Notification, Visit to Estonia to monitor the implementation of Directive 2014/90/EU on marine equipment, September 2023 - Ares(2023)3916870

Ref.Ref. Ares(2023)3916870 - 06/06/2023 Ares(2020)3573558 - 07/07/2020 Privacy Statement on the processing of personal data in the context of carrying-out visits to Member States, including the reporting thereof, as referred to in Article 3 of Regulation (EC) No 1406/2002, as amended, to assist the Commission and the EFTA Surveillance Authority in the effective implementation of relevant binding legal acts of the Union The protection of privacy is of high importance to the European Maritime Safety Agency (´EMSA´) and the European Commission, Directorate-General/Service for Mobility and Transport, (‘DG MOVE’). EMSA and DG MOVE are responsible for the personal data they process. Therefore, we are committed to respecting and protecting the personal data of every individual and to ensuring efficient exercising of data subject’s rights. All the data of a personal nature, namely data that can identify an individual directly or indirectly, will be handled fairly and lawfully with the necessary due care. This processing operation is subject to Regulation (EU) 2018/1725 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data. The information in this Privacy Statement is given pursuant to Articles 15 and 16 of Regulation (EU) 2018/1725. DG MOVE processes the personal data received from EMSA in the context of the visits to Member States carried out by EMSA. In these circumstances, EMSA and DG MOVE are joint controllers in relation to the visits to Member States and have signed a Joint Controllership Arrangement which sets out the allocation of respective roles, responsibilities and practical arrangements between DG MOVE and EMSA as Joint Controllers pursuant to Article 28 of Regulation (EU) 2018/1725. 1. Nature and the purpose of the processing operation The purpose of the processing of personal data is: The organisation, carrying out, reporting and follow-up of EMSA’s visits to Member States requires that personal data concerning the persons participating in a visit and others persons who did not participate in a visit but are referred to in relevant documents, including their names, job titles, responsibilities and work carried out by them, is recorded in various documents including the visit programme, documents or other evidence obtained before, during and after a visit, and in the report complied afterwards and submitted to the Commission, the EFTA Surveillance Authority (where applicable) and to the Member State that has been visited. This personal data needs to be referred to in EMSA’s visit reports as a formal record of the persons who provided input or evidence, or are referred to therein, based on which the conclusions of a visit, including any findings identified in the effective implementation of the Union law the subject of the visit, have been based. The personal data processed will not be reused for another purpose that is different to the one stated above. The processing is not intended to be used for any automated decision making, including profiling. 2. Categories/types of personal data processed The categories/types of personal data processed are the following: Name, education and training, employment details, goods or services provided, work carried out in the performance of their employment and/or the role(s) they perform in the organisation. 3. Processing the personal data The processing of the personal data is carried out under the responsibility of, for EMSA, the Head of Unit 1.2, Visits and Inspections, Human Element, acting as delegated EMSA data controller and, for DG MOVE, the Page 1 of 3 [email protected] EMSA, Praça Europa 4, 1249-206 Lisbon, Portugal emsa.europa.eu Head of Unit D.2, acting as Data Controller for Directorate-General for Mobility and Transport of European Commission. 4. Access to and disclosure of personal data The personal data is disclosed to the following recipients: Responsible staff members in EMSA, the European Commission, the EFTA Surveillance Authority and the responsible administrations of the Member State being visited, as applicable. The data is not used for any other purposes or disclosed to any other recipient. The information in question will not be communicated to third parties, except where necessary for the purposes outlined above. Personal data is not intended to be transferred to third countries. 5. Protecting and safeguarding personal information The data controllers implement appropriate technical and organisational measures in order to safeguard and protect data subjects’ personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to them. All personal data collected for the performance and reporting of EMSA’s visits is stored in secure IT applications according to the security standards of EMSA and the European Commission as well as in specific electronic folders accessible only to the authorised recipients. Appropriate levels of access are granted individually only to the above recipients. The e-records are held securely so as to safeguard the confidentiality and privacy of the data therein. 