Record for processing of personal data

Title: Information system supporting the organization of meetings

Reference: DPR-EC-01141.2

Entity of the Operational Controller: European Commission: Administration and Payment of Individual Entitlements (PMO) (PMO)

Publication date: 22/10/2021

 

 

1. General Information

Data protection record

Record reference

DPR-EC-01141.2

Title of the processing operation

Information system supporting the organization of meetings

Language of the record

English

Corporate record

Corporate - Centralised

 

Data Protection Officer

Contact details

EC-DPO-INTERNALec [dot] europa [dot] eu (EC-DPO-INTERNAL[at]ec[dot]europa[dot]eu)

 

Entity of the Operational Controller

Responsible organisational entity

Administration and Payment of Individual Entitlements (PMO) (PMO)

Contact Details

PMO-DATA-PROTECTION-COORDINATORec [dot] europa [dot] eu (PMO-DATA-PROTECTION-COORDINATOR[at]ec[dot]europa[dot]eu)

 

Joint controllership

Joint controllership is involved

N/A

 

Processors

Processors are involved in the processing

Yes

• Names and contact details of processor

The main processors are Commission staff and European Union staff for EPDS and agencies. In order to develop, test and support the system the European Commission might have recourse to the services of external companies as processors. In the case of individuals, the contracts will be finalised in accordance with DIGIT framework contracts. The production environment will be hosted by DIGIT.

 

2. Purpose and description of the processing

 

Purpose

Description of the purpose of the processing

Organising meetings and managing reimbursement of expenses incurred by participants invited by the European Commission.

 

Processing for further purposes

The purpose(s) for further processing

N/A

 

Modes of processing

The mode of processing

• Any other mode:

          AGM (Advanced Gateway to your Meetings) covers most of the processes involved in organising a meeting:

• through a Front Office where the experts (external persons) manage the invitations to meetings (including user consent to data processing) and encode their expenses claims for costs incurred when attending a meeting organised by the DGs/agencies. The Front Office is also used by correspondents (external users) who settle the list of attendants to meetings.
• through a Back Office managed by the service organising the meeting and all the practical arrangements for the meeting (invitation and registration of participants);
• and through a Back Office managed by the PMO for the validation of participants’ bank accounts and legal entities, before reimbursement of the expenses incurred by them.

Description/additional information regarding the modes of processing

The purpose of the data processing is twofold:

• Collection and use of personal data in order to organise and manage meetings with or without outside participants.
• Reimbursement of participants invited to meetings pursuant to Commission Decision C(2007) 5858 of 5 December 2007 – Rules on the reimbursement of expenses incurred by people from outside the Commission invited to attend meetings in an expert capacity (C(2007)5858).

 

Storage medium

The medium of storage (one or more)

• Electronic
• Others:

          -

Description/additional information regarding the storage medium

European Commission Data centres

 

Comments

Comments/additional information on the data processing

AGM covers most of the processes related to the organisation of a meeting. The system replaced existing manual practices without adding extra data processing operations. It provides additional safeguards to protection of personal data as the processing is done using normalized operations rather than as done previously where the different meeting organisers kept their own lists. The business processes related to personal data are: - Creation of the list of correspondents of third parties and/or nominated experts to whom the invitations are sent: only meeting assistants assigned to the organisation of the meeting can update this information. - Collection of the necessary data (only first name, last name and email address) for the access to Commission premises which are sent to the IT systems of the Security Office of the Commission for access control purposes by security guards (under the responsibility of DG HR.DS - see Notification DPR-EC-0655). The correspondents of a third party enter the mentioned information that is available only to them and to the meeting assistants assigned to the organisation of the meeting. - Collection of the personal data for financial and contractual relations to be processed through AGM and to be sent to the IT systems under the responsibility of DG BUDG (see Notification DPR-EC-00301.1). - Collection of the proof of expenses by the experts for their reimbursement: the experts enter data on the expenses for which they request reimbursement. These data are registered in Ares and are accessible only to the operational and financial agents in charge of verifying and executing the payments. - Storage of the users contact information and of the rights to access/not access the different functionalities of the system - Where needed, personal data become part of a database (see NotificationDPR-EC-00847.1) that facilitates interaction between the EC and its stakeholders in their areas of interest.

