Staff recruitment

A/ INTRODUCTION

These guidelines concern processing operations on staff recruitment carried out by the Community institutions and bodies. The data subjects are candidates in the recruitment procedures for permanent staff, temporary agents, contractual agents, national experts and trainees of these bodies. These processing operations are subject to prior-checking in conformity with Article 27(2)(b) of Regulation 45/2001, since they involve an evaluation of the applicants’ ability to perform the job functions for which the selection and recruitment procedures have been organized. Some of these processing operations might also involve the processing of data related to health as well as to criminal offences, which constitutes an additional ground for priorchecking in the light of Article 27(2)(a) of the Regulation.

The content of the guidelines is based on the 9 EDPS Opinions issued so far regarding staff recruitment procedures by the agencies as well as the Opinions on other processing operations carried out by other institutions and bodies. The objective is to present in a clear and concise way the outcome of the EDPS' positions and recommendations regarding each fundamental principle as they have been analysed in the prior-checking Opinions. Moreover, where necessary, it underlines particular issues that might have been raised and practices that might have been criticised throughout those Opinions.

The EDPS envisages that these guidelines will be used as a practical guidance for the agencies and hope they will contribute to the task of the DPO's and controllers in notifying to the EDPS the missing notifications in the field of staff recruitment. The notifications should be clear, precise and as complete as possible in the light of the issues raised in the guidelines paper. It must be noted that "transfer of staff to other institutions" foreseen by Article 29 (1) (a) of the Staff Regulations should be also part of the notification.

B/ GUIDELINES

1) Lawfulness of the processing operation

Article 5(a) of the Regulation provides that personal data may be processed if “processing is necessary for the performance of a task carried out in the public interest on the basis of the Treaties ... or other legal instrument adopted on the basis thereof”.

The selection procedures are necessary for the management and functioning of the agencies.

Regulations establishing agencies usually state that the Staff Regulations of officials of the European Communities, the Conditions of Employment of other servants of the European Communities (CESE), as well as the rules adopted jointly by the institutions of the European Communities for the purposes of the application of those Staff Regulations and Conditions of Employment shall apply to the staff of the Agency. Staff Regulations and CESE are adopted on the basis of the Treaties.

Specific legal instruments adopted on the basis of the Treaties:

• Title III Chapter 1 (Articles 27-34) of the Staff Regulations for the case of the permanent staff; • Articles 12 - 15 and 82 - 84 of the Conditions of Employment of other servants of the European Communities (CEOS) in the case of temporary and contract agents.

Concerning the legal basis for trainees and Seconded National Experts recruitment procedures, a decision shall be drafted by the body.

In addition, since the participation in the recruitment procedure is not mandatory, the processing is also lawful under Article 5(d) of the Regulation because "the data subject has unambiguously given his or her consent". In this context special attention has to be drawn to the information given to the data subjects to avoid irrelevant data.

2) Processing of special categories of data

Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and of data concerning health or sex life, are prohibited unless an exception can be found in Articles 10 (2) -10 (5) of Regulation 45/2001.

Within the framework of the selection and recruitment procedures certain data belonging to the “special categories of data” might be collected, including (i) data related to health (in particular medical certificate and information about applicant's disability necessary for the organisation of the selection so that accommodation for the tests or additional grants can be provided), (ii) data regarding criminal records, (iii) data revealing racial or ethnic origin (communication of a photograph), (iv) data revealing political opinions, religious or philosophical beliefs, or trade union membership (for instance, spontaneous communication of such data are perceived as "social, organisational and other skills and competences" in the European CV).

Medical certificate: During the selection phase candidates are requested to provide a medical aptitude certificate or to pass a medical examination resulting in a medical aptitude certificate. This information, although not medical data in the strict sense, must be considered as data relating to health in terms of Article 10 of the Regulation. The legal basis for processing medical certificates regarding officials and other servants can be found in Article 28(e) and Article 33 of the Staff Regulations, and Articles 12(d) and 13 of the Conditions of Employment of Other Servants respectively. These provisions require that a candidate may be recruited as a member of the staff only on condition that "he is physically fit to perform his duties". Therefore the prohibition shall not apply where the processing is "necessary for the purpose of complying with the specific rights and obligations of the controller in the field of employment law insofar as it is

In the case of trainees, although the Staff Regulations and Conditions of Employment of Other Servants are not directly applicable to trainees, the latter are still considered to be part of the staff of the agency that recruited them for the traineeship. Thus, one can consider that the collection of a medical certificate can be justified on the basis of Article 28(e) of the Staff Regulations and hence in conformity with Article 10(2)(b) of the Regulation.

