Article 1 - Purpose
Article 2 - Appointment, statute and independence
Article 2a - Assistant Officers
Article 3 - Duties
Article 4 - Tasks
Article 5 - Powers
Article 6 - Procedure for notifying processing operations
Article 7 - Register of processing operations
Article 8 - General rules governing the exercise of rights by data subjects
Article 9 - Right of access
Article 10 - Right of rectification
Article 11 - Right to have data blocked
Article 12 - Right of erasure
Article 12a - Notification to third parties
Article 13 - Right to object
Article 14 - Monitoring procedure
Article 15 - Remedies
Article 16 - Restrictions
Article 17 - Data controllers
Article 17a - Access to documents
Article 18 - Entry into force

---

BUREAU DECISION OF 22 JUNE 2005

The Bureau,

- having regard to the Treaty establishing the European Community and, in particular, Article 286 thereof,

- having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data and, in particular, Article 24(8) thereof,

- having regard to Rule 22(2) of the European Parliament's Rules of Procedure,

- whereas:
(1) Regulation (EC) No 45/2001 (referred to hereinafter as 'the Regulation') lays down the principles and the rules applicable to all the Community institutions and bodies and provides for a Data Protection Officer to be appointed by each Community institution and body.

(2) Pursuant to Article 24(8) of the Regulation, further implementing rules shall be adopted by each Community institution or body in accordance with the provisions set out in the Annex to the Regulation. The implementing rules shall concern in particular the Data Protection Officer's tasks, duties and powers.

(3) The purpose of the implementing rules is to lay down procedures which will enable data subjects to exercise their rights and all persons within the Community institutions or bodies who are involved in the processing of personal data to fulfil their obligations.

DECIDES:

Article 1 - Purpose

1. This Decision lays down the general rules governing the implementation of the Regulation in the case of the European Parliament. In particular, it supplements the provisions set out in the Regulation which relate to the tasks, duties and powers of the European Parliament's Data Protection Officer(s).

Furthermore, the Decision lays down the detailed rules pursuant to which a data subject may exercise his or her rights, the procedure for notifying a processing operation and the procedure for obtaining access to the register of processing operations kept by the Data Protection Officer.

Article 2 - Appointment, statute and independence

1. The Secretary-General shall appoint the Data Protection Officer from amongst the officials of the Community institutions and bodies on the basis of his or her personal and professional qualities and, in particular, his or her expert knowledge of data protection. The Data Protection Officer shall be appointed in accordance with the procedure laid down in Article 29 of the Staff Regulations.

2. The Secretary-General shall register the Data Protection Officer with the European Data Protection Supervisor.

3. For the purpose of performing his or her duties, the Data Protection Officer shall be relieved of any other activity within the European Parliament. He or she may perform other duties, provided that they do not result in a conflict of interests with the role of Data Protection Officer, particularly in relation to the application of the provisions laid down in the Regulation.

4. The Data Protection Officer shall be appointed for a five-year period, renewable once. He or she may be dismissed from his or her post only with the consent of the European Data Protection Supervisor and only if he or she no longer fulfils the conditions required for the performance of his or her duties. The European Data Protection Supervisor shall be consulted in writing and a copy sent to the Officer.

5. The Data Protection Officer shall be independent in the performance of his or her duties. In that regard, he or she may not receive any instructions, in particular from the Appointing Authority, the Secretary-General or any other source as regards the internal application of the provisions laid down in the Regulation or his or her cooperation with the European Data Protection Supervisor. The Data Protection Officer shall refrain from any act which is incompatible with the nature of his or her duties.

6. The Data Protection Officer shall inform the appropriate European Parliament authorities of the number of staff and the resources which he or she requires in order to carry out his or her duties. In addition, he or she may call upon specialist outside staff to help him or her in the performance of his or her duties.

7. The Data Protection Officer and his or her staff shall at all times be subject to the rules and provisions laid down in the Staff Regulations applicable to officials and the conditions of employment applicable to other servants.

The Data Protection Officer and his or her staff (to whom Article 287 of the Treaty shall apply) shall maintain, including once they have ceased their duties, professional secrecy as regards any confidential documents or information which they obtain in the course of their duties.

Article 2a - Assistant Officers

1. The Secretary-General may appoint Assistant Data Protection Officers, to whom Article 2(4), (5), (7) and (8) shall also apply.

2. The Officer, the Assistant Officers and any support staff shall form an integral part of the Data Protection Department, which shall be run by the Officer.

The Officer may be assisted in all of his or her tasks or be represented (in his or her absence or when otherwise engaged) by an assistant.

Article 3 - Duties

1. The Data Protection Officer shall ensure that the provisions laid down in the Regulation are applied within the European Parliament. He or she shall carry out his or her tasks in cooperation with the European Data Protection Supervisor.

