1. PRIVACY STATEMENT ON PERSONAL DATA IN RELATION TO SELECTION AND RECRUITMENT

Important note on the use of Reserve Lists: ENISA has signed a Memorandum of Understanding for the sharing of reserve lists of suitable candidates among EU. Successful candidates may be placed in a reserve list but only after their written consent. For that case a separate Privacy Notice applies.

CATEGORIES OF: TEMPORARY AGENTS, CONTRACT AGENTS, SECONDED NATIONAL EXPERTS AND TRAINEES AT ENISA

Your personal data shall be processed in accordance with Regulation (EU) No 2018/1725 of the European Parliament and of the Council (OJ L 295, 21.11.2018, p. 39–98) on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.

The data controller of the processing operation is the European Union Agency for Cybersecurity (ENISA), ENISA, Corporate Support Services Unit (HR), recruitment@enisa.europa.eu

The legal basis for the processing operation is Article 5(1) (a) of Regulation (EU) 2018/1725 on the basis of the Staff Regulations of Officials (SR) and the Conditions of Employment of Other Servants of the European Communities (CEOS), in particular Articles 27-34 (SR), 12-15 and 82-84 (CEOS) thereof.

In addition, ENISA has adopted the following relevant Decisions: 

• MB Decision 2016/12 on the general implementing provisions on the procedure governing the engagement and use of the temporary agents under Article 2(f) of the CEOS thereof;
• MB Decision 2019/14 adopting Implementing rules on the general provisions for implementing Article 79(2) of the Conditions of Employment of Other Servants of the European Union, governing the conditions of employment of contract staff employed under the terms of Article 3a thereof
• MB Decision 2013/15 laying down rules on the secondment of national experts (SNE); ED Decision 92/2018 on the rules governing the traineeship programme at ENISA.

The data processor of the processing operation is Adequasys (https://adequasys.com/) providing the Adequasys HRMS recruitment platform under specific service contract with ENISA. A specific Data Processing Agreement forms part of the service contract. All personal data processing takes place within EU.

The purpose of this processing operation is to administer staff selection procedures, to manage applications of candidates at different stages, and to facilitate the recruitment of different categories of staff (e.g., temporary agents, contract agents, seconded national experts and trainees), in view of filling vacant posts and establishing reserve lists for potential future recruitments. For this scope, the applicants’ personal data will be processed to facilitate the management of the recruitment process and any subsequent legal challenge to that process.

The following personal data are being processed:

• Identification details – information provided by the applicants to allow themselves to be identified and contacted by ENISA (e. g. name, surname, email address, phone number etc.);
• Eligibility and selection criteria information – information provided by the applicants to allow verification of their fulfilment of the criteria laid down in the vacancy notice (e.g., nationality, knowledge of languages, information on educational and professional experience, information relevant to military service and criminal records);
• Information related to interviews conducted at ENISA’s premises or remotely via ENISA's videoconferencing platform (further information on the processing of personal data via ENISA’s videoconferencing platform will be provided in the case of interviews or written tests conducted remotely), written tests, tests conducted in assessment centre. Candidates may also undertake online psychometric tests (further information on the processing of personal data in the context of online psychometric tests shall be provided to candidates in such cases);
• Evaluation of candidates undertaken by the appointed selection board(s) in different stages of the selection process (e.g., applications, pre-selection screening, interviews, tests, etc.).
• Information related to pre-medical visits for recruited candidates (e.g., fit to work medical certificate);
• Information related to support claims for the reimbursement of travel costs for interview or medical visits.

Access to your data will be granted only to delegated ENISA staff involved in different stages of the selection process; members of appointed selection board(s); delegated ENISA contractor involved in different stages of the selection process (data processor). The data may also be available to EU bodies charged with monitoring or inspection tasks in application of EU law (e.g., internal audits, European Anti-fraud Office – OLAF).