Disability: When an applicant reveals information on his/her disability, it should be considered as if he/she is giving his/her consent to the processing of that data, thus the condition of Article 10(2)(a) of the Regulation is met. In addition, this consent is given in order to enable the employer to comply with its specific obligations in the field of employment law in conformity with Article 10(2)(b) of the Regulation; namely to adjust the selection procedure to the special needs of such applicant (provide for extra time or specific IT equipment for the test envisaged to take, additional grants or special arrangements regarding the interview) .

Criminal records: Articles 28 of the Staff Regulations and 12(2) of the Conditions of Employment provides that a member of the staff may be engaged only on condition that: “(a) he is a national of one of the Member States ... and enjoys his full rights as a citizen” and that “(c) he produces the appropriate character references as to his suitability for the performance of his duties”. This legal instrument provides the basis to process data related to criminal convictions, pursuant to Article 10(5) of the Regulation.

Photograph: The communication of a photograph by an applicant may reveal his/her racial or ethnic origin. It may be justified on the basis that the data subject has given his/her express consent according to Article 10(2)(a) of the Regulation (on this point see below on "data quality").

Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or

trade union membership: Their spontaneous communication may be considered to be justified in terms of Article 10(2)(a) of the Regulation (on this point see below on "data quality").

3) Data Quality

Adequacy, relevance and proportionality: According to Article 4(1)(c) of Regulation 45/2001 "personal data must be adequate, relevant and not excessive in relation to the purposes for which collected and/or further processed".

A few examples of some practices carried out by some agencies are the following:

i) In cases where a photograph is required, the EDPS recommends that agencies assess whether a photograph should be collected in/through the application form. This should be based on consent of the data subject .

ii) Past convictions: As it has been noted in the previous section regarding the processing of special categories of data, the questions of the type “have you ever been convicted or found guilty of any offence by any court?” are excessive and goes beyond what is necessary to support that the applicant “enjoys his full rights as a citizen” and that “he produces the appropriate character references as to his suitability for the performance of his duties”. This type of question may result in a situation where candidates feel obliged to reveal data unnecessary for the recruitment. The question should therefore be replaced by a request for a current criminal record or a similar official document issued in accordance with the respective national law. Only short-listed candidates invited to an interview must provide this document .

iii) Questions related to the "reasons for leaving a previous post" are excessive in relation to the recruitment procedure. Accordingly, the EDPS recommends reconsidering the mandatory character of those questions .

iv) The question on "Interests and skills not related to work, including social and sport activities" deserves also special attention. By answering this question, candidates give details on skills, interests and activities which are not in relation with the work which they apply for. These details give the opportunity, however, to assess the personality, and not the working skills of the candidate. The EDPS understands that this question may bring useful information to the knowledge of the staff members participating in the recruitment procedure. Nevertheless, the EDPS considers this question as not fully appropriate regarding the purpose of the application form. Therefore, the EDPS recommends including this question only as optional in the application form. It has to be ensured that applicants not answering optional questions will not be put to any disadvantaged position due to their failure to give answer .

v) The collection of the criminal record, police record or certificate of good conduct: It should be noted that these documents have a very diverse content in different Member States and carry diverse denominations. In some Member States, they contain information about the character of an individual or his/her moral behaviour that go beyond a legitimate purpose for collection, which is to establish if the selected candidate "enjoys his full rights as a citizen" and has "the appropriate character references as to his suitability for the performance of his duties". Even if in principle, the EDPS considers that the collection of these documents is lawful, it is recommended that the analysis of the content of the national police record/criminal record/certificate of good conduct is carried out on a case by case basis so that only relevant data are processed in the light of the Staff Regulation's requirements .

Fairness and lawfulness: Article 4(1)(a) provides that personal data must be "processed fairly and lawfully". Lawfulness has already been discussed (see above, point 1) and fairness will be dealt with in relation to information provided to data subjects (see below, point 6).

Accuracy: Article 4(1)(d) provides that personal data must be "accurate and, where necessary, kept up to date". The selection procedure itself ensures that the data are accurate and kept up to date considering that data processed during the recruitment process are provided by the data subjects. In addition, the possibility to make use of the rights of access and rectification helps to ensure that the data are accurate and up to date (see below, point 5).

4) Data retention

Article 4(1)(e) of Regulation 45/2001 states that personal data must be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed".

i) Officials, contract, temporary agents and national experts:

The EDPS would like to point out the need to differentiate between three different categories of data subjects, namely the recruited applicants, the non-recruited applicants and the non-recruited applicants whose names were put on the "reserve lists for appointment".

