Data protection is a fundamental right, protected not only by national legislation, but also by European Union law. At FRA, we are responsible for the personal data that we collect and process.
The processing of an individual’s personal data carried out by the European Agency for Fundamental Rights (FRA) is performed in compliance with Regulation 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC.
The personal data that the Agency collects and processes relates to you as a natural person. The personal data collected can be classified into two types.
Mandatory personal data: This refers to the personal data necessary for the performance of the tasks carried out in the public interest that were conferred on the Agency or for compliance with a legal obligation to which the Agency is subject to. Some examples include your name, address, your CV when applying for a job or traineeship at the Agency, or when submitting a tender linked to a published procurement procedure.
Non-mandatory personal data: This refers to personal data processed based on consent only. Examples include your dietary and mobility requirements when attending an event organised by the Agency, your phone number, fax number or email address when you choose to make them publicly available. Additionally, your information might be processed when you choose to participate in the surveys undertaken by the Agency.
Access to these data will be restricted to authorised staff of the Agency, and we will request your consent to make them available to the general public.
Whenever personal data is processed, it is essential that the data subject (the person whose personal data are collected, held or processed) knows for which purposes the data is being collected. According to Article 4 Paragraph a) of the Regulation, personal data "must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes."
Moreover, personal data must be adequate, relevant, and not excessive in relation to the purpose and kept for no longer than is necessary for the purposes for which they were collected.
In this regard, the Agency informs you through a privacy notice linked to the specific processing operation. A number of those privacy notices are listed below.
Primarily, we collect and process your personal data on the basis of Article 5.1(a), (b) and (d) of the EU Data Protection Regulation 2018/1725:
In very specific circumstances, a different or additional legal basis mentioned in Article 5 of Regulation 2018/1725 may apply.
The processing of personal data by the Agency is governed not only by Regulation 2018/1725, but also by specific legal instruments, such as implementing rules and internal rules.
Information on the legal basis is provided to you in a privacy notice.
The general public has access to data in relation to information that is considered to be of public interest. Indeed, the Agency has a legal obligation to make such data public. Such examples can include the names of its Management Board members.
Access to your personal data is limited to the Agency’s staff. The Agency will not make personal data available to the public, unless the party concerned has given his or her express statement of consent. The consequence being that certain personal data provided by you as an applicant or as representative of an organisation, for which publication is not a legal obligation (e.g. phone, fax number or email address), may only be accessible to the public if consent is given and provided that the Agency’s IT systems can support it.
For each processing operation there is a defined retention period that specifies the period for which the personal data is kept. Depending on the processing operation the retention period can vary. For example, in the case of surveys the retention period might be a few months where in the case of financial transactions it can be up to 10 years. The exact retention period is specified in the privacy notice of the processing operation.
The Agency takes the protection of your personal data very seriously, and therefore applies adequate organisational, technical and security measures to protect it. Some examples of these measures are:
As a data subject you have the right to access, rectify and, where processed on the basis of your consent, transfer your data to another controller at any time. You may also request the erasure of your data under certain conditions. Moreover, you also have the right to object to and restrict certain processing of your data.
We will review your requests and grant your rights provided that certain conditions are met. Please note that in some cases restrictions may apply under Article 25 of Regulation (EU) 2018/1725 and MB decision 2021/08 on internal rules concerning restrictions of certain rights of data subjects in relation to processing of personal data in the framework of the functioning of the European Union Agency for Fundamental Rights.
You also have the right to recourse to the European Data Protection Supervisor.
For more information please read the specific privacy notice that specifies in detail your data protection rights and how to exercise them.
You can contact us for any aspect regarding your personal data, by sending a written request to the FRA as the data controller responsible for your information, or to the FRA Data Protection Officer as follows:
By post: Luisa Lopez, Data Protection Officer, FRA, Schwarzenbergplatz 11, AT-1040 Vienna, Austria.
By email: dpo@fra.europa.eu
If you feel your request was not responded adequately by the data controller and/or the DPO, you can lodge a complaint with the European Data Protection Supervisor.
You can find all records of FRA processing activities on the Records registry page . A list of privacy notices available for download can be found below.
