Data Protection

• Year: 2015

39

The OLAF report 2015

6. Data protection

The protection of personal data is key to a successful

investigation because it is a crucial element in safe-

guarding the rights of individuals involved at any step

of an investigation. Since OLAF was set up as an inde-

pendent body, it has appointed its own data protection

officer (DPO) who ensures that OLAF implements the

requirements of Regulation 45/2001 on the protection

of personal data, including recommendations of the

European Data Protection Super visor (EDPS). The deci-

sions and recommendations of the EDPS have a signif-

icant impact on how OLAF carries out its investigative

activities, such as on-the-spot checks or the forensic

examination of digital media.

More than 2300 relevant data subjects have been listed

in the numerous cases opened by OLAF between 2011-

2015. By year end of 2015, privac y statements had been

sent to 76% of them, and deferred in 5% of the cases be-

cause that was the appropriate and n ecessary measure

to safeguard the investigation.

In 2015, OLAF entered several new Administrative

Cooperation Arrangeme nts (ACAs) which cover trans-

fers of personal data with partners in non-EU countries

and international organisations. Data p rotection claus-

es, based on a model established in consultation with

the EDPS, were included in all of these ACAs. A total of

149 transfers of personal data were made during 2015 to

non-EU countries or international organisations.

During 2015, OLAF received a total of 8 requests from

data subjects for access to their personal data, which

also included one request for rectification. OLAF grant-

ed access in response to each request, but refused the

request for rectification, as the personal data con-

cerned were based on subjective personal assessments,

information or opinions provided by others, which by

definition cannot be factually wrong. Requests for rec-

tification of personal data only apply to objective and

factual data .

IDCP authorisation

In 2015, OLAF received the authorisation of

the European Data Protection Supervisor

(EDPS) for its Investigation Data Cross-

Checking Platform (IDCP). The IDCP is an

innovative system which aims to further

international cooperation in the fight

against fraud by creating a database to

support the exchange of investigative

information. The database will contain

a subset of data from investigative files

of OLAF and its selected international

partners. Taking full account of the

recommendations of the EDPS, the system

will automatically cross-reference newly

uploaded information with data already in

the system, looking for matches. Specific

procedural arrangements concerning the

functioning of the system will be signed by

all partners to the IDCP before they will be

allowed to use the system.