Personal data will be kept up to a maximum period of:

• In relation to recruited applicants (Temporary Agents, Contract Agents and SNEs) whose data is stored in their personal file as per Article 26 of the Staff Regulations, the data is retained in ENISA for a period of up to 10 years after the termination of employment or the last pension payment.
• In relation to non-recruited personnel (Temporary Agents, Contract Agents and SNEs), the data is retained for a period of maximum of 2 years following the completion of the recruitment process.
• In relation to applicants placed on the reserve list and not recruited (Temporary Agents, Contract Agents and SNEs), the retention period for data relating to the "reserve lists for appointment" is to be determined in terms of the validity and the actual extension of the respective reserve lists.
• In relation to trainees completing a traineeship programme at ENISA, the data will be retained for no longer than five years following the completion of the traineeship program. Once the above 5 years period is completed, only the data necessary for providing a copy of the trainee certificate e.g. information on the duration of the traineeship, the department to which the trainee was assigned, the name of supervisor and the nature of work performed will be stored.
• In relation to non-recruited trainees, the data is kept for one year from the closure of the call.

You have the right to of access to your personal data and to relevant information concerning how we use it. You have the right to rectify your personal data. Under certain conditions, you have the right to ask that we delete your personal data or restrict its use. You have the right to object to our processing of your personal data, on grounds relatinating Ageg to your particular situation, at any time. We will consider your request, take a decision and communicate it to you. If you have any queries concerning the processing of your personal data, you may address them to ENISA at recruitment@enisa.europa.eu.

You may also contact at any time the ENISA DPO at dataprotection@enisa.europa.eu.

You shall have right of recourse at any time to the European Data Protection Supervisor at https://edps.europa.eu.

 

2. PRIVACY STATEMENT FOR THE PROCESSING OF PERSONAL DATA WHEN SHARING RESERVE LISTS

Introduction

The EU Agencies and Joint Undertakings (‘participating Agencies’) that signed the Memorandum of Understanding (‘MoU’) for the sharing of reserve lists of suitable candidates among EU Agencies and Joint Undertakings, acting as Joint Controllers, are committed to protect and respect the personal data processed in this context. The Joint Controllers collect and process personal data pursuant to Regulation (EU) 2018/1725[1].

One of the data subject rights under this Regulation is that the data subject is informed when their personal data - also known as personal information - is processed (collected, used, stored, etc.) by any of the EU institutions, bodies or agencies. Data subjects also have the right to know the details and purpose of that processing.

Within this privacy statement, the data subjects will find information about the processing of personal data in the context of ‘sharing reserve lists’ among the EU Agencies and Joint Undertakings acting jointly as Joint Controllers[2].

The Joint Controllers have signed the above-mentioned MoU which includes specific data protection clauses, the practical arrangement among the Joint Controllers and a joint controllership agreement. 

This processing operation relates to Record No 93 – Sharing of reserve lists of suitable candidates among EU Agencies and Joint Undertakings, available under ENISA’s register of data processing activities.

Whose personal data is processed by the participating Agencies?

This Data Protection Notice concerns the following category of data subjects: candidates that apply to a post (temporary or contract agent) published by any of the EU Agencies or Joint Undertakings that have signed the MoU on sharing reserve lists, where the vacancy notice includes the relevant provisions.

Who is the Data Controller?

Participating Agencies that signed the MoU on sharing reserve lists among the EU agencies and Joint Undertakings and are listed in the vacancy notice for which the data subject has applied.

Why do we process the data from the data subjects (candidates)?

Participating EU Agencies and Joint Undertakings signed the MoU for the sharing of reserve lists of suitable candidates among EU Agencies and Joint Undertakings to:

• Facilitate recruitment by leveraging reserve lists established by the Agencies,
• Promote efficiency by reducing the overall timelines of recruitment and selection procedures and associated costs,
• Ensure access for the Agencies to a broader pool of candidates from diverse geographic locations,
• Foster cooperation among the Agencies, maximizing synergies and avoiding duplication of effort for common transversal job profiles,
• Increase the attractiveness of Agencies as employers of choice, potentially increasing the number of candidates applying for posts published by the Agencies.