 

3. Data subjects and data categories

 

Data subjects’ categories

Data subject(s) are

• Internal to the organisation
  
  A description of the data subjects (internal to the organisation)

          All Services staff including EC users and the people that will be managing the invitations in external organisations (correspondents).

• External to the organisation
  
  A description of the data subjects (external to the organisation)

           All the people invited and participating in a meeting (experts).

 

Data categories/fields

Description of the categories of data that will be processed

In order to process the data, the Data Controller, PMO.5, collects and processes the following categories of personal data through AGM:

• First name and surname
• Email address
• Unique identifier used by the European Commission’s Authentication Service (EU Login ID)
• Information on the transport expenses of reimbursable participants
• Information on the subsistence expenses of reimbursable participants
• The data in the legal entity form (e.g. ID document, private or professional address of the reimbursable participant, etc.). The data in the bank account form of the reimbursable participant (account number, name of account holder and any other information needed to identify the account to which payment is to be made)
• EU Login data

 

Through AGM it is also possible to process the first name, surname, email address, EU Login and login data of the meeting assistants in charge of organisation and the Commission’s financial officers responsible for making the reimbursements.

There is no reference in the personal data to ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, health or sexual orientation.

The processing operation concerns any 'special categories of data' which fall(s) under Article 10(1), which shall be prohibited unless any of the reasons under Article 10(2) applies

 

N/A

 

Description/additional information regarding special categories of personal data

-

 

Data related to ‘criminal convictions and offences’

The data being processed contains sensitive data which fall(s) under Article 11 'criminal convictions and offences'

N/A

 

Comments

Comments/additional information on data subjects and data categories

-

 

4. Retention period

 

Data categories and their individual retention periods

The administrative time limit(s) for keeping the personal data per data category

  1. Data category

      Financial documents

      Retention period

      7 years

      Start date description

      -

      End date description

      -

  2. Data category

      Electronic documents

      Retention period

      7 years

      Start date description

      -

      End date description

      -

 

Comments

Comments/additional information on the data retention periods

The Privacy statement is accessible to every data subject on the AGM page. The Commission meeting assistant / organiser assesses the arguments of the data subject as soon as the DG staff organising the meeting receives a request for rectification/blocking/erasure of data for legitimate reasons. The request will be handled within 15 working days after the reception of the request.

 

5. Recipients

 

Origin of the recipients of the data

The origin of the data recipients

• Within the EU organisation
  
  A description of the indicated recipients of the data

          All EC Services

• Outside the EU organisation
  
  A description of the indicated recipients of the data

          Agencies staff being involved in management of meetings and expense claim reimbursements in AGM

          Correspondents in external organization

 

Categories of the data recipients

The categories (one or more) of the data recipients

• A natural or legal person
• Public authority
• Agency

Description of the indicated category(ies) of data recipients

All EC Services & Agencies staff being involved in management of meetings and expense claim reimbursements in AGM.

Staff of National authorities/bodies (Ministries, Offices…) acting as correspondents in AGM

Who has access to which parts of the data

EU staff assigned to execute tasks in the system based on the need to know principle.

 

Comments

Comments/additional information on data recipients

Access to your personal data is provided to the Commission staff responsible for carrying out this processing operation and authorised for this staff according to the ‘need to know’ principle. Such staff abide by statutory, and when required, additional confidentiality agreements.

