1. Last update of this record: 05/06/23

2. Reference number: 05/2023

3. Name and contact details of the controller: European Ombudsman, 1 avenue du Président Robert Schuman, CS 30403, F-67001 Strasbourg Cedex - EO@ombudsman.europa.eu

Responsible department:

Directorate for Administration (ICT staff members) and the project team (one member of the SG and the Head of HR team)

4. Name and contact details of the Data Protection Officer: Ms Francesca Pavesi- Deputy DPO: Mr Nicholas Hernanz

Email: mailto:DPO-Euro-Ombudsman@ombudsman.europa.euDPO-Euro-Ombudsman@ombudsman.europa.eu

5. Name and contact details of the processor: the external company in charge of compiling the survey responses and drafting the summary report:

INCIDENCE SPRL

Chaussée de Bruxelles 11/15,

1300 Wavre

Belgium

Email: gcomhaire@incidence.be or info@incidence.be

6. Name and contact details of the joint controller(s): N/A

7. Purpose(s) of the processing:  The EO, through LimeSurvey (an internal survey tool), intends to carry out a staff survey to gather feedback from staff on the organisation of the office, the working conditions, work environment and on ethical and wellbeing matters. The purpose is to identify areas perceived as working satisfactorily as well as areas that may require follow up actions and, to the extent possible, compare results over time and with those of other institutions.

The legal basis of the procedure is Article 1e (2) and (3) of the Staff Regulations^[1].

8. Description of the categories of data subjects and of the categories of personal data:

- Categories of data subjects: staff members from the EO Office (officials, temporary or contract agents). Trainees of the EO Office do not participate to the staff survey.

- Categories of personal data:

The survey is anonymous. The record of the survey responses does not contain any identifying information about the respondents. When making comments in the free text box, the respondents can add information. In those instances, there is a possibility for certain respondents to be identified or for them to reveal personal data of third parties, depending on the content of the information they choose to provide.

The EO processes the professional email addresses of staff to be able to send the link to the survey. The EO also processes the survey responses. These personal data may be processed by the external company and by the EO Office.

The external company in charge of the report processes the opinions of staff gathered on the basis of the survey questionnaire.

9. Time limit for keeping the data and, where possible, for erasure:

The EO will keep the e-mail addresses of respondents to the survey for as long as it is necessary for sending the Staff Survey 2023 to the staff members concerned.

The EO will keep the survey responses, including any potential personal data submitted by respondents in the free text boxes, for a maximum of five years. It will delete the data afterwards.

The external company will keep the replies provided by the respondents for as long as it is necessary to draw up the survey report and for a maximum of five years^[2]. It will delete the data afterwards. All replies are presumed to be anonymous, with the exception of free text boxes if respondents provide personal data in them.

10. Recipients of the data:

The recipient is the external company responsible for drafting the report on the survey.

The overall results (anonymised data) will also be shared with staff.

11. Are there any transfers of personal data to third countries and/or to International Organisations? N/A

12. General description of security measures:

The EO uses “LimeSurvey” to send the survey to respondents and collect the replies. LimeSurvey is an internal survey tool ensuring that all data processed stays within a secure server of the European Ombudsman and that data is protected through strict security rules.

Replies to questions of the survey make it impossible for data subjects to be identified, except for the certain cases in which the respondents can add information in a free text box.

The survey includes the following disclaimer : "to maintain the anonymity of participants, we ensure that the answers are structured in a manner that prevents the identification of individuals. However, please be aware that some free-text fields allow individuals the freedom to enter any information they choose, including personal data of themselves or others. We strongly encourage participants to refrain from disclosing any personally identifiable information in these fields."

13. Information on how data subjects can exercise their rights of access and rectification, and where applicable, of erasure, restriction and data portability:

Concerning the e-mail addresses of EO staff members:

Staff members can ask to have access to their own personal data and to relevant information concerning how the EO uses it. They can also request rectification of any incomplete or inaccurate data concerning them. Under certain conditions, they have a right to object to the use of their data by the EO on grounds relating to their particular situation, at any time, as well as a right to ask that the EO delete their personal data or restrict its use.

