Applicable exceptions and restrictions
1. Where the Commission exercises its duties with respect to data subjects’ rights pursuant to Regulation (EU) 2018/1725, it shall consider whether any of the exceptions laid down in that Regulation apply.
2. Subject to Articles 14 to 18 of this Decision, the Commission may restrict the application of Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725, as well as the principle of transparency laid down in Article 4(1)(a) of that Regulation insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19 and 20 of Regulation (EU) 2018/1725, where the exercise of those rights and obligations would jeopardise the purpose of the DPO tasks, inter alia, by revealing its investigative or auditing tools and methods, or would adversely affect the rights and freedoms of other data subjects in accordance with Article 25(1)(c), (g) and (h).
3. Subject to Articles 14 to 18 of this Decision, the Commission may restrict the rights and obligations referred to in paragraph 2 of this Article, in relation to personal data obtained by the DPO from Commission services, or other Union institutions and bodies. The Commission may do so where the exercise of those rights and obligations could be restricted by those Commission services, Union institutions or bodies on the basis of other acts provided for in Article 25 of Regulation (EU) 2018/1725 or in accordance with Chapter IX of that Regulation or in accordance with Regulation (EU) 2016/794 of the European Parliament and of the Council ( 6 ) or Council Regulation (EU) 2017/1939 ( 7 ) .
Before applying restrictions in the circumstances referred to in the first subparagraph, the Commission shall consult the relevant Union institution or bodies unless it is clear to the Commission that the application of a restriction is provided for by one of the acts referred to in that subparagraph.
4. Any restriction of the application of rights and obligations, referred to in paragraph 2 of this Article, shall be necessary and proportionate taking into account the risks to the rights and freedoms of data subjects.
Provision of information to data subjects
1. The Commission shall publish, on its website, data protection notices that inform all data subjects of the DPO tasks involving processing of their personal data.
2. The Commission shall individually inform, in an appropriate format, any natural person whom it considers a person concerned by the DPO tasks or an informant.
3. Where the Commission restricts, wholly or partly, the provision of the information to data subjects referred to in paragraph 2, the Commission shall record and register the reasons for the restriction, in accordance with Article 17.
Right to access by data subjects, right to erasure and right to restriction of processing
1. Where the Commission restricts, wholly or partly, the right of access to personal data by data subjects, the right to erasure, or the right to restriction of processing as referred to in Articles 17, 19 and 20 respectively of Regulation (EU) 2018/1725, it shall inform the data subject concerned, in its reply to the request for access, erasure or restriction of processing of the restriction applied and of the principal reasons therefor, and of the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking a judicial remedy in the Court of Justice of the European Union.
2. The provision of information concerning the reasons for the restriction referred to in paragraph 1 may be deferred, omitted or denied for as long as it would undermine the purpose of the restriction.
3. The Commission shall record and register the reasons for the restriction in accordance with Article 17.
4. Where the right of access is wholly or partly restricted, the data subject is entitled to exercise his or her right of access through the intermediary of the EDPS, in accordance with Article 25(6), (7) and (8) of Regulation (EU) 2018/1725.
Communication of a personal data breach to the data subject
Where the Commission restricts the communication of a personal data breach to the data subject, as referred to in Article 35 of Regulation (EU) 2018/1725, it shall record and register the reasons for the restriction in accordance with Article 17 of this Decision.
Recording and registering of restrictions
1. The Commission shall record the reasons for any restriction applied pursuant to this Decision, including a case-by-case assessment of the necessity and proportionality of the restriction taking into account the relevant elements in Article 25(2) of Regulation (EU) 2018/1725.
To that end, the record shall state how the exercise of the right would jeopardise the purpose of the DPO tasks under this Decision, or of restrictions applied pursuant to Article 13(2) or (3), or would adversely affect the rights and freedoms of other data subjects.
2. The record and, where applicable, the documents containing underlying factual and legal elements shall be registered. They shall be made available to the EDPS on request.
Duration of restrictions
1. Restrictions referred to in Articles 14, 15 and 16 shall continue to apply as long as the reasons justifying them remain applicable.
2. Where the reasons for a restriction referred to in Article 14 or 16 no longer apply, the Commission shall lift the restriction and provide the reasons for the restriction to the data subject. At the same time, the Commission shall inform the data subject of the possibility of lodging a complaint with the EDPS at any time or of seeking a judicial remedy in the Court of Justice of the European Union.
3. The Commission shall review the application of the restrictions referred to in Articles 14 and 16 every six months from their adoption and in any case at the closure of the relevant DPO activity. Thereafter, the Commission shall monitor the need to maintain any restriction or deferral on an annual basis.
Review by the Data Protection Officer
1. Where other Commission services conclude that a data subject’s rights should be restricted pursuant to this Decision, they shall inform the DPO. They shall also provide the DPO with access to the record and any documents containing underlying factual and legal elements.
2. The DPO may request that the delegated controller of the Commission service concerned review the application of the restrictions. The delegated controller of the Commission service concerned shall inform the DPO in writing about the outcome of the requested review.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