This includes:

• For the purpose of organising the meeting, in particular sending the invitations, organisations must provide the first name, surname and email address of government experts attending the meeting on their behalf.
• These data can also be seen by the staff of the Directorate-General responsible for organising the meeting, and by the staff in charge of reimbursement.
• Participants, when attending a meeting with other participants in the same delegation, can see the first name(s), surname and email address of each of them. The indicator showing which of the participants will be reimbursed can be seen by all the participants in a delegation.
• Correspondents for a delegation can see the status of a reimbursement request by participants in their delegation. The amount reimbursed is not visible.
• Users in the services can access the personal data of the participants and contact persons in public organisations solely for the meetings for which these same users are responsible.
• Users in the services have access to information on transport and hotel expenses and also bank information for the purpose of reimbursement of travel expenses/allowances.
• The European Commission’s technical staff or the IT service provider has access to the system data for the purpose of resolving any technical issues.
• Line managers, authorising officers by delegation and/or subdelegation.
• Investigation and control bodies also receive data: IAS, IAC, OLAF, IDOC.

 

Outside the organisation, your personal data are (or may be) transferred to:

- the Court of Auditors, the European Ombudsman and the EDPS

. 

 

6. International data transfers

 

Transfer outside of the EU or EEA

Data is transferred to countries outside the EU or EEA

N/A

 

Transfer to international organisation(s)

Data is transferred to international organisation(s)

N/A

 

Comments

Comments/additional information on international data transfers

The system does not foresee any transfers of personal data of data to countries outside of EU/EEA.

Specific expert groups will include experts from outside UE/EEA who will be able to see the meeting documentation. It is the responsibility of the meeting organiser to adjust meeting documentation to Regulation (EU) 2018/1725

 

7. Information to data subjects on their rights

 

Privacy statement

Rights of the data subjectsThe processing should respect the following rights of data subjects

• Article 17 - Right of access by the data subject
• Article 18 - Right to rectification
• Article 19 - Right to erasure (right to be forgotten)
• Article 20 - Right to restriction of processing
• Article 21 - Notification obligation regarding rectification or erasure of personal data or restriction of processing
• Article 22 - Right to data portability
• Article 23 - Right to object
• Article 24 - Rights related to Automated individual decision making, including profiling

The data subjects are informed about their rights and how to exercise them in the form of a privacy statement attached to this record

Yes

Publication of the privacy statement

• Published on website
  
  The link of the website where the privacy statement is published

          Https://ec.europa.eu/tools/agm/legal-notice_en

Guidance for Data subjects which explains how and where to consult the privacy statement is available and will be provided at the beginning of the processing operation

Yes

An explanation of the guidance on how and where to consult the privacy statement

The Data Controller

If you would like to exercise your rights under Regulation (EU) 2018/1725, or if you have comments, questions or concerns, or if you would like to submit a complaint regarding the collection and use of your personal data, please feel free to contact the Data Controller, PMO_MAIL_05ec [dot] europa [dot] eu (PMO_MAIL_05[at]ec[dot]europa[dot]eu).

-    The Data Protection Officer (DPO) of the Commission

You may contact the Data Protection Officer ( DATA-PROTECTION-OFFICERec [dot] europa [dot] eu (DATA-PROTECTION-OFFICER[at]ec[dot]europa[dot]eu) )

with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725.

-    The European Data Protection Supervisor (EDPS)

You have the right to have recourse (i.e. you can lodge a complaint) to the European Data Protection Supervisor ( edpsedps [dot] europa [dot] eu (edps[at]edps[dot]europa[dot]eu) )

if you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data by the Data Controller.

Where to find more information

The Commission Data Protection Officer (DPO) publishes the register of all processing operations on personal data by the Commission which have been documented and notified to him. You may access the register via the following link:

http://ec.europa.eu/dpo-register

This specific processing operation has been included in the DPO’s public register with the following Record reference:

DPR-EC-01141.1

 

 

The privacy statement(s)

•  declaration_de_confidentialite_en-agm-ec-1141.3.pdf

 

Comments

Comments/additional information on information to data subjects on their rights

-

 

8. Security measures

 

Short summary of overall Technical and Organisational measures implemented to ensure Information Security:

User profiles defined for different roles with access based on the need to know principle.

