European Investment Bank Decision of 9 October 2023 laying down internal rules concerning the processing of personal data by the Human Resources Directorate of the European Investment Bank in relation to the provision of information to data subjects and the restriction of certain of their rights [2023/2717]

1 This Decision lays down the rules to be followed by the data controller, as defined in Article 2(1), to inform data subjects of the processing of their data in accordance with Articles 14, 15 and 16 of Regulation (EU) 2018/1725. It also lays down the conditions under which the relevant data controller may restrict the application of Articles 14 to 21 and 35 as well as Article 4, of the Regulation, in accordance with Article 25(1)(c), (g) and (h) of that Regulation.

2 This Decision applies to the processing of personal data by the Human Resources Directorate for the purpose of or in relation to the activities carried out in order to fulfil its tasks referred to in Articles 40 and 41 of the EIB Staff Regulations I and II, as well as in the EIB’s Policy on Dignity at Work and subsequent amendments thereof.

3 In the framework of its mandate, the Human Resources Directorate processes several categories of personal data, particularly identification data, contact data, professional data and case involvement data.

1 The controller of the processing operations is the Director General of Human Resources.

2 The personal data are stored in a secured electronic and physical environment, which prevents unlawful access or transfer of data to persons who do not have a need to know.

3 The personal data processed are retained for at least six months from the starting point defined in the retention schedule. Further details on the exact length of the retention periods per procedure can be found in the Retention Schedule of the Human Resources Directorate.

1 Where the Human Resources Directorate exercises its duties with respect to the data subjects’ rights pursuant to Regulation (EU) 2018/1725, it shall consider whether any of the exceptions laid down in that regulation apply.

2 Subject to Articles 4 to 7 of this Decision, the Human Resources Directorate may restrict the application of Articles 14 to 21 and 35 of Regulation (EU) 2018/1725, as well as Article 4 in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 22 of this regulation where the exercise of those rights and obligations would jeopardise the purpose of the procedures set out in Articles 40 and 41 of the EIB Staff Regulations I and II as well as in the EIB’s Policy on Dignity at Work or would adversely affect the rights and freedoms of other data subjects.

3 Subject to Articles 4 to 7 of this Decision, the Human Resources Directorate may restrict the rights and obligations referred to in paragraph 2 of this Article in relation to personal data obtained from other European Union institutions, bodies, agencies and offices, competent authorities of Member States or from international organisations, in the following circumstances: (a) where the exercise of those rights and obligations could be restricted by other European Union institutions, bodies, agencies and offices on the basis of other acts provided for in Article 25 of the Regulation or in accordance with Chapter IX of that Regulation; (b) where the exercise of those rights and obligations could be restricted by competent authorities of Member States on the basis of acts referred to in Article 23 of Regulation (EU) 2016/679 of the European Parliament and of the Council , or under national measures transposing Articles 13(3), 15(3) or 16(3) of Directive (EU) 2016/680 of the European Parliament and of the Council ; (c) where the exercise of those rights and obligations could jeopardise the Human Resources Directorate’s cooperation with third countries and international organisations in the conduct of its tasks. Before applying restrictions in the circumstances referred to in points (a) and (b) of the first subparagraph, the Human Resources Directorate shall consult the relevant European Union institutions, bodies, agencies, offices or the competent authorities of Member States unless it is clear to the Human Resources Directorate that the application of a restriction is provided for by one of the acts referred to in those points. Point (c) of the first subparagraph shall not apply where the interest of the European Union to cooperate with third countries or international organisations is overridden by the interests or fundamental rights and freedoms of the data subjects.

4 Paragraphs 1, 2 and 3 are without prejudice to the application of other EIB decisions laying down internal rules concerning the provision of information to data subjects and the restriction of certain rights under Article 25 of Regulation (EU) 2018/1725.

1 The Human Resources Directorate shall publish on the EIB intranet data protection notices that inform all data subjects of its activities involving processing of their personal data, including a general data protection notice on the potential restrictions of their rights. The information shall cover the rights that may be restricted, the grounds on which restrictions may be applied and their potential duration.

2 The Human Resources Directorate shall individually inform data subjects who are parties to a procedure, persons concerned by a procedure or witnesses, by a specific data protection notice, which shall include information relating to the rights that may be restricted, the reasons for such restriction(s) and the potential duration of the restriction(s).

