Introduction

Data protection is a fundamental right, protected not only by national legislation, but also by European Union law. At FRA, we are responsible for the personal data that we collect and process.

The processing of an individual’s personal data carried out by the European Agency for Fundamental Rights (FRA) is performed in compliance with Regulation 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC.

What types of personal data do we collect?

The personal data that the Agency collects and processes relates to you as a natural person. The personal data collected can be classified into two types.

Mandatory personal data: This refers to the personal data necessary for the performance of the tasks carried out in the public interest that were conferred on the Agency or for compliance with a legal obligation to which the Agency is subject to. Some examples include your name, address, your CV when applying for a job or traineeship at the Agency, or when submitting a tender linked to a published procurement procedure.

Non-mandatory personal data: This refers to personal data processed based on consent only. Examples include your dietary and mobility requirements when attending an event organised by the Agency, your phone number, fax number or email address when you choose to make them publicly available. Additionally, your information might be processed when you choose to participate in the surveys undertaken by the Agency.

Access to these data will be restricted to authorised staff of the Agency, and we will request your consent to make them available to the general public.

Purpose of the processing

Whenever personal data is processed, it is essential that the data subject (the person whose personal data are collected, held or processed) knows for which purposes the data is being collected. According to Article 4 Paragraph a) of the Regulation, personal data "must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes."

Moreover, personal data must be adequate, relevant, and not excessive in relation to the purpose and kept for no longer than is necessary for the purposes for which they were collected.

In this regard, the Agency informs you through a privacy notice linked to the specific processing operation. A number of those privacy notices are listed below.

What are the legal bases on which the Agency processes your personal data?

Primarily, we collect and process your personal data on the basis of Article 5.1(a), (b) and (d) of the EU Data Protection Regulation 2018/1725:

• To perform a task carried out in the public interest or in the exercise of official authority vested in the Agency (for example its Founding Regulation or the EU Staff Regulations)
• To comply with a legal obligation to which the Agency is subject
• Where the processing is based on consent.

In very specific circumstances, a different or additional legal basis mentioned in Article 5 of Regulation 2018/1725 may apply.

The processing of personal data by the Agency is governed not only by Regulation 2018/1725, but also by specific legal instruments, such as implementing rules and internal rules.

Information on the legal basis is provided to you in a privacy notice.

Who has access to your personal data?

The general public has access to data in relation to information that is considered to be of public interest. Indeed, the Agency has a legal obligation to make such data public. Such examples can include the names of its Management Board members.

Access to your personal data is limited to the Agency’s staff. The Agency will not make personal data available to the public, unless the party concerned has given his or her express statement of consent. The consequence being that certain personal data provided by you as an applicant or as representative of an organisation, for which publication is not a legal obligation (e.g. phone, fax number or email address), may only be accessible to the public if consent is given and provided that the Agency’s IT systems can support it.

How long do we keep your data?

For each processing operation there is a defined retention period that specifies the period for which the personal data is kept. Depending on the processing operation the retention period can vary. For example, in the case of surveys the retention period might be a few months where in the case of financial transactions it can be up to 10 years. The exact retention period is specified in the privacy notice of the processing operation.

What measures do we have to protect and safeguard your information?

The Agency takes the protection of your personal data very seriously, and therefore applies adequate organisational, technical and security measures to protect it. Some examples of these measures are:

• A username and password are required in order to access FRA’s IT systems;
• Authentication and authorisation for the IT systems are based on roles and anonymous access at server level is not permitted;
• The Agency’s datacenter is physically protected;
• Network security is configured to prevent external threats from accessing the Agency’s infrastructure;
• Confidentiality and data protection clauses are signed by service providers to ensure compliance with security rules and the data protection regulation.

What are your rights to manage your personal data?

As a data subject you have the right to access, rectify and, where processed on the basis of your consent, transfer your data to another controller at any time. You may also request the erasure of your data under certain conditions. Moreover, you also have the right to object to and restrict certain processing of your data.

We will review your requests and grant your rights provided that certain conditions are met. Please note that in some cases restrictions may apply under Article 25 of Regulation (EU) 2018/1725 and MB decision 2021/08 on internal rules concerning restrictions of certain rights of data subjects in relation to processing of personal data in the framework of the functioning of the European Union Agency for Fundamental Rights.

You also have the right to recourse to the European Data Protection Supervisor.

For more information please read the specific privacy notice that specifies in detail your data protection rights and how to exercise them.

How to contact us?

You can contact us for any aspect regarding your personal data, by sending a written request to the FRA as the data controller responsible for your information, or to the FRA Data Protection Officer as follows:

By post:
Luisa Lopez,
Data Protection Officer,
FRA,
Schwarzenbergplatz 11,
AT-1040 Vienna,
Austria.

By email:
dpo@fra.europa.eu

If you feel your request was not responded adequately by the data controller and/or the DPO, you can lodge a complaint with the European Data Protection Supervisor.

Privacy notices

All privacy notices can be found in the Register of documents page.

Records registry

All EU institutions have the legal obligation to keep a central register of records of activities processing personal data (Article 31 of Regulation 2018/1725).

The register shall contain at least the following information (Article 31(1) of the Regulation):

• name and contact details of the controller, the data protection officer and, where applicable, the processor and the joint controller;
• the purposes of the processing description of the categories of data subjects and of the categories of personal data;
• the categories of recipients to whom the personal data have been or will be disclosed;
• where applicable, transfers of personal data to a third country or an international organisation and the documentation of suitable safeguards;
• where possible, the envisaged time limits for erasure of the different categories of data;
• where possible, a general description of the technical and organisational security measures to protect those personal data. 

The list of records of FRA activities processing personal data can be found on the Register of documents page.