller ved at indhente yderligere oplysninger fra klageren.
A complaint was made against the European Commission regarding a ‘profile’ of the person online (2005-112).
EDPS har beføjelse til fra den registeransvarlige, institutionen eller organet at rekvirere alle de personoplysninger og andre oplysninger, der er nødvendige for undersøgelsen, og til at få adgang til alle de lokaler, hvor en registeransvarlig eller en institution eller et organ udfører sine aktiviteter.
One of the participants at a three-day conference organised by the European Commission wanted to delete his profile, provided before the conference, from its publication on a specific section of the Europa website. e data subject contacted the EDPS to object (Article 18) to the disclosure of his résumé. e EDPS forwarded the request to the official in charge of the particular website, asking him to look at the merits of the case. e official subsequently chose to delete the profile.
EDPS modtog 27 klager i 2005. Heraf blev kun fem antaget og undersøgt nærmere af EDPS.
Out of the 27 complaints received in 2005, 22 were declared not admissible for reason of lack of competence of the EDPS.
Desuden traf EDPS fire afgørelser vedrørende sager, der blev indgivet i 2004.
Indeed, the cases did not concern processing of personal data by the European institutions and bodies, and so should have been referred to national data protection authorities.