According to the MoU, the leading Agency is the EU Agency or Joint Undertaking which has organised the selection procedure and is ready to share its established reserve list; a receiving Agency is the EU Agency or Joint Undertaking which is interested in using the shared reserve list to meet its recruitment needs, and is listed in the relevant vacancy notice as ‘participating Agency’.

The scope of this Data Protection Notice covers processing of personal data collected by the leading agency within the context of its selection procedure for candidates included in the reserved list of suitable candidates, which, upon consent of those candidates, may be shared with a receiving Agency.

The processing of such data includes sharing of the data of the candidates on the reserve list with the receiving Agency/Agencies interested in using the shared reserve list to meet their recruitment needs, and the related processing operations undertaken by the Joint Controllers for the purpose of managing the personal data of the candidates in the shared reserve list.

This Data Protection Notice covers the following processing activities:

• Receiving consent from the candidates on the reserve list of suitable candidates: after a receiving Agency expresses interest in using a reserve list, the leading Agency will seek explicit consent of candidates on the list i.e., that they agree to their personal information being shared with the specific receiving Agency.
• Sharing of data: sharing the data of candidates on the reserve list who have given their consent with the receiving Agency (the leading agency can share the reserve list with several receiving Agencies at the same time, provided the candidates provide explicit and specific consent).
• Updating the reserve list: keeping the reserve list updated based on the information for candidates accepting a job offer and being recruited either by the leading or a receiving Agency.

The jointly processed personal data shall not be used for any automated decision-making, including profiling. 

This processing operation relates to Record No 93 – Sharing of reserve lists of suitable candidates among EU Agencies and Joint Undertakings available under ENISA’s register of data processing activities. 

What is the legal basis of the processing personal data?

Regulation No 31 (EEC), 11 (EAEC), laying down the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Economic Community and the European Atomic Energy Community. 

Grounds for lawfulness

The processing is lawful based on Article 5(d) of Regulation (EU) 2018/1725. The leading Agency establishes the reserve list of candidates whose personal data will be shared with the receiving Agency after receiving consent of candidates on the reserve list. A Joint Controllership Agreement has been signed by the participating Agencies in line with Article 28 of Regulation (EU) 2018/1725.

What data is collected and processed?

The following categories of data subjects’ personal data are collected by the leading Agency within its selection procedure and may be shared with the receiving Agency, upon consent of candidates on the reserve list:

• Contact and identification details (Name, First Name, Address, Email address, telephone);
• Application form containing all information provided by the candidate regarding eligibility and selection criteria applicable to the selection procedure; and/or
• Curriculum vitae, if applicable.

How long is personal data kept? 

1. The leading Agency shall store the shared reserve list and process the personal data contained therein for a period of two years. The leading Agency must be informed of candidates having accepted a job offer and being recruited by the receiving Agency; it should promptly remove them from the reserve list.
2. The receiving Agency shall process the personal data from the shared reserve list until the completion of its selection procedure including the communication to the leading Agency on candidates accepting a job offer/recruited to ensure their prompt removal from the reserve list by the leading Agency.

How do we protect and safeguard personal data in the shared reserve list?

Personal data from the candidates in the shared reserve list is stored by the leading and receiving Agencies in accordance with their respective provisions indicated in their relevant Data Protection Notices.

Personal data of candidates in the shared reserve list are shared between the leading and a receiving Agencies by way of a secure solution of their choice, complying with the data protection principles. 

Who has access to your personal data and to whom is it disclosed? 

Any EU agency or Joint Undertaking that signed the MoU for sharing reserve list, when acting as a leading Agency.

