Commission Decision (EU) 2019/165 of 1 February 2019 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their data protection rights by the Commission in the context of administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings
Commission Decision (EU) 2019/165 of 1 February 2019 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their data protection rights by the Commission in the context of administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings
Decision (EU) 2019/165 · Decision · 9 articles
Data as of 2026-07-04 · Compiled from an official source version. Later amendments or repeals may not be reflected; the official text prevails. · Read the official text ↗
1. This Decision lays down the rules to be followed by the Commission to inform data subjects of the processing of their data in accordance with Articles 14, 15 and 16 of Regulation (EU) 2018/1725 when conducting administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings.
2. It also lays down the conditions under which the Commission may restrict the application of Articles 4(1)(a), 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725, in accordance with Article 25 (1) (c), (g) and (h) thereof.
3. This Decision applies to the processing of personal data by the Commission pursuant to Article 86 of the Staff Regulations and Annex IX thereof, as well as Decision C (2004) 1588.
4. This Decision applies to the processing of personal data by the Commission insofar as it processes personal data for purposes related to administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings.
5. The categories of personal data covered by this Decision include identification, contact and behavioural data.
1. Where the Commission exercises its duties with respect to data subjects' rights under Regulation (EU) 2018/1725, it shall consider whether any of the exceptions laid down in that Regulation apply.
2. Subject to Articles 3 to 7 of this Decision, the Commission may restrict the application of Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725, as well as the principle of transparency laid down in Article 4(1)(a) of that Regulation insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19, 20 and 35 of that Regulation, where the exercise of those rights and obligations would jeopardise the purpose of administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings or would adversely affect the rights and freedoms of other data subjects.
3. Subject to Articles 3 to 7, the Commission may restrict the rights and obligations referred to in paragraph 2 of this Article in relation to personal data obtained from other Union institutions, bodies, agencies and offices, competent authorities of Member States or third countries or from international organisations, in the following circumstances:
(a)
where the exercise of those rights and obligations could be restricted by other Union institutions, bodies, agencies and offices on the basis of other acts provided for in Article 25 of Regulation (EU) 2018/1725 or in accordance with Chapter IX of that Regulation or in accordance with Regulation (EU) 2016/794 of the European Parliament and of the Council ( 6 ) or Council Regulation (EU) 2017/1939 ( 7 ) ;
(b)
where the exercise of those rights and obligations could be restricted by competent authorities of Member States on the basis of acts referred to in Article 23 of Regulation (EU) 2016/679 of the European Parliament and of the Council ( 8 ) , or under national measures transposing Articles 13(3), 15(3) or 16(3) of Directive (EU) 2016/680 of the European Parliament and of the Council ( 9 ) ;
(c)
where the exercise of those rights and obligations could jeopardise the Commission's cooperation with third countries or international organisations in the conduct of administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings.
Before applying restrictions in the circumstances referred to in points (a) and (b) of the first subparagraph, the Commission shall consult the relevant Union institutions, bodies, agencies, offices or competent authorities of the Member States, unless it is clear to the Commission that the application of a restriction is provided for by one of the acts referred to in those points or such consultation would jeopardise the Commission's activities.
Point (c) of the first subparagraph shall not apply where the interest of the Commission to cooperate with third countries or international organisations is overridden by the interests or fundamental rights and freedom of the data subjects.
1. The Commission shall publish on its website data protection notices that inform all data subjects of its activities involving processing of their personal data.
2. The Commission shall individually inform, in an appropriate format, the person concerned by an administrative inquiry, pre-disciplinary, disciplinary or suspension proceedings, as well as witnesses requested to provide information in relation to those proceedings, about the processing of their personal data.
3. Where the Commission restricts in accordance with Article 2 of this Decision, wholly or partly, the provision of the information referred to in paragraph 2, it shall record and register the reasons for the restriction in accordance with Article 6.
Right of access by data subjects, right of erasure and right to restriction of processing
1. Where the Commission restricts, wholly or partly, the right of access to personal data by data subjects, the right of erasure, or the right to restriction of processing as referred to in Articles 17, 19 and 20 respectively of Regulation (EU) 2018/1725, it shall inform the data subject concerned, in its reply to the request for access, erasure or restriction of processing, of the restriction applied and of the principal reasons therefor, and of the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking a judicial remedy in the Court of Justice of the European Union.
2. The provision of information concerning the reasons for the restriction referred to in paragraph 1 may be deferred, omitted or denied for as long as it would undermine the purpose of the restriction.
3. The Commission shall record the reasons for the restriction in accordance with Article 6 of this Decision.
4. Where the right of access is wholly or partly restricted, the data subject may exercise his or her right of access through the intermediary of the European Data Protection Supervisor, in accordance with Article 25 (6), (7) and (8) of Regulation (EU) 2018/1725.
Communication of personal data breaches to data subjects
Where the Commission restricts the communication of a personal data breach to the data subject, as referred to in Article 35 of Regulation (EU) 2018/1725, it shall record and register the reasons for the restriction in accordance with Article 6 of this Decision.
1. The Commission shall record the reasons for any restriction applied pursuant to this Decision, including a case-by-case assessment of the necessity and proportionality of the restriction.
To that end, the record shall state how the exercise of the right would jeopardise the purpose of the administrative inquiry, pre-disciplinary, disciplinary or suspension proceedings, or of restrictions applied pursuant to Article 2(2) or (3), or would adversely affect the rights and freedoms of other data subjects.
2. The record and, where applicable, the documents containing the underlying factual and legal elements shall be registered. They shall be made available to the European Data Protection Supervisor on request.
1. Restrictions referred to in Articles 3, 4 and 5 shall continue to apply as long as the reasons justifying them remain applicable.
2. Where the reasons for a restriction referred to in Articles 3 and 5 no longer apply, the Commission shall lift the restriction and provide the principal reasons for the restriction to the data subject. At the same time, the Commission shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor at any time or of seeking a judicial remedy in the Court of Justice of the European Union.
3. The Commission shall review the application of the restrictions referred to in Articles 3 and 5 every six months from their adoption and in any case at the end of the administrative inquiry, pre-disciplinary, disciplinary or suspension proceedings. Thereafter, the Commission shall monitor the need to maintain any deferral on an annual basis.
Review by the Data Protection Officer of the European Commission
1. The Data Protection Officer of the European Commission shall be informed, without undue delay, whenever data subjects' rights are restricted in accordance with this Decision. Upon request, the Data Protection Officer shall be provided with access to the record and any documents containing underlying factual and legal elements.
2. The Data Protection Officer may request a review of the restriction. The Data Protection Officer shall be informed in writing of the outcome of the requested review.
