Commission Decision (EU) 2019/1862 of 6 November 2019 laying down internal rules in relation to the provision of information to data subjects and the restrictions of certain of their rights in the context of the processing of personal data by the Commission in the Union system to prevent, deter and eliminate illegal, unreported and unregulated fishing

• CELEX: Decision (EU) 2019/1862
• Articles: 9

Article 1 Subject-matter and scope

1.   This Decision lays down the rules to be followed by the Commission when informing the data subjects of the processing of their data in accordance with Articles 14, 15 and 16 of Regulation (EU) 2018/1725 in the framework of the Union system to prevent, deter and eliminate illegal, unreported and unregulated (IUU) fishing.

2.   It also lays down the conditions under which the Commission may restrict the application of Articles 4, 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725, in accordance with Article 25(1)(c), (g) and (h) thereof, in the framework of that system.

3.   This Decision applies to the processing of personal data by the Commission for the purpose of or in relation to the activities carried out to fulfil the Commission’s tasks of conducting analyses and procedures and mutual assistance in relation to alleged IUU fishing pursuant to Regulations (EC) No 1005/2008 and (EC) No 1010/2009.

This Decision does not apply to the processing of personal data by the Commission that have been disclosed to owner and, where appropriate, the operator of the fishing vessel in accordance with Article 26(2)(d) or (3)(d) and Article 27(6)(a) of Regulation (EC) No 1005/2008.

This Decision applies to the following categories of personal data:

(a)

identification and contact data;

(b)

professional data;

(c)

activities of or relating to a vessel, its position and movements, fishing activity or a fishing-related activity;

(d)

data relating to vessel owners and operators (position or role), masters, and crew members;

(e)

data relating to persons involved in the movement, storage, processing and marketing of fishery products across the supply chain;

(f)

data concerning informants;

(g)

all other data related to the subject matter of the relevant analyses and procedures.

Article 2 Applicable exceptions and restrictions

1.   Where the Commission exercises its duties with respect to the data subjects’ rights pursuant to Regulation (EU) 2018/1725, it shall consider whether any of the exceptions laid down in that Regulation apply.

2.   Where the exercise of the rights and obligations provided for in Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725 in relation to personal data processed by the Commission would jeopardise the purpose of the Commission’s analyses and procedures with regard to IUU fishing, including by revealing its tools and methods, or would adversely affect the rights and freedoms of other data subjects, the Commission may restrict the application of:

(a)

Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725; and

(b)

the principle of transparency laid down in Article 4(1)(a) of that Regulation insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725.

3.   The Commission may restrict the rights and obligations referred to in paragraph 2 of this Article in relation to personal data obtained from other Union institutions, bodies, agencies and offices, competent authorities of Member States or third countries, international organisations or anonymous or identified sources in the following circumstances:

(a)

where the exercise of those rights and obligations in respect of the personal data obtained from another Union institution, body, agency or office could be restricted by that other Union institution, body, agency or office on the basis of legal acts referred to in Article 25 of Regulation (EU) 2018/1725, or in accordance with Chapter IX of that Regulation; with Regulation (EU) 2016/794 of the European Parliament and of the Council  ( 9 ) or with Council Regulation (EU) 2017/1939  ( 10 ) ;

(b)

where the exercise of those rights and obligations in respect of the personal data obtained from a competent authority of a Member State could be restricted by competent authorities of that Member State on the basis of acts referred to in Article 23 of Regulation (EU) 2016/679 of the European Parliament and of the Council  ( 11 ) or under national measures transposing Articles 13(3), 15(3) or 16(3) of Directive (EU) 2016/680 of the European Parliament and of the Council  ( 12 ) ;

(c)

where the exercise of those rights and obligations could jeopardise the Commission’s cooperation with third countries or international organisations with regard to IUU fishing.

Before applying restrictions in the circumstances referred to in points (a) and (b) of the first subparagraph, the Commission shall consult the relevant Union institutions, bodies, agencies or competent authorities of the Member States unless it is clear to the Commission that the application of a restriction is provided for by one of the acts referred to in those points.

Point (c) of the first subparagraph shall not apply where the interest of the Commission to cooperate with third countries or international organisations is overridden by the interests or fundamental rights and freedom of the data subject.

