Protection of personal data in the EEA selection and recruitment processes of officials, temporary agents, contract agents, seconded national experts and non-statutory staff

1. Brief description of the EEA recruitment and selection as a processing operation

Staff selection and recruitment at EEA is based on open selection procedures based on transparency and equity. EEA’s processes are supported by an Oracle Systal Cloud electronic system, designed to simplify the application process for candidates and to maximise EEA’s screening and selection efforts.

EEA’s career opportunities are available on a dedicated ‘EEA careers’ page on the website, covering the recruitment of statutory staff (officials, temporary agents and contract agents), as well as other dedicated selection procedures, like for example the selection of seconded national experts (SNEs). Persons interested can create their general candidate profile in the e-recruitment tool (‘Systal’) and submit their application for a specific vacant position when published.

Documents pertaining to the evaluation and selection stage, such as the report with scoring of applications for each vacancy and the scoring grids of online and live interviews as well as of the written tests are also collected and stored in the tool.

The shortlisted candidates are invited to an interview with the Executive Director and, in case of the recruitment of managerial staff, they shall take part in an assessment centre, provided by an external service provider of EEA.

Personal data processing in any manner in the context of EEA selection and recruitment processes, including the electronic processing, shall be compliant with Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.

The present privacy statement contains the information required in accordance with Articles 15 and 16 of the Regulation.

The selection procedures and the associated processing operations are under the responsibility of the Head of Human Resource Management Group in the Administrative Services, acting as data Controller, regarding the collection and processing of personal data.

References in this privacy statement to ‘you’, means you as an individual candidate or applicant for a vacant position or belonging to one of the groups of EEA’s workforce.

2. Purpose

The objective of the EEA selection and recruitment management is to attract, retain and develop talented and engaged human resources, more particularly:

• To organise and support selection and recruitment procedures for statutory staff in view of potential recruitment at the EEA, and
• To manage administratively applications and the different stages of these selection procedures and to manage and check the exploitation of reserve lists.

3. Information on the controller and data protection officer

• The Head of Human Resource Management Group (HRM) is the controller of the data processing in the context of selection and recruitment, including the use of the electronic support tools. Data processing by means of the tools is mainly entrusted to the HRM staff responsible for recruitment who can be contacted writing to: 
• recruitment.enquiries@eea.europa.eu
• EEA’s data protection officer can be contacted writing to DPO@eea.europa.eu

4. Categories of personal data processed

The personal data collected and further processed may relate to all or some of the following data:

• Data input by you as a user of the e-recruitment tool, including the general profile information and data to identify you: compulsory fields include Name (title, first name, surname), date of birth, gender, nationality, private address, email address and telephone number;
• Data relevant to demonstrate, in the framework of the selection procedure, that you fulfil the profile advertised in the vacancy notice: education, employment history, certifications and data on the selection criteria, and in case that an employment contract is offered, supporting documents;
• Additional data: any supporting information and/or documents verifying your technical and professional competences, ID/Passport number and bank account details for reimbursement of expenses and payments of allowances;
• Furthermore, you may wish to provide other information to support your application (e.g. recommendation letters, certificates);
• Evaluation data input in the tool throughout the selection and recruitment process for each vacancy, including the report with scoring of applications, scoring grids for interviews and written tests;
• The data processed may be used for the drawing up of a reserve list with the aim to recruit personnel (i.e. officials, temporary agents, contract agents, seconded national experts) with the highest standard of ability, efficiency and integrity.
• Originals or certified copies of evidence of nationality and qualifications, as well as evidence of character references are requested from the candidate who is offered a position, prior to final recruitment.

5. Who has access to the data and to whom is it disclosed?

• The access to personal data is managed on a need-to-know basis by means of function-based access control and account management for the e-recruitment tool (‘access control and account management’). This procedure aims at ensuring that the information only is disclosed to authorised recipients, including: EEA staff in the Human Resource Management group, appointed members of the Selection Board, the Executive Director in his capacity as Appointing Authority or any person delegated;
• In case of reserve lists and in the case of the selection of seconded national experts (SNEs) in addition to the above: line managers;

• EEA staff members in the Finance group dealing with the reimbursement of travel expenses, allowances and removal costs in case of recruitment;
• Access can be granted on request to any of the supervisory instances of the EEA, and to bodies in charge of auditing, control and judicial review, including the European Ombudsman, the European Data Protection Supervisor, OLAF, the European Public Prosecutor’s Office, the European Court of Auditors, Internal Audit Service, the General Court.

All recipients of the data are reminded of the purpose limitation of the transfer in question and the obligation of confidentiality arising from Articles 4(1)(f) and 9 of Regulation 2018/1725.

6. Modalities for the processing operation

Personal data is provided by creating a profile in Systal and applying following a vacancy notice. The personal data is processed electronically and stored in Systal and by EEA staff members responsible for the selection and recruitment procedure. The selection committee members access the personal data provided in Systal and review the applications using Systal.

Further the information is processed manually for the purpose of the management and administration of the selection and recruitment procedures (contacts with applicants during the selection/recruitment process, written notifications to the applicants, shortlisted candidates and selected applicant during the procedure and upon completion of the selection process, where necessary).

7. Information security

The Oracle Systal Cloud electronic system supporting the EEA selection and recruitment management has been configured so that it generally complies with the requirements of the General Data Protection Regulation (EU) 2016/679 (GDPR). The tool is accommodated with state-of-the-art security measures and data is stored securely in ISO certified data centres located inside the European Union. In addition, function-based access control and account management has been established (see above).