As regards the recruited applicants whose data should be stored in their personal file (Article 26 of the Staff Regulations), the EDPS recommends that a data retention period of ten years as of the termination of employment or as of the last pension payment is considered to be reasonable .

As to the non-recruited applicants, the EDPS acknowledges that the time-limit for storage of such data shall be set in relation to the time-limits to be established for the possible review of the decision taken in the selection procedure (complaint to the European Ombudsman, appeal with the Civil Service Tribunal), as well as in accordance with Article 49 of the Implementing Rules to the Financial Regulation (for budgetary and audit purposes) . In addition, the validity of the respective (reserve) lists shall be duly taken into account. It is worth-noting that in various opinions the EDPS accepted to keep personal data of unsuccessful candidates for two years following the recruitment procedure as that period was derived from the length of time during which a complaint may be brought to the European Ombudsman .

The retention period for data relating to the non-recruited applicants on the "reserve lists for appointment" is to be determined in terms of the validity and the actual extension of the respective reserve lists.

ii) Trainees:

The EDPS gave some guidelines on the calculation of the starting period for the storage: In the case of pre-selected but not recruited candidate the EDPS recommended that the starting date

for computing the storage period (dies a quo) should be the immediate official starting date of the traineeship period (and not the end of the traineeship period to which the application relates) . As to the storage period of personal data of successful candidates, the controller may need to keep all financial documents for a minimum of 5 years from the date on which the agency grants discharge for the budgetary year to which the documents relate for audit purposes. The EDPS recommends that personal data necessary for discharging the budget may be retained for up to 5 years after the traineeship budget is discharged in accordance with the Financial Regulation .

Once the above 5 years period is completed, only the data necessary for providing a copy of the trainee certificate i.e. information on the duration of the traineeship, the department to which the trainee was assigned, the name of supervisor and the nature of work performed should be stored. In case the data subjects require that a certificate of their traineeship is re-issued, the EDPS accepted the period of 50 years that some institutions adopted, under the condition that only the above-mentioned data are kept .

Any further data required for statistical purposes should be kept in an anonymous form in the light of Article 4(1)(e) of the Regulation). Finally, it needs to be noted that the recruitment does not require the collection and storage of original supporting documents but rather copies, certified copies or official certified translations .

iii) Retention period of the criminal record, police record and certificate of good conduct

It is inappropriate to keep information about crimes that have expunged and which would be no longer reflected in a criminal record, police record or certificate of good conduct. These three documents are a snapshot which may not reflect the reality the day after their emission and the principle of accuracy of data is therefore not respected. Moreover, the legal basis provided by the institutions is strictly limited to “a condition for recruitment”. Once the recruitment is terminated, institutions do not have a legal basis to store these documents (except limited information for auditing, etc.). Consequently, the EDPS recommends the creation of a "standard form" stating that the person is suitable for the performance of his duties and enjoys his full rights of citizen. The criminal record should be returned to the person immediately after the selection and possible recruitment . If a person is recruited, it should also be returned.

iv)Retention period of other special categories of data:

Sensitive data, such as data on disability should be deleted once they are no longer necessary for recruitment or reimbursement purposes or following the date when any follow-up procedure has been completed. However, in the case of successful applicants, such data can be forwarded to the personal file in case special arrangements are required throughout the whole period of employment .

5) Transfer of data

Internal transfer: Article 7(1) of Regulation 45/2001 states that "personal data shall only be transferred within or to other Community Institutions or bodies if the data are necessary for the legitimate performance of tasks covered by the competence of the recipient".

This provision outlines a specific necessity requirement: internal transfers of data within the agency can be accepted as long as they are necessary for the management of the selection procedure of the staff (i.e. selection committees in the human resources sector, Head of Units) as well as for the performance of the respective supervisory task including the internal audit .

In order to ensure the full compliance with Article 7 of the Regulation, the controller should remind all recipients of their obligation not to use the data received for other purposes than the one for which they were transmitted , as it is explicitly stated in Article 7(3) of the Regulation.

External transfer: Article 8 applies to recipients other than Community institutions and bodies but who are subject to the national law adopted for the implementation of Directive 95/46/EC. Article 9 applies to recipients other than Community institutions and bodies which are not subject to Directive 95/46/EC.

For instance, in case an external company, covered by the Directive is in charge of carrying out tasks for an agency, for example organising tests for the Selection Committee, the necessity of the transfer of data to the company should be examined under the conditions provided in Article 8(a), as it is performing an official task on behalf of the Selection Committee. In particular, it must be established whether the data are necessary for the performance of its task. In the case the necessity of such transfer is established, the precise mandate of the recipient should be established in a contract or a legal act. Their respective obligations should also be ensured in the light of the confidentiality and security requirements pointed out in Article 23 of the Regulation.

