The FRA's Data Protection Statement
Introduction
The legal definition of personal data is very broad. Any information relating to an identified or identifiable person is considered personal data (for a full definition see Article 2 paragraph a) of Regulation (EC) No 45/2001).
Examples of personal data are telephone numbers, addresses, financial information, photographs, satellite images, car registrations, ID numbers, e-mail addresses, health records, etc.
Personal data can be contained in computer files (e.g. in databases, on the Internet or other closed networks) or in paper records.
Data protection is a fundamental right, protected not only by national legislation, but also by European law.
Legal Basis
The legal basis for data protection is Regulation (EC) No 45/2001.
This regulation aims to protect the liberties and fundamental rights of individuals and in particular their right to privacy with respect to the processing of personal data about them.
It only applies within the institutions and bodies set up by, or on the basis of, the Treaties establishing the European Communities. The legal basis for data protection concerning the general public is not ruled by this Regulation.
The Regulation applies to the processing of personal data by all Community institutions and bodies, insofar as such processing is carried out in the exercise of activities all or part of which fall within the scope of Community law (Article 3.2.)
Legal Background
-
Charter of Fundamental Rights of the EU - Article 8
-
Treaty establishing the European Community - Article 286
Collection of personal data by the FRA
A number of the FRA's activities involve the collection and processing of personal data, for example as part of recruitment, or collecting data for salaries or reimbursements, contractual arrangements with suppliers or organization of events, etc.
Such collecting and processing of personal data and its subsequent utilization should be done "fairly and lawfully" (Article 4 paragraph 1a).
Purpose of the collection
Whenever personal data is requested, it is essential that the data subject (the person whose personal data are collected, held or processed) knows for what purposes the data is being collected. According to article 4 paragraph a) of the Regulation, personal data "must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes."
Moreover, personal data must be adequate, relevant, and not excessive in relation to the purpose and kept for no longer than is necessary for the purposes for which they were collected.
Rights of data subjects
When personal data are requested, data subjects have the right
-
to be informed of the processing operations (Articles 11 and 12)
-
to access, rectify, block or erase the data (Articles 13-16)
-
to object to the processing on compelling legitimate grounds (Article 18)
-
to compensation for any damage (Article 32)
The main players
Besides the data subject, there are three main data protection players:
The European Data Protection Supervisor (EDPS) is responsible for the monitoring of Community institutions and bodies on their compliance with data protection rules, in particular to ensure that the fundamental rights and freedoms of natural persons, especially their right to privacy, are respected by the Community institutions and bodies. The EDPS is an independent supervisory authority.
The Data Protection Officer (DPO) ensures that data controllers and individuals know their rights and obligations, co-operates with the EDPS, ensures internal application of the regulations and keeps a register of processing operations notified by the controllers. The FRA has one designated DPO, who can be contacted via e-mail at: dpo@fra.europa.eu
The Data Controller is the person that determines how personal data is processed, and is the person that grants the rights to the data subject. For each processing operation, a Data Controller must be identified and prior notice must be given to the DPO of the institution.
- PROTECTION OF PERSONAL DATA IN RELATION TO THE ORGANISATION OF EVENTS (10.10.2011)
(PDF File 94 KB)
- PROTECTION OF PERSONAL DATA IN RELATION TO PROCUREMENT PROCEDURES AND CONTRACT MANAGEMENT
(PDF File 93 KB)
- PROTECTION OF PERSONAL DATA IN RELATION TO THE PROCESSING OF INDIVIDUAL COMPLAINTS
(PDF File 27 KB)
- PROTECTION OF PERSONAL DATA IN RELATION TO APPLICATION TO PARTICIPATE IN THE FUNDAMENTAL RIGHTS PLATFORM
(PDF File 94 KB)
- Privacy Statement
(PDF File 84 KB)









