Communication of personal data breaches to data subjects
Article 6
1. Where the Commission is under an obligation to communicate a personal data breach pursuant to Article 35(1) of Regulation (EU) 2018/1725, it may, in exceptional circumstances, restrict such communication wholly or partly. It shall record and register the reasons for the restriction, the legal ground for it under Article 3, and an assessment of its necessity and proportionality. The record shall be communicated to the European Data Protection Supervisor at the time of the notification of the personal data breach. 2. Where the reasons for the restriction no longer apply, the Commission shall communicate the personal data breach to the data subject concerned and inform him or her of the principal reasons for the restriction and of his or her right to lodge a complaint with the European Data Protection Supervisor. 3. Where the Commission notifies the personal data breach to the European Data Protection Supervisor pursuant to Article 34(1) of Regulation (EU) 2018/1725, it shall include the record it made pursuant to Article 7 of this Decision.