Decision 22/2023 of the Governing Board of the European Institute of Innovation and Technology (EIT) on internal rules concerning restrictions of certain rights of data subjects in relation to processing of personal data in the framework of the functioning of the EIT

This Decision lays down rules relating to the conditions under which the EIT may restrict the application of Articles 14 to 20, 35 and 36, as well as Article 4 thereof based on Article 25 of the Regulation (EU) 2018/1725.

1 The controller of the processing operations is the EIT, represented by its Director, who may delegate the function of the controller.

2 Data subjects shall be informed of the delegated controller by way of the data protection records or privacy statements published on the website and/or the intranet of the EIT.

1 Where the EIT exercises its duties with respect to data subjects’ rights under Regulation (EU) 2018/1725, it shall consider whether any of the exemptions laid down in Regulation (EU) 2018/1725 applies.

2 In accordance with Article 25(1) of Regulation (EU) 2018/1725, EIT may restrict the application of Articles 14 to 20, 35 and 36, and Article 4 thereof in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 20 of Regulation (EU) 2018/1725: (a) pursuant to Article 25(1), points (b), (c), (f), (g) and (h) of the Regulation (EU) 2018/1725, when conducting administrative inquiries, pre-disciplinary, disciplinary or suspension proceedings under Article 86 and Annex IX of the Staff Regulations as well as Decision of the Governing Board of the EIT laying down implementing provisions on the conduct of administrative inquiries and disciplinary proceedings, and when notifying cases to OLAF; (b) pursuant to Article 25(1), point (h) of the Regulation (EU) 2018/1725, in the course of whistleblowing procedures in order ensuring that EIT staff members may confidentially report facts where they believe there are serious irregularities, as set out in the Decision 33/2018 of the Governing Board of the EIT on laying down Guidelines on Whistleblowing; (c) pursuant to Article 25(1), point (h) of the Regulation (EU) 2018/1725, in formal and informal procedures for cases of harassment ensuring that EIT staff members are able to confidentially report to confidential counsellors in the context of a harassment procedure, as defined by Decision 16/2017 of the Governing Board of the EIT on the EIT policy on protecting the dignity of the person and preventing psychological harassment and sexual harassment and Decision 28/2019 of the Director of the EIT on the adoption of a manual for informal procedures for cases involving psychological and sexual harassment; (d) pursuant to Article 25(1), points (c), (g) and (h) of the Regulation (EU) 2018/1725, when conducting internal or external audits in relation to activities or units/departments of the EIT; (e) pursuant to Article 25(1), points (c), (d), (g) and (h) of the Regulation (EU) 2018/1725, when providing or receiving assistance to or from other Union institutions, bodies, offices and agencies or cooperating with them in the context of activities under points (a) to (d) of this paragraph and pursuant to relevant service level agreements, memoranda of understanding and cooperation agreements; (f) pursuant to Article 25(1), points (c), (g) and (h) of the Regulation (EU) 2018/1725, when providing or receiving assistance to or from third countries national authorities and international organisations or cooperating with such authorities and organisations, either at their request or on its own initiative; (g) pursuant to Article 25(1), points (c), (g) and (h) of the Regulation (EU) 2018/1725, when providing or receiving assistance and cooperation to and from EU Member States’ public authorities, either at their request or on its own initiative; (h) pursuant to Article 25(1), point (e) of the Regulation (EU) 2018/1725, when processing personal data in documents obtained by the parties or interveners in the context of proceedings before the Court of Justice of the European Union as well as in case of proceedings initiated by the national authorities or courts of a Member State; (i) pursuant to Article 25(1), points (c), (g) and (h) of Regulation (EU) 2018/1725, when the Data Protection Officer is conducting inquiries on processing activities carried out at the EIT in accordance with Decision 01/2020 of the EIT Director , and in line with Article 45(2) of Regulation (EU) 2018/1725.

3 The categories of data include identification data of a natural person, contact information, professional roles and tasks, information on private and professional conduct and performance, and financial data.

4 Any restriction shall respect the essence of fundamental rights and freedoms and be necessary and proportionate in a democratic society.

5 A necessity and proportionality test shall be carried out on a case-by-case basis before restrictions are applied and it must be duly documented. Restrictions shall be limited to what is strictly necessary to achieve the set objectives.

6 Restrictions should be duly monitored by the data controller and a periodical revision with a necessity and proportionality test shall be done every six months following their adoption in consultation with the Data Protection Officer.

7 Restrictions shall be lifted as soon as the circumstances that justify them no longer apply. The data controller in consultation with the Data Protection Officer shall provide the information concerned to the data subject together with the information on the possibility to lodge a complaint with the EDPS at any time or to seek a judicial remedy in the Court of Justice of the European Union.

8 For accountability purposes, the EIT shall draw up a record describing the reasons for the restrictions applied, which grounds among those listed in paragraph 1 apply and the outcome of the necessity and proportionality test. Those records shall be part of an ad hoc register kept by the Data Protection Officer, which shall be made available on request to the EDPS. The EIT shall prepare periodic reports on the application of Article 25 of the Regulation (EU) 2018/1725.