User access with EU login identification.

General information

Data protection record

Record reference

DPR-EC-01141.2

Title of the processing operation

Information system supporting the organization of meetings

Language of the record

English

Corporate record

Corporate - Centralised

 

Data Protection Officer

Contact details

EC-DPO-INTERNALec [dot] europa [dot] eu (EC-DPO-INTERNAL[at]ec[dot]europa[dot]eu)

 

Entity of the Operational Controller

Responsible organisational entity

Administration and Payment of Individual Entitlements (PMO) (PMO)

Contact Details

PMO-DATA-PROTECTION-COORDINATORec [dot] europa [dot] eu (PMO-DATA-PROTECTION-COORDINATOR[at]ec[dot]europa[dot]eu)

 

Joint controllership

Joint controllership is involved

N/A

 

Processors

Processors are involved in the processing

Yes

• Names and contact details of processor

The main processors are Commission staff and European Union staff for EPDS and agencies. In order to develop, test and support the system the European Commission might have recourse to the services of external companies as processors. In the case of individuals, the contracts will be finalised in accordance with DIGIT framework contracts. The production environment will be hosted by DIGIT.

 

2. PURPOSE AND DESCRIPTION OF THE PROCESSING

 

Purpose

Description of the purpose of the processing

Organising meetings and managing reimbursement of expenses incurred by participants invited by the European Commission.

 

Processing for further purposes

The purpose(s) for further processing

N/A

 

Modes of processing

The mode of processing

• Any other mode:

          AGM (Advanced Gateway to your Meetings) covers most of the processes involved in organising a meeting:

• through a Front Office where the experts (external persons) manage the invitations to meetings (including user consent to data processing) and encode their expenses claims for costs incurred when attending a meeting organised by the DGs/agencies. The Front Office is also used by correspondents (external users) who settle the list of attendants to meetings.
• through a Back Office managed by the service organising the meeting and all the practical arrangements for the meeting (invitation and registration of participants);
• and through a Back Office managed by the PMO for the validation of participants’ bank accounts and legal entities, before reimbursement of the expenses incurred by them.

Description/additional information regarding the modes of processing

The purpose of the data processing is twofold:

• Collection and use of personal data in order to organise and manage meetings with or without outside participants.
• Reimbursement of participants invited to meetings pursuant to Commission Decision C(2007) 5858 of 5 December 2007 – Rules on the reimbursement of expenses incurred by people from outside the Commission invited to attend meetings in an expert capacity (C(2007)5858).

 

Storage medium

The medium of storage (one or more)

• Electronic
• Others:

          -

Description/additional information regarding the storage medium

European Commission Data centres

 

Comments

Comments/additional information on the data processing

AGM covers most of the processes related to the organisation of a meeting. The system replaced existing manual practices without adding extra data processing operations. It provides additional safeguards to protection of personal data as the processing is done using normalized operations rather than as done previously where the different meeting organisers kept their own lists. The business processes related to personal data are: - Creation of the list of correspondents of third parties and/or nominated experts to whom the invitations are sent: only meeting assistants assigned to the organisation of the meeting can update this information. - Collection of the necessary data (only first name, last name and email address) for the access to Commission premises which are sent to the IT systems of the Security Office of the Commission for access control purposes by security guards (under the responsibility of DG HR.DS - see Notification DPR-EC-0655). The correspondents of a third party enter the mentioned information that is available only to them and to the meeting assistants assigned to the organisation of the meeting. - Collection of the personal data for financial and contractual relations to be processed through AGM and to be sent to the IT systems under the responsibility of DG BUDG (see Notification DPR-EC-00301.1). - Collection of the proof of expenses by the experts for their reimbursement: the experts enter data on the expenses for which they request reimbursement. These data are registered in Ares and are accessible only to the operational and financial agents in charge of verifying and executing the payments. - Storage of the users contact information and of the rights to access/not access the different functionalities of the system - Where needed, personal data become part of a database (see NotificationDPR-EC-00847.1) that facilitates interaction between the EC and its stakeholders in their areas of interest.