The EO will reply to the requests as soon as possible and within one month at the latest.

Concerning the responses to the survey:

Once respondents submit their responses to the survey, the responses become anonymous information. As such, the rights of data subjects under Regulation (EU) 2018/1725 are not applicable when it comes to the survey responses. The disclaimer above the free text boxes provides enough information to respondents about the risks of providing personal data in their replies. Since the survey is carried out anonymously, it is technically not possible to identify “who responded what” nor to give respondents the rights of access, rectification, objection, deletion or restriction to/of their response.

Any data subject, however, has the right to access, rectify, object, delete or request restriction of personal data included in one of the free text boxes if it concerns him or her, under certain conditions set out in the Regulation. Those requests should be addressed to the external company processing the survey responses (info@incidence.be) or to the EO.

At any time, staff members may ask the office information concerning the processing of their personal data by e-mail (EO@ombudsman.europa.eu) or by contacting the Directorate for Administration. The services will reply to their requests as soon as possible and within one month at the latest. They may also contact the office’s Data Protection Officer at:

DPO-Euro-Ombudsman@ombudsman.europa.eu

If they wish to complain about the EO’s handling of their personal data, they may contact the European Data Protection Supervisor (www.edps.europa.eu) at the following address: EDPS@edps.europa.eu

Privacy Statementrelating to the Staff Survey 2023 in the European Ombudsman’s Office

This privacy statement explains the reason for the processing, the way the European Ombudsman (EO) collects, handles and ensures protection of all personal data provided, how that information is used and what rights the data subjects may exercise in relation to their data.

The controller is the EO. The processor is the external company in charge of compiling the survey responses and drafting the summary report.

1. What personal data will the European Ombudsman process?

The survey is anonymous. The record of the survey responses does not contain any identifying information about the respondents.

The EO processes the professional email addresses of staff to be able to receive the link to the survey.

Trainees of the EO Office do not participate to the staff survey.

In certain cases, the respondents can add information in a free text box. 

The instructions on the survey will include a specific disclaimer along these lines: to maintain the anonymity of participants, we ensure that the answers are structured in a manner that prevents the identification of individuals. However, please be aware that some free-text fields allow individuals the freedom to enter any information they choose, including personal data of themselves or others. We strongly encourage participants to refrain from disclosing any personally identifiable information in these fields.

When making comments in the free text box, the respondents can add information. In those instances, there is a possibility for certain respondents to be identified or for them to reveal personal data of third parties, depending on the content of the information they choose to provide.

These personal data may be processed by the external company and by the EO Office.

A report on the survey will be drawn up by an external company and circulated to staff and the management team.

2. Why does the European Ombudsman process these personal data?

As stated in the preceding paragraph, the survey maintains anonymity. Nevertheless, staff members have the option to voluntarily disclose their personal data or the personal data of third parties in the free text boxes. It is only in such cases that the Ombudsman may incidentally handle personal data.

The European Ombudsman’s Office intends to carry out a staff survey to gather feedback from staff on the organisation of the office, the working conditions, work environment and on ethical and wellbeing matters. The purpose is to identify areas perceived as working satisfactorily as well as areas that may require follow up actions and, to the extent possible, compare results over time and with those of other institutions.

3. What are the legal bases and necessity for processing this data?

Processing is necessary on the basis of Article 5(1) (a) (the performance of a task carried out in the public interest).

The legal basis is Article 1e (2) and (3) of the Staff Regulations .

4. Who is responsible for processing the data?

The first category of personal data, namely the e-mail addresses of all staff members, is processed by the Directorate for Administration (ICT staff members) and the project team (one member of the SG and the Head of HR team).

The second category of personal data, namely the ones that may be introduced by staff in the comments in the free text of the survey, may be processed by the external company responsible for drafting the report on the survey, the Directorate for administration (ICT staff members) and the project team (one member of the SG and the Head of HR team). This external company is presumed to handle only anonymous data, except in the case of the free text boxes, if respondents provide personally identifiable information about themselves or others.

