Decision of the Steering Committee of the European Health and Digital Executive Agency on internal rules concerning restrictions of certain rights of data subjects in relation to the processing of personal data in the framework of activities carried out by the Agency

1 This Decision lays down rules relating to the conditions under which the European Health and Digital Executive Agency (HaDEA) and any of its legal successor (‘the Agency’) may restrict the application of Articles 4, 14 to 22, 35 and 36, pursuant to Article 25 of the Regulation.

2 The Agency, as the Data controller, is represented by the Director of the Agency, who may delegate further the function of the Data controller.

1 The Agency may restrict the application of Articles 14 to 22, 35 and 36, as well as Article 4 of the Regulation in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 20.

2 This Decision applies to the processing of personal data by the Agency within the framework of its administrative and operational functioning: (a) pursuant to Article 25(1)(b), (c), (f), (g) and (h) of the Regulation when conducting internal investigations, including based on external complaints, administrative inquiries, pre-disciplinary, disciplinary or suspension proceedings under Article 86 and Annex IX to the Staff Regulations and its implementing rules, security investigations or OLAF investigations; (b) pursuant to Article 25(1)(h) of the Regulation, when ensuring that Agency’s staff members may report facts confidentially where they believe there are serious irregularities, as set out in the internal rules or policies concerning whistleblowing; (c) pursuant to Article 25(1)(h) of the Regulation, when ensuring that Agency’s staff members are able to report to confidential counsellors in the context of a harassment procedure, as defined by internal rules; (d) pursuant to Article 25(1)(c), (g) and (h) of the Regulation, when conducting internal or external audits in relation to activities or the functioning of the Agency; (e) pursuant to Article 25(1)(d) and (h) of the Regulation, when ensuring security analyses, including cyber security and IT system abuses, handled internally or with external involvement (e.g. CERT-EU), ensuring internal security by means of video surveillance, access control and investigation purposes, securing communication and information systems and carrying out technical security counter measures; (f) pursuant to Article 25(1)(g) and (h) of the Regulation, when the Data Protection Officer (‘DPO’) of the Agency investigates matters directly related to the his/her tasks; (g) pursuant to Article 25(1)(b), (g) and (h) of the Regulation, in the context of investigations from the European Public Prosecutor Office (EPPO); (h) pursuant to Article 25(1)(h) of the Regulation, when individuals request to access or rectify their medical data, including if they are held by the Commission’s Medical Service; (i) pursuant to Article 25(1)(c), (d), (g) and (h) of the Regulation, when providing or receiving assistance to or from other Union institutions, bodies, offices and agencies or cooperating with them in the context of activities under points (a) to (h) of this paragraph and pursuant to relevant service level agreements, memoranda of understanding and cooperation agreements of their respective establishment act; (j) pursuant to Article 25(1)(c), (g) and (h) of the Regulation, when providing or receiving assistance to or from third countries national authorities and international organisations or cooperating with such authorities and organisations, either at their request or on its own initiative; (k) pursuant to Article 25(1)(c), (g) and (h) of the Regulation, when providing or receiving assistance and cooperation to and from EU Member States’ public authorities, either at their request or on its own initiative; (l) pursuant to Article 25(1)(e) of the Regulation, when processing personal data in documents obtained by the parties or interveners in the context of proceedings before the Court of Justice of the European Union. For the purpose of this Decision, the above activities shall include preparatory and follow-up actions directly related to the same activity.

3 The Agency may also apply restrictions on a case-by-case basis to data subjects' rights referred to in this Decision, in the following circumstances: (a) where the Commission services or other Union institutions, bodies, agencies and offices are entitled to restrict the exercise of the listed rights and the purpose of such a restriction by that Commission Service, Union institution, body or agency would be jeopardised where the Agency does not apply an equivalent restriction in respect of the same personal data; (b) where the competent authorities of Member States are entitled to restrict the exercise of the listed rights and the purpose of such a restriction by that Member State authority would be jeopardised where the Agency does not apply an equivalent restriction in respect of the same personal data; (c) where the exercise of those rights and obligations would jeopardise the Agency’s cooperation with third countries or international organisations in the conduct of its tasks, unless this need to cooperate is overridden by the interests or fundamental rights and freedoms of the data subject; (d) Before applying restrictions under this paragraph, the Agency shall consult where necessary the relevant Commission services, other Union institutions, bodies, agencies, offices, international organisations or the competent authorities of Member States, unless it is clear that the restriction is provided for by one of the acts referred to above or such a consultation would jeopardise the Agency’s activities.

