Oops … the Commission did it again! Illegal request on private phones

Data Protection, Health, New HR strategy, Newsletter – 2024-04-29, Staff Regulations Reform, Teleworking, Working conditions Print This Post

It’s not even a month since the European Data Protection Supervisor (EDPS) ordered the Commission to suspend illegal personal data flows and we see another such order coming.

Last December, the Commission launched a ‘business continuity’ exercise asking most colleagues (if not all, it was never clear) to provide their private mobile phone numbers to create Signal private messenger groups where they could be contacted for work matters.

This action was never discussed with staff representatives and lacked any legal preparation, not even a basic consultation with the Commission Data Protection Officer (DPO). What was expected of those who responded and what of staff who are not working: for any reason? Imaging receiving a missed call from work when you are off sick: was this thought through?

Generation 2004 warned in an exceptional flash message to staff that this request was not justified and was probably breaching privacy rights stated in the General Data Protection Regulation (GDPR).

The Central Staff Committee (CSC) wrote a note to HR and the DPO to ask for clarifications and suggesting removing all groups created illegally.

The DPO just confirmed on 12/04/2024 in a carefully drafted note trying to avoid the shame to HR that there was no legal basis for such a request.

This is just the confirmation of another breach of data protection rights of staff by the European Commission. While data protection is important for every organization, it is certainly particularly shameful that the Guardian of the Treaties is not leading by example.

Generation 2004 requests that HR:

  • Provide clear guidance to all Commission services to ensure that this situation does not happen again.
  • Instruct that all colleagues be removed from all Signal groups created under the business continuity action or any other, unless there is a clear written agreement by the colleagues mentioning their rights of access, rectification, erasure, portability, etc. in strict respect of GDPR.

As always, we would love to hear from you. Please do not hesitate to get in touch with us or leave a comment below.

If you appreciate our work, please consider becoming a member of Generation 2004.