 

3. DATA SUBJECTS AND DATA CATEGORIES

 

Data subjects’ categories

Data subject(s) are

• Internal to the organisation
  
  A description of the data subjects (internal to the organisation)

          All Services staff including EC users and the people that will be managing the invitations in external organisations (correspondents).

• External to the organisation
  
  A description of the data subjects (external to the organisation)

           All the people invited and participating in a meeting (experts).

 

Data categories/fields

Description of the categories of data that will be processed

In order to process the data, the Data Controller, PMO.5, collects and processes the following categories of personal data through AGM:

• First name and surname
• Email address
• Unique identifier used by the European Commission’s Authentication Service (EU Login ID)
• Information on the transport expenses of reimbursable participants
• Information on the subsistence expenses of reimbursable participants
• The data in the legal entity form (e.g. ID document, private or professional address of the reimbursable participant, etc.). The data in the bank account form of the reimbursable participant (account number, name of account holder and any other information needed to identify the account to which payment is to be made)
• EU Login data

 

Through AGM it is also possible to process the first name, surname, email address, EU Login and login data of the meeting assistants in charge of organisation and the Commission’s financial officers responsible for making the reimbursements.

There is no reference in the personal data to ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, health or sexual orientation.

The processing operation concerns any 'special categories of data' which fall(s) under Article 10(1), which shall be prohibited unless any of the reasons under Article 10(2) applies

 

N/A

 

Description/additional information regarding special categories of personal data

-

 

Data related to ‘criminal convictions and offences’

The data being processed contains sensitive data which fall(s) under Article 11 'criminal convictions and offences'

N/A

 

Comments

Comments/additional information on data subjects and data categories

-

 

4. RETENTION PERIOD

 

Data categories and their individual retention periods

The administrative time limit(s) for keeping the personal data per data category

  1. Data category

      Financial documents

      Retention period

      7 years

      Start date description

      -

      End date description

      -

  2. Data category

      Electronic documents

      Retention period

      7 years

      Start date description

      -

      End date description

      -

 

Comments

Comments/additional information on the data retention periods

The Privacy statement is accessible to every data subject on the AGM page. The Commission meeting assistant / organiser assesses the arguments of the data subject as soon as the DG staff organising the meeting receives a request for rectification/blocking/erasure of data for legitimate reasons. The request will be handled within 15 working days after the reception of the request.

 

5. RECIPIENTS

 

Origin of the recipients of the data

The origin of the data recipients

• Within the EU organisation
  
  A description of the indicated recipients of the data

          All EC Services

• Outside the EU organisation
  
  A description of the indicated recipients of the data

          Agencies staff being involved in management of meetings and expense claim reimbursements in AGM

          Correspondents in external organization

 

Categories of the data recipients

The categories (one or more) of the data recipients

• A natural or legal person
• Public authority
• Agency

Description of the indicated category(ies) of data recipients

All EC Services & Agencies staff being involved in management of meetings and expense claim reimbursements in AGM.

Staff of National authorities/bodies (Ministries, Offices…) acting as correspondents in AGM

Who has access to which parts of the data

EU staff assigned to execute tasks in the system based on the need to know principle.

 

Comments

Comments/additional information on data recipients

Access to your personal data is provided to the Commission staff responsible for carrying out this processing operation and authorised for this staff according to the ‘need to know’ principle. Such staff abide by statutory, and when required, additional confidentiality agreements.

