Decision of the Bureau of the European Parliament of 16 January 2023 amending the Decision of the Bureau of the European Parliament of 17 June 2019 on the implementing rules relating to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC 2023/C 44/01

‘3 The controller shall review the application of restrictions referred to in Articles 29 and 31 to 34 of this Decision, read in conjunction with the applicable Annexes to this Decision, every six months from its adoption and at the closure of the relevant procedure. Thereafter, for the purposes of the activities and procedures laid down in Annexes I, II, III, V, VI, VII, VIII, IX and X to this Decision, the controller shall monitor the need to maintain any restriction on an annual basis.’.

2 Annex III of the Bureau Decision is replaced by the following: ‘’.

3 In Annex IX of the Bureau Decision, point 2 in part (1) is replaced by the following: ‘2. This Annex lays down the specific conditions under which, when providing information and documents to OLAF at the request of OLAF or on its own initiative, when notifying cases to OLAF or when processing information and documents coming from OLAF, the controller may restrict the application of Articles 14 to 21, 35 and 36 of Regulation (EU) 2018/1725, as well as Article 4 thereof in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 21 of that Regulation, in order to safeguard: (a) the prevention, investigation, detection and prosecution of criminal offences or the execution of criminal penalties, in accordance with Article 25(1), point (b), of that Regulation, (b) the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions, in accordance with Article 25(1), point (f), of that Regulation, and (c) the rights and freedoms of others, in accordance with Article 25(1), point (h), of that Regulation.’.

4 In Annex IX of the Bureau Decision, point 1 in part (2) is replaced by the following: ‘1. Subject to Articles 30 to 36 of this Decision, the controller may restrict the application of Articles 14 to 21, 35 and 36 of Regulation (EU) 2018/1725, as well as Article 4 thereof in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 21 of that Regulation where the exercise of those rights would jeopardise the purpose of OLAF’s investigative activities or the European Parliament’s investigative activities in cooperation with OLAF, including by revealing their investigative tools and methods, or would adversely affect the rights and freedoms of other data subjects.’.

This Decision shall enter into force on the day following that of its publication in the Official Journal of the European Union.