RU EN
www.
Technical audit · 13.05.2026

ecdc.europa.eu

ECDC — the EU Agency for Epidemiological Surveillance and Infectious Diseases
EU-INSTITUTIONS

The EU's epidemiological surveillance agency — 98 requests, 2 domains, both europa.eu. Zero external trackers, zero cookies. The standard europa.eu pattern, with webtools and the etrans translation tool.

Request timeline

+234 ms · load
webtools.europa.eu — the EU theme, the global banner, the etrans translation tool, flag icons.

Context

The European Centre for Disease Prevention and Control (ECDC) is the EU’s agency for epidemiological surveillance, headquartered in Stockholm. It coordinated the COVID-19 response and monitors infectious diseases across the EU. It publishes sensitive data on disease outbreaks and vulnerable population groups. Governed by Regulation (EU) 2018/1725. HAR: 98 requests, 3 page sessions, 2 domains.

What the HAR shows

Two domains — www.ecdc.europa.eu and webtools.europa.eu. Three page passes (requests repeat at +6422 and +12394 ms) — the session covered several pages. Zero external trackers, zero Set-Cookie responses. The standard europa.eu pattern: the theme, the global banner (webtools.globan.js), the translation tool (webtools.etrans), flag icons.

Sensitivity context

ECDC processes epidemiological data, including information on disease outbreaks, infection spread, and at-risk groups. For an agency handling potentially sensitive public health data, the absence of external trackers matters particularly. Visitors to the ECDC site — researchers, physicians, journalists — should not be profiled by advertising networks.

Conclusion

98 requests, 2 europa.eu domains. The infectious-disease agency upholds the EU institutions’ standard: zero external trackers, zero cookies, only European infrastructure.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: eu/ecdc-europa-eu-2026-05-13.har
SHA-256: 2796b4653bb03c0ad2696e0e17a12e87fb22a3c1d8d8b12e7db9e5956f942c1c
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — ecdc.europa.eu

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website ecdc.europa.eu.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/eu-ecdc-europa-eu/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]