Regulation (EU) 2018/1725 of the European Parliament and the Council of 23 October 2018 apply to the processing of personal data carried out by the European Parliament.
1) Who processes your personal data?
- The European Parliament is acting as the controller and the entity responsible for the processing is the Medical Service in Brussels.
- You can contact the controller at:
2) What is the purpose of the processing of your personal data?
To offer COVID-19 tests, performed on a voluntary basis, to all MEPs and EP Staff working in Brussels including close family-members, both for health monitoring and early detection and for screening and contact tracing purposes and international travelling. This service was extended to staff from external contractors working on EP premises in Brussels. Exceptionally, EP guests, who in principle do not have access to this service, may be granted access subject to prior approval. EESC Members, delegates, experts and personal assistants of EESC Members with a disability can also benefit from tests.
3) What is the legal basis for the processing?
- Article 1.(e) of the Staff Regulations of officials according to which “Officials in active employment shall be accorded working conditions complying with appropriate health and safety standards at least equivalent to the minimum requirements applicable under measures adopted in these areas pursuant to the Treaties“.
- Article 5.(1) (a) of Regulation (UE) 2018/1725, this “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Union institution or body”.
- Article 5.(1) (e) of Regulation (UE) 2018/1725, this “processing is necessary in order to protect the vital interests of the data subject or of another natural person”.
- Article 10.(2) (h) and (i) of Regulation (EU) 2018/1725
4) What personal data are processed?
In order to carry out this processing operation, the Medical Service collects the following categories of personal data:
- Name, surname, date of birth, gender, nationality of the person concerned, and contact details including phone number, email address, place of work and, if provided, Belgian National Register or BIS number (to enable contact tracing and obtaining valid test certificates (as EUDCC) or recovery certificates in case of positive test result) and/or ID card number, family relationship where relevant.
- The reason why you are doing the test (High risk contact, pre-travel and post-travel screening, screening). Absence or presence of symptoms.
- The DG, Unit or Service and place of employment.
When the test is taken for pre-travel purposes, the following additional data are requested and processed in order for the laboratory to be able to deliver the necessary official certificate:
- Passport number
- Country of travel destination and departure date
Subsequently, in the case management and contact tracing procedures, other elements are collected including the results of the COVID-19 test, symptoms and other health related data. This is not done via the IT platform for the booking of appointments.
5) How will your personal data be processed?
The Medical Service collects and uses your personal data to:
- Arrange the Covid-19 screening test with ECOLOG (Ecolog Deutschland GmbH) for taking the sample (and in case of a Rapid Antigen Test immediately perform the test), and with Eurofins Laboratory van Poucke (Belgium), which will perform the PCR test. These enterprises are processors bound by Article 29 of Regulation (EU) 2018/1725. Contracts fix terms and conditions for the processing operation and assure security and safety for personal data processed. No medical data are processed in the context of the functioning of the website for booking tests.
- Record results of tests for COVID-19 and to provide you the results.
- Facilitate contact tracing and medical assistance in the event of a positive COVID-19 result.
6) For how long will your personal data be stored?
Eurofins Laboratory will keep data including results in accordance with Belgian legislation.
For MEPs and EP staff, when relevant, data related to the test result may be stored in your medical file, in accordance with the standard retention period of 30 years beyond the date of closure or death, applicable to those files.
ECOLOG will erase data after a period of 2 months after the end of the month in which the test was taken.
7) Who are the recipients of your personal data?
The recipients of your personal data are the processors (ECOLOG and Eurofins laboratory) and the Parliament’s staff responsible for carrying out this processing operation according to the “need to know” principle. Such staff abide by statutory, and when required, additional confidentiality agreements:
- The Head of Units of the Medical Service and Crisis Management Unit Brussels;
- The doctors and nurses in these services in Brussels appointed to follow the list of COVID-19 cases;
A positive test result implies the obligation of the laboratory conducting tests to inform the National Health Authority in Belgium (Sciensano). The EP Medical Service will transmit positive results of EESC patients to the doctor of the EESC Medical Service via a password protected message.
8) Will your personal data be shared with a non-EU country or international organisation?
The information we collect will not be given to any third party, except to the extent and for the purpose we may be required to do so by law.
9) Are any automated processes and/or profiling used to make decisions which could affect you?
10) The source of personal data?
The source of your personal data is directly from the data-subject. (only the data introduced during the registration-process is processed)
11) What rights do you have?
- You have the following rights:
- Specific rights as a ‘data subject’ under Chapter III (Articles 14-25) of Regulation (EU) 2018/1725, in particular the right to access, rectify or, if applicable, erase your personal data and the right to restrict the processing of your personal data. Where applicable, you also have the right to object to the processing or the right to data portability.
- You can exercise your rights by contacting the Data Controller, or in case of conflict the Data Protection Officer.
- Right to contact the European Parliament’s data protection officer at
- Right to lodge a complaint with the European Data Protection Supervisor at firstname.lastname@example.org.