The European Public Prosecutor’s Office (“EPPO”) is committed to ensuring that you have all the information you need in order to understand how your personal data are being processed, understand your rights, and how to exercise them. Below you can find all the details of the processing of personal data in the context of selection and recruitment procedures and the relevant contact details for further information, assistance or redress.
a) Identity and contact details of the controller
The entity that determines how and why your personal data are processed in the context of selection and recruitment procedures and which is legally responsible for complying with data protection obligations under Regulation (EU) 2018/1725 is the EPPO. You may contact the EPPO by email to EU-EPPO-HR (at) ec.europa.eu or by mail marked for the attention of the Head of Human Resources Unit, EPPO, 11 Avenue John F. Kennedy, 1855 Luxembourg.
b) Contact details of the Data Protection Officer
The Data Protection Officer (“DPO”) of the EPPO can be reached by email to EPPO-DPO (at) eppo.europa.eu, or by mail marked for the attention of the DPO, EPPO, 11, Avenue John F. Kennedy, 1855 Luxembourg, for assistance and with regard to any issues in relation to the processing of your personal data and the exercise of your rights, as outlined below under h).
c) Purpose and legal basis for the processing of personal data
In order to assess the suitability of applicants for a position at the EPPO as described in a vacancy notice and to administrate the documentation related to the selection and recruitment procedures (including reimbursements of expenses, calculation of entitlements, onboarding etc.), the EPPO needs to process personal data throughout the selection and recruitment procedures. The processing is necessary in order to recruit personnel (including seconded national experts (‘SNEs’) and trainees / interns) for the proper management and functioning of the EPPO.
The legal basis is Article 5(1)(b) Regulation (EU) 2018/1725, as the processing is necessary for compliance with a legal obligation to which the EPPO is subject, under the Staff Regulations of Officials and the Conditions of Employment of Other Servants (the ‘Staff Regulations’) and Implementing rules, and under Article 93 (Implementation of the Budget) and Article 98 (Seconded national experts and other staff) of Regulation (EU) 2017/1939 (the ‘EPPO Regulation’), and Implementing rules and decisions.
d) Categories of personal data concerned
Personal data required from all applicants such as family name, first name, date of birth, gender, nationality, date and place of birth, contact details (correspondence address, e-mail address, telephone number), application form information (may vary depending on the specific vacancy notice, but generally include professional experience, education, language skills, references, motivation for applying to the post), and a declaration of honour; Personal data required from applicants who pass the screening assessment by the selection board (suitable candidates), such as conflict of interest declaration form, identification documents (ID, Passport), employer authorisation form (for Seconded National Experts only), information contained in any exercise or test undertaken and corresponding evaluation of it by the members of the panel; Other personal data required where applicable (such as information stemming from the external assessment centre / entity when the procedure involves one; financial details (LEF and BAF) and relevant supporting documentation) for applicants entitled to reimbursement of expenses); Personal data required for the recruitment of successful applicants (such as, where applicable, contract details, proof of character references, details necessary for encoding into HR Services and, in general, for their on boarding, including (if needed) specific office requirements). Successful applicants will be asked to provide a formal certificate confirming the absence of any criminal record from pertinent authorities. If applicable, successful applicants will also be examined by the Medical Service of the European Commission to confirm that the requirements of the Staff Regulations are met (fitness for work). The EPPO will only be provided with the outcome of the medical examination and the health data are only disclosed in the course of the compulsory medical examination to the Medical Service (details in relation to this processing activity may be found in the relevant Record of Processing Activity of the European Commission). Furthermore, applicants may autonomously decide to provide certain information in the course of the selection and / or recruitment procedure that may allow the deduction of special categories of personal data (such as religious or philosophical affiliation etc.). Where relevant, successful applicants will also be required to undergo a security clearance procedure (dealt with under Record of Processing Activity No. APD-070721-CS Management of Personnel Security Clearances).
e) Recipients or categories of recipients of the personal data
Members of the EPPO’s Human Resources Unit in charge of handling the selection and recruitment procedure, members of the selection board, members of the selection panel, external assessment centre / entity (if applicable), Appointing Authority; Other members of the staff of the EPPO, if applicable (for example, staff from the Finance and Procurement Sector, when necessary in order to reimburse travel expenses of the applicant; Relevant members of the EPPO’s staff (including staff from the IT and Corporate Services Unit), as required in order to proceed with the on boarding of the newly recruited staff; The European Commission, Medical Service (health data are disclosed directly to them by the successful applicants (if applicable). The EPPO will disclose to the Medical Service of the European Commission solely information necessary for booking an appointment for the compulsory medical check on behalf of the successful applicant such as name, surname and contact details); If applicable, all bodies, offices and agencies of the EU may request the EPPO to share the reserve list content; Other persons, internal or external, in the context of legal proceedings, audits, internal investigations, or responding to data protection or security related incidents may also have access to all or some of the personal data, to the extent determined by the circumstances.
f) Transfers to third countries and / or international organisations
N/a.
g) Period for which the personal data will be stored
Personal data of applicants who were not selected are retained for 3 years following the financial discharge for the year in which recruitment of the successful applicant was finalised. Personal data of applicants who were selected and put on the reserve list are retained in accordance with the period of validity of the list (including its extension, if relevant). Personal data of recruited applicants are retained in accordance with the retention period specified in the processing activity related to the personnel file management (record No. APD-140721-HR) available from the EPPO’s DPO. The retention period may be prolonged until the end of possible audits or legal proceedings if started before the end of it. Personal data processed by the European Commission as processor are retained in accordance with their records of processing activity related to the variety of HR services that they provide to the EPPO. In particular, with reference to the medical checks, details in relation to the retention period may be found in the respective record of the Commission.
h) Right to request access, rectification, erasure, restriction, objection and data portability
You have the right at any time to request access to your personal data and to have them rectified in case they are inaccurate or incomplete, to object to or request restriction of processing of your personal data, to erase your personal data and to data portability. To exercise these rights, request assistance or if you have a question thereto, or to file a complaint, you may contact the DPO of the EPPO by using the contact details above.
i) Right to withdraw consent
N/a.
j) Complaints to the European Data Protection Supervisor
You have the right to address yourself to the European Data Protection Supervisor (“EDPS”) to lodge a complaint. The EDPS can be contacted by email to EDPS (at) edps.europa.eu, or by post to EDPS, Rue Wiertz 60, B-1047 Brussels.
k) Source from which the personal data originate
Personal data stem directly from the applicants in the selection (e.g. application form and supporting documentation) and recruitment procedures. Personal data also stem from the selection board, the panel members, and the external assessment centre / entity (where applicable) assessing the suitability of applicants, and from the European Commission in relation to the recruitment procedure (limited to the opinion issued by the Medical Service concerning the pre-employment medical examination, where applicable).
l) Mandatory nature of provision of personal data
Failure to provide personal data at any stage of the selection process (including by asking to be removed from the reserve list, where applicable) implies withdrawal from the procedure by the applicant. Failure to provide any of the personal data requested at any stage of the recruitment procedure has consequences related to recruitment. For example, without producing a medical certificate or without producing the character references, the contract will automatically expire after a pre-defined period.
m) Automated decision-making
The processing of your personal data by the EPPO in the context of this processing activity does not result in any decision, which produces legal effects concerning you or similarly significantly affects you.
n) Record of processing activity
The related record of processing activity kept by the EPPO with record no. APD-200521-HR is available from the EPPO’s DPO.
Last Update: 30/01/2023