Commission Decision (EU) 2026/1446 of 30 June 2026 laying down internal rules concerning the provision of information to data subjects and the restriction of certain data-subjects’ rights in relation to the processing of personal data by the Commission for the purpose of the investigation, enforcement and monitoring under Regulation (EU) 2022/1925 of the European Parliament and of the Council
Subject matter
1. This Decision lays down the internal rules to be followed by the Commission to inform data subjects of the processing of their personal data in accordance with Articles 14, 15 and 16 of Regulation (EU) 2018/1725 when carrying out its investigation, enforcement and monitoring, tasks under Regulation (EU) 2022/1925.
2. This Decision also lays down the conditions under which the Commission may restrict the application of Article 4, Articles 14 to 20 and Article 35 of Regulation (EU) 2018/1725, in accordance with Article 25(1), points (c), (g) and (h), thereof.
Scope
1. This Decision applies to the processing of personal data by the Commission of the following categories of data subjects:
(a)
legal representatives and staff members of gatekeepers, as defined in Article 2, point (1), of Regulation (EU) 2022/1925;
(b)
legal representatives and staff members of interested third parties;
(c)
witnesses;
(d)
whistleblowers;
(e)
natural persons whose personal data is contained in the documents or other media collected as part of investigation, enforcement and monitoring tasks in accordance with Regulation (EU) 2022/1925.
2. This Decision applies to the processing of personal data belonging to the following categories of personal data:
(a)
identification data;
(b)
contact details;
(c)
case involvement data;
(d)
case-related data;
(e)
any other information deemed necessary to fulfil the requirements under Regulation (EU) 2022/1925, including the personal data referred to in Article 10(1) of Regulation (EU) 2018/1725.
Provision of information to data subjects
1. The Commission shall publish on its relevant website a data protection notice that informs all data subjects of the Commission’s activities involving the processing of their personal data for the purpose of the investigation, enforcement and monitoring tasks pursuant to Regulation (EU) 2022/1925.
2. The data protection notice shall provide information on the potential restrictions of data subjects’ rights as set out in Article 4. The information shall specify which rights may be restricted, the grounds on which the restrictions may be applied and the potential duration of these restrictions and contain information of the right of data subjects to submit a complaint to the European Data Protection Supervisor.
3. The Commission shall individually inform, by appropriate means, whistleblowers, witnesses and legal representatives and staff members of gatekeepers and of interested third parties, about the processing of their personal data.
Restrictions
1. The Commission may restrict the application of Articles 14 to 20 and Article 35 of Regulation (EU) 2018/1725, as well as the application of the principles of lawfulness, fairness and transparency referred to in Article 4(1), point (a), of that Regulation, insofar as the provisions concerning the restrictions correspond to the rights and obligations provided for in Articles 14 to 20 of Regulation (EU) 2018/1725 where:
(a)
the exercise of those rights and obligations would jeopardise the Commission’s investigative, enforcement and monitoring tasks to ensure the effective application of Regulation (EU) 2022/1925, in accordance with Article 25(1), points (c) and (g), of Regulation (EU) 2018/1725;
(b)
the exercise of those rights and obligations would adversely affect the protection of the data subject or the rights and freedoms of others in accordance with Article 25(1), point (h), of Regulation (EU) 2018/1725;
(c)
the exercise of those rights and obligations could jeopardise the Commission's cooperation with the competent authorities of the Member States when exercising its tasks to ensure the effective application of Regulation (EU) 2022/1925, in accordance with Article 25(1), points (c) and (g), of Regulation (EU) 2018/1725.
2. Before applying restrictions in the circumstances referred to in paragraph 1, point (c), the Commission shall consult the competent authorities of the relevant Member States on potential grounds for imposing restrictions and the necessity and proportionality of those restrictions, unless such consultation would jeopardise the activities of the Commission.
3. Any restriction shall respect the essence of fundamental rights and freedoms and be necessary and proportionate in a democratic society.
4. Before the restrictions referred to in paragraph 1 are applied, the Commission shall carry out and document a case-by-case assessment of their necessity and proportionality. Those restrictions shall be limited to what is strictly necessary to achieve their objective.
Right of access by data subject, right to rectification, right of erasure and right to restriction of processing
1. Where the Commission restricts pursuant to Article 4, wholly or partly, the right of access to data subjects, the right to rectification, the right of erasure, or the right to restriction of processing as referred to in Articles 17 to 20, respectively, of Regulation (EU) 2018/1725, it shall inform the data subject concerned, in its reply to the request for access, rectification, erasure or restriction of processing of the following aspects:
(a)
the restriction applied and of the principal reasons thereof;
(b)
the possibility of lodging a complaint with the European Data Protection Supervisor.
