1. Data Protection Office1 Training Course on Data Protection Nico Hilbert Assistant to the Data Protection Officer xxxx.xxxxxxx@xxx.xx.xxx March 9th, 2005 Notification to the Data Protection Officer (DPO) and Access to the Register

2. Data Protection Office2 Objective of the presentation zGeneral principles for the Register zGeneral principles for Notifications zPrinciples for Commission specific aspects on Notifications - The Actors zWhy is the Notification system Online? zObjective of the IS NDPO&R

3. Data Protection Office3 Principles for the Register (1) zWhat is the “Register” of the DPO : yThe collection of all “Notifications” send to the DPO by “Controllers”; zWhy is a “Register” needed? yTo conform to Regulation 45/2001 as defined in article 26 - Register :Regulation 45/2001 x“A register of processing operations notified in accordance with Article 25 shall be kept by each Data Protection Officer”; x“The registers may be inspected by any person”;

4. Data Protection Office4 Principles for the Register (2) zWhat is the contents of the “Register”? yArticle 26 says: “The register shall contain at least the information referred to in Article 25(2)(a) to (g)”; (a) the name and address of the controller; (b) the purpose of the processing; (c) a description of the categories of data subjects and of the data or categories of data relating to them; (d) the legal basis of the processing; (e) the recipients or categories of recipient disclosed; (f) a general indication of the time limits for blocking and erasure of the different categories of data; (g) proposed transfers of data to third countries or international organisations.

5. Data Protection Office5 Principles for Notifications (1) zWhat is a “Notification” and who is responsible for it? yPrior notice of the “Controller” to the DPO of any processing operation (manual & electronic) in which personal data is involved; zWhen is a “Notification” needed? yIf personal data is processed; zWhy is a “Notification” needed? yTo conform to Regulation 45/2001 :Regulation 45/2001

6. Data Protection Office6 Principles for Notifications (2) xas defined in article 25 - Notification to the Data Protection Officer; xas defined in articles 24.1(e) - Data Protection Officer + 27 - Prior checking zWhat is the contents of a “Notification”? ySame information as requested by article 26 (Article 25(2)(a) to (g)”) + paragraph (h) of article 25; xArticle 25 (h) a general description allowing a preliminary assessment to be made of the appropriateness of the measures taken pursuant to Article 22 to ensure security of processing.

7. Data Protection Office7 Principles for Commission specific aspects on Notifications (1) zActors (Players) in the context of a “Notification” : yEuropean Data Protection Supervisor (EDPS): DPO submits to EDPS Notification for Prior checking;European Data Protection Supervisor (EDPS) yData Protection Officer (DPO): receives the Notification in the Register and gives prior-advice on it; yController: is responsible for the Notification;

8. Data Protection Office8 Principles for Commission specific aspects on Notifications (2) yDelegated Controller: A Delegated Controller may be designated by the Controller to prepare under his/her responsibility the notification to the DPO and to assure all the related co-ordination with the Data Protection Coordinator and others concerned with data protection inside or outside the respective Directorate General. yData protection Co-ordinator (DPC): gives advice and helps the Controller and Delegated Controller; yProcessor(s): process(es) personal data on behalf of the Controller;

9. Data Protection Office9 Principles for Commission specific aspects on Notifications (3) yProject leader/Developer/IRM/HU DC: help to fill-in Notification concerning specific aspects related to their implication in the definition resp. execution/operation of the processing.

10. Data Protection Office10 Interaction between Main Players European Data Protection Supervisor (EDPS) Data Protection Officer (DPO) Register DG Data Protection Coordinator Controller Data Subjects Any body

11. Data Protection Office11 The Online Information System NDPO&R zImplements Regulation 45/2001 zBrowser based (Internet Explorer) zOnline Notification System and Access to the Register which translate articles 25+26 + zWrites notifications into the DPO’s “Register” - translates article 26 zHas a built-in workflow system (see actors)

12. Data Protection Office12 Why is the Notification system Online? zTo avoid any interaction of the DPO with the content of the final Notification zTo avoid that the DPO is involved in the process of writing notifications in the Register zTo give an integrated help (legal and question based) zTo have all legal references needed available online zTo interact electronically between actors in preparing notifications zTo keep independent electronic track of prior advice by DPO and EDPS for legal reasons zTo have integrated access of Data Subjects

13. Data Protection Office13 Objective of the IS NDPO&R zTo implement (parts of) Regulation 45/2001 ymainly articles 25 and 26 zThe prior Notification of Controllers to the DPO of all processing operations performed upon personal data by the institution zThe creation of the Register of the DPO zThe public access to the Register as requested by article 26

14. Data Protection Office14 Notification to the Data Protection Officer (DPO) zSince October 2003 the DPO has also made available on his web site on IntraComm a Simplified Notification System for small adhoc “processing of personal data” ythis new system is compatible with the standard online Notification System zAny Questions? zThank you for your attention!