Decision of the Authority for European political parties and European political foundations of 18 May 2021 adopting rules concerning the implementation of Regulation (EU) 2018/1725 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data by the Union Institutions, Bodies, Offices and Agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, in relation to the restriction of certain rights of data subjects in accordance with Article 25 of that Regulation 2021/C 257 I/01

This Decision lays down internal rules pursuant to which the Authority for European political parties and European political foundations (the ‘Authority’) may apply exceptions, derogations or restrictions with regard to the rights of data subjects according to Article 25 of Regulation (EU) 2018/1725.

1 The Authority determines the purposes and means of the processing of personal data and therefore acts as controller in respect to those data within the meaning of Article 3(8) of Regulation (EU) 2018/1725, and as referred to in Article 25(2)(e) of that Regulation.

2 Where the Authority and at least one other entity, including Union Institutions and bodies, determine the purposes and means of a given processing operation, the competent actors shall be considered to be joint controllers within the meaning of Article 28(1) of Regulation (EU) 2018/1725.

3 The controller shall be responsible for ensuring that processing operations are carried out in compliance with Regulation (EU) 2018/1725 and must be able to demonstrate compliance with that Regulation. In particular, the controller shall be responsible for: (a) implementing appropriate technical and organisational measures in view of the application of the data protection by design and by default principles, (b) giving the staff under its authority suitable instructions for ensuring that processing is lawful, fair, transparent and confidential and providing an appropriate level of security in view of the risks which processing entails, (c) cooperating with the Data Protection Officer and the European Data Protection Supervisor in the performance of its respective duties, in particular by sending information to them in reply to their requests, (d) informing and involving in a timely manner the Data Protection Officer notably in projects regarding new data processing operations or significant modifications to existing operations.

1 Before applying a restriction pursuant to Section 2 of this Chapter, the controller shall consider whether any of the exceptions laid down in Regulation (EU) 2018/1725 apply, notably those pursuant to Articles 15(4), 16(5), 19(3) and 35(3) of that Regulation.

2 For processing for archiving purposes in the public interest as well as for processing for scientific or historical research purposes or statistical purposes, the controller shall consider whether the exceptions pursuant to Articles 16(5), point (b), and 19(3), point (d), of Regulation (EU) 2018/1725 apply.

1 For processing for archiving purposes in the public interest, the controller may apply derogations in accordance with Article 25(4) of Regulation (EU) 2018/1725. To that end, the controller may derogate from the rights referred to in Articles 17, 18, 20, 21, 22 and 23 of Regulation (EU) 2018/1725 in accordance with the conditions provided for in Article 25(4) of that Regulation.

2 For processing for scientific or historical research purposes or statistical purposes, the controller may apply derogations in accordance with Article 25(3) of Regulation (EU) 2018/1725. To that end, the controller may derogate from the rights referred to in Articles 17, 18, 20 and 23 of Regulation (EU) 2018/1725 in accordance with the conditions provided for in Article 25(3) of that Regulation.

3 Such derogations shall be subject to appropriate safeguards in accordance with Article 13 of Regulation (EU) 2018/1725 and Article 6(1) and (2) of this Decision. Technical and organisational measures shall be in place to ensure the respect of data minimisation and, where applicable, pseudonymisation.

1 This Section lays down the general conditions under which the controller may restrict the application of Articles 14 to 21, 35 and 36 of Regulation (EU) 2018/1725, as well as Article 4 thereof in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 21 of that Regulation, in accordance with Article 25 thereof. The general conditions referred to in subparagraph one are complemented by the provisions of the Annexes to this Decision, which specify the conditions under which the Authority may restrict rights of the data subjects in each of its activities and procedures where personal data is being processed and restrictions might become necessary.

2 This Section applies to the processing of personal data for the purposes of the activities and procedures carried out by the Authority, as specified in the Annexes to this Decision.

1 Personal data subject to a restriction shall be stored in a secure physical or electronic environment which prevents unlawful access or transfer of data to persons who do not have a need to know.

2 Before applying any restriction, an assessment of whether the restriction is necessary and proportional, as well as of the risks to data subjects, shall be carried out in accordance with Article 12 of this Decision.

1 Subject to Articles 8 to 13 and to the specifications laid down in the applicable Annexes to this Decision, the controller may apply restrictions with regard to those rights of the data subject explicitly referred to in the applicable Annexes, where the exercise of those rights would jeopardise the purpose of one of the activities or procedures laid down in those Annexes.

2 Where it applies a restriction, and in particular where it defers, omits or denies, wholly or partly, the exercise of a data subject right, the controller shall proceed in accordance with Article 12 of this Decision.

1 Where the controller restricts the right of information, as referred to in Articles 15 and 16 of Regulation (EU) 2018/1725, data subjects shall be informed, in accordance with Article 25(6) of that Regulation, of the principal reasons on which the application of the restriction is based and of their right to lodge a complaint with the European Data Protection Supervisor.