6. Access, rectification, erasure or restriction of processing of personal data Data subjects have the right to access, rectify, erase, and receive their personal data, as well as to restrict and object to the processing of the data, in the cases foreseen by Articles 17 to 24 of Regulation (EU) 2018/1725. If data subjects would like to exercise any of these rights, they should send a written request explicitly specifying their query to the delegated data controller in EMSA, the Head of Unit 1.2, Visits and Inspections, Human Element. The right of rectification can only apply to inaccurate or incomplete factual data processed within the context of the individual visit for which the personal data is recorded. The above requests will be answered without undue delay, and in any event within one month of receipt of the request. However, according to Article 14(3) of Regulation (EU) 2018/1725, that period may be extended by two further months where necessary, taking into account the complexity and number of the requests. EMSA shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. 7. Legal basis for Data processing Processing is based on Article 5.1 (a) of Regulation (EU) 2018/1725. The personal data are collected and processed in accordance with Article 2.2(b) of Regulation (EC) No 1406/2002, as amended, which states that, “The Agency shall assist the Commission in the effective Page 2 of 3  implementation of relevant binding legal acts of the Union, in particular by carrying-out visits and inspections as referred to in Article 3 of this Regulation” and Article 3 ‘Visits to Member States and inspections’ which states: “1. In order to perform the tasks entrusted to it and to assist the Commission in fulfilling its duties under the TFEU, and in particular the assessment of the effective implementation of relevant Union law, the Agency shall carry out visits to Member States in accordance with the methodology established by the Administrative Board. 2. The Agency shall inform the Member State concerned in good time of the planned visit, the names of the authorised officials, and the date on which the visit starts and its expected duration. The Agency officials delegated to carry out such visits shall do so on presentation of a decision in writing from the Executive Director of the Agency specifying the purpose and the aims of their mission. 3. […] 4. At the end of each visit or inspection, the Agency shall draw up a report and send it to the Commission and to the Member State concerned.” 8. Storing Personal data The data controllers do not keep personal data longer than necessary for the purpose for which that personal data is collected. The personal data is stored in accordance with the applicable retention policies. In the case of EMSA, this is for 20 years in accordance with EMSA’s Records Management Policy and Procedure. Following the expiry of the aforementioned Administrative Retention Period, Sampling and selection and Second Review shall be performed in compliance with the provisions of the above policy. For the Commission this is 5 years in accordance with the Commission’s Common level retention policy. In the event of a formal appeal, all data held at the time of the formal appeal should be retained until the completion of the appeal procedures. 9. Data protection points of contact Should data subjects have any queries/questions concerning the processing of your personal data, they should address them to the data controller, Head of Unit 1.2, Visits and Inspections, Human Element, at the following mailbox: [email protected]. Any data subject may also consult the EMSA Data Protection Officer at: [email protected] or the European Commission’s Data Protection Officer at [email protected] with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725. Recourse: Complaints, in cases where the conflict is not resolved by the Data Controller and/or the Data Protection Officer, can be addressed at any time to the European Data Protection Supervisor: [email protected]. Page 3 of 3 Electronically signed on 07/07/2020 12:16 (UTC+02) Ref. Ares(2023)3916870 - 06/06/2023 Mr Meelis Kivinurm Maritime Attaché Permanent Representation of Estonia to the EU Rue Guimard 11–13 1040 Brussels BELGIUM Lisbon, 06 June 2023 Subject: Visit to Estonia to monitor the implementation of Directive 2014/90/EU on marine equipment Dear Mr Kivinurm, Please find enclosed a copy of the letter sent today to H.E. Mr Aivo Orav, Permanent Representative of Estonia to the European Union. Please can I also take this opportunity to confirm that the report of the visit will be made available by downloading it from EMSA’s e-Delivery portal. For this purpose our current e-delivery contact in the Permanent Representation is Ms Maria Alajoe ([email protected]). If this contact is no longer valid, please can you provide the new name and contact details to the Team Leader for the visit so that my services can arrange for them to have access to the portal before the report is issued. Yours sincerely, e-signed p.p. Maja Markovčić Kostelac Executive Director Encl.: 1. Letter to H.E. Mr Aivo Orav; 2. Privacy Statement. [email protected] Electronically signed on 06/06/2023 14:20 (UTC+02) EMSA, Praça Europa 4, 1249-206 Lisbon, Portugal emsa.europa.eu Ref. Ares(2023)3916870 - 06/06/2023 H.E. Mr Aivo