Any EU Agency or Joint Undertaking when acting as receiving Agency, provided they were listed in the relevant vacancy notice, and that suitable candidates on the reserve list have given explicit and specific consent for their personal data to be shared with the specific receiving Agency.

By default, authorised staff from EU agencies and Joint Undertakings, acting either as the lead or receiving agency, may access the personal data of a data subject, in line with the principles of necessity and data minimisation.

In addition, data may be disclosed to:

• Upon request and for the purposes of legal proceedings: Access to your personal data is provided to authorised staff of the EU Courts (e.g., the General Court and the Court of Justice) or national Courts, as well as, the lawyers of the parties;
• The competent Appointing Authority of the leading or receiving Agency, in case of a request or a complaint lodged under Article 90 of the Staff Regulations;
• OLAF, in case of an investigation conducted in application of Regulation (EU, Euratom) No 883/2013;
• The Internal Audit Service of the Commission within the scope of the tasks entrusted to it by article 118 of the Financial Regulation and by Article 49 of Regulation (EC) No 1653/2004;
• The Court of Auditors within the tasks entrusted to it by Article 287 of the Treaty on the Functioning of the European Union and Article 20, paragraph 5 of Regulation (EC) No 58/2003;
• The European Ombudsman within the scope of the tasks entrusted to it by Article 228 of the Treaty on the Functioning of the European Union;
• The European Data Protection supervisor in accordance with Article 58 of the Regulation (EU) 2018/1725.

Third parties

Information concerning the selection procedure may be disclosed to external lawyers subject to the GDPR and or EUDPR, for specific and limited purposes only. In this case a written contract (service contract) is signed between the leading or receiving Agency and the external lawyer in order to ensure that that Article 29 of the Regulation (EU) 2018/1725 is respected by the external data processor. These written contracts include a specific article on data protection.

What are the rights of the data subject? 

Data subjects have the right to access their personal data, the right to rectify them, if necessary, and/or to restrict its processing or erase them, if applicable. Data subjects are also entitled to object to the processing of their personal data, where relevant.

If a data subject would like to exercise his/her rights under the Regulation, if he/she has comments, questions or concerns, regarding the collection and use of their personal data, they may contact the any of the Joint Controllers.

Data subjects can withdraw their consent given to the leading Agency for sharing their personal data with other EU agencies/Joint Undertaking (receiving Agencies) at any time. This can be done by sending an email to the leading Agency that established the reserve list of suitable candidates.

Please note that access to data subject personal data and its modification or deletion may be restricted by the Joint Controllers that have adopted Internal Rules restricting data subjects’ rights as provided for by Article 25 of the Regulation. This is in order to safeguard the rights of other data subjects and/or to respect the principles of equal treatment among applicants and/or the secrecy of deliberations of the Selection Board. In that context, these rights may be restricted by the relevant Joint Controller on a case-by-case basis in line with the relevant Internal Rules, where necessary and appropriate for the purposes. This restriction shall be proportionate to what is strictly necessary for the purpose of the processing. In order to lift this restriction, the relevant Joint Controller will carry out a case-by-case assessment of each individual request and give the reasons underlying its decision. The restrictions will continue applying as long as the reasons justifying them remain applicable and may be lifted if these reasons would no longer apply.

CONTACT INFORMATION

The Joint Controller

Should data subjects have comments or questions, any concerns or a complaint regarding the collection and use of their personal data, or if they would like to exercise their rights as data subject, they can contact any of the Joint Controllers, i.e., either of the leading or the receiving Agency.

If you have any queries concerning the processing of your personal data where ENISA is the Joint Controller, you may address them at recruitment@enisa.europa.eu.

You may also contact at any time the ENISA DPO at dataprotection@enisa.europa.eu.

The European Data Protection Supervisor (EDPS)

Data subjects have the right to have recourse (i.e., can lodge a complaint) to the European Data Protection Supervisor (edps@edps.europa.eu) if they consider that their rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of their personal data by any of the Data Controllers.