5. Who will be recipients of the data?

The recipient is the external company responsible for drafting the report on the survey. The overall results (anonymised data) will also be shared with staff.

6. How long will the data be kept?

The Ombudsman will keep personal data listed in point 1 above (e-mail addresses of respondents to the survey) for as long as it is necessary for sending the Staff Survey 2023 to the staff members concerned.

The external company will keep the replies provided by the respondents for as long as it is necessary to draw up the survey report and for a maximum of five years . It will delete the data afterwards. All replies are presumed to be anonymous, with the exception of free text boxes if respondents provide personal data in them.

7. How do we protect your data?

The EO uses “LimeSurvey” to send the survey to respondents and collect the replies. LimeSurvey is an internal survey tool ensuring that all data processed stays within a secure server of the European Ombudsman and that data is protected through strict security rules.

Replies to questions of the survey make it impossible for data subjects to be identified, except for the certain cases mentioned in part 1 in which the respondents can add information in a free text box.

The following disclaimer will be added: "to maintain the anonymity of participants, we ensure that the answers are structured in a manner that prevents the identification of individuals. However, please be aware that some free-text fields allow individuals the freedom to enter any information they choose, including personal data of themselves or others. We strongly encourage participants to refrain from disclosing any personally identifiable information in these fields."

8. What are your rights and how can you exercise them?

Concerning the first category of personal data, namely the e-mail addresses of all staff members:

You have the right of access to your own personal data and to relevant information concerning how the EO uses it.

Under certain conditions, you have also a right to request rectification of any incomplete or inaccurate data concerning you. You can rectify identification data at any time. You have a right to object to the use of your data by the EO on grounds relating to your particular situation, at any time.

Under certain conditions, you have the right to ask that the EO delete your personal data or restrict its use.

The EO will reply to the requests as soon as possible and within one month at the latest.

Concerning the second category of personal data, namely the responses to the survey:

Once respondents submit their responses to the survey, the responses become anonymous information. As such, the rights of data subjects under Regulation (EU) 2018/1725 are not applicable when it comes to the survey responses. The disclaimer above the free text boxes provides enough information to respondents about the risks of providing personal data in their replies. Since the survey is carried out anonymously, it is technically not possible to identify “who responded what” nor to give respondents the rights of access, rectification, objection, deletion or restriction to/of their response.

Any data subject, however, has the right to access, rectify, object, delete or request restriction of personal data included in one of the free text boxes if it concerns him or her, under certain conditions set out in the Regulation. Those requests should be addressed to the external company processing the survey responses.

9. Who to contact in case of queries or complaints concerning data protection issues?

At any time, you may send data protection related questions concerning the organisation of the Staff Survey 2023 to the EO, at the following address:

European Ombudsman

1 avenue du Président Robert Schuman

CS 30403

F-67001 Strasbourg Cedex

EO@ombudsman.europa.eu

You may contact the external company processing the survey responses at:

Mr Geoffroy Comhaire

INCIDENCE SPRL

Chaussée de Bruxelles 11/15,

1300 Wavre

Belgium

gcomhaire@incidence.be

It is important to note that, in principle, the external company processes only anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.

You also may contact the Data Protection Officer of the EO office at the following address: DPO-Euro-Ombudsman@ombudsman.europa.eu

You may lodge a complaint with the European Data Protection Supervisor at any time at the following address: EDPS@edps.europa.eu

 

[1] Article 1e (2) and (3) “2. Officials in active employment shall be accorded working conditions complying with appropriate health and safety standards at least equivalent to the minimum requirements applicable under measures adopted in these areas pursuant to the Treaties. 3. Measures of a social nature adopted in accordance with this Article shall be implemented by each institution in close co-operation with the Staff Committee, on the basis of multi-annual proposed actions. These proposed actions shall be transmitted each year to the budgetary authority in the framework of the budget procedure”.

[2] See Article 21.2.13 of the General Conditions of the contract : https://www.ombudsman.europa.eu/en/office/publicprocurements/generalconditions/en