Commission Decision (EU) 2019/154 of 30 January 2019 laying down internal rules concerning the restriction of the right of access of data subjects to their medical files

• CELEX: Decision (EU) 2019/154
• Articles: 7

Article 1 Subject matter and scope

1.   This Decision lays down the conditions under which the Commission may restrict the application of Article 17 of Regulation (EU) 2018/1725, in accordance with Article 25(1)(h) of that Regulation.

2.   This Decision applies to the access to personal medical data processed by the Commission pursuant to Articles 26 a , 33, 59, 72, 73 and 78 of the Staff Regulations and Articles 1, 13 to 15 of its Annex VIII, and Articles 13, 16, 28, 32, 33, 83, 91, 95, 100, 101 and 102 of the Conditions of Employment of Other Servants.

Article 2 Applicable restrictions

1.   Subject to Articles 3 to 5, the Commission may restrict, on a case-by-case basis, data subjects' right to access directly personal medical data of a psychological or psychiatric nature concerning them which is processed by the Commission, where access to such data is likely to represent a risk for the data subject's health. This restriction shall be proportionate to what is strictly necessary to protect the data subject.

2.   Access to the information referred to in paragraph 1 shall be given to a doctor of the data subject's choice.

3.   In such cases, the data subject shall, upon request, be reimbursed by the Medical Service of the part of the cost of the medical consultation with the doctor who received access to the medical files that has not been reimbursed by the Joint Sickness Insurance Scheme (JSIS). The reimbursement shall not exceed the difference between the ceiling laid down in the General Implementing Provisions for the reimbursement of medical expenses  ( 5 ) and the amount reimbursed to the data subject by the Join Sickness Insurance Scheme pursuant to those rules.

4.   Such reimbursement by the Medical Service shall be subject to the condition that access has not already been granted for the same data.

5.   Subject to Articles 3 to 5 of this Decision, the Commission may restrict, on a case-by-case basis and in accordance with Article 25(1)(h) of Regulation (EU) 2018/1725, data subjects' right to access their personal medical data in its possession where the exercise of that right would adversely affect the rights and freedoms of the data subject or other data subjects.

Article 3 Right of access by data subjects

1.   Where the Commission restricts, wholly or partly, the right of access to personal medical data by data subjects, as referred to in Article 17 of Regulation (EU) 2018/1725, it shall inform the data subject concerned, in writing, in its reply to the request for access without undue delay of the restriction applied and of the principal reasons therefor. The Commission will also inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking judicial remedy in the Court of Justice of the European Union.

2.   The provision of information concerning the reasons for the restriction referred to in paragraph 1 may be deferred, omitted or denied for as long as it would undermine the purpose of the restriction.

3.   The Commission shall record the reasons for the restriction in accordance with Article 5.

4.   Where the right of access is wholly or partly restricted, the data subject shall exercise his or her right of access through the intermediary of the European Data Protection Supervisor, in accordance with Article 25(6), (7) and (8) of Regulation (EU) 2018/1725.

Article 4 Recording and registering of restrictions

1.   The Commission shall record the reasons for any restriction applied pursuant to this Decision, including an assessment of the necessity and proportionality of the restriction, taking into account the relevant elements in Article 25(2) of Regulation (EU) 2018/1725.

To that end, the record shall state how the exercise of the right would present a risk for the data subject's health or would adversely affect the rights and freedoms of other data subjects.

2.   The record and, where applicable, the documents containing the underlying factual and legal elements shall be registered in the relevant medical file.

Article 5 Duration of restrictions

1.   Restrictions referred to in Articles 2 shall continue to apply as long as the reasons justifying them remain applicable.

2.   Where the reasons for a restriction no longer apply and the data subject has asked again for access to the personal medical data concerned, the Commission shall lift the restriction and provide the principal reasons for the restriction to the data subject. At the same time, the Commission shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor at any time or of seeking a judicial remedy in the Court of Justice of the European Union.

Article 6 Review by the Data Protection Officer of the European Commission

1.   The Data Protection Officer shall be informed, without undue delay, whenever data subjects' rights are restricted in accordance with this Decision. Upon request, the Data Protection Officer shall be provided with access to the record and any documents containing underlying factual and legal elements.

2.   The Data Protection Officer may request a review of the restriction. The Data Protection Officer shall be informed in writing of the outcome of the requested review.

Article 7 Entry into force

This Decision shall enter into force on the day of its publication in the Official Journal of the European Union .

It shall apply from 11 December 2018.