{"id":17896,"date":"2022-09-18T17:37:42","date_gmt":"2022-09-18T17:37:42","guid":{"rendered":"http:\/\/legalblog.ie\/?p=17896"},"modified":"2022-09-25T07:55:08","modified_gmt":"2022-09-25T07:55:08","slug":"data-processing-by-eu","status":"publish","type":"post","link":"https:\/\/legalblog.ie\/data-processing-by-eu\/","title":{"rendered":"Data Processing by EU"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_63 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title \" >Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/legalblog.ie\/data-processing-by-eu\/#Protection_of_individuals_with_regard_to_the_processing_of_personal_data_by_EU_institutions_bodies_offices_and_agencies\" title=\"Protection of individuals with regard to the processing of personal data by EU institutions, bodies, offices and agencies\">Protection of individuals with regard to the processing of personal data by EU institutions, bodies, offices and agencies<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/legalblog.ie\/data-processing-by-eu\/#Key_Points\" title=\"Key Points\">Key Points<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/legalblog.ie\/data-processing-by-eu\/#Data_Subjects\" title=\"Data Subjects\">Data Subjects<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/legalblog.ie\/data-processing-by-eu\/#Controllers\" title=\"Controllers\">Controllers<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/legalblog.ie\/data-processing-by-eu\/#EDPS\" title=\"EDPS\">EDPS<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/legalblog.ie\/data-processing-by-eu\/#EDPS_rules_of_procedure\" title=\"EDPS rules of procedure\">EDPS rules of procedure<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/legalblog.ie\/data-processing-by-eu\/#Special_rules_for_EU_bodies_offices_and_agencies\" title=\"Special rules for EU bodies, offices and agencies\">Special rules for EU bodies, offices and agencies<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/legalblog.ie\/data-processing-by-eu\/#Data_protection_officers\" title=\"Data protection officers\">Data protection officers<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/legalblog.ie\/data-processing-by-eu\/#Reports\" title=\"Reports\">Reports<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/legalblog.ie\/data-processing-by-eu\/#Context\" title=\"Context\">Context<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/legalblog.ie\/data-processing-by-eu\/#MAIN_DOCUMENT\" title=\"MAIN DOCUMENT\">MAIN DOCUMENT<\/a><\/li><\/ul><\/nav><\/div>\n<h3><span class=\"ez-toc-section\" id=\"Protection_of_individuals_with_regard_to_the_processing_of_personal_data_by_EU_institutions_bodies_offices_and_agencies\"><\/span>Protection of individuals with regard to the processing of personal data by EU institutions, bodies, offices and agencies<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Regulation (EU) 2018\/1725 on the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices and agencies and on the free movement of such data<\/p>\n<p>The regulation:<\/p>\n<p>lays down rules on how EU institutions, bodies, offices and agencies should treat the personal data* they hold on individuals;<br \/>\nupholds an individual\u2019s fundamental rights and freedoms, especially the right to protection of personal data and the right to privacy;<br \/>\naligns the rules for EU institutions, bodies, offices and agencies with those of the general data protection regulation (GDPR) and of Directive (EU) 2016\/680, known as the data protection law enforcement directive (LED), which have applied since May 2018;<br \/>\nrepeals Regulation (EC) No 45\/2001, which previously contained the rules on personal data processing by EU institutions, bodies, offices and agencies, and ensures that these comply with the same strict standards as set out in the GDPR;<br \/>\nrepeals Decision No 1247\/2002\/EC regarding the European Data Protection Supervisor (EDPS).<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Key_Points\"><\/span>Key Points<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Personal data must be:<\/p>\n<p>processed in a lawful, fair and transparent way;<br \/>\ncollected for specific, explicit and legitimate purposes;<br \/>\nadequate, relevant and limited to what is necessary;<br \/>\naccurate and, where necessary, kept up to date;<br \/>\nstored in a way that identification of the individuals concerned is possible for no longer than necessary;<br \/>\nprocessed with appropriate confidentiality.<\/p>\n<p>The controller is responsible for, and must be able to demonstrate compliance with, all the abovementioned data-processing principles.<\/p>\n<p>In addition, personal data:<\/p>\n<p>may be transmitted to a recipient in the EU that is not an EU institution, body, office or agency only subject to additional safeguards;<br \/>\nmay be transferred outside of the EU only under strict conditions;<br \/>\nrevealing a person\u2019s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person\u2019s sex life or sexual orientation must not be processed except under special circumstances;<br \/>\nneed appropriate safeguards if archived in the public interest or for scientific, historical or statistical purposes.