9 When processing personal data exchanged with other organisations in the context of its tasks, the EIT shall consult those organisations on the possible relevant grounds for imposing restrictions and the necessity and proportionality of the restrictions concerned, unless this would jeopardise the activities of the EIT.

1 The assessment of the risks to the rights and freedoms of data subjects whose personal data may be subject to restrictions as well as their retention period, shall be registered in the record of processing activities maintained by the EIT under Article 31 of the Regulation (EU) 2018/1725, if applicable in relevant data protection impact assessments regarding those restrictions conducted under Article 39 of the said Regulation.

2 Whenever the EIT assesses the necessity and proportionality of a restriction it shall consider the potential risks to the rights and freedoms of the data subject.

1 The EIT shall implement safeguards to prevent abuse and unlawful access or transfer of the personal data that may be subject to restrictions. These safeguards shall include technical and organisational measures to protect the personal data against accidental or unlawful destruction, accidental loss or unauthorised disclosure, alteration and access or any other unauthorised form of processing and be detailed as necessary in EIT internal decisions, procedures and implementing rules. The safeguards shall include: (a) a clear definition of roles, responsibilities and procedural steps; (b) if appropriate, a secure electronic environment which prevents unlawful and accidental access or transfer of electronic data to unauthorised persons; (c) if appropriate, secure storage and processing of paper-based documents; (d) due monitoring of restrictions and a periodic review of their application. The reviews referred to in point (d) shall be conducted at least every six months.

2 Restrictions shall be lifted as soon as the circumstances that justify them no longer apply.

3 The retention period of the personal data that may be subject to restrictions shall be no longer than necessary and appropriate for the purposes for which the data are processed. It shall in any event not be longer than the retention period specified in the data protection notices, privacy statements or data protection records maintained under Article 31 of the Regulation (EU) 2018/1725. At the end of the retention period, the personal data shall be deleted, anonymised or transferred to archives in accordance with Article 13 of the Regulation (EU) 2018/1725.

1 The Data Protection Officer shall be informed without undue delay by the data controller whenever the data subject rights are restricted in accordance with this Decision and shall be provided access to the record containing the assessment of the necessity and proportionality as well as any documents concerning factual or legal elements.

2 The Data Protection Officer may request the review of the application of a restriction. The EIT shall inform its DPO in writing of the outcome of the review by the data controller.

3 The involvement of the Data Protection Officer in the restrictions procedure, including information exchanges, shall be documented in an appropriate form by the data controller.

1 The EIT shall include a section in the data protection notices published on its website/intranet informing all data subjects on processing activities involving processing of their personal data which could be subject to restrictions in accordance with these rules. This information shall cover which rights may be restricted, the grounds on which restrictions may be applied and their potential duration.

2 Data controllers shall individually inform data subjects who are parties to a procedure, parties concerned by procedures or witnesses, in writing and without delay of ongoing or future restrictions to their rights.

3 Where in the context of the activities mentioned in this Decision, the EIT restricts, wholly or partly, the rights of the data subjects mentioned in Articles 14 to 16 and 35 of Regulation (EU) 2018/1725, they shall be informed of the principal reasons on which the application of the restriction is based, and of their right to consult the Data Protection Officer with a view to challenging the restriction and of their rights to lodge a complaint with the EDPS as well to seek a judicial remedy before the Court of Justice of the European Union.

4 The EIT may defer, omit or deny the provision of information concerning the reasons for the restriction referred to in paragraph 1 and the right to lodge a complaint with EDPS for as long as it would cancel the effect of the restriction. The assessment of whether this would be justified shall take place on a case-by-case basis in cooperation with the Data Protection Officer. As soon as it would no longer cancel the effect of the restriction, the EIT shall provide the information to the data subject.

1 Where the EIT is under an obligation to communicate a data breach under Article 35(1) of the Regulation (EU) 2018/1725, it may, in exceptional circumstances, restrict such communication wholly or partly. It shall document in a note the reasons for the restriction, the legal ground for it under Article 2 and an assessment of its necessity and proportionality. The note shall be communicated to the EDPS at the time of the notification of the personal data breach.

2 Where the reasons for the restriction no longer apply, the EIT shall communicate the personal data breach to the data subject concerned and inform him or her of the principal reasons for the restriction and of his or her right to lodge a complaint with the EDPS.

1 In exceptional circumstances, the EIT may restrict the right to confidentiality of electronic communications under Article 36 of Regulation (EU) 2018/1725. Such restrictions shall comply with Directive 2002/58/EC of the European Parliament and of the Council.

2 Where the EIT restricts the right to confidentiality of electronic communications, it shall inform the data subject concerned, in its reply to any request from the data subject, of the principal reasons on which the application of the restriction is based and of his or her right to lodge a complaint with the EDPS or of seeking a judicial remedy before the Court of Justice of the European Union.

3 The EIT may defer, omit or deny the provision of information concerning the reasons for the restriction and the right to lodge a complaint with the EDPS for as long as it would cancel the effect of the restriction. This assessment shall take place on a case-by-case basis in cooperation with the Data Protection Officer.

This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.