4 The categories of personal data processed related to the above activities may contain factual ‘hard’ data and ‘soft’ assessment data.

5 Any restriction shall respect the essence of fundamental rights and freedoms and be necessary and proportionate in a democratic society.

1 The Data controller shall draw up a record of the restriction describing: (a) the reasons for any restriction applied pursuant to this Decision; (b) which grounds among those listed in Article 2 apply; (c) how the exercise of the right would present a risk for the data subject or would jeopardise the purpose of the Agency's tasks or would adversely affect the rights and freedoms of other data subjects; (d) outcome of the assessment of the necessity and proportionality of the restriction, taking into account the relevant elements in Article 25(2) of the Regulation.

2 A necessity and proportionality test of a restriction shall be carried out on a case-by-case basis before restrictions are applied. The Data controller shall consider the potential risks to the rights and freedoms of the data subject. Restrictions shall be limited to what is strictly necessary to achieve their objective.

3 The record of the restriction and, where applicable, the documents containing underlying factual and legal elements shall be registered. They shall be made available to the European Data Protection Supervisor on request.

1 Assessments of the risks to the rights and freedoms of data subjects of imposing restrictions and details of the period of application of those restrictions shall be registered in the record of processing activities maintained by the data controller based on Article 31 of the Regulation. They shall also be recorded in any data protection impact assessments regarding those restrictions conducted under Article 39 of the Regulation, when applicable.

2 Where the data controller considers applying a restriction, the risk to the rights and freedoms of the data subject shall be weighed, in particular, against the risk to the rights and freedoms of other data subjects and the risk of negatively impacting investigations or procedures, for example, by destroying evidence. The risks to the rights and freedoms of the data subject concern primarily, but are not limited to, reputational risks and risks to the right of defence and the right to be heard.

1 The Agency shall put in place specific safeguards to prevent abuse and unlawful access or transfer of personal data in respect of which restrictions apply or could be applied. Such safeguards shall include technical and organisational measures and be detailed as necessary in the Agency’s internal decisions, procedures and implementing rules. These safeguards shall include: (a) a clear definition of roles, responsibilities and procedural steps; (b) if appropriate, a secure electronic environment which prevents unlawful and accidental access or transfer of electronic data to unauthorised persons; (c) if appropriate, secure storage and processing of paper-based documents; (d) ensure compliance with confidentiality obligations for all persons having access to the personal data.

2 The retention period of personal data under a restriction shall be defined in the related record under Article 31 of the Regulation taking into account the purpose of the processing and shall include the timeframe necessary for administrative and judicial review. At the end of the retention period, the personal data shall be deleted, anonymised or transferred to archives in accordance with Article 13 of the Regulation.

1 Restrictions referred to in Article 2 shall continue to apply as long as the reasons justifying them remain applicable.

2 Where the reasons for a restriction no longer apply, the Data controller shall lift the restriction if the exercise of the restricted right would no longer negatively impact the relevant applicable procedure or adversely affect the rights or freedoms of other data subjects.

3 In case the data subject has asked again for access to the personal data concerned, the Data controller shall provide the principal reasons for the restriction to the data subject. At the same time, the Agency shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor at any time or of seeking a judicial remedy in the Court of Justice of the European Union.

4 The Agency shall review the application of the restrictions referred to in Article 2 every six months.

1 The data controller of the Agency shall inform the DPO of the Agency without undue delay and prior to any decision to restrict data subject rights in accordance with this Decision or to extend the application of the restriction. The data controller shall provide the DPO access to the associated records and any document concerning the factual or legal context.