2. The Officer may be consulted at any time by any person and in particular by data subjects in respect of any matter relating to the application of the Regulation. Specifically, the Officer shall provide advice to the Registry department in order to ensure compliance with the provisions laid down in the Bureau decision of 28 November 2001 concerning public access to European Parliament documents.

The Data Protection Officer shall represent the European Parliament's Secretariat in respect of any matter relating to data protection. He or she may in particular attend meetings of committees or relevant bodies at international level.

Article 4 - Tasks

The Data Protection Officer's tasks shall be as follows:
- Provision of information: the Officer shall inform the European Parliament's data controllers and data subjects of their rights and obligations under the Regulation, for which purpose he or she shall provide the necessary information concerning the legislation in force, current procedures and existing notified files, and he or she shall facilitate the exercise of those rights and the fulfilment of those obligations.
- Requests from the European Data Protection Supervisor: the Officer shall respond to requests from the European Supervisor.
- Cooperation with the European Data Protection Supervisor: within his or her area of responsibility, the Officer shall cooperate with the European Supervisor at the latter's request or on his or her own initiative, particularly as regards dealing with complaints and carrying out inspections.
- Provision of information to the European Data Protection Supervisor: the Officer shall inform the European Supervisor regarding any new development at the European Parliament which has a bearing on the protection of personal data.
- Register of processing operations: the Officer shall, pursuant to Article 26 of the Regulation, keep a register of the processing operations carried out by the data controllers and shall ensure that that register may be inspected by any individual.
- Notification of processing operations which are likely to present specific risks: the Officer shall notify the European Data Protection Supervisor of any processing operation which is likely to present specific risks within the meaning of Article 27 of the Regulation. Should there be any doubt regarding the need for a prior check, the Data Protection Officer shall consult the European Data Protection Supervisor.
- Upholding data subjects' rights and freedoms: the Data Protection Officer shall ensure that processing operations do not undermine the rights and freedoms of data subjects and that no person suffers loss or damage for having brought to the Data Protection Officer's attention a matter which in the view of that person constitutes an infringement of the Regulation.

Article 5 - Powers

1. In order to perform his or her tasks and in accordance with the conditions laid down in the Regulation, the Data Protection Officer may:
- on his or her own initiative, make recommendations to the data controllers or to the Secretary-General on issues concerning the application of the provisions relating to data protection or included in these implementing rules;
- consider issues and facts (on his or her own initiative or at the request of the data controller, the European Parliament's Staff Committee or any individual) which relate directly to his or her powers and responsibilities and which have been brought to his or her knowledge. He or she shall consider them in accordance with the principle of impartiality and with due regard to the rights of the data subject. The Data Protection Officer shall forward his or her findings to the person who submitted the request and to the data controller;
- report any breach of the provisions laid down in the Regulation to the Secretary-General;
- regularly attend meetings with the European Data Protection Supervisor and/or the Data Protection Officers of the other institutions and bodies with a view to establishing a mutual exchange of information, engaging in interinstitutional cooperation and harmonising the application of the procedures in force;
- draw up an annual activity report for the Secretary-General and the European Data Protection Supervisor concerning activities relating to the protection of data within the European Parliament. He or she shall make the report accessible to Parliament's staff;
- issue an opinion on the lawfulness of actual or proposed processing operations, on the measures required in order to ensure that such operations are lawful and on the suitability or inadequacy of data or of security measures. The opinion may in particular relate to any issue concerning the notification of data-processing operations.

2. The Data Protection Officer shall have access at all times to data which are being processed and to all offices, data-processing installations and data carriers.

Article 6 - Procedure for notifying processing operations

1. Before processing any data (and in sufficiently good time to enable any prior check within the meaning of Article 27(3) of the Regulation to be carried out), the data controller shall notify the Data Protection Officer thereof, for which purpose he or she may use the notification form available on the European Parliament's Intranet. In any event, the notification shall comply with the provisions laid down in paragraph 3. The notification shall be signed by the data controller and be despatched to the Data Protection Department by internal post, e-mail or fax. Where the notification is sent by email or fax, the signed original paper copy shall reach the Data Protection Department within ten calendar days of the date of despatch.

2. The data controller shall, in accordance with the notification procedure laid down in paragraph 1, immediately notify processing operations which were already under way on the date of entry into force of the Regulation (1 February 2002).

3. The information to be provided shall include at least the following:
(a) the name and address of the data controller and an indication of the European Parliament departments which are entrusted with the processing of personal data for a particular purpose;
(b) the purpose or purposes of the processing;
(c) a description of the category or categories of data subjects and of the data or categories of data relating to them;
(d) the legal basis of the processing operation for which the data are intended;
(e) the recipients or categories of recipient to whom the data might be disclosed;
(f) a general indication of the time limits for blocking and erasure of the various categories of data;
(g) the proposed transfers of data to third countries or international organisations and recipients who are subject to the law of a Member State;
(h) a general description allowing a preliminary assessment to be made of the appropriateness of the measures taken pursuant to Article 22 of the Regulation in order to ensure that processing is secure.

