(1)

The BEREC Office may, in the context of its functioning, conduct administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings, on the basis of Annex IX to the Staff Regulations of Officials of the European Union and the Conditions of Employment of Other Servants of the European Union (3) and in compliance with Decision MC/2012/3 by the Management Committee of the Office of the Body of European Regulators for Electronic Communications (BEREC Office) laying down general implementing provisions on the conduct of administrative inquiries and disciplinary procedures, which implies processing of information including personal data.

(2)

The BEREC Office staff members have the obligation to report possible illegal activities, including fraud or corruption, detrimental to the interests of the Union, or of conduct relating to the discharge of professional duties, which may constitute a serious failure to comply with the obligations of staff members of the Union. This is regulated by Decision No MC/2018/11 of the Management Committee of the Office of the Body of European Regulators for Electronic Communications (BEREC Office) laying down guidelines on whistleblowing of the BEREC Office.

(3)

The BEREC Office has set out a policy to prevent and deal effectively and efficiently with actual or potential cases of psychological or sexual harassment at the workplace, as provided for by Decision No MC/2016/15 of the Management Committee of the Office of the Body of European Regulators for Electronic Communications (BEREC Office) on the policy on protecting the dignity of the person and preventing psychological harassment and sexual harassment.

(4)

In the context of the above-mentioned activities, the BEREC Office collects and processes relevant information and several categories of personal data, including identification data of a natural person, contact information, professional roles and tasks, information on private and professional conduct and performance, and financial data. The BEREC Office acts as data controller.

(5)

Adequate safeguards are in place to protect personal data and prevent them from accidental or unlawful access or transfer, both if they are stored in a physical or in an electronic environment. After processing, the data are retained in accordance with the applicable BEREC Office’s retention rules, as defined in data protection records based on Article 31 of the Regulation. At the end of the retention period, the case related information, including personal data, is deleted, anonymised or transferred to the historical archives.

(6)

Within this context, the BEREC Office is bound to fulfil its obligation to provide information to the data subjects in relation to the above processing activities and respect the rights of the data subjects, as laid down in the Regulation.

(7)

It may be necessary to reconcile the rights of data subjects pursuant to the Regulation with the needs of the above-mentioned activities, while fully respecting fundamental rights and freedoms of other data subjects. To that effect, Article 25 of the Regulation provides, under strict conditions, the possibility to restrict the application of Articles 14 to 20, 35 and 36, as well as Article 4 insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 20. In this case, it is necessary to adopt internal rules under which the BEREC Office may restrict those rights in line with the same Article of the Regulation.

(8)

This might in particular be the case when providing information about the processing of personal data to the data subject at the preliminary assessment phase of an administrative enquiry or during the enquiry itself, prior to a possible dismissal of the case or a pre-disciplinary stage. In certain circumstances, providing such information might seriously affect the BEREC Office’s capacity to conduct the enquiry in an effective way, whenever, for example, there is a risk that the person concerned destroys evidence or interferes with potential witnesses before they are interviewed. Furthermore, the BEREC Office might need to protect their rights and freedoms as well as the rights and freedoms of other persons involved.

(9)

It might be necessary to protect the confidentiality of a witness or a whistle-blower who has asked not to be identified. In such a case, the BEREC Office may decide to restrict access to the identity, statements and other personal data of the whistle-blower and other persons involved, in order to protect their rights and freedoms.

(10)

It might be necessary to protect the confidentiality of a staff member who has contacted BEREC Office’s confidential counsellors in the context of a harassment procedure. In such a case, the BEREC Office may decide to restrict access to the identity, statements and other personal data of the alleged victim, the alleged harasser and other persons involved, in order to protect their rights and freedoms.

(11)

The BEREC Office should apply restrictions only when they respect the essence of the fundamental rights and freedoms, and are strictly necessary and a proportionate measure in a democratic society. The BEREC Office should give justifications explaining the grounds for those restrictions.

(12)

Based on the principle of accountability, the BEREC Office should keep a record of the application of the restrictions.

(13)

Article 25(6) of the Regulation obliges the controller to inform data subjects of the principal reasons on which the application of the restriction is based and of their right to lodge a complaint with the EDPS.

(14)

Pursuant to Article 25(8) of the Regulation, the BEREC Office may defer, omit or deny the provision of information on the reasons for the application of a restriction to the data subject if this would in any way cancel the effect of the restriction. The BEREC Office should assess on a case-by-case basis whether the communication of the restriction would cancel its effect.

(15)

The BEREC Office should lift the restriction as soon as the conditions that justify the restriction no longer apply, and assess those conditions on a regular basis.

(16)

To guarantee the utmost protection of the rights and freedoms of data subjects and in accordance with Article 44(1) of the Regulation, the DPO should be informed in due time of any restrictions