Privacy statement on the protection of personal data in relation to online subscriptions to the Medical Devices newsletters and notifications

All personal data are dealt with in compliance with Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by Community institutions and bodies and on the free movement of such data (Regulation (EC) 45/2001).

The following data protection information notice outlines the criteria by which the data is collected, managed and used in relation to online subscriptions to DG GROW Medical devices Unit newsletters and/or notifications about updates made on the DG GROW Medical devices website section.

Identity of the controller:
The data controller of the processing operation under the request for service SC 20177304, in line with the FWC PO/2016-12/A2, is the Head of unit of COMM –A2 Corporate Communication contracts, article I.9 Data Controller.

Purpose of data processing:

The data is processed to:

  • establish list(s) of subscribers wishing to receive the DG GROW Medical devices Unit newsletters and/or notifications about updates made on the DG GROW Medical devices website section. Based on their preferences, different lists are established (one list for those choosing to receive only “newsletters”, one list for those choosing to receive only “notifications” and one list for those choosing to receive both); and
  • send DG GROW newsletters twice a year and DG GROW notifications about updates made on the DG GROW Medical devices website section to the subscribers (as per their choices explained above).

Data concerned:

Data subjects (that is, subscribers to the newsletters and to the notifications) submit their name, surname, organisation (e.g. public institution, private sector etc.), country and email address as well as other information regarding their specific areas of interest. Data subjects can choose the information type(s) to which they wish to subscribe, without the need to provide any additional personal data other than those mentioned above.

Legal basis:

Data subjects’ consent, following the Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by Community institutions and bodies and on the free movement of such data (Regulation (EC) 45/2001).

Recipients of the processed data:

The recipients of your data will be Chafea and European Commission staff (DG GROW) and bodies charged with monitoring or inspection tasks in application of EU law (e.g. internal audits, European Anti-fraud Office – OLAF).

Access to personal data is granted on a ‘need to know’ basis to:

  • Duly appointed staff of Chafea and European Commission staff (DG GROW and DG COMM);
  • Staff of the Chafea’s contractor in charge of communication services, which manages the collected personal data;
  • Staff of the Chafea’s contractor providing web services for the DG GROW Medical Devices website (such as website design, website hosting including cloud services etc.).

All recipients shall be reminded of their obligation not to use the data received for any purpose other than the one for which they were provided.

Lawfulness of data processing:

The lawfulness of the data processing is based on Article 5(d) of Regulation (EC) No 45/2001 and the PO/2016-12/A2 FWC article II.9 Processing of Personal Data. Data subjects unambiguously give their consent to the processing of their personal data when filling in the online subscription form.

Information on the retention period and storage locations of personal data:

  • Personal data is stored electronically for 3 years and six months for the purpose of dispatching the newsletters.
  • Personal data is stored on the servers of the Chafea’s contractors, which are located in the EU and abide by the necessary security provisions.
  • Data subjects can unsubscribe and withdraw their consent to the treatment of their personal data at any time. Furthermore, every three years an email is sent to the users reminding them of the possibility to (i) amend and review their information preferences; (ii) withdraw their consent to the treatment of their personal data and unsubscribe from the newsletters.

The data subjects’ rights:

  • You have the right to access your personal data and the right to correct any inaccurate or incomplete personal data. If you have any queries concerning the processing of your personal data, you may address them to data controller in Chafea, at the following email: CHAFEA-EXT-MEETINGS (CHAFEA-EXT-MEETINGS@ec.europa.eu).
  • You shall have right of recourse at any time to the Chafea DATA PROTECTION (CHAFEA-DATA-PROTECTION@ec.europa.eu) and to the European Data Protection Supervisor at https://edps.europa.eu.
  • Data subjects are entitled to lodge an appeal at any time with the European Data Protection Supervisor (EDPS) at edps@edps.europa.eu should they consider that the processing operations do not comply with Regulation (EC) No 45/2001.