The data controller shall immediately inform the Data Protection Officer of any change affecting the information referred to in paragraph 3.

Article 7 - Register of processing operations

1. The Data Protection Officer shall keep a register of the processing operations notified pursuant to Article 6. The register shall detail all the notified processing operations which have been carried out at the European Parliament and shall indicate in particular the department responsible for the processing, the data processed and the intended purpose.

The register may be inspected by any person and shall also facilitate the exercise of the recognised rights of the data subject which are laid down in Articles 13 to 19 of the Regulation.

2. The register shall contain the information referred to in Article 6(3)(a) to (g) of this Decision.

If the Officer deems it necessary, he or she may take action to rectify the data contained in the register, with a view to ensuring that they are accurate.

Article 8 - General rules governing the exercise of rights by data subjects

1. The rights of access, rectification, blocking, erasure and objection may be exercised by the data subject or his or her duly authorised representative only.

2. Requests to exercise one of those rights shall be addressed to the data controller. A form shall be available in electronic form on the European Parliament's Intranet. The request shall contain:
- the name, first name and contact details of the data subject;
- an indication of the right to be exercised;
- where appropriate, supporting documents relating to the request;
- the category or categories of the data concerned;
- the applicant's signature and the date of the request.

The request may be submitted by internal or external post, e-mail or fax in such a way that the submission and receipt of the request may be certified. Should the request contain any errors or omissions, the data controller may ask for additional information. The data controller shall verify the applicant's credentials.

3. The data controller shall respond to any request to exercise the rights, even in the absence of the personal data processed in the file. An acknowledgement of receipt shall be sent to the applicant within five working days of the receipt of the request. However, the data controller shall not be required to send an acknowledgement of receipt if a substantial reply to the request is provided within the same time limit of five working days. The reply shall be sent by the same means of communication as was used by the data subject.

4. The data controller shall notify the data subject of his or her right to lodge a complaint with the European Data Protection Supervisor if that person considers that the rights granted to him or her under Article 286 of the Treaty were infringed when the personal data relating to him or her were processed.

5. The data subject may exercise any of these rights free of charge.

Requests to exercise a right may be rejected in the cases referred to in Article 20 of the Regulation, subject to application of Article 17 of this Decision.

Article 9 - Right of access

1. The data subject shall have the right to obtain, without constraint, at any time within three months from the receipt of the request and free of charge from the data controller:
- confirmation as to whether or not data related to him or her are being processed;
- information at least as to the purposes of the processing operation, the categories of data concerned, and the recipients or categories of recipients to whom the data are disclosed;
- communication in an intelligible form of the data undergoing processing and of any available information as to their source;
- knowledge of the logic involved in any automated decision process concerning him or her.

2. The data subject may access his or her personal data by any of the following means:
- on-site consultation;
- issue of a certified copy drawn up by the data controller;
- issue of an electronic copy;
other means available to the data controller and suited to the configuration of the file.

Article 10 - Right of rectification

1. The data subject shall have the right to obtain from the data controller the rectification without delay of inaccurate or incomplete personal data.

2. Requests for rectification shall specify the data to be rectified and the correction to be made. Where appropriate, a request may be accompanied by supporting documents.

If a request for rectification is accepted, it shall be acted upon immediately and the data subject notified thereof. Should a request for rectification be rejected, the data controller shall have 15 working days within which to inform the data subject by means of a letter stating the grounds for the rejection.

Article 11 - Right to have data blocked

1. The data subject shall have the right to obtain from the data controller the blocking of data where:
(a) their accuracy is contested by the data subject, for a period enabling the data controller to verify the accuracy, including the completeness, of the data, ==or==
(b) the data controller no longer needs them for the accomplishment of his or her tasks but they must be maintained for purposes of proof, ==or==
(c) the processing is unlawful and the data subject opposes their erasure and demands their blocking instead.

2. Requests for blocking shall specify the data to be blocked. A data subject who has requested and obtained the blocking of data shall be informed thereof by the data controller. He or she shall also be informed of the fact that data are to be unblocked at least 15 working days before they are unblocked.

3. The data controller shall take a decision within 15 working days of receiving a request for data to be blocked. If the request is accepted, it shall be acted upon within 30 working days and the data subject notified thereof. Should the request for blocking be rejected, the data controller shall have 15 working days within which to inform the data subject by means of a letter stating the grounds for the rejection.

4. In automated filing systems, blocking shall be ensured by technical means. The fact that personal data are blocked shall be indicated in the system in such a way as to make it clear that the data may not be used.

Personal data blocked pursuant to this Article shall, with the exception of their storage, only be processed for purposes of proof, or with the consent of the data subject or for the purpose of protecting the rights of third parties.