4.   Paragraphs 1, 2 and 3shall be without prejudice to

(a)

the application of other Commission decisions laying down internal rules concerning the provision of information to data subjects and the restrictions of certain rights under Article 25 of Regulation (EU) 2018/1725;

(b)

Article 23 of the Rules of Procedure of the Commission.

Paragraphs 2 and 3 shall apply subject to Articles 3 and 7 of this Decision.

5.   Any restriction of the application of rights and obligations, referred to in paragraph 2 of this Article, shall be necessary and proportionate taking into account the risks to the rights and freedoms of data subjects.

Article 3 Provision of information to data subjects

1.   The Commission shall publish on its website data protection notices that inform all data subjects of its activities involving processing of their personal data for the purposes of analyses and procedures with regard to IUU fishing. Where relevant, the Commission shall ensure that the data subjects are informed individually in an appropriate format.

2.   Where the Commission restricts, wholly or partly, the provision of information to data subjects whose data are processed for the purposes of analyses and procedures with regard to IUU fishing, it shall record and register the reasons for the restriction in accordance with Article 6.

Article 4 Right of access by data subject, right of erasure and right to restriction of processing

1.   Where the Commission restricts, wholly or partly, the right of access to personal data by data subjects, the right of erasure, or the right to restriction of processing as referred to respectively in Articles 17, 19 and 20 of Regulation (EU) 2018/1725, it shall inform the data subject concerned, in its reply to the request for access, erasure or restriction of processing,

(a)

of the restriction applied and of the principal reasons thereof; and

(b)

of the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking a judicial remedy in the Court of Justice of the European Union.

2.   The provision of information concerning the reasons for the restriction referred to in paragraph 1 may be deferred, omitted or denied for as long as it would undermine the purpose of the restriction.

3.   The Commission shall record and register the reasons for the restriction in accordance with Article 6 of this Decision.

4.   Where the right of access is wholly or partly restricted, the data subject is entitled to exercise his or her right of access, in accordance with Article 25(6), (7) and (8) of Regulation (EU) 2018/1725. The data subject may submit a complaint to the European Data Protection Supervisor where he or she considers that his or her rights have been unlawfully denied or restricted.

Article 5 Communication of personal data breaches to data subjects

Where the Commission restricts the communication of a personal data breach to the data subject, as referred to in Article 35 of Regulation (EU) 2018/1725, it shall record and register the reasons for the restriction in accordance with Article 6 of this Decision.

Article 6 Recording and registering of restrictions

1.   The Commission shall record the reasons for any restriction applied pursuant to this Decision, including an assessment of the necessity and proportionality of the restriction, taking into account the relevant elements set out in in Article 25(2) of Regulation (EU) 2018/1725.

2.   The record shall state how the exercise of a right by the relevant data subject would jeopardise the purpose of the Commission’s analyses and procedures with regard to IUU fishing, or of restrictions applied pursuant to Article 2(2) or (3) of this Decision, or would adversely affect the rights and freedoms of other data subjects.

3.   The record and, where applicable, the documents containing underlying factual and legal elements shall be registered. They shall be made available to the European Data Protection Supervisor on request.

Article 7 Duration of restrictions

1.   Restrictions referred to in Articles 3, 4 and 5 shall continue to apply as long as the reasons justifying them remain applicable.

2.   Where the reasons for a restriction referred to in Article 3 or 5 no longer apply, the Commission shall lift the restriction and provide the principal reasons for the restriction to the data subject. At the same time, the Commission shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor at any time or of seeking a judicial remedy in the Court of Justice of the European Union.

3.   The Commission shall review the application of the restrictions referred to in Articles 3 and 5 one year after adoption and at the closure of the relevant Commission analyses and procedures carried out with regard to IUU fishing. Thereafter, the Commission shall monitor the need to maintain any restriction.

Article 8 Review by the Data Protection Officer of the Commission

1.   The Data Protection Officer of the Commission shall be informed, without undue delay, whenever data subjects’ rights are restricted in accordance with this Decision. Upon request, the Data Protection Officer shall be provided with access to the record and any documents containing underlying factual and legal elements.

2.   The Data Protection Officer may request a review of the restriction. The Data Protection Officer shall be informed about the outcome of the requested review.

3.   The Commission shall document the involvement of the Data Protection Officer in each case where the application of rights and obligations referred to in Article 2(2) of this Decision is restricted.

Article 9 Entry into force

This Decision shall enter into force on the third day of its publication in the Official Journal of the European Union .