Exceptions and restrictions
1. Where the Council or the GSC exercises its duties with regard to data subjects’ rights pursuant to Regulation (EU) 2018/1725, it shall consider whether any of the exceptions laid down in that Regulation apply.
2. Subject to Articles 18 to 22 of this Decision, the Council or the GSC may restrict, in accordance with Article 25(1), points (c), (g) and (h), of Regulation (EU) 2018/1725, the application of Articles 14 to 17, 19, 20 and 35 of that Regulation, as well as the principle of transparency laid down in Article 4(1), point (a), of that Regulation insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19 and 20 of that Regulation, where the exercise of those rights and obligations would jeopardise the exercise of the DPO tasks, inter alia, by revealing its investigative or auditing tools and methods, or would adversely affect the rights and freedoms of other data subjects.
3. Subject to Articles 18 to 22 of this Decision, the Council or the GSC may restrict the rights and obligations referred to in paragraph 2 of this Article, in relation to personal data obtained by the DPO from GSC directorates-general or services or other Union institutions or bodies. The Council or the GSC may do so where the exercise of those rights and obligations could be restricted by those GSC directorates-general or services or other institutions or bodies on the basis of other acts provided for in Article 25 of Regulation (EU) 2018/1725 or in accordance with Chapter IX of that Regulation or in accordance with Regulation (EU) 2016/794 of the European Parliament and of the Council ( 10 ) or Council Regulation (EU) 2017/1939 ( 11 ) .
Before applying restrictions in the circumstances referred to in the first subparagraph, the Council or the GSC shall consult the relevant Union institution or body, unless it is clear that the application of a restriction is provided for by one of the acts referred to in that subparagraph.
4. Any restriction of the rights and obligations referred to in paragraph 2 shall be necessary and proportionate, taking into account the risks to the rights and freedoms of data subjects.
Provision of information to data subjects
1. The GSC shall publish on the Council’s website data protection notices that inform data subjects of the DPO tasks involving the processing of their personal data.
2. The GSC shall individually inform, in an appropriate format, any natural person whom it considers a person concerned by the DPO tasks.
3. Where the GSC restricts, wholly or partly, the provision of information to data subjects referred to in paragraph 2 of this Article, the GSC shall record and register the reasons for the restriction, in accordance with Article 21.
Right of access by data subjects, right to erasure and right to restriction of processing
1. Where the Council or the GSC restricts, wholly or partly, the right of access to personal data by data subjects, the right to erasure or the right to restriction of processing as referred to in Articles 17, 19 and 20, respectively, of Regulation (EU) 2018/1725, it shall inform the data subject concerned, in its reply to a request for access, erasure or restriction of processing of the restriction applied and of the principal reasons therefor, and of the possibility of lodging a complaint with the EDPS or of seeking a judicial remedy before the Court of Justice of the European Union.
2. The provision of information concerning the reasons for the restriction referred to in paragraph 1 may be deferred, omitted or denied for as long as it would undermine the purpose of the restriction. The Council shall provide the information to the data subject as soon as such information would not undermine that purpose.
3. The GSC shall record and register the reasons for the restriction in accordance with Article 21.
Communication of a personal data breach to the data subject
Where the Council or the GSC restricts the communication of a personal data breach to the data subject as referred to in Article 35 of Regulation (EU) 2018/1725, the GSC shall record and register the reasons for the restriction in accordance with Article 21 of this Decision.
Recording and registering of restrictions
1. The GSC shall record the reasons for any restriction applied pursuant to this Decision, including a case-by-case assessment of the necessity and proportionality of the restriction, taking into account the relevant elements of Article 25(2) of Regulation (EU) 2018/1725.
To that end, the record shall state how the exercise of any of the rights referred to in Articles 14 to 17, 19, 20 and 35 of that Regulation, or of the principle of transparency laid down in Article 4(1), point (a), thereof, would jeopardise the DPO activities under this Decision, or the restrictions applied pursuant to Article 17(2) or (3) of this Decision, or would adversely affect the rights and freedoms of other data subjects.
2. The record and, where applicable, the documents containing underlying factual and legal elements shall be registered. They shall be made available to the EDPS on request.
Duration of restrictions
1. Restrictions referred to in Articles 18, 19 and 20 shall continue to apply as long as the reasons justifying them remain applicable.
2. Where the reasons for a restriction referred to in Articles 18 and 20 no longer apply, the GSC shall lift the restriction and provide the reasons for the restriction to the data subject. At the same time, the GSC shall inform the data subject of the possibility of lodging a complaint with the EDPS at any time or of seeking judicial remedy before the Court of Justice of the European Union.
3. The GSC shall review the application of the restrictions referred to in Articles 18 and 20 every six months after their adoption and in any case at the completion of the relevant DPO task. After the completion, the GSC shall monitor the need to maintain any restriction or deferral on an annual basis.
Review by the DPO
1. Where other GSC directorates-general or services conclude that a data subject’s rights should be restricted pursuant to this Decision, they shall inform the DPO. They shall also provide the DPO with access to the record and any documents containing underlying factual and legal elements. The involvement of the DPO in the application of restrictions shall be documented in detail.
2. The DPO may request that the delegated controller concerned review the application of the restrictions. The delegated controller concerned shall inform the DPO in writing about the outcome of the requested review.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