This includes:

• For the purpose of organising the meeting, in particular sending the invitations, organisations must provide the first name, surname and email address of government experts attending the meeting on their behalf.
• These data can also be seen by the staff of the Directorate-General responsible for organising the meeting, and by the staff in charge of reimbursement.
• Participants, when attending a meeting with other participants in the same delegation, can see the first name(s), surname and email address of each of them. The indicator showing which of the participants will be reimbursed can be seen by all the participants in a delegation.
• Correspondents for a delegation can see the status of a reimbursement request by participants in their delegation. The amount reimbursed is not visible.
• Users in the services can access the personal data of the participants and contact persons in public organisations solely for the meetings for which these same users are responsible.
• Users in the services have access to information on transport and hotel expenses and also bank information for the purpose of reimbursement of travel expenses/allowances.
• The European Commission’s technical staff or the IT service provider has access to the system data for the purpose of resolving any technical issues.
• Line managers, authorising officers by delegation and/or subdelegation.
• Investigation and control bodies also receive data: IAS, IAC, OLAF, IDOC.

 

Outside the organisation, your personal data are (or may be) transferred to:

- the Court of Auditors, the European Ombudsman and the EDPS

. 

 

6. INTERNATIONAL DATA TRANSFERS

 

Transfer outside of the EU or EEA

Data is transferred to countries outside the EU or EEA

N/A

 

Transfer to international organisation(s)

Data is transferred to international organisation(s)

N/A

 

Comments

Comments/additional information on international data transfers

The system does not foresee any transfers of personal data of data to countries outside of EU/EEA.

Specific expert groups will include experts from outside UE/EEA who will be able to see the meeting documentation. It is the responsibility of the meeting organiser to adjust meeting documentation to Regulation (EU) 2018/1725

 

7. INFORMATION TO DATA SUBJECTS ON THEIR RIGHTS

 

Privacy statement

Rights of the data subjectsThe processing should respect the following rights of data subjects

• Article 17 - Right of access by the data subject
• Article 18 - Right to rectification
• Article 19 - Right to erasure (right to be forgotten)
• Article 20 - Right to restriction of processing
• Article 21 - Notification obligation regarding rectification or erasure of personal data or restriction of processing
• Article 22 - Right to data portability
• Article 23 - Right to object
• Article 24 - Rights related to Automated individual decision making, including profiling

The data subjects are informed about their rights and how to exercise them in the form of a privacy statement attached to this record

Yes

Publication of the privacy statement

• Published on website
  
  The link of the website where the privacy statement is published

          Https://ec.europa.eu/tools/agm/legal-notice_en

Guidance for Data subjects which explains how and where to consult the privacy statement is available and will be provided at the beginning of the processing operation

Yes

An explanation of the guidance on how and where to consult the privacy statement

The Data Controller

If you would like to exercise your rights under Regulation (EU) 2018/1725, or if you have comments, questions or concerns, or if you would like to submit a complaint regarding the collection and use of your personal data, please feel free to contact the Data Controller, PMO_MAIL_05ec [dot] europa [dot] eu (PMO_MAIL_05[at]ec[dot]europa[dot]eu).

-    The Data Protection Officer (DPO) of the Commission

You may contact the Data Protection Officer ( DATA-PROTECTION-OFFICERec [dot] europa [dot] eu (DATA-PROTECTION-OFFICER[at]ec[dot]europa[dot]eu) )

with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725.

-    The European Data Protection Supervisor (EDPS)

You have the right to have recourse (i.e. you can lodge a complaint) to the European Data Protection Supervisor ( edpsedps [dot] europa [dot] eu (edps[at]edps[dot]europa[dot]eu) )

if you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data by the Data Controller.

Where to find more information

The Commission Data Protection Officer (DPO) publishes the register of all processing operations on personal data by the Commission which have been documented and notified to him. You may access the register via the following link:

http://ec.europa.eu/dpo-register

This specific processing operation has been included in the DPO’s public register with the following Record reference:

DPR-EC-01141.1

 

 

The privacy statement(s)

•  declaration_de_confidentialite_en-agm-ec-1141.3.pdf

 

Comments

Comments/additional information on information to data subjects on their rights

-

 

8. SECURITY MEASURES

 

Short summary of overall Technical and Organisational measures implemented to ensure Information Security:

User profiles defined for different roles with access based on the need to know principle.

User access with EU login identification.