8. How can you access your data and how can you exercise your other rights as a data subject, in particular right of access and rectification?

You, as a candidate, can exercise your data subject rights of access and rectification by means of password authentication in the e-recruitment tool and you are able to edit your application until the procedure closing date.

The right to rectify can only be exercised up to the closing date for submission of applications. However, inaccurate identification data may be updated and rectified at any time during and after the selection procedure.

Any request for access or rectification of personal data shall be addressed in writing at the following email address recruitment.enquiries@eea.europa.eu or to the EEA’s Human Resources Management Group at the address:

• European Environment Agency, ADS1, Kongens Nytorv 6, 1050 Copenhagen K, Denmark.

9. Retention period of personal data

Your personal data is kept as long as necessary for the purposes of the administration and management of the related selection procedure, as well as for any follow-up actions it may entail.

• Profile information: The profile information of users in the electronic tool is maintained to facilitate their preparation of any future applications for recruitment or selection at EEA. EEA will carry out periodical screenings and delete inactive profiles on a 5-years basis;
• In the case of recruited applicants, the data retention period is ten years as of the termination of the employment or the last pension payment, whichever is applicable.
• In the case of non-recruited applicants included in a reserve list, the data retention period is determined by the validity period (and possible extension) of the reserve list.
• In case of non-recruited applicants (unsuccessful applicants), the data retention period is two years as of the date the applicant became aware of the result of the recruitment procedure (i.e. from the date of publication in the EEA web page that the procedure was closed, or the date of receipt of the notification to the applicant).
• After the above-mentioned periods, only data needed to provide overall statistics on the exercise (number of eligible and non-eligible applications, total number of applications, etc.) will be kept. The statistics are not subject to Regulation (EU) 2018/1725 since they are anonymous and cannot be used to identify one or more persons either directly or indirectly.
• Documents related to recruited Officials, Temporary Agents and Contract Agents are kept in their personal file in accordance with Art. 26 of the Staff Regulations. EEA keeps personal files until 10 years after the jobholder has terminated employment or the last pension payment, whichever is applicable provided there are no pending claims or any other open issues concerning the EEA employment relationship. The same retention is applied for recruited SNEs.

10. Lawfulness of processing and legal basis

Personal data processing in the context of EEA selection and recruitment is necessary for the performance of tasks carried out in the exercise of official authority vested in EEA as an agency of the European Union and for the compliance with the legal obligations to which it is subject in the sense of Article 5(1)(a) and (b) of Regulation (EU) 2018/1725. Furthermore, it is considered lawful because the data subject has unambiguously given his/her consent (Article 5(1)(d) of Regulation (EU) 2018/1725).

The specific legal basis is provided by:

• EEA’s Founding Regulation (EC) No 401/2009 of the European Parliament and of the Council of 23 April 2009 on the European Environment Agency and the European Environment Information and Observation Network;
• The Staff Regulations (SR) and the Conditions of Employment of Other Servants of the European Communities (CEOS), in particular Art. 27-34 (SR), Art. 12-15 (CEOS) and Art. 82-84 (CEOS);
• Decision 007/EEA/MB-WP-HR/2015 of the Management Board of the European Environment Agency of 25 August 2015 laying down general implementing provisions on the procedure concerning the engagement and use of temporary staff under Article 2(f) of the Conditions of Employment of Other Servants of the European Union;
• Decision EEA/MB/2018/017 of the Management Board of the European Environment Agency of 1 June 2018 amending its Decision (EEA/BU/51 written procedure of 21 May 2010) on the adoption of detailed implementing rules on the engagement and the use of contract staff;
• Decision EEA/BU/2019/004 of the Bureau of the European Environment Agency of 4 February 2019 on implementing rules on middle management staff;
• Commission Decision C(2008) 6866 final of 12 November 2008 laying down rules on the secondment to the Commission of national experts and national experts in professional training, applicable by analogy to the EEA.

11. Specific information on the processing of personal data in the context of the external assistance in staff selection, in particular the assessment centre for the recruitment of managerial staff

• EEA relies on specialised service provision in the area of staff selection, based on procurement contracts. In accordance with Regulation (EU) 2018/1725 (EDPR) and specifically Article 29 thereof, the Framework Contracts include specific conditions for personal data processing. The assistance from external service providers may comprise the following tasks: (1) Assessment centre for the recruitment of targeted job profiles and levels, (2) Support during interviews with the Selection Committee, (3) Psychometric testing, (4) Ad hoc consultancy.
• In particular, as concerns the Assessment Centre for the recruitment of targeted job profiles and levels, it shall be clarified that pursuant to Article 9(1)(c) of the EEA Decision on middle management staff of 04/02/2019, Head of Unit (Head of Programme) functions shall take part in an Assessment centre as a step of the selection and recruitment process.

12. Right to appeal

As a data subject, you are entitled to have recourse at any time to the European Data Protection Supervisor (https://edps.europa.eu; edps@edps.europa.eu) if you consider that your rights under Regulation(EU) No 2018/1725 have been infringed as a result of the processing of your personal data in the context of the EEA selection and recruitment processes.

You may also contact the EEA’s Data protection Officer (DPO) in case of any difficulties or for any questions relating to the processing of your data at the following email address:

• DPO@eea.europa.eu