Decision of the European Investment Fund of 4 June 2020 on internal rules concerning restrictions of certain rights of data subjects in relation to the processing of personal data in the framework of activities carried out by the European Investment Fund

The present Decision lays down rules relating to the conditions under which the EIF may restrict the application of Articles 14 to 20, 35 and 36, as well as Article 4 thereof based on Article 25 of the Regulation.

1 In accordance with Article 25(1) of the Regulation, the EIF may, on a case by case basis only, restrict the application of Articles 14 to 20, 35 and 36, as well as Article 4 thereof, in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 20, when: (a) conducting administrative inquiries, on the basis of the EIB Group Staff Code of Conduct and other applicable Codes of Conduct; (b) conducting investigations related to matters and occurrences directly relating to the DPO tasks, as per Article 45(2) of the Regulation; (c) conducting disciplinary proceedings, on the basis of Section 6 of the EIF Staff Regulations, Title IV of the Dignity at Work Policy, the EIB Group Staff Code of Conduct and other applicable EIF codes of conduct; (d) ensuring that EIF staff members may confidentially report facts where they believe there are serious irregularities as regulated by the EIB Group Whistleblowing Policy; (e) ensuring that EIF staff members may confidentially report facts where they believe there are suspicions of prohibited conduct, including fraud or corruption, detrimental to the interests of the Union, or conduct relating to the discharge of professional duties which may constitute a serious failure to comply with the EIF Staff members’ obligations, as regulated by the EIB Group Whistleblowing Policy, the EIF Anti-Fraud Policy, and the relevant EIF Codes of Conduct; (f) conducting investigations of Prohibited Conduct, as per the EIF’s Anti-Fraud Policy; (g) conducting internal audits in relation to all the activities and departments of the EIF; (h) providing or receiving assistance and cooperation to and from other Union institutions, bodies, offices and agencies, in the context of the abovementioned activities, as set out in relevant service level agreements, memoranda of understanding and cooperation agreements; (i) providing or receiving assistance and cooperation to and from EU Member States’ public authorities, upon their request or by its own initiative; (j) providing or receiving assistance and cooperation to and from third countries’ national authorities and international organisations, upon their request or by its own initiative.

2 The categories of data may include the identification data of a natural person, contact information, professional roles and tasks, information on private and professional conduct and performance, case involvement data and financial data.

3 The application of the abovementioned restrictions is without prejudice to the possible application of the provisions of Article 16(5) and 17(4) of the Regulation, relating, respectively, to the right of information when data have not been obtained from the data subject, and to the right of access by the data subject.

4 Any restriction shall respect the essence of the fundamental rights and freedoms and be necessary and proportionate in a democratic society, as addressed in the Regulation, corresponding regulatory acts or internal policies of EIF or EIB Group.

5 Any restriction shall be based on an express authorisation in an effective internal EIF policy or procedure and shall affect the rights of the data subject(s) concerned to the least extent possible, as confirmed by the DPO.

6 A necessity and proportionality test shall be carried out on a case-by-case basis and to the satisfaction of the DPO before restrictions are applied. Restrictions shall be limited to what is strictly necessary to achieve the set objectives. Restrictions shall only be established for the time any relevant ground under paragraph 1, which is referred to as motivation for the restriction, so requires, as is evidenced to the satisfaction of the DPO.

7 Where IG/IN restricts, wholly or partly, the provision of information to the data subjects relevant to an investigation (person concerned, witness or informant), it shall record the reasons for the restriction, including an assessment of the necessity and proportionality of the restriction. To that end, the record shall state how the provision of the information would jeopardise the purpose of IG/IN’s investigative activities, or of restrictions applied pursuant to Article 2(1)(f), (g) and (h) of this Decision, or would adversely affect the rights and freedoms of other data subjects. The record and, where applicable, the documents containing underlying factual and legal elements shall be registered. They shall be made available to the European Data Protection Supervisor (EDPS) on request.

8 The EIF, shall file, for accountability purposes, a record describing the reasons for the restrictions applied, which grounds among those listed in paragraph 1 apply and the outcome of the necessity and proportionality test. Those records shall be part of an ad hoc register, which shall be made available on request to the EDPS.

9 When processing personal data exchanged with other organisations in the context of its tasks, the EIF shall consult and shall be consulted by those organisations on the possible relevant grounds for imposing restrictions and the necessity and proportionality of the restrictions, unless this would jeopardise the activities of the EIF.

The assessment of the risks to the rights and freedoms of data subjects whose personal data may be subject to restrictions, as well as their retention period, are referenced in the record of the relevant processing activities in accordance with Article 31 of the Regulation and, if applicable, in relevant data protection impact assessments based on Article 39 of the Regulation.