<\/p>\n<p>Requests for an individual\u2019s consent to the use of their data must be in an intelligible and easily accessible form using clear and plain language. The consent must be a clear affirmative action by the individual.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Data_Subjects\"><\/span>Data Subjects<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Individuals (known as \u2018data subjects\u2019 in the legislation) have the right to:<\/p>\n<p>withdraw their consent at any time, which should be as easy as giving it;<br \/>\nknow whether or not their personal data is being processed and to have access to it;<br \/>\nobtain the correction of any inaccurate personal data;<br \/>\nremove or restrict any personal data from processing provided that certain conditions are met;<br \/>\nreceive their personal data provided to the controller in a structured, commonly used and machine-readable format and transmit it to another controller;<br \/>\nobject to the use of their personal data for public-interest purposes, because of their particular situation;<br \/>\nnot be subject to a decision based solely on automated processing, which has legal consequences for them;<br \/>\ncomplain to the EDPS if they feel their personal data is being processed in a way that violates the regulation;<br \/>\nbe compensated for any material or non-material damage they suffer because of the actions of an EU institution, body, office or agency;<br \/>\nmandate a not-for-profit organisation to lodge a complaint with the EDPS.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Controllers\"><\/span>Controllers<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Controllers:<\/p>\n<p>have to inform data subjects, in plain language and with factual information, such as contact details of the data controller and the purpose of the personal data processing, when such data is collected;<br \/>\nmust reply to any requests from data subjects, such as requests to access or correct their personal data, as soon as possible and no later than 1 month;<br \/>\napply appropriate technical and organisational measures, including pseudonymisation*, to ensure that processing of personal data complies with the regulation;<br \/>\nmust only use data processors that meet EU requirements;<br \/>\nkeep a detailed record of data processing under their responsibility;<br \/>\ncooperate with the EDPS;<br \/>\nnotify the EDPS and, in some cases, also the individual concerned, as soon as possible of any personal data breach;<br \/>\ncarry out data protection impact assessment for certain high-risk processing of personal data;<br \/>\nensure the confidentiality and security of their electronic communication networks;<br \/>\ninform the EDPS when drawing up administrative measures or internal rules on the processing of personal data.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"EDPS\"><\/span>EDPS<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The legislation creates the post of the EDPS, appointed for a once-renewable 5-year term of office. Based in Brussels, the holder of the post:<\/p>\n<p>acts with complete independence;<br \/>\ntreats all confidential information with professional secrecy;<br \/>\nmonitors how EU institutions, bodies, offices and agencies apply the legislation;<br \/>\npromotes public understanding and awareness of the processing of personal data;<br \/>\nhandles complaints and conducts investigations;<br \/>\nwarns and sanctions data controllers;<br \/>\nrefers issues to the Court of Justice, which handles any disputes over the legislation;<br \/>\nsubmits an annual report to the European Parliament, the Council and the European Commission;<br \/>\ncooperates with national data protection supervisory authorities.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"EDPS_rules_of_procedure\"><\/span>EDPS rules of procedure<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>A decision of 15 May 2020 adopts the rules of procedure of the EDPS. It lays down in detail:<\/p>\n<p>the EDPS\u2019s mission, guiding principles and organisation;<br \/>\nhow it will monitor and ensure the application of the regulation;<br \/>\nprocedures for its legislative consultation, technology monitoring, research projects and court proceedings; and<br \/>\nprocedures for cooperation with national supervisory authorities and international cooperation.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Special_rules_for_EU_bodies_offices_and_agencies\"><\/span>Special rules for EU bodies, offices and agencies<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Special rules apply to EU bodies, offices and agencies that process operational personal data* for the purposes of law enforcement (e.g. Eurojust). They are covered by a specific chapter in the regulation. The rules in this chapter are aligned with the LED. Moreover, in the founding acts of these bodies, offices and agencies, more specific rules can be laid down to take into account their particular characteristics.