2 The DPO may request the data controller to review the application of a restriction. The data controller shall inform the DPO in writing of the outcome of the requested review.

3 The data controller shall document the involvement of the DPO in the application of the restriction, including what information is shared. The documents under this Article shall be part of the record related to the restriction and made available to the EDPS on request.

1 The data controller shall include in the data protection notices and records under Article 31 of the Regulation, published on its website and on the Intranet general information on the potential restrictions of data subjects' rights pursuant to Article 2(2) of this Decision. The information shall cover which rights and obligations may be restricted, the grounds on which restrictions may be applied and their potential duration.

2 The data controller shall inform data subjects individually, in writing and without undue delay of ongoing or future restrictions of their rights. The data controller shall inform the data subject of the principal reasons on which the application of the restriction is based, of their right to consult the DPO with a view to challenging the restriction and of their rights to lodge a complaint with the EDPS.

3 The data controller may defer, omit or deny the provision of information concerning the reasons for a restriction and the right to lodge a complaint with the EDPS for as long as it would cancel the effect of the restriction. The assessment of this justification shall take place on a case-by-case basis and the data controller shall provide the information to the data subject, as soon as this would no longer cancel the effect of the restriction.

1 In duly justified cases and under the conditions stipulated in this Decision, the right to access under Article 17 of the Regulation may be restricted by the data controller where necessary and proportionate with regards to the activities under this Decision.

2 Where data subjects request access to their personal data processed in the context of a specific processing activity referred to in Article 2(2) of this Decision, the Agency shall limit its response to the personal data processed for that activity.

3 The data subjects rights to directly access the documents of a psychological or psychiatric nature may be restricted. Neither indirect access, nor the right to rectification and communication of a personal data breach shall be limited with these internal rules. Therefore, an intermediary physician should be granted access on request of the concerned individual to all related information and discretionary power as to how and what access to provide to the data subject.

4 Where the data controller restricts, wholly or partly, the right of access to personal data, as referred to in Article 17 of the Regulation, it shall inform the data subject concerned in writing, in its reply to the request for access, of the restriction applied and of the principal reasons thereof and of the possibility of lodging a complaint with the EDPS or of seeking a judicial remedy in the Court of Justice of the European Union.

5 The information on the restriction of access may be deferred, omitted or denied if it would cancel the effect of the restriction in accordance with Article 25(8) of the Regulation.

6 A restriction under this Article shall be applied in accordance with this Decision.

1 In duly justified cases and under the conditions stipulated in this Decision, the right to rectification, erasure and restriction of processing under Articles 18, 19(1) and 20(1) of the Regulation may be restricted by the data controller where necessary and appropriate, with regards to activities under Article 2(2) of this Decision.

2 In relation to medical data, data subjects may exercise the right to rectification of the assessment or opinion of the Commission’ Medical Service by providing their comments or a report of a medical practitioner of their choice including, directly to the Commission’s Medical Service.

3 A restriction under this Article shall be applied in accordance with this Decision.

1 Where the data controller is under an obligation to communicate a data breach under Article 35(1) of the Regulation, he/she may, in exceptional circumstances, restrict such communication wholly or partly. He/she shall document in a note the reasons for the restriction, the legal ground for it under Article 2 and an assessment of its necessity and proportionality. The note shall be communicated to the EDPS at the time of the notification of the personal data breach.

2 Where the reasons for the restriction no longer apply, the Agency shall communicate the personal data breach to the data subject concerned and inform him or her of the principal reasons for the restriction and of his or her right to lodge a complaint with the EDPS.

1 In exceptional circumstances, the Agency may restrict the right to confidentiality of electronic communications provided for by Article 36 of the Regulation. Such restrictions shall comply with Directive 2002/58/EC of the European Parliament and of the Council.

2 Notwithstanding Article 8(3), where the Agency restricts the right to confidentiality of electronic communications, it shall inform the data subject concerned, in its reply to any request from the data subject, of the principal reasons on which the application of the restriction is based and of his or her right to lodge a complaint with the EDPS.

This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.