Data Protection Register and Privacy Notices

Data Protection Register and Privacy Notices

• The EU-RAIL, as a controller, shall maintain a record of processing activities under its responsibility in a central register. In addition, for reasons of transparency, EU-RAIL shall make the register publicly accessible (article 31(5) of Regulation (EU) 2018/1725). The EU-RAIL central register has been considered by the European Data Protection Supervisor (EDPS) “fully compliant”  in terms of availability, coverage and format. More information is available on the EDPS report on remote inspection of publicly accessible registers under Article 31(5) of the Regulation.  The central register have also passed the ENISA “risk assessment and security” compliance test under the on-line tool for the security of personal data processing (https://www.enisa.europa.eu/risk-level-tool/). After the evaluation the level of risk is considered “Low”.
• The EU-RAIL shall take appropriate measures to provide transparent information, communication and modalities for the exercise of the rights of the data subject (articles 14 to 16 of Regulation (EU) 2018/1725) 

You can find a collection of privacy notices for each specific processing operation listed below:

• Selection and recruitment of temporary agents (TA), contract agents (CA), seconded national experts (SNE) (recruited candidates)
• Selection and recruitment of temporary agents (TA), contract agents (CA), seconded national experts (SNE) (non-recruited candidates)
• Selection and recruitment of temporary agents (TA), contract agents (CA), seconded national experts (SNE) (spontaneous applications)
• Selection and recruitment of interims
• Management of procurement procedures and grant applications (successful)
• Management of procurement procedures and grant applications (unsuccessful)
• Selection and management of external experts (selected experts)
• Selection and management of external experts (Non-selected experts)
• Event registration and organisation
• E-newsletter subscription and related information
• EU Survey Tool for event registration
• Video Surveillance system
• Experts involved in the European DAC Delivery Programme
• Microsoft 365 – Guest Users
• Access to documents
• Management of SR2 JU Governance’s bodies and meetings
• Prevention and management of conflicts of interests applicable to the bodies of EU-RAIL JU

EU-RAIL internal rules concerning restrictions of certain rights of data subjects

In accordance with Article 25(1) of Regulation (EU) 2018/1725 in matters relating to the operations of EU-RAIL, restrictions of data subject rights may be provided for by internal rules adopted at the highest level of management of the EU-RAIL, i.e. the  Governing Board. Once adopted they have to be published in the Official Journal of the European Union as well as in the internet website of the institution. The Governing Board adopted on 26 March 2020 the Decision n° 01/2020  laying down internal rules concerning restrictions of certain rights of data subjects in relation to processing of personal data in the framework of the functioning of the EU-RAIL, which has been published in the EU Official Journal on 22 July 2020. The  internal rules will enter into force on the twentieth day following its publication.