Orav Permanent Representative of Estonia to the EU Rue Guimard 11–13 1040 Brussels BELGIUM Lisbon, 06 June 2023 Subject: Visit to Estonia to monitor the implementation of Directive 2014/90/EU on marine equipment Your Excellency, According to Article 2.2(b) of Regulation (EC) No 1406/2002, as amended, one of the tasks of EMSA is to assist the Commission in the effective implementation of relevant binding legal acts of the Union, in particular carrying out visits to the Member States. I am writing to inform you that, in accordance with the Methodology for Visits to Member States adopted by the Administrative Board of EMSA and following consultation with the Commission, it has been decided that a team of EMSA staff will visit your Administration from 12 to 18 September 2023. The purpose of the visit is to assess the functioning of the systems in place in Estonia to implement the requirements of Directive 2014/90/EU of 23 July 2014 on marine equipment. Particular attention will be paid to the following: ■ Flag State activities, including ship survey reports, transfer-of-flag cases and the delegation of MED activities to Recognised Organisations; ■ Designation and monitoring of notified bodies, including their appointment, biennial monitoring and the fulfilment of their obligations under the Directive; ■ Market surveillance and follow-up action, including the designation of authorities, their resources, operational functioning, market surveillance programmes, identification of potential hazards, corrective actions and safeguard clause procedures; ■ Cooperation and mutual assistance, including exchanges of experience, participation in the sectoral group and involvement with technical specifications and testing standards. The EMSA team will consist of: Kim Nielsen, Team Leader, Senior Inspector, Regulatory Compliance; Francisco Broissin-Capo, Senior Project Officer for Marine Equipment. The preliminary work plan includes as a minimum a visit to the headquarters of the competent authority designated to perform functions under the above mentioned Directive. The preliminary timetable for the visit is as follows: [email protected] EMSA, Praça Europa 4, 1249-206 Lisbon, Portugal emsa.europa.eu  1. 12 September - monitoring of the operational implementation and enforcement of the Directive by the designated competent authorities. 2. 12 September - monitoring of the operational implementation and enforcement of the Directive by the designated market surveillance authorities. 3. 13 September - monitoring of the operational implementation and enforcement of the Directive by a body notified by Estonia, including accompanying the notified body during an audit, assessment or visit to a manufacturer of which the visited notified body is in charge of the relevant technical file. 4. 14 September - monitoring of the operational implementation and enforcement of the Directive by the flag State authorities, including a visit on board a nationally flagged ship. 5. 18 September - summing up of findings and closing meeting with the designated competent authority (online - remote sessions). I propose that further details for the programme are worked out between the national focal point or coordinator you may designate for further correspondence and the EMSA team. The contact person in EMSA will be Kim Nielsen, Senior Inspector. His direct telephone number is: +351 21 1209 387 and his e-mail address is [email protected]. Following the visit, EMSA will send a report with the findings of the visit to the Commission and to your Administration. I trust that I, and the team, can rely upon the co-operation of the Estonian Administration in carrying out this mission. Please can you send a formal response within three weeks from the date of this letter. Please be assured, Your Excellency, of my highest consideration. Yours sincerely, e-signed p.p. Maja Markovčić Kostelac Executive Director Encl.: Privacy Statement Cc: Ms Maja Bakran (DG MOVE) Page 2 of 2 Electronically signed on 06/06/2023 14:20 (UTC+02) Saatja: Meelis Kivinurm <[email protected]> Saadetud: 06.06.2023 19:27 Adressaat: <=?utf-8?Q?Kaupo_L=C3=A4=C3=A4nerand?=>; <"Jaak Viilipus">; <"Tarmo Ots">; <"Madis Ross"> Koopia: <"Silver Tammik">; Kerli Kiili (Keskkonnaministeerium) <[email protected]>; <"[email protected]">; <"MKM info">; Raili Lillemets <[email protected]> Teema: FW: Notification, Visit to Estonia to monitor the implementation of Directive 2014/90/EU on marine equipment, September 2023 - Ares(2023)3916870 Tähtsus: Kõrgeim Manused: MED notify visit to Estonia - Letter to Mar Attache.pdf; MED notify visit to Estonia - Letter to Perm Rep.pdf; Privacy Statement Visits to MS JC with DG MOVE ARES.pdf Tervitus! Saan aru kiirpilgul, et EMSA tuleb teile septembris külla. Palun võtke vajalik otsesuhtlus üle, kui see juba ei käi. Dokumenditalitusel palun registreerida. Tervitades Meelis From: BOSCARIOL Donatella (EMSA) <[email protected]> Sent: Tuesday, June 6, 2023 4:47 PM To: Meelis Kivinurm <[email protected]> Subject: Notification, Visit to Estonia to monitor the implementation of Directive 2014/90/EU on marine equipment, September 2023 - Ares(2023)3916870 Please see the enclosed correspondence from MARKOVCIC KOSTELAC Maja, dated 06/06/2023.