Processing operation: « Management of missions and authorised travel, including the online tool MiPS (Missions Processing System), OBT (Online Booking Tool) and the Travel Agency(ies), Mission Insurance and Professional Credit Card contracts »
Data Controller: PMO5
Record reference: DPR-EC-00990
Table of Contents
- Introduction
- Why and how do we process your personal data?
- On what legal ground(s) do we process your personal data?
- Which personal data do we collect and further process?
- How long do we keep your personal data?
- How do we protect and safeguard your personal data?
- Who has access to your personal data and to whom is it disclosed?
- What are your rights and how can you exercise them?
- Contact information
- Where to find more detailed information?
The European Commission (hereafter ‘the Commission’) is committed to protect your personal data and to respect your privacy. The Commission collects and further processes personal data pursuant to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (repealing Regulation (EC) No 45/2001).
This privacy statement explains the reason for the processing of your personal data, the way we collect, handle and ensure protection of all personal data provided, how that information is used and what rights you have in relation to your personal data. It also specifies the contact details of the responsible Data Controller with whom you may exercise your rights, the Data Protection Officer and the European Data Protection Supervisor.
The information in relation to processing operation “Management of missions and authorised travel, including the online tool MiPS (Missions Processing System), OBT (Online Booking Tool) and the Travel Agency(ies), Mission Insurance and Professional Credit Card contracts”, under the responsibility of PMO.5, are provided below
PMO.5 collects and uses your personal data to enable travel arrangements and the payment and/or reimbursement of the resulting expenses.
The process consists of four steps, namely:
Step (1) Preparation and submission of the mission order and/or authorised travel request in MIPS by the staff member going on mission/person undertaking the journey and validation in accordance with the visa chain applicable to the DG.
Stage (2) Booking and purchase of tickets (plane, train, etc.), reservation of accommodation (hotel, etc.) if necessary, possible reservation of the hire car by the staff member going on mission/person travelling or via the Commission’s approved travel agency.
Step (3) Possible use of the credit card (mixed, professional and/or personal credit card) made available to the staff member going on mission or to the person travelling by the Commission to pay for any expenditure incurred on mission or authorised travel. The staff member going on mission or the person travelling shall be covered by an insurance and assistance contract signed by the Commission.
Step (4) Establishment of the statement of expenses by the staff member going on mission or the person travelling on return, signature by the competent authority and transmission to the Missions, Laissez-passer and Visas Unit (PMO.2) of the PMO via MIPS for settlement and payment of mission expenses.
In order to ensure the most cost-effective management of the missions of its staff, the Commission relies on external service providers. The mission management activity is broken down into a number of internal and other operations that are carried out by the selected contractors following tender procedures.
These contractors are:
• the travel agency responsible for issuing tickets, making hotel/car reservations;
• the company responsible for issuing the credit card;
• the insurance company responsible for providing additional cover for the staff member going on mission/the person undertaking the authorised travel in the event of sickness/accident or any other risk defined by the policy when travelling on mission;
Your personal data will not be used for an automated decision-making including profiling.
We process your personal data, because:
(a) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Union institution or body;
Processing concerns special categories of personal data as described in Article 10 (1), which provides that processing is prohibited unless one of the conditions of Article 10 (2) is met.
In MiPS, data relating to trade union membership and the state of health of the staff member on mission may be processed.
Trade union membership data are visible when a professional travel is made at the request of a trade union. In this case, the costs of the professional travel are charged to the budget of the trade union and not to the budget of the DG to which the person belongs.
Data on a health problem affecting work-related travel may appear in MiPS in the following cases:
If it is authorised to make a certain travel arrangement and/or to use a certain means of transport (e.g. travel by business class) in derogation from the common rules, a comment must be added to the file on the basis of a certificate from the institution’s medical service, which must be uploaded in MiPS. The medical certificate must indicate the method of travel/recommended means of transport and the date of validity, without however indicating the specific medical reason justifying the derogation.
If the person travelling requires an accompanying person for medical reasons (e.g. in the case of a visually impaired person), the mission expenses relating to his/her accompanying person are recorded in MiPS in order to be reimbursed at the rate of 100 %.
Any costs of vaccinations must be recorded in MiPS in order to be reimbursed at the rate of 100 %.
In the present case, the conditions of Article 10 (2) authorising the processing of special data are as follows:
(b) the processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law insofar as it is authorised by Union law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;
Your data are processed in execution of:
- Regulation 1962/31 of 1 January 1962 laying down the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Economic Community and the European Atomic Energy Community, in particular Articles 11, 12, 13 and 17, and successive amendments.
- Commission Decision of 6 November 2002 establishing the Office for the Administration and Payment of Individual Entitlements C (2002) 4367.
- Commission Decision of 13 May 2025 on general provisions for implementing Articles 11, 12 and 13 of Annex VII to the Staff Regulations (mission expenditure) and on authorised travel adopting the Guide to Missions and Authorised Travel C (2025) 2495.
- Commission Decision of 31 January 2018 on a Code of Conduct for the Members of the European Commission C (2018) 700.
In order to carry out this processing, PMO.5 collects the following categories of personal data:
Data in MIPS: Title of title, surname, first name, date of birth, login, personnel number, per id number, place of employment, office address, professional telephone number, professional e-mail address, place(s) of mission/authorised travel and transit, expected times of departure and return to the place of employment, means of transport used, name of hotel, bill(s), start and end times of professional commitments at the place of mission, bank account number, budget heading to which the mission/authorised travel will be charged, MiPS mission/authorised travel number and confirmation number generated at the time of signature of the mission order/travel authorisation for approval by the authorising officer.
