DPO-3445.3 DG ECHO - Procurement procedures, grant procedures, contract execution, grant implementation and calls for expressions of interest for the selection of experts
DG Humanitarian Aid and Civil Protection
1. Name of the processing
DG ECHO - Procurement procedures, grant procedures, contract execution, grant implementation and calls for expressions of interest for the selection of experts
- Procurement and grant procedures:
Management, coordination and organisation of calls for tenders or calls for proposals including in particular the reception of tenders and requests to participate (both referred to as "tenders") and proposals, their opening, evaluation, negotiation, ranking, copying, distributing, using, filing, archiving and destruction, the preparation of the opening report, the evaluation report, the award decision and the contract or grant agreement or grant decision, the correspondence with tenderers or candidates (both referred to as "tenderers") or applicants, the generation of mailing labels and the publication of the results of the relevant procedure in the Official Journal of the European Union and / or the Europa website. In all these procedures, personal data are processed within the duration of the particular procedure, or if applicable, up to provision of publicity of the results of that procedure.
In most cases, the tenderers or applicants must provide a declaration on their honour that they are not in a situation of exclusion as defined in Article 93 and 94 of the Financial Regulation.
Some tenderers or applicants can be legal entities of one person (translators, experts…) directly allowing the identification of the natural person. Therefore, some personal data contained in the above mentioned documents fall under article 27 of Regulation 45/2001.
See also the Vademecum on Public Procurement at: https://intracomm.ec.europa.eu/budg/imp/procurement/imp-080-020_procproced_en.html
and the practical guide on grants at:
The last two sections are described in the attached document:
- Contract execution and grant implementation.
- Calls for expression for interests for the selection of experts..
The EDPS (European Data Protection Supervisor) released his Opinion on 10 Apr 2010.
4. Automated / Manual operations
see point 7)
Personal data in paper format is stored in operational and financial units of the DG.
Personal data in electronic form is stored on servers of the Commission's computer centre, of either DG DIGIT or the DG, physically under the control of DG DIGIT or the DG.
The contractor or beneficiary acting as data processor is submitted to the obligations of data processing confidentiality and security provided for in articles 21 and 22.
This notification does not cover the procedures referred to in Point 6 if the data processing falls under the provisions of Article 10 of Regulation 45/2001.
[This notification is considered as the reference of the 'External Audit and Control' notification DPO-nnnn where relevant]
Purpose & legal basis
- Management and administration of the selection of experts or procurement or grant procedures by the Commission services, including in particular the provision of evidence of the technical and professional capacity of experts, tenderers, their staff and subcontractors.
- Purpose indicated in the relevant contract, grant agreement and grant decision, and carried out by the contractor or beneficiary acting as data processor.
8. Legal basis / Lawfulness
Council Regulation (EC, Euratom) N° 1605/2002 of 25 June 2002 on the Financial Regulation applicable to the general budget of the European Communities (OJ L 248, 16.9.2002, p.1) as amended by later Regulations and Corrigenda ("Financial Regulation"), in particular Article 179a for selection of experts, Title V for procurement and Title VI for grants.
Commission Regulation (EC, Euratom) N° 2342/2002 of 23 December 2002 laying down detailed rules for the implementation of Council Regulation (EC, Euratom) N°1605/2002 on the Financial Regulation applicable to the general budget of the European Communities (OJ L 357, 31.12.2002, p.1) as amended by later Regulations and Corrigenda ("Implementing Rules to the Financial Regulation"), in particular Article 265a for selection of experts, Title V for procurement and Title VI for grants.
For contract execution, the legal basis is the particular contract.
For grant implementation, the legal basis is the particular grant agreement or grant decision.
The data processing is considered lawful because it is necessary:
• For the performance of tasks carried out on the basis of the Financial Regulation and Implementing Rules;
• To ensure compliance of the Data Controller with the legal obligations stated in the Financial Regulation and the Implementing Rules, and
• To take steps prior to entering into a contract with the data subject as described in points (a), (b) and (c) of article 5 of Regulation 45/2001
There is no exemption or restriction under article 20 but data or operations require prior checking under article 27 of Regulation 45/2001.
Data subjects / fields
9. Data subjects
Persons willing to participate in the selection of experts or procurement or grant procedures of the Commission services:
• experts - natural persons,
• tenderers - natural persons,
• staff of tenderers, and/or
• subcontractors - natural persons.
Persons concerned in the relevant contract, grant agreement and grant decision.