2 However, such provision of information may, following a case-by-case assessment, be deferred, omitted or denied, in accordance with Article 25(8) of Regulation (EU) 2018/1725, for as long as it would cancel the effect of the restriction. As soon as the provision of this information would no longer cancel the effect of the restriction, the information shall be provided to the data subject.

1 Where the controller restricts, wholly or partly, the right of access to personal data by data subjects, the right to rectification, the right to erasure or the right to restriction of processing as referred to in Articles 17, 18, 19 and 20 respectively of Regulation (EU) 2018/1725 as well as the notification obligation pursuant to Article 21 of that Regulation, it shall inform the data subject concerned, in its reply to the request for access, rectification, erasure or restriction of processing, of the restriction that has been applied and of the principal reasons for the restriction and of the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking a judicial remedy before the Court of Justice of the European Union (‘the Court of Justice’).

2 The provision of information concerning the reasons for the restriction referred to in paragraph 1 may, following a case-by-case assessment, be deferred, omitted or denied for as long as it would cancel the effect of the restriction. As soon as the provision of this information would no longer cancel the effect of the restriction, the information shall be provided to the data subject.

3 Where the right of access is wholly or partly restricted and the data subject has exercised his or her right to lodge a complaint with the European Data Protection Supervisor, the data subject, and only he or she, shall be informed by the European Data Protection Supervisor of whether the data have been processed correctly and, if not, whether any corrections have been made in accordance with Article 25(7) of Regulation (EU) 2018/1725.

Where it restricts the application of Article 35 of Regulation (EU) 2018/1725, the controller shall proceed in accordance with Article 12 of this Decision. If the communication of a data breach to the data subject is restricted on this basis, this shall be documented in a note and the note shall be communicated to the European Data Protection Supervisor at the time of the notification of the personal data breach.

Where it restricts the obligation to ensure confidentiality of electronic communications referred to in Article 36 of Regulation (EU) 2018/1725, the controller shall proceed in accordance with Article 12 of this Decision.

1 Before applying any particular restrictions, the controller shall assess on case-by-case basis whether the restrictions are necessary and proportionate, taking into account Article 25(2) and (8) of Regulation (EU) 2018/1725.

2 That assessment shall state in writing the reasons for any restriction applied pursuant to this Decision and include an examination of the risks to the rights and freedoms of the data subjects concerned, notably the risk that their personal data might be further processed without their knowledge and that they might be prevented from exercising their rights in accordance with Regulation (EU) 2018/1725, and of how the exercise of the data subjects' rights would jeopardise the purpose of one of the activities or procedures carried out by the Authority, as defined in the Annexes to this Decision.

3 The assessments shall be stored in a central register and be made available to the European Data Protection Supervisor on request.

4 Where the controller restricts the right to confidentiality of electronic communications referred to in Article 36 of Regulation (EU) 2018/1725 under this Article, the controller shall inform the data subject concerned, in reply to any request from the data subject, of the principal reasons on which the application of the restriction is based and the right to lodge a complaint with the European Data Protection Supervisor.

5 The provision of information referred to in paragraph 4 may, following a case-by-case assessment, be deferred, omitted or denied for as long as it would cancel the effect of the restriction. As soon as the provision of this information would no longer cancel the effect of the restriction, the information shall be provided to the data subject.

1 Restrictions referred to in this Decision, read in conjunction with the applicable Annexes to this Decision, shall apply as long as the reasons justifying them remain applicable.

2 Where the reasons for a restriction referred to in this Decision, read in conjunction with the applicable Annexes to this Decision, no longer exist, the controller shall lift the restriction. At the same time, the controller shall provide the data subject with the principal reasons for the restriction and inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor at any time or of seeking a judicial remedy before the Court of Justice.

3 The controller shall review the application of restrictions referred to in this Decision, read in conjunction with the applicable Annexes to this Decision, every six months from its adoption and at the closure of the relevant procedure. Thereafter, for the purposes of the activities and procedures laid down in Annexes I, II, III, IV, V, VI, VII and VIII to this Decision, the controller shall monitor the need to maintain any restriction on an annual basis.

1 The Data Protection Officer shall be informed, without undue delay, whenever data subjects' rights are restricted in accordance with this Section. The Data Protection Officer shall, to the extent possible, be consulted before and throughout the restriction procedure and be involved in the assessment. The involvement of the Data Protection Officer shall be documented in a note to be produced by the controller. The note shall document the information that was shared with the Data Protection Officer. Upon request, the Data Protection Officer shall be provided with access to any documents containing underlying factual and legal elements.

2 The Data Protection Officer may request from the controller a review of the restrictions. The Data Protection Officer shall be informed in writing of the outcome of the requested review.

The Annexes to this Decision form an integral part of this Decision.

This Decision shall enter into force on the day following that of its publication in the Official Journal of the European Union.