Template for record structure Ares reference(2022)1489054
Status: PublishedDraft Page 1
European Labour Authority
DATA PROTECTION OFFICER
RECORD OF PROCESSING OPERATIONS ON PERSONAL DATA
DPR-ELA-2023-0003 ELA interactive online training platform for Concerted and Joint Inspections
Template for record structure Ares reference(2022)1489054
Status: PublishedDraft Page 2
1 PART 1: PUBLIC - RECORD (ARTICLE 31
1
)
1.1 GENERAL INFORMATION
Record reference
DPR-ELA-2023-0003
Title of the processing operation
ELA interactive online training platform for Concerted and Joint
Inspections
Controller entity
European Labour Authority, Enforcement and Analysis Unit
Joint controllers
☒
N/A
☐
YES, fill in details below
Processor(s)
☐
N/A
☒
YES, fill in details below
Internal organization(s)/entity(ies)
☒
N/A
☐
YES
Names and contact details
External organization(s)/entity(ies)
☐
N/A
☐
YES
Names and contact details
PricewaterhouseCoopers Auditing Ltd.
Bajcsy-Zsilinszky út 78,
1055 Budapest
Hungary
Data Protection Officer
Name and contact details
Laura NUNEZ BAREZ
Landererova 12,
811 09 Bratislava I
Slovakia
Email: data-protection@ela.europa.eu
Corporate Record
☐
Yes
☒
No
Language of the record
English
1
Pursuant to article 31 of the new data protection regulation for EU institutions and bodies (Regulation (EU) 2018/1725)
each controller and processor have to maintain a record of processing activities under its responsibility that contains at
least the information listed under that article.
Template for record structure Ares reference(2022)1489054
Status: PublishedDraft Page 3
1.2 PURPOSE AND DESCRIPTION OF THE PROCESSING
1.2.1 Purpose
The Enforcement and Analysis Unit of the European Labour Authority (ELA) provides specialized
training to effectively carry out concerted and joint cross-border inspections in order to promote a
consistent enforcement of Union law in the area that is operated by the Authority.
In this particular case, ELA and MS employees will have access to a software-based learning
management system, provided by an external contractor. The system does not require the direct link
to personal data, but to data to:
• Grant access to the specific platform
• Provide training material and e-learning
1.2.2 Processing for further purposes
☒ Archiving in the public interest
☒ Scientific or historical research purposes
☒ Statistical purposes
☐ N/A
Safeguards in place to ensure data minimization
☒ Pseudonymization
☐ Any other, specify
1.2.3 Modes of processing
1. ☒ Automated processing (Article 24)
a. ☒ Computer/machine
i. ☐ automated individual decision-making, including profiling
ii. ☐Online form/feedback
iii. ☐Any other, specify
Lint to an external training platform provided by the external contractor.
a. ☒ Excel sheet
b. ☐ Any other, specify
2. ☒ Any other mode, specify
Online training platform supported by SCORM packages.
1.2.4 Storage medium
1. ☒ Paper
2. ☒ Electronic
a. ☒Digital (MS documents (Word, excel, PowerPoint), Adobe pdf,
Audiovisual/multimedia assets, Image files (.JPEG, .PNG, etc.))
b. ☐ Databases
c. ☐ Servers
d. ☒ Cloud
3. ☒ External contractor premises
4. ☐ Others, specify
1.2.5 Comments on the processing of the data
Template for record structure Ares reference(2022)1489054
Status: PublishedDraft Page 4
Online (interactive) training platform:
The external contractor will receive the names of the candidates, but not their CVs. This contractor will
also receive the email address of each of the current registered participants in order to send them a login
and a password that enables access. At this stage, users will receive the link to ELA web site with the
privacy statement for accessing.
Regarding specific training: The tenderer will provide the link to ELA, and ELA will send it to the member
states enforcement authorities, and these will designate the trainees that will have access to the online
interactive training platform.
1.3 DATA SUBJECTS AND DATA CATEGORIES
1.3.1 Data subjects' categories
ELA staff
Officials from national authorities
Special advisers from Member States
1.3.2 Data categories/fields
Indicate the categories of data that will be processed:
For the online/hybrid training:
Name, surname, organization, role/position, email address and country.
Their activity in the course will be monitored and a certification of attendance will be provided after its
completion.