10. Data fields
Personal data of tenderers, their staff or subcontractors which may include in particular:
• Contact details (e-mail address, business telephone number, mobile telephone number, fax number, postal address, company and department, country of residence, internet address);
• Certificates for social security contributions and taxes paid, extract from judicial records;
• Bank account reference (IBAN and BIC codes), VAT number, passport number, ID number;
• Information for the evaluation of selection criteria: expertise, technical skills and languages, educational background, professional experience including details on current and past employment
• A declaration on their honour that they are not in one of the exclusion situation referred to in article 93 and 94 of the Financial Regulation.
Since the information is often provided on CV, the tenderers, staff or subcontractors may supply additional information which is not necessary for the purpose of procurement (such as gender, age, nationality).
Data processing on implementation of contract or grant agreements and decision may require other types of data as specified in the relevant documents.
See point 17 above.
Rights of D.S.
Documents 1 + 2 + 3 are included in the model invitation to tender of the Commission for procurement procedures,
Documents 2 + 3 are included in any call for expression of interest,
Document 3 is included in any contract of the Commission,
Documents 2 + 4 + 5 are included in calls for proposals
Document 5 is included in the grant decisions and grant agreements
1. the adapted model of data protection clauses for Invitations to Tender
2. the adapted model of Privacy Statement (covering procurement and grant)
3. the adapted model of data protection clauses for Contracts
4. the adapted model of data protection clauses for model application forms for grants
5. the adapted model of data protection clauses for grant agreement and grant decisions
Documents 2 + 3 are available at the DPO site: http://ec.europa.eu/dataprotectionofficer/index.cfm?TargetURL=D%5FPriv%5Fstatements
12. Procedure to grant rights
See the "Contact" section of the Call for expression of interest or the Invitation to tender or the model application form for grants
Files relating to selection of experts including personal data are to be retained in the service in charge of the procedure until the end of the multi-annual programme for which it is submitted, and in the archives for a period of 5 years following the end of the programme.
Files relating to tender procedures including personal data are to be retained in the service in charge of the procedure until it is finalised (see section 10), and in the archives for a period of 10 years following the signature of the contract. However, tenders from unsuccessful tenderers have to be kept only for 5 years following the signature of the contract into question.
These files could be retained until the end of a possible audit if one started before the end of the above periods
After the periods mentioned above have elapsed, the files containing personal data are sampled to be sent to the historical archives of the Commission for further conservation. The non-sampled files are destroyed.
Files related to the implementation of grants and contracts are kept by the data processor (contractor or beneficiary) for up to 5 years after payment of the balance of the contract or grant.
14. Time limit
Legitimate requests are treated immediately.
However, data encoded as record of reception of the tender is kept as it was at the time of reception, as required by the Commission registration rules - (SEC(2003)349). The updated data - address or contacts - are used for correspondence and exchanges that follow.
15. Historical purposes
After the periods mentioned in point 22) above have elapsed, the files containing personal data are sampled to be sent to the historical archives of the Commission for further conservation and the non-sampled files are destroyed.
All recipients are on a "need to know" basis.
• Staff of operational and financial units of the DG participating in management of selection of experts or procurement procedures as defined in Section 7 and to the bodies charged with a monitoring or inspection task in application of Union law (e.g. internal control, internal audit);
• External experts and contractors participating in the evaluation of tenders when external expertise is required, on the basis of Article 179a FR;
• Staff of OLAF, IDOC, IAS (Internal Audit Services), IAC (Internal Audit Control) of the DG and the Legal Service of the Commission as well as staff of other DG (SG, DG BUDG and clearinghouse) upon request necessary in the context of official investigations or for audit purposes.
• Members of the public in accordance with the Commission's obligation to publish information on the outcome of the procurement procedure and on the beneficiaries of funds deriving from the budget of the European Union (Article 90 and Article 30(3) of the Financial Regulation, respectively). The information concerns in particular name and address, the amount awarded and the name of the project or programme. It will be published in supplement S of the Official Journal of the European Union and/or on the website of the Commission. Additionally, selected experts are listed in the Register of Expert Groups of the Commission.
• Staff of the contractor or beneficiary who need to have access to the data strictly for performance, management and monitoring of the contract or grant.
See point 20) above
Only transfers to third party countries not subject to Directive 95/46/EC (Article 9) should be considered for this question. Please treat transfers to other community institutions and bodies and to member states under question 20.
No transfer of personal data to third party countries.