Updated on 13.11.2024.

Roles covered by the generic Privacy Notices:

• DAO, DPO, DTO, GAO, SL and GL: PN01519.
• Departmental Space Manager (DSM): PN01489.

Action covered by the generic Privacy Notices:

• Surveys: PN01522.

Sub-group “Communication”: 

• Cf the Data Privacy leaflet (French and English and PDF attached) originally prepared for Contractors but can be also used as an introduction for Data Privacy.

• Cf the videos "Privacy in a nutshell":

  • 1st video: “What is privacy about?”;

    2nd video: “Controlling and Processing Services”;

    3rd video: "Data subjects".

• Posters published on CDS and displayed next to the printers: Data Privacy - Secure printing and Data Privacy - Use a shredder.

Sub-group “OC11 impact on the IT applications used at CERN”: 

The main objective of this sub-group is to provide the CERN main IT stakeholders (IT, FAP-BC and SCE) with practical requirements for functionalities supporting OC11 compliance of the concerned services. A survey have been launched in the end of 2023. The replies to the survey were analysed over the summer by the members of the sub-group. The edition of the final report is currently in work and they expect a first draft by the next DPCC meeting.

Sub-group “Privacy by design”: 

The sub-group worked on a training structured in 2 modules, with Module 1 targeting anyone at CERN who processes personal data (mainly acting as data controllers) and Module 2 targeting colleagues who develop software tools/IT processes (mainly acting as data processors). Trainings are available via the CERN Learning Hub:

• Data Privacy by Design and by Default - Module 1;
• Data Privacy by Design and by Default - Module 2.

Sub-group “Retention periods”: 

The procedure “Data retention guidelines” is available in the Admin e-guide with an Excel list with recommended retention periods.

Sub-group “Surveys”: 

• You will find a list of IT tools to be used for the creation of surveys.
• "Guide to creating a survey" on the website of the ODP.

You can use the generic Survey privacy notice for your survey carried out with Microsoft Forms or with other standard tools provided by CERN, provided that the target audience of your survey is CERN internal.
Included are the identification of the target audience using standard filter criteria, the contact via e-mail and the collection of the replies to the survey incl. the login to the tool.

In case the generic privacy notice is not suitable and you don’t have RoPO, you must create a new one covering the invitation, if applicable, and the replies collected through the survey.

In practice, the Controlling Service decides what data is to be collected, what will be done with it and why (purpose, legal basis, retention period, transfer etc.). The Processing Service executes the processing operation requested by the Controlling Service and does not take initiative regarding establishing or changing the purposes or means of the processing operation.