6) Right of access and rectification

According to Article 13(c) of the Regulation, the data subject has "the right to obtain from the controller, without constraint, communication in an intelligible form of the data undergoing processing and any available information as to their source". Article 14 of the Regulation provides the data subject with "the right to rectify inaccurate or incomplete data". The rights of access and rectification may be restricted in terms of Article 20(1) of the Regulation; in particular "where such a restriction constitutes a necessary measure to (...) the protection of the rights and freedoms of others" (point c)). Moreover, the issue of the right of access and the secrecy of the proceedings of the Selection Committee under Article 6 of the Annex III of the Staff Regulations should also be taken into consideration.

Right of access: As a general and fundamental rule, candidates should be able to contact the human resources sector of the agency or the DPO of the agency and submit their request to access or rectify personal data processed within the framework of the selection procedure. Their request may be submitted, for example, by e-mail or by filling in a "personal data access request form", which cannot be made mandatory.

The EDPS has always recommended in his opinions that data subjects should be given access to their evaluation results regarding all stages of the selection procedure (pre-selection, interview and written tests), unless the exception of Article 20(1)(c) of the Regulation in line with Article 6 of the Annex III to the Staff Regulations are applied. This exception may imply that access should be granted neither to the comparative data concerning other applicants (comparative results), nor to the individual opinions of the members of the Selection Committee. Nevertheless, data subjects should be provided with aggregated results.

Right of rectification: As concerns the right of rectification, the EDPS acknowledges that this right can only apply in the case of factual data processed within the selection procedure. In addition, he points out that any limitation to the right of rectification after the closing date of submitting applications should only apply to data related to the admissibility criteria and not to the identification data that can be rectified at any time during the selection procedure . The EDPS considers this limitation necessary for the fairness of the selection procedure and justified in terms of Article 20(1)(c) of the Regulation. It is however important that all applicants are informed about the scope of this restriction before the beginning of the processing operation (see below "right of information").

Secrecy of the Selection Committee and limitations to the right of access and rectification: In line with the previous opinions of the EDPS on EPSO selection procedures and the follow-up of these opinions with EPSO, the EDPS points out that the controller should ensure that it does not restrict access more broadly that it is justified on grounds of safeguarding the confidentiality of the deliberations and decision-making of the Selection Committee or safeguarding the rights of other candidates. It should therefore be clearly established that (i) the objective of any confidentiality requirement is to ensure that the Selection Committee is able to maintain its impartiality and independence and is not under undue influence from the controller, the candidates, or any other factor and (ii) any restriction on access rights must not exceed what is absolutely necessary to achieve this purported objective.

In a particular case , the EDPS recommended that the agency in question should provide access, upon request, to the (i) evaluation sheets drawn by the selection boards, (ii) the “separate assessment and decision documents signed by Chairpersons - on behalf of committees” documenting the final decision of the selection board made available to candidates and to the (iii) minutes of the selection boards.

It has to be reminded that neither comparative data concerning other applicants (comparative results), nor to the individual opinions of the members of the Selection Committee should be disclosed to the data subject.

Consequently, the protection of the impartiality and independence of the selection board, which is the reason behind the requirement of confidentiality, would be unlikely to be prejudiced if the Selection Committee disclosed to candidates, in a transparent manner, the criteria according to which it evaluated candidates as well as the actual detailed marks or comments a particular candidate received with respect to each criterion.

7) Right of information

Articles 11 and 12 of Regulation 45/2001 provide that data subjects must be informed of the processing of data relating to them and list a range of general and additional items. The latter apply insofar as they are necessary in order to guarantee fair processing and transparency in respect of the data subject having regard to the specific circumstances of the processing operation.

In the processing operations on staff recruitment, Article 11 (Information to be supplied where the data have been obtained from the data subject) applies since data have been provided directly by the data subjects themselves by submitting their application forms. Article 12 (Information to be supplied where the data have not been obtained from the data subject) applies as well, since data are obtained from different participants of the selection procedure such as evaluation and marking data provided by the human, resources sector of the agency, the Selection Committee or an external company in charge of carrying out selection tests.

Time of the information note to be provided: The EDPS has always recommended in his opinions that a "data protection note" should be posted on the agency's website so that all candidates can be informed of all their rights as well as of all necessary information concerning the processing of his/her data before the selection procedure begins.

Content of the information note: As to the content of the "data protection note ", it is important that all elements listed in both Articles 11 and 12 respectively are clearly and thoroughly indicated in the statement.