2. The Commission may defer, omit or deny the provision of information concerning the reasons for a restriction and the right to submit a complaint to the European Data Protection Supervisor for as long as it would cancel the effect of the restriction. The Commission shall assess whether that is justified on a case-by-case basis. As soon as it no longer cancels the effect of the restriction, the Commission shall provide the information to the data subject.
Communication of personal data breaches to data subjects
1. Where the Commission is under an obligation to communicate a personal data breach under Article 35(1) of Regulation (EU) 2018/1725, it may, in exceptional circumstances, restrict such communication wholly or partly in accordance with Article 4 of this Decision. The Commission shall record and register the reasons for the restriction, the legal grounds for it under Article 4 and an assessment of its necessity and proportionality.
2. Where the reasons for the restriction no longer apply, the Commission shall communicate the personal data breach to the data subject concerned and inform them of the principal reasons for the restriction and of their right to submit a complaint to the European Data Protection Supervisor.
3. Where the Commission notifies the personal data breach to the European Data Protection Supervisor pursuant to Article 34(1) of Regulation (EU) 2018/1725, the Commission shall accompany the notification with the record it made pursuant to Article 7 of this Decision.
Recording and registering of restrictions
1. The Commission shall record the reasons for any restriction applied pursuant to this Decision, the legal grounds laid down in Article 4 for it, the details of the period of application of that restriction, an assessment of the risks to the rights and freedoms of data subjects of imposing a restriction and an assessment of the necessity and proportionality of the restriction.
2. The record shall state how the exercise of the right by the relevant data subject would undermine one or more of the applicable objectives set out in Article 25(1), points (c), (g), and (h), of Regulation (EU) 2018/1725.
3. The record and, where applicable, the documents containing the underlying factual and legal elements shall be registered. They shall be made available to the European Data Protection Supervisor on request.
Duration of restrictions
1. Restrictions referred to in Article 4 shall be applied as long as the reasons justifying them remain applicable.
2. Where the reasons for a restriction no longer apply, the Commission shall lift the restriction.
3. When a restriction is lifted, the Commission shall provide the reasons for applying that restriction to the data subject and inform them of the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking a judicial remedy in the Court of Justice of the European Union.
4. The Commission shall review the application of the restrictions referred to in Article 4 every six months. The review shall include an assessment of the necessity and proportionality of the restriction.
Safeguards and storage periods
1. The Commission shall implement safeguards to prevent abuse and unlawful access to or transfer of personal data in respect of which restrictions apply or could be applied. Such safeguards shall include the following technical and organisational measures:
(a)
a clear definition of roles, responsibilities, procedural steps and access rights;
(b)
a secure electronic environment which prevents unlawful or accidental access to or transfer of electronic data to unauthorised persons;
(c)
a secure storage and processing of paper documents limited to what is strictly necessary to achieve the purpose of processing;
(d)
due monitoring of restrictions.
2. The personal data shall be stored in accordance with the applicable Commission storage rules to be defined in the records of processing kept under Article 31 of Regulation (EU) 2018/1725. At the end of the storage period, the personal data shall be deleted, anonymised or transferred to the archives in accordance with Article 13 of Regulation (EU) 2018/1725.
Involvement of the Data Protection Coordinators and the Data Protection Officer of the Commission
1. The Data Protection Coordinators of the Directorate-General responsible for Competition and of the Directorate-General responsible for Communications Networks, Content and Technology shall be consulted before any restrictions are applied.
2. The Data Protection Coordinators of the Directorate-General responsible for Competition and of the Directorate-General responsible for Communications Networks, Content and Technology shall verify the compliance of the restrictions with this Decision.
3. The Data Protection Officer of the Commission shall be informed, without unnecessary delay, whenever data subjects' rights are restricted in accordance with this Decision. Upon request, the Data Protection Officer of the Commission shall be given access to the record and any documents containing the underlying factual and legal elements.
4. The Data Protection Officer of the Commission may request a review of the application of a restriction and shall be informed in writing of the outcome of such review.
5. The Commission shall document and register the involvement of the Data Protection Officer of the Commission and the Data Protection Coordinators, including what information is shared with them, in each case where a restriction referred to in Article 4(1) is applied.
Entry into force
This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