• Data sent to the travel agency: PMO will provide the contractor with the identification data necessary to create the traveller’s profit. This refers to the following data: surname, first name, DG, personal number, telephone number, e-mail address and gender.
Other optional data may be provided voluntarily by the staff member sent on mission with a view to receiving a more personalised service, in particular through his or her traveller profile (travel agency management tool grouping together information necessary and/or useful for processing orders and formatted and/or structured by them): Mobile phone number, nationality, place of issue and expiry date of passport, passport number, credit card, details of the person who may be required to make reservations for the staff member going on mission and any preference in terms of travel conditions, seat + meal.
• Data sent to the contractor as part of the mission insurance:
In the context of missions to countries at risk, the PMO will provide the contractor with the following data: type of traveller (staff member/non-staff member), surname, first name, date of birth, passport number and date of validity, destination (s), with dates on site, places to be visited/location of meetings, whether the person is experienced in travelling in the geographical area in question, whether the person has a relationship with governmental entities, purpose of the mission and security measures in place, such as travel with private driver.
PMO.5 only keeps your personal data for the time necessary to fulfil the purpose of collection or further processing, namely:
Scanned documents are kept for 10 years.
The documents sampled are kept for 10 years.
The personal data received by the contractors with which the PMO has concluded contracts shall be kept in accordance with the duration laid down in the contractual provisions in force.
All personal data in electronic format (e-mails, documents, databases, uploaded batches of data, etc.) are stored either on the servers of the European Commission. All processing operations are carried out pursuant to the Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission.
The Commission’s contractors are bound by a specific contractual clause for any processing operations of your data on behalf of the Commission, and by the confidentiality obligations deriving from the transposition of the General Data Protection Regulation in the EU Member States (‘GDPR’ Regulation (EU) 2016/679).
In order to protect your personal data, the Commission has put in place a number of technical and organisational measures in place. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of this processing operation.
7. Who has access to your personal data and to whom is it disclosed?
Access to your personal data is provided to the Commission staff responsible for carrying out this processing operation and to authorised staff according to the “need to know” principle. Such staff abide by statutory, and when required, additional confidentiality agreements.
This includes:
Line managers, authorising officers (and persons who have received delegations in the course of their duties, e.g. secretaries), mission managers within each DG/Service (GEMIs) and the respective financial units, as well as the staff of the Unit responsible for missions and authorised travel (Unit PMO.5 — Missions, Laissez-Passer and Visas), as well as certain members of other PMO units who monitor and maintain IT systems, deal with legal issues and deal with professional travel and complaints.
In addition, the following services receive your data for the purpose of carrying out their duties under the Staff Regulations of Officials and the applicable law of the European Union:
EEAS (security reasons): to add automatically staff members to the lists of evacuation while on mission/authorised travel in a delegation.
HR (security issues, handling of complaints)
SG (access to documents)
SJ (legal matters)
Finally, the following inspection and investigation bodies can also receive data:
— IAS, IAC
— OLAF, IDOC
— European Ombudsman, EDPS
— CJEU
In some cases your personal data may be transferred to a third country. Indeed, the travel agency may have to transmit data concerning the staff member on mission/ authorised travel to a country outside the EU. This transfer is based on Article 48 of Regulation (EC) No 2018/1725 (appropriate safeguards). Such appropriate safeguards shall consist of binding corporate rules, codes of conduct or certification mechanisms pursuant to points (b), (e) and (f) of Article 46(2) of Regulation (EU) 2016/679.
8. What are your rights and how can you exercise them?
You have specific rights as a ‘data subject’ under Chapter III (Articles 14-25) of Regulation (EU) 2018/1725, in particular the right to access, your personal data and to rectify them in case your personal data are inaccurate or incomplete. Where applicable, you have the right to erase your personal data, to restrict the processing of your personal data, to object to the processing, and the right to data portability.
You have the right to object to the processing of your personal data, which is lawfully carried out pursuant to Article 5(1)(a) on grounds relating to your particular situation.
You can exercise your rights by contacting the Data Controller, or in case of conflict the Data Protection Officer. If necessary, you can also address the European Data Protection Supervisor. Their contact information is given under Heading 9 below.
Where you wish to exercise your rights in the context of one or several specific processing operations, please provide their description (i.e. their Record reference(s) as specified under Heading 10 below) in your request.
- The Data Controller
If you would like to exercise your rights under Regulation (EU) 2018/1725, or if you have comments, questions or concerns, or if you would like to submit a complaint regarding the collection and use of your personal data, please feel free to contact the Data Controller, PMO.2 pmo-missions
ec [dot] europa [dot] eu ((pmo-missions[at]ec[dot]europa[dot]eu).)
You may contact the Data Protection Officer DATA-PROTECTION-OFFICERec [dot] europa [dot] eu ((DATA-PROTECTION-OFFICER[at]ec[dot]europa[dot]eu)) with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725.
You have the right to have recourse (i.e. you can lodge a complaint) to the European Data Protection Supervisor edpsedps [dot] europa [dot] eu ((edps[at]edps[dot]europa[dot]eu)) if you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data by the Data Controller.
10. Where to find more detailed information?
The Commission Data Protection Officer (DPO) publishes the register of all processing operations on personal data by the Commission, which have been documented and notified to him. You may access the register via the following link: http://ec.europa.eu/dpo-register.
This specific processing operation has been included in the DPO’s public register with the following Record reference: DPR-EC-00990.