In particular, it is important that the statement indicates clearly which question in the application form is mandatory or optional. With regard to the right of rectification, the applicants should be informed that in the case of identification data their right to rectify those data can be exercised at any time during the procedure. It should also be clearly stated that in the case of data related to the admissibility criteria the right of rectification cannot be exercised after the closing date of candidatures' submission. Moreover, in the case of trainees for instance and according to some agency's policy and internal decisions, although applicants are selected on the basis of their qualifications, the issue of maintaining an appropriate geographical distribution and gender balance during the selection is also taken into consideration. Thus, if it is the case, the "data protection note" should inform the applicants-trainees that data related to gender and nationality, aside from identification purposes, might be processed on the basis of the agency's policy and

internal decision, so that the fairness of the processing in respect of the data subject can be guaranteed.

C/ CONCLUSION

In the light of the above analysis on the basis of the EDPS Opinions in the field of staff recruitment, the EDPS sums up his recommendations as follows:

1) Data quality

• the question "Have you ever been convicted or found guilty of any offence by any court?" in the application form should be replaced by a request for a criminal record or a similar official document issued in accordance with the respective national law, and only short-listed candidates invited to an interview must provide this document; • the mandatory character of the questions related to the "reasons for leaving a previous post" should be reconsidered; • it should be clearly indicated that the question on interests and skills not related to work, including social and sport activities, is optional in the application form. It should also be ensured that applicants not answering optional questions will not be put to any disadvantaged position due to their failure to give answer; • the analysis of the content of the national police record/criminal record/certificate of good conduct is carried out on a case by case basis so that only relevant data are processed in the light of the Staff Regulation's requirements.

2) Data retention Officials, agents, national experts:

• in the case of recruited applicants, a data retention period of ten years as of the termination of employment or as of the last pension payment is considered to be reasonable; • in the case of non-recruited applicants, the time-limit for storage of their data shall be set in relation to the time-limits established for the possible review of the decision taken in the selection procedure (complaint to the European Ombudsman, appeal with the Civil Service Tribunal), as well as in accordance with Article 49 of the Implementing Rules to the Financial Regulation. A 2-year period of data retention was found reasonable in the light of complaints before the Ombudsman; • in the case of non-recruited applicants on the "reserve lists for appointment" the conservation of their data is to be determined in terms of the validity and the actual extension of the respective reserve lists.

Trainees:

• in the case of pre-selected but not recruited candidates the starting date for computing the storage period (dies a quo) should be the immediate official starting date of the traineeship period (and not the end of the traineeship period to which the application relates); • in the case of successful candidates, data necessary for discharging the budget may be retained for up to 5 years after the traineeship budget is discharged in accordance with the Financial Regulation;

• the period of 50 years can be acceptable for the prupose of providing a copy of a trainee certificate as long as only a limited number of data is stored, namely information on the duration of the traineeship, the department to which the trainee was assigned, the name of supervisor and the nature of work performed; • it must be ensured that data only in an anonymous form should be kept for statistical purposes.

Criminal record:

• a "standard form" stating that the person is suitable for the performance of his duties and enjoys his full rights of citizen should be created and the criminal record should be returned to the person immediately after the selection and possible recruitment or not.

Other special categories of data:

• all sensitive data, such as data on disability should be deleted once they are not any more necessary for recruitment or reimbursement purposes or following the date when any follow-up procedure has been completed. Such data can be forwarded to the personal file in case special arrangements are required throughout the whole period of employment.

3) Transfer of data

• the controller should remind all recipients of their obligation not to use the data received for other purposes than the one for which they were transmitted; • in case an external company, covered by the Directive is in charge of carrying out tasks for an agency, the exact tasks between the controller (agency) and the processor-recipient (company) should be set up through a contract or a legal act. Their respective obligations should also be ensured in the light of the confidentiality and security requirements pointed out in Article 23 of the Regulation.

4) right of access and rectification

• data subjects should be given access to their evaluation results regarding all stages of the selection procedure (pre-selection, interview and written tests), unless the exception of Article 20(1)(c) of the Regulation in line with Article 6 of the Annex III to the Staff Regulations are applied; • any limitation to the right of rectification after the closing date of submitting candidatures should only apply to data related to the admissibility criteria and not to the identification data that can be rectified at any time during the selection procedure; • the controller should ensure that it does not restrict access more broadly that it is justified on grounds of safeguarding the confidentiality of the deliberations and decision-making of the Selection Committee or safeguarding the rights of other candidates.

5) right of information

• a "data protection note" should be posted on the agency's website including all elements as explained above.

Brussels, 10 October 2008