1.3.2.1 Special categories of personal data
Indicate if the processing operation concerns any ‘special categories of data’ which fall(s) under Article
10(1), which shall be prohibited unless any of the reasons under article 10(2) applies:
☐
Yes, the processing concerns the following special category(ies):
Data revealing
☐ racial or ethnic origin,
☐ political opinions,
☐ religious or philosophical beliefs,
☐ trade union membership,
Or/and,
☐ Genetic data, biometric data for the purpose of uniquely identifying a natural person,
☐ Data concerning health,
☐ Data concerning a natural person’s sex life or sexual orientation.
☒
N/A
1.3.2.2 Data related to 'criminal convictions and offences'
The data being processed contain sensitive data which
fall(s) under Article 11 'criminal convictions and offences'
N/A ☒
Yes
☐
Template for record structure Ares reference(2022)1489054
Status: PublishedDraft Page 5
1.4 RETENTION PERIOD
Indicate the administrative time limit(s) for keeping the personal data per data category, and if known,
specify the start/end date, or describe the specific start/end moment of each time limit:
Data category
Retention period
Data categories related to
the participants
Will be kept for maximum one year after the specific training take place.
After this year only aggregated data will be kept.
1.5 RECIPIENTS
Origin of the recipients of the data
1. ☒ Within the EU organization
Staff of the Enforcement and Analysis Unit
2. ☒ Outside the EU organization
Staff of the external contractor
Line managers of the external applicants
Categories of the data recipients
1.
☒
A natural or legal person
2.
☐
Public authority
3.
☐
Agency
4.
☐
Any other third party, specify
Description
ELA staff on the Enforcement and Analysis Unit will have access to the participants data
on an “a
need-to-know basis”.
Line managers will have access to their staff data and the status of the training (completed or not) .
External contractors will have access to the list of participants and their email in order to grant access
to their training platform.
1.6 INTERNATIONAL DATA TRANSFERS
Transfer to third countries or international organizations of personal data
1. Transfer outside of the EU or EEA
☒
N/A, transfers do not occur and are not planned to occur
☐
YES,
2. Transfer to international organization(s)
☒ N/A, transfers do not occur and are not planned to occur
☐
Yes, specify further details about the transfer below
1.7 INFORMATION TO DATA SUBJECTS ON THEIR RIGHTS
Rights of the data subjects
Template for record structure Ares reference(2022)1489054
Status: PublishedDraft Page 6
Article 17 – Right of access by the data subject
Article 18 – Right to rectification
Article 19 – Right to erasure (right to be forgotten)
Article 20 – Right to restriction of processing
Article 21 – Notification obligation regarding rectification or erasure of personal data or restriction
of processing
Article 22 – Right to data portability
Article 23 – Right to object
Article 24 – Rights related to Automated individual decision-making, including profiling
1.7.1 Privacy statement
☒ The data subjects are informed about their rights and how to exercise them in the form of a privacy
statement attached to this record.
Publication of the privacy statement
☒ Published on website
Web location:
- ELA internal website ☒ (URL: SharePoint on Personal Data Protection )
- External website ☒(URL: https://www.ela.europa.eu/en/privacy-policy )
☒ Other form of publication, specify
External providers’ website.
☒ Guidance for Data subjects which explains how and where to consult the privacy statement is
available and will be provided at the beginning of the processing operation.
Description:
Guidance on data subjects’ rights available on ELA main website.
1.8 SECURITY MEASURES
Short summary of overall Technical and Organizational Measures implemented to ensure Information
Security:
Description:
All data in electronic format (e-mails, documents, uploaded batches of data etc.) are stored either on
the servers of the European Labour Authority or of its contractors.
The European Labour Authority's contractors are bound by a specific contractual clause for any
processing operations of personal data on behalf of the European Labour Authority, and by the
confidentiality obligations deriving from the General Data Protection Regulation.
In order to protect personal data, the European Labour Authority has put in place a number of technical
and organizational measures. Technical measures include appropriate actions to address online security,
risk of data loss, alteration of data or unauthorized access, taking into consideration the risk presented
by the processing and the nature of the personal data being processed. Organizational measures include
restricting access to the personal data solely to authorized persons with a legitimate need to know for
the purposes of this processing operation.