<\/p>\n<p>The processing of operational personal data by Europol and the European Public Prosecutor\u2019s Office is excluded from the scope of the regulation and is instead governed by specific provisions in the legal acts establishing them. However, their administrative processing of personal data (e.g. for staff management) is subject to the regulation.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Data_protection_officers\"><\/span>Data protection officers<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Controllers also appoint a data protection officer for a 3- to 5-year term to:<\/p>\n<p>give independent advice on personal data processing;<br \/>\nmonitor compliance with the data protection rules.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Reports\"><\/span>Reports<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The European Commission must submit its first report on the application of the regulation by 30 April 2022.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Context\"><\/span>Context<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>It has applied since 11 December 2018, except with regard to the processing of personal data by Eurojust, where it has applied since 12 December 2019.<\/p>\n<p>Article 8 of the Charter of Fundamental Rights states that everyone has the right to personal data protection. Article 16 of the Treaty on the Functioning of the EU further develops that right. This article is the legal basis for any EU legislation on data protection.<\/p>\n<p>For further information, see:<\/p>\n<p>Data protection in the EU (European Commission).<\/p>\n<p>KEY TERMS<\/p>\n<p>Personal data. Any information on an identified or identifiable individual.<br \/>\nController. Any EU institution, body, office or agency, or its organisational entity, that determines the means and purposes of processing personal data.<br \/>\nPseudonymisation. Processing personal data so that an individual cannot be identified without the use of additional information kept elsewhere.<br \/>\nOperational personal data. All personal data processed for the purposes of carrying out law-enforcement tasks.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"MAIN_DOCUMENT\"><\/span>MAIN DOCUMENT<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Regulation (EU) 2018\/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45\/2001 and Decision No 1247\/2002\/EC (OJ L 295, 21.11.2018, pp. 39\u201398).<\/p>\n<p>RELATED DOCUMENTS<br \/>\nCommission Decision (EU) 2020\/969 of 3 July 2020 laying down implementing rules concerning the Data Protection Officer, restrictions of data subjects\u2019 rights and the application of Regulation (EU) 2018\/1725 of the European Parliament and of the Council, and repealing Commission Decision 2008\/597\/EC (OJ L 213, 6.7.2020, pp. 12\u201322).<\/p>\n<p>Decision of the European Data Protection Supervisor of 15 May 2020 adopting the Rules of Procedure of the EDPS (OJ L 204, 26.6.2020, pp. 49\u201359).<\/p>\n<p>European Data Protection Supervisor Decision of 2 April 2019 on internal rules concerning restrictions of certain rights of data subjects in relation to the processing of personal data in the framework of activities carried out by the European Data Protection Supervisor (OJ L 99I, 10.4.2019, pp. 1\u20137).<\/p>\n<p>Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, pp. 1\u201388).<\/p>\n<p>Successive amendments to Regulation (EU) 2016\/679 have been incorporated into the original text. This consolidated version is of documentary value only.<\/p>\n<p>Directive (EU) 2016\/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008\/977\/JHA (OJ L 119, 4.5.2016, pp. 89\u2013131).<\/p>\n<!--themify_builder_content-->\n<div id=\"themify_builder_content-17896\" data-postid=\"17896\" class=\"themify_builder_content themify_builder_content-17896 themify_builder tf_clear\">\n    <\/div>\n<!--\/themify_builder_content-->\n","protected":false},"excerpt":{"rendered":"<p>Protection of individuals with regard to the processing of personal data by EU institutions, bodies, offices and agencies Regulation (EU) 2018\/1725 on the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices and agencies and on the free movement of such data The regulation: lays down [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[123],"tags":[],"_links":{"self":[{"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/posts\/17896"}],"collection":[{"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/comments?post=17896"}],"version-history":[{"count":1,"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/posts\/17896\/revisions"}],"predecessor-version":[{"id":17897,"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/posts\/17896\/revisions\/17897"}],"wp:attachment":[{"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/media?parent=17896"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/categories?post=17896"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/tags?post=17896"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}