Applicable exceptions and restrictions
Article 13
1. Where the Commission exercises its duties with respect to data subjects’ rights pursuant to Regulation (EU) 2018/1725, it shall consider whether any of the exceptions laid down in that Regulation apply. 2. Subject to Articles 14 to 18 of this Decision, the Commission may restrict the application of Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725, as well as the principle of transparency laid down in Article 4(1)(a) of that Regulation insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19 and 20 of Regulation (EU) 2018/1725, where the exercise of those rights and obligations would jeopardise the purpose of the DPO tasks, inter alia, by revealing its investigative or auditing tools and methods, or would adversely affect the rights and freedoms of other data subjects in accordance with Article 25(1)(c), (g) and (h). 3. Subject to Articles 14 to 18 of this Decision, the Commission may restrict the rights and obligations referred to in paragraph 2 of this Article, in relation to personal data obtained by the DPO from Commission services, or other Union institutions and bodies. The Commission may do so where the exercise of those rights and obligations could be restricted by those Commission services, Union institutions or bodies on the basis of other acts provided for in Article 25 of Regulation (EU) 2018/1725 or in accordance with Chapter IX of that Regulation or in accordance with Regulation (EU) 2016/794 of the European Parliament and of the Council ( 6 ) or Council Regulation (EU) 2017/1939 ( 7 ) . Before applying restrictions in the circumstances referred to in the first subparagraph, the Commission shall consult the relevant Union institution or bodies unless it is clear to the Commission that the application of a restriction is provided for by one of the acts referred to in that subparagraph. 4. Any restriction of the application of rights and obligations, referred to in paragraph 2 of this Article, shall be necessary and proportionate taking into account the risks to the rights and freedoms of data subjects.