*Update 08.10.2025: the information below was correct at the time of publication. Subsequent (unpublished) changes might have made some parts obsolete: when we receive communication detailing the changes we’ll update this article.*
As explained in our event “Who owns your mobile phone? [1]”, the Commission is not just setting a questionable example of unsuccessfully respecting staff privacy, it is doubling down on that choice and working on granting itself formal permission to commandeer your mobile phone. The Commission is in the process of drafting a formal decision.The aim of this decision is to make its access to your private mobile phone (and by extension its access to you and your time) for work purposes compulsory, regardless of whether that access falls outside of your working time or even within the often-disregarded disconnection period (19.00-08.00) set out in the working time and hybrid working decision (WTHW [2], Article 5(6)) [*].
For context, in December 2023 the Commission insisted staff provide their private mobile phone numbers [3] for the purpose of creating work Signal messenger groups where they could be contacted for work purposes. The stated goal was to test business continuity, but it lacked any legal basis or even a basic compliance with data-protection [4] (GDPR) principles (as confirmed later [3] by the Commission Data Protection Officer (DPO)) and meant everyone’s mobile number was visible to everyone else within that Signal group, with no clear means to opt-out of this unwanted sharing of personal data.
Disregarding DPO feedback
Post-DPO clarification, instead of taking corrective measures, such as informing managers that these already-existing Signal groups were not compliant with GDPR or reminding staff that participation in such groups remains voluntary [5][**] and asking staff for written consent for continued participation in a given Signal group, HR prepared a draft decision to grant themselves permission to continue as before. The first draft contained controversial elements such as obliging every staff member to provide a private telephone number for the purposes of contact for work-related needs at any time. That phone number would apparently also be available for emergencies and business continuity needs (without specifying what constitutes an emergency or business continuity need…do you see how easily this begins to slide?).
That first draft was unanimously rejected by Generation 2004 and all the other staff representatives in November 2024.
Months without news from HR and then in July 2025, coinciding with the start of the summer break, HR contacts staff representatives with a new draft allowing only 5 days to provide feedback.
The staff representation is not different form other services when making decisions. We have our own internal consultations, we need to coordinate with partners, find agreements for a common text, etc. Of course, each trade union or staff association (OSP) can provide their own answer, but a common message sounds always stronger, and drafting this common message takes time. Asking for feedback in July without notice and with such a short deadline shows more interest in complying with the letter but not the spirit of the rules: the focus is there on ticking a box to say staff representatives were consulted rather than in genuinely working together to find consensus.
Disregarding staff-representative feedback
This July draft decision had no improvements on the first, rejected, draft. It ignored basically all the constructive feedback and remarks from Generation 2004 and other staff representatives. Our latest common reply stated therefore these concerns:
– The draft decision obliges staff to provide their private mobile phone number for emergencies or other needs. While some of these contacts could make sense, staff should be able to choose less intrusive alternative electronic means, such as email.
– Contacting staff on their private mobile phones during their disconnection time for work purposes appears to now become legitimate. However, this is a period when all contact should be severely limited.
– There are no limitations to avoid possible abuse: personal data is retained until the staff leave the institution; and the definitions of exceptional use and emergencies are wide.
– Staff lose control over the use of their personal data. There are no provisions for staff to check who has access to their private phone numbers nor why or when. Access to this data is widely open, including even to loosely defined persons “indirectly working for the Commission”.
– The draft also ignores largely the concerns and recommendations of the European Data Protection Supervisor (EDPS) as articulated in the Supervisory Opinion on the Draft Commission Decision on the Means of Urgent Internal Communication (Case 2024-0775 [6]) of 6 November 2024 and summarised below.
‘The draft decision proposes that the European Commission may contact staff on security and safety matters, business continuity, and work-related emergencies. While recognising the necessity of ensuring effective communication, we evaluated the data protection implications of using private mobile numbers.
Three key recommendations were issued to ensure compliance with data protection principles:
- we emphasised the need to clarify the definition of “emergency”, to help ensure that contacting staff on their private mobile numbers is justified and respects their right to disconnect;
- we suggested limiting communications to corporate devices to help reduce privacy risks while maintaining efficient internal communication. This would prevent the need to process private phone numbers unnecessarily;
- we stressed that once an employee leaves the service, their private phone number should be deleted to avoid unnecessary data retention. This aligns with the data minimisation principles under EU data protection law. This Opinion highlights the importance of balancing operational needs with employees’ privacy rights.
