1. Online data inputting and upload of rules.

Transcription

1 SERVICE SPECIFIC PRIVACY STATEMENT 1. Online data inputting and upload of rules. The User management module of the MOVEHUB Web Application allows the management of users in the Competent Authorities of the MOVEHUB countries (Member States (MS), European Economic Area (EEA) and "Accord Européen sur les Transports Routiers" (AETR) countries) who will use the application and the management of roles the users will have when using it. The role will determine which functionalities of the system they can access; these roles are Administrative (EU Super Administrator, EU Help Desk, MS Administrator) or just for Reporting (EU Reporting, MS Reporting). Administrative roles: o EU Super Administrator: The role with highest privileges on the application. It can access all the functionalities. It can create/update/delete/view users, including other users with his role. It can also create/update/delete/view any contact. Reserved to few selected EC users (IT Project Manager and backup). o EU Help Desk: This role can create/update/delete/view users except of role EU Super Administrator or EU HelpDesk. It can also create/update/delete/view any contact. Reserved to support EC users. o MS Administrator: This role can create/update/delete/view users of role MS Reporting for his own MS. It can also create/update/delete contacts of his own MS but it can view all contacts from other MS or EC. Reserved to few selected MS responsible users (max. 3 per country). Reporting roles: o EU Reporting: This role can only view contacts. Reserved to EC users. o MS Reporting: This role can only view contacts. Reserved to MS users. The Administrative users in the Member States have to follow a specific procedure which involves the MS sending a signed form and copy of ID card or passport of the user to be created when asking EC to add new MS administrative user. As MOVEHUB is a common platform for ERRU (European Register for Road transport Undertakings), RESPER (Réseau Permis de Conduire) and TACHOnet (TACHOgraph NETwork); users will be created once for each system and they will be able to access only the systems where they are created. If a user needs to access more than one system it must be created for each system. The administrator will need to create the user for one system with the corresponding role and then again for the other system. When this user will log in the application (with his EU Login) he will see the two systems he has access to with the different functionalities depending on his role in each system. The Contacts management module of the MOVEHUB Web Application allows users to manage contacts in the Competent Authorities of the MOVEHUB countries, which are responsible for maintaining their own contacts (see above User Management roles). This data is automatically stored in a DB behind the web application. All contacts are then available in read mode to the other users of the application. As with users, contacts will be created in each system independently. If the same contact works in several systems the contact will be duplicated.

2 When a user or contact is created, updated, deleted, an is sent to the provided address indicating the related data and the person responsible for it, who can be contacted if needed. The application is accessible through the "EU Login" authentication system. 2. What personal information do we collect, for what purpose and through which technical means? User Management: The Administrative users at the EC can manage the Administrative users in the Member States, following a specific procedure which involves sending a signed form and copy of ID card or passport. They manage the users at EC as well. The Administrative users in the MS manage the (other) users in their own countries. User details are stored in DB: User: Mandatory: Optional: o o Family Name o User Type (Role) o First Name o MS o Additional Information Contact Management: Contact details are professional details. Only professional addresses and phone numbers are allowed. The Competent Authorities can fill their contacts manually in a web form, only users of the application working for that country having role MS Administrator are allowed to create/edit/remove this data. This data is automatically stored in a DB behind the web application. Users of the application working for the EC with role EU Super Administrator and EU Help Desk can create/edit/remove any contact from any MS and EC, even if created by another user. Contact details are stored in DB: Contact:

3 Mandatory: Optional: o Categories o First Name o Last Name o Function o s o Phones o Hours available o Other Information When a user or contact is created, modified or deleted, an automatic notification is sent to that user or contact to let him know that his details have been added to the system, which details have been modified or that they have been removed. It informs him about who has done the action, giving contact information, in case he wants to react. A link to this Specific Privacy Statement is also provided. The processing of personal data serves only to restrict access to the application in the case of users and for communication purposes in the case of contacts. The Competent Authorities of the MOVEHUB Countries sometimes need to contact each other directly. Also, the EC often needs to contact the Competent Authorities. The Contacts Management module is aimed at providing the members of the MOVEHUB network with each other's up to date contact details (per system). Each authority is responsible for updating its own contacts. Logs: DG MOVE is keeping logs of all the actions which change the database, including users and contacts creation, edition and deletion, users' login date/time, for troubleshooting, audit and statistical purposes. Data kept includes the user or contact record before and after the change, as well as the username of the user who performed the action and date/time when action was performed. 3. Who has access to your information and to whom is it disclosed? Authorised staff of the European Commission or staff authorised by the MOVEHUB countries' Competent Authorities with administrative rights in the MOVEHUB Web Application (with role "EU Super Administrator" and "EU Help Desk" for EC and "MS Administrator" for MS) can create, modify or delete personal data. Users with no administrator rights (with role "EU Reporting" for EC and "MS Reporting" for MS) have only READ access to the personal data.

4 4. How do we protect and safeguard your information? The collected personal data and all related information are protected by technical and organizational measures. Access to the application is restricted by login and password using the EU Login service from the EC. 5. How can you verify, modify or delete your information? In case you wish to verify which personal data is stored on your behalf by the responsible controller, have it modified, corrected, or deleted, you may send an to the administrator of the application at your MS or to EU HelpDesk in case of EC users. His address is known at your competent authority and should be mentioned in all notifications sent to you when your user or contact data has been created/updated/deleted in the system (as mentioned in section 2). In addition, you can also contact the EC functional mailbox EC-MOVEHUB- 6. How long do we keep your data? Only active data is kept. The database will remain active as long as the legal base requires the database to be active or the Competent Authorities want to use it (if it is not legally mandatory). When a user or contact is removed from the system, the logs of any action containing the user or contact data are kept in the logs. Every 6 six months an automatic process will remove all the logs older than 6 months. Logs are only accessible to EU Super Administrator users. 7. Contact information For any questions on your rights, feel free to contact the owner of the application, which is the Road Transport unit in DG MOVE. You can contact them via the administrators' functional address, which is shown on the web application. EC-MOVEHUB-HELPDESK@ec.europa.eu Any further information relating to the processing of your personal data is detailed in the register of the data protection officer of the European commission: 8. Recourse

5 Complaints, in case of conflict, can be addressed to the European Data Protection Supervisor. or 9. Legal basis TACHOnet: Regulation (EU) No 165/2014 Regulation: 2016/68 ERRU: Regulation (EC) No 1071/2009 Regulation: 2016/480 RESPER: Directive 2006/126/EC Personal Data Protection at EU: Regulation (EC) 45/2001