3 Where the Human Resources Directorate restricts, wholly or partly, the provision of information to the data subjects referred to in paragraph 2, it shall record the reasons for the restriction, including an assessment of the necessity and proportionality of the restriction. This assessment shall also document the risks for the respective procedure and for the rights and the freedoms of the data subjects. In particular, the record shall state how the provision of the information would cancel the effect of the restriction(s) applied pursuant to Articles 3(2) and 3(3), or would adversely affect the rights and freedoms of other data subjects. The record and, where applicable, the documents containing underlying factual and legal elements shall be registered. They shall be made available to the European Data Protection Supervisor (EDPS) upon request.

4 The restriction referred to in paragraph 3 shall continue to apply as long as the reasons justifying it remain applicable. Where the reasons for the restriction no longer apply, the Human Resources Directorate shall provide the information concerned and the reasons for the restriction to the data subject. At the same time, the Human Resources Directorate shall inform the data subject of the possibility of lodging a complaint with the EDPS at any time or of seeking a judicial remedy in the Court of Justice of the European Union. The Human Resources Directorate shall review the application of the restriction at least every six months from its adoption and at the closure of the relevant procedure. Thereafter, the controller shall monitor the need to maintain any restriction every six months.

1 Where the Human Resources Directorate restricts, wholly or partly, the right of access, referred to in Article 17 of this regulation, it shall take the following steps: (a) it shall inform the data subject concerned, in its reply to the request for access, of the restriction applied, of the principal reasons thereof, of the duration of the restriction and of the possibility of lodging a complaint with the EDPS or of seeking a judicial remedy in the Court of Justice of the European Union; (b) it shall record the reasons for the restriction, including an assessment of the necessity and proportionality of the restriction; to that end, the record shall state how the provision of the information and exercise of the right would jeopardise the purpose of the respective procedure or cancel the effect of the restrictions applied pursuant to Articles 3(2) and 3(3), or would adversely affect the rights and freedoms of other data subjects. The provision of information referred to in point (a) may be deferred, omitted or denied in accordance with Article 25(8) of Regulation (EU) 2018/1725.

2 The record referred to in point (b) of the first subparagraph of paragraph 2 and, where applicable, the documents containing underlying factual and legal elements shall be registered. They shall be made available to the EDPS on request. Article 25(7) of Regulation (EU) 2018/1725 shall apply.

3 The restriction referred to in paragraph 1 shall continue to apply as long as the reasons justifying it remain applicable. Where the reasons for the restriction no longer apply, the Human Resources Directorate shall provide the information concerned and the reasons for the restriction to the data subject. At the same time, the Human Resources Directorate shall inform the data subject of the possibility of lodging a complaint with the EDPS at any time or of seeking a judicial remedy before the Court of Justice of the European Union. The Human Resources Directorate shall review the application of the restriction at least every six months from its adoption and at the closure of the relevant procedure. Thereafter, the controller shall monitor the need to maintain any restriction every six months.

Where the Human Resources Directorate restricts, wholly or partly, the application of the right to rectification, erasure or the right to restriction of processing, referred to in Articles 18, 19(1) and 20(1) of Regulation (EU) 2018/1725, it shall take the steps set out in Article 5(2) and 5(3) of this Decision.

Where the Human Resources Directorate restricts the communication of a personal data breach to the data subject, referred to in Article 35 of Regulation (EU) 2018/1725, it shall record and register the reasons for the restriction in accordance with Article 4(3) of this Decision. Article 4(4) of this Decision shall apply.

The Human Resources Directorate shall inform, without undue delay, the DPO before it restricts the application of data subjects’ rights in accordance with this Decision. The record and the assessment of the necessity and proportionality of the restriction shall be reviewed by the DPO. The review of the DPO will be documented. The DPO may request the Human Resources Directorate in writing to review the application of the restrictions. The Human Resources Directorate shall inform the DPO in writing about the outcome of the requested review.

This Decision, approved by the EIB’s Board of Directors on 9 October 2023, replaces the EIB’s decision laying down internal rules concerning the processing of personal data by the Human Resources Directorate of the European Investment Bank in relation to the provision of information to data subjects and the restriction of certain of their rights that was approved by EIB’s Board of Directors on 26 February 2019. The decision shall enter into force on the twentieth day after its publication in the Official Journal of the European Union.