By following these recommendations, the European Commission can ensure that staff communications remain efficient, proportionate, and privacy conscious.’ (p.18, EDPS, 2024 Annual Report, 2025 [7])
Schrödinger’s disconnection period?
Generation 2004 expects more from the Commission in its role as Guardian of the Treaties [8]. A real and meaningful dialogue is necessary, balancing the needs of the institution, particularly the duty of care in case of emergencies; but taking also into account staff privacy and the scope for this to slide into round-the-clock availability and the already-well-recognised digital overload [9]. Many DGs already count on a ‘voluntary’ standby [10] service.
The situation in the Delegations [11] in more than 140 sites around the world, is that staff are expected to regularly use their private phone for work needs [12], showing just how far can things go once the slide starts [13].
If this current dialogue continues to discount our observations and warnings, Generation 2004 is ready to take the matter to the to the European Data Protection Superviser (EDPS [14]).
‘One of [the EDPS] core tasks is to supervise the way all EU institutions, bodies, offices and agencies (EUIs) process individuals’ personal data, to ensure their compliance with the applicable data protection law, in particular Regulation (EU) 2018/1725 [15], also known as the EUDPR.’ (EDPS, 2024 Annual Report, 2025 [7])
Look at just how much time colleagues already donate [16] (voluntarily or otherwise) to the Commission and yet it’s still not enough, it’s never enough: there is always more work to be done. Please don’t give your valuable time away for free: there are no rewards and it will become expected of you!
The Commission cannot simultaneously lament increasing cases of burnout and sickness [17] while expecting colleagues to be available whenever called [3] (even during holiday periods! [5]). It is inconsistent for employers anywhere to talk about a disconnection period/digital detox [18] and work-life balance [19] on the one hand and then to insist on staff belonging to work groups on private devices [20] on the other. You have no obligation to join these groups [21]!
As always, we would love to hear from you. Please do not hesitate to contact us [22] on this topic.
—————————————————————————-
[*] The first point of Article 55 of the staff regulations [23] is often quoted in this context, but we find that giving only that part is misleading: it’s all about context. The limitations listed in points 2 and 3 and in Article 56 are very important.
Article 55
- Officials in active employment shall at all times be at the disposal of their institution.
- The normal working week shall range from 40 to 42 hours, the hours of the working day to be determined by the appointing authority. Within the same limits the appointing authority may, after consulting the Staff Committee, determine the hours to be worked by certain groups of officials engaged on particular duties.
- An official may, moreover, be required because of exigencies of the service or safety rules to remain on standby duty at his place of work or at home outside normal working hours. The appointing authority of each institution shall lay down detailed rules for the application of this paragraph after consulting the Staff Committee.
Article 56
An official may not be required to work overtime except in cases of urgency or exceptional pressure of work; night work, and all work on Sundays or public holidays, may be authorised only in accordance with the procedure laid down by the appointing authority. The total overtime which an official may be asked to work shall not exceed 150 hours in any six months. Overtime worked by officials in function group AD, and in function group AST 5 to 11 shall carry no right to compensation or remuneration.As provided in Annex VI, overtime worked by officials in grades SC 1 to SC 6 and grades AST 1 to AST 4 shall entitle them either to compensatory leave or to remuneration where requirements of the service do not allow compensatory leave during two months following that in which the overtime was worked.
[**] ‘Voluntary’ does not mean what you think it means in the Commission. We’ve previously questioned to what extent working from home [24] or being a member of work signal groups [21] is truly voluntary.
On the voluntariness of informal standby, the 2019 Central Staff Committee [25] note 18/12/2019 (2019)7798989 [26] states ‘The [DGT standby] scheme is ‘voluntary’ in that it is stated that staff are not obliged to be on standby. In practice staff report that they feel obliged to ‘volunteer’ in order to share the burden with colleagues.’ At the DGT staff meeting Luxembourg 09.03.2023 the acting DG stated that the only element of DGT standby duty which is voluntary is that the translator has some flexibility in the choice of week. So, a standby system which is neither truly voluntary nor formally organised, what about Articles 55 and 56 of the staff regulations?