The EIF shall implement safeguards to prevent abuse or unlawful access or transfer of personal data that may be subject to restrictions. These safeguards shall include technical and organisational measures and be detailed, as necessary, in EIF internal decisions, procedures and implementing rules. The safeguards shall include: (1) an adequate definition of roles, responsibilities and procedural steps; (2) if applicable, a secure electronic environment which prevents unlawful or accidental access or transfer of electronic data to unauthorised persons; (3) if applicable, secure storage and processing of paper-based documents; (4) due monitoring of restrictions and a periodical revision by the DPO, which shall be done at least every six months. A revision must also be carried out when essential elements of the case at hand change. The restrictions shall be lifted as soon as the circumstances that justify them no longer apply.

1 The DPO shall be informed without undue delay whenever the rights of any data subject are restricted in accordance with the present Decision and shall be provided full and unrestricted access to all records and any documents containing underlying factual and legal elements, which are relevant for the decision on the restriction and the monitoring of the maintenance of the restriction.

2 The DPO may request to review the application of the restriction.

3 Should the DPO, in the course of his or her own investigations, apply restrictions, he or she will inform the controller without undue delay.

4 The involvement of the DPO in the restrictions process, including information exchanges, shall be documented in the appropriate form and included in the relevant records and registers.

5 In the context of Prohibited Conduct Investigations, the EIB’s Fraud Investigations Division will consult the DPO prior to the application of certain grounds for restriction, referred to in Article 25 of the Regulation to data processing operations carried out in the framework of its tasks set out in the EIF’s Anti-Fraud Policy, the Fraud Investigations Division’s Charter and Investigations Procedures.

1 The EIF shall include in the data protection notices published on its website general information to the data subjects related to the potential restrictions of all data subjects’ rights described in Article 2(1). The information shall cover which rights may be restricted.

2 The EIF shall inform data subjects individually on present or future restrictions of their rights without undue delay and in a written form, as further specified in Articles 7, 8 and 9.

1 Where in the context of the activities mentioned in the present Decision, the EIF, restricts, wholly or partly, their rights of data subjects referred to in Articles 14 to 16 and 35 of the Regulation, data subjects shall be informed of the principal reasons on which the application of the restriction is based, and of their right to lodge a complaint with the EDPS as well as seeking a judicial remedy before the Court of Justice of the European Union. Such restriction shall follow the rules established and the process described in the present Decision.

2 The EIF may defer, omit or deny the provision of information concerning the reasons for the restriction referred to in paragraph 1 to the extent that and for as long as it would jeopardise the purpose of the restriction. This assessment shall take place on a case-by-case basis. Any such deferral or denial must be adequately justified to the satisfaction of the DPO and will be included in the relevant records and registers. For the avoidance of doubt, data subjects concerned shall be informed of their rights to lodge a complaint with the EDPS as well as seeking a judicial remedy before the Court of Justice of the European Union against the decision to defer or deny them the provision of the information referred to under paragraph 1 above.

1 Where in the context of the activities mentioned in the present Decision, the EIF restricts, wholly or partly, the right of access to personal data, the right to rectification, erasure, and restriction of processing, as referred to in Articles 17 to 20 respectively of the Regulation, it shall inform the data subject concerned, in its reply to the request, of the principal reasons on which the application of the restriction is based, and of the possibility of lodging a complaint with the EDPS or of seeking a judicial remedy before the Court of Justice of the European Union.

2 Where the right of access is wholly or partly restricted, the EIF, when investigating the request, shall only inform the data subject of whether the data have been processed correctly and, if not, whether any necessary corrections have been made, in accordance with Article 25(7) of the Regulation.

3 The EIF may defer, omit or deny the provision of information concerning the reasons for the restriction referred to in paragraph 1 and 2 to the extent that and for as long as it would jeopardise the purpose of the restriction. This assessment shall take place on a case-by-case basis and shall follow the rules established and the process described in the present Decision.

1 The EIF, under exceptional circumstances, and in line with the provisions and the rationale of Directive 2002/58/EC of the European Parliament and of the Council , may restrict the right to confidentiality of electronic communications, as referred to in Article 36 of the Regulation. In this case, the EIF shall detail circumstances, grounds, relevant risks and related safeguards in specific internal rules.

2 Where the EIF restricts the right to confidentiality of electronic communications, it shall inform the data subject concerned, in its reply to their request, of the principal reasons on which the application of the restriction is based, and of the possibility of lodging a complaint with the EDPS or of seeking a judicial remedy before the Court of Justice of the European Union.

3 The EIF may defer, omit or deny the provision of information concerning the reasons for the restriction referred to in paragraph 1 and 2 for as long as it would cancel the effect of the restriction. This assessment shall take place on a case-by-case basis.

The present Decision and any amendments thereto shall be approved by the EIF Board of Directors and shall enter into force on the twentieth day after its publication in the Official Journal of the European Union.