Restriction of the rights of data subjects
Article 47
1. Where the exercise by a data subject of the right of access and the right to a restriction of processing referred to in Articles 15 and 18 of Regulation (EU) 2016/679 and Articles 17 and 20 of Regulation (EU) 2018/1725, or the communication of a data breach referred to in Article 34(1) of Regulation (EU) 2016/679 and Article 35(1) of Regulation (EU) 2018/1725, would jeopardise an ongoing investigation concerning a natural person in the field of customs, the performance of customs controls or the management of a specific risk identified in relation to a natural person in the field of customs, those rights may be wholly or partly restricted, provided that the restriction is necessary and proportionate. That restriction shall be imposed: (a) by the customs authorities in accordance with Article 23(1), points (c), (e), (f) and (h), of Regulation (EU) 2016/679; or (b) by the Commission and the EU Customs Authority in accordance with Article 25(1), points (a), (c), (e), and (g), of Regulation (EU) 2018/1725. 2. The customs authorities, the Commission and the EU Customs Authority shall assess the necessity and proportionality of the restrictions referred to in paragraph 1 on a case-by-case basis before they are applied, taking into consideration the potential risks to the rights and freedoms of the data subject. 3. When processing personal data received from other organisations in the context of their tasks, the customs authorities, the EU Customs Authority or the Commission, when acting as a controller or a joint controller, shall, before applying a restriction of the rights referred to in paragraph 1, consult those organisations on the potential grounds for such restriction and whether they are necessary and proportionate. 4. Where the customs authorities, the Commission or the EU Customs Authority restrict, wholly or partly, the rights referred to in paragraph 1, they shall take the following steps: (a) inform the data subject concerned, in their reply to the request, of the restriction applied and of the reasons for that restriction, and of the possibility of lodging a complaint with the national data protection authorities or the European Data Protection Supervisor or of seeking a judicial remedy in a national court or the Court of Justice of the European Union; and (b) record the reasons for the restriction, including an assessment of the necessity for and proportionality of that restriction, and the reasons why providing access would jeopardise risk management and customs controls. The provision of information referred to in the first subparagraph, point (a), of this paragraph may be deferred, omitted or denied in accordance with Article 25(8) of Regulation (EU) 2018/1725, or where the provision of that information would be prejudicial to the purposes of the restriction. 5. The customs authorities, the Commission or the EU Customs Authority shall include a section in the data protection notices published on its website or intranet providing general information to data subjects on the possibility of restriction of data subjects’ rights. 6. The Commission shall adopt implementing acts laying down safeguards to prevent the abuse of, unlawful access to, or transmission of the personal data in respect of which restrictions apply or could be applied. Such safeguards shall, inter alia, determine the roles and responsibilities of the various actors, lay down the procedural steps to be followed in relation to such restrictions, specify what constitutes due monitoring of restrictions, and provide for the periodic review of their application, which is to take place at least every six months. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 283(4).