Article 12 - Right of erasure

1. The data subject shall have the right to obtain from the data controller the erasure of data if the processing thereof is unlawful.

2. Requests for erasure shall specify the data to be erased. Where the data controller disputes that the processing is unlawful, he or she shall provide proof that it is lawful.

3. The data controller shall reply within 15 working days of receiving a request for erasure. If the request is accepted, it shall be acted upon immediately. If the data controller deems the request unjustified, he or she shall have 15 working days within which to inform the data subject by means of a letter stating the grounds for the decision.

Erasure entails the physical disappearance of the data without its being necessary to replace them by a code or by the creation of an alternative file containing the data erased. If erasure proves impossible for technical reasons, the data controller shall block the data immediately. The data subject shall be duly informed of this procedure.

Article 12a - Notification to third parties

The data subject shall have the right to obtain from the data controller the notification to third parties to whom the data have been disclosed of any rectification, erasure or blocking pursuant to Articles 10 to 12, unless this proves impossible or involves a disproportionate effort. In the event of a refusal to notify a third party on the grounds of impossibility or disproportionate effort, the data controller shall have 15 working days within which to inform the data subject by means of a letter stating the grounds for the refusal.

Article 13 - Right to object

1. The data subject shall have the right to object at any time, on compelling legitimate grounds relating to his or her particular situation, to the processing of data relating to him or her, except in the cases covered by Article 5(b), (c) and (d) of the Regulation.

2. The data subject shall have the right to be informed before personal data are disclosed for the first time to third parties or used on their behalf for the purposes of direct marketing and shall be expressly offered the right to object free of charge to such disclosure or use.

3. Requests to make an objection shall specify the datum or data concerned.

4. The data controller shall reply to the data subject within 15 working days of receiving a request to make an objection. If the data controller deems the request unjustified, he or she shall inform the data subject by means of a letter stating the grounds for the decision.

In the event of a justified objection the data in question may not be subjected to the processing referred to in paragraph 1.

Article 14 - Monitoring procedure

1. Any data controller concerned shall assist the Data Protection Officer in the performance of his or her duties and provide him or her with any information which he or she requests within 20 working days. In performing his or her duties, the Data Protection Officer shall have access at all times to the data being processed and to all offices, data-processing installations and data carriers.

The Data Protection Officer may decide to carry out any other type of monitoring at any time in order to ensure that the Regulation is being properly applied by the European Parliament.

Article 15 - Remedies

1. Any person employed by the European Parliament may lodge a complaint pursuant to Article 33 of the Regulation with the European Data Protection Supervisor. Lodging such a complaint shall not have the effect of stopping time running for the purposes of lodging a complaint pursuant to Article 90 of the Staff Regulations.

Irrespective of the right referred to in paragraph 1, any person employed by the European Parliament may lodge with the Appointing Authority a complaint pursuant to Article 90 of the Staff Regulations in respect of a matter relating to the processing of personal data. In that case, the Data Protection Officer shall be consulted by the relevant departments.

Article 16 - Restrictions

1. The data controller may restrict the rights laid down in Articles 9 to 13 of this Decision on the grounds set out Article 20(1) of the Regulation. He or she shall consult the Data Protection Officer in advance.

2. If a restriction is imposed, the data controller shall, in accordance with Community law, inform the data subject of the principal reasons for the restriction and of his or her right to refer the matter to the European Data Protection Supervisor and the Court of Justice.

The data controller shall respond immediately to requests relating to the application of restrictions on the exercise of rights and shall give the reasons for any decision taken to that effect.

Article 17 - Data controllers

1. By means of a specific decision, the Secretary-General may appoint an authority subordinate to him or her as the data controller, within the meaning of Article 2(d) of the Regulation.

2. The data controller shall be responsible for ensuring that processing operations carried out under his or her supervision are in accordance with the Regulation. In particular, he or she shall be responsible for:
- assisting the Data Protection Officer and the European Data Protection Supervisor in the performance of their respective duties, in particular by sending information to them in reply to their requests within 20 working days at most;
- implementing appropriate technical and organisational measures and giving the members of the European Parliament's staff (or other persons under their authority) suitable instructions for ensuring that processing is confidential and providing an appropriate level of security in view of the risks which processing entails;
notifying the Data Protection Officer of any data-processing operation before undertaking it, pursuant to Article 6 of this Decision.

Article 17a - Access to documents

1. The register of processing operations shall be public and accessible in electronic form. Any person may inspect it directly and request an authenticated copy of the entry for a specific processing operation from the Data Protection Officer. Indirect access shall also be possible via the European Data Protection Supervisor.

Documents produced by the Data Protection Officer and his or her staff shall be subject to Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents.

Article 18 - Entry into force

This Decision shall come into force on the day following its publication in the Official Journal of the European Union.