Decision of the Management Board of the Agency for Support for BEREC (BEREC Office) of 10 September 2019 laying down internal rules concerning restrictions of certain rights of data subjects in relation to the processing of personal data in the framework of activities carried out by the BEREC Office

This Decision lays down rules relating to the conditions under which the BEREC Office may restrict the application of Articles 14 to 20, 35 and 36, as well as Article 4 thereof based on Article 25 of the Regulation.

1 In accordance with Article 25(1) of the Regulation, the BEREC Office may restrict the application of Articles 14 to 20, 35 and 36, as well as Article 4 thereof, in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 20, when: (a) conducting administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings, on the basis of Annex IX to the Staff Regulations of Officials of the European Union and the Conditions of Employment of Other Servants of the European Union and in compliance with Decision MC/2012/3 by the Management Committee of the Office of the Body of European Regulators for Electronic Communications (BEREC Office) laying down general implementing provisions on the conduct of administrative inquiries and disciplinary procedures, which implies processing of information including personal data. Relevant restrictions may be based on Article 25(1)(c), (g), (h) of the Regulation; (b) ensuring that BEREC Office’s staff members may confidentially report facts where they believe there are serious irregularities in compliance with Decision No MC/2018/11 of the Management Committee of the Office of the Body of European Regulators for Electronic Communications (BEREC Office) laying down guidelines on whistleblowing of the BEREC Office. Relevant restrictions may be based on Article 25(1)(h) of the Regulation; (c) ensuring that BEREC Office’s staff members may confidentially report to confidential counsellors in the context of a harassment procedure in compliance with Decision No MC/2016/15 of the Management Committee of the Office of the Body of European Regulators for Electronic Communications (BEREC Office) on the policy on protecting the dignity of the person and preventing psychological harassment and sexual harassment. Relevant restrictions may be based on Article 25(1)(h) of the Regulation.

2 The categories of data include identification data of a natural person, contact information, professional roles and tasks, information on private and professional conduct and performance, and financial data.

3 Any restriction shall respect the essence of the fundamental rights and freedoms and be necessary and proportionate in a democratic society.

4 A necessity and proportionality test shall be carried out on a case-by-case basis before restrictions are applied. Restrictions shall be limited to what is strictly necessary to achieve the set objectives taking into account the risks to the rights and freedoms of the data subjects.

5 The BEREC Office shall file, for accountability purposes, a record describing the reasons for the restrictions applied, which grounds among those listed in paragraph 1 apply and the outcome of the necessity and proportionality test. Those records shall be part of an ad hoc register, which shall made available on request to the EDPS. A report on the application of Article 25 of the Regulation shall be made available periodically.

The assessment of the risks to the rights and freedoms of data subjects whose personal data may be subject to restrictions, as well as their retention period, are referenced in the record of the relevant processing activities in accordance with Article 31 of the Regulation and, if applicable, in relevant data protection impact assessments based on Article 39 of the Regulation.

The BEREC Office shall implement safeguards to prevent abuse or unlawful access or transfer of personal data that may be subject to restrictions. These safeguards shall include technical and organisational measures and be detailed, as necessary, in BEREC Office’s internal decisions, procedures and implementing rules. The safeguards shall include: (a) an adequate definition of roles, responsibilities and procedural steps; (b) if applicable, a secure electronic environment which prevents unlawful or accidental access or transfer of electronic data to unauthorised persons; (c) if applicable, secure storage and processing of paper-based documents. (d) due monitoring of restrictions and a periodical revision, which shall be done at least every six months. A revision must also be carried out when essential elements of the case at hand change. The restrictions shall be lifted as soon as the circumstances that justify them no longer apply.

1 The DPO of the BEREC Office shall be informed without undue delay whenever the data subject rights are restricted in accordance with this Decision and shall be provided access to the record and any documents underlying factual and legal elements.

2 The DPO of the BEREC Office may request to review the application of the restriction. The BEREC Office shall inform its DPO in writing about the outcome of the requested review.

3 The involvement of the DPO of the BEREC Office in the restrictions procedure, including information exchanges, shall be documented in the appropriate form.

1 The BEREC Office shall include in the data protection notices published on its website general information to the data subjects related to the potential restrictions of all data subjects’ rights described in Article 2(1) of this Decision. The information shall cover which rights may be restricted, the reasons and the potential duration of the restriction.

2 Additionally, the BEREC Office shall inform data subjects individually on present or future restrictions of their rights without undue delay and in a written form, as further specified in Articles 7, 8 and 9 of this Decision.

1 Where in the context of the activities mentioned in this Decision, the BEREC Office restricts, wholly or partly, their rights mentioned in Articles 14 to 16 and 35 of the Regulation, data subjects shall be informed of the principal reasons on which the application of the restriction is based, and of their right to lodge a complaint with the EDPS as well as seeking a judicial remedy before the Court of Justice of the European Union.

2 The BEREC Office may defer, omit or deny the provision of information concerning the reasons for the restriction referred to in paragraph 1 for as long as it would cancel the effect of the restriction. This assessment shall take place on a case-by-case basis.

1 Where in the context of the activities mentioned in this Decision, the BEREC Office restricts, wholly or partly, the right of access to personal data, the right to rectification, erasure, and restriction of processing, as referred to in Articles 17 to 20 respectively of the Regulation, it shall inform the data subject concerned, in its reply to their request, of the principal reasons on which the application of the restriction is based, and of the possibility of lodging a complaint with the EDPS or of seeking a judicial remedy before the Court of Justice of the European Union.

2 The BEREC Office may defer, omit or deny the provision of information concerning the reasons for the restriction referred to in paragraph 1 if it would cancel the effect of the restriction. This assessment shall take place on a case-by-case basis.

1 The BEREC Office, under exceptional circumstances, and in line with the provisions and the rationale of Directive 2002/58/EC of the European Parliament and of the Council , may restrict the right to confidentiality of electronic communications, as referred to in Article 36 of the Regulation. In this case, the BEREC Office shall detail circumstances, grounds, relevant risks and related safeguards in specific internal rules.

2 Where the BEREC Office restricts the right to confidentiality of electronic communications, it shall inform the data subject concerned, in its reply to their request, of the principal reasons on which the application of the restriction is based, and of the possibility of lodging a complaint with the EDPS or of seeking a judicial remedy before the Court of Justice of the European Union.

3 The BEREC Office may defer, omit or deny the provision of information concerning the reasons for the restriction referred to in paragraph 1 and 2 for as long as it would cancel the effect of the restriction. This assessment shall take place on a case-by-case basis.

This Decision shall enter into force on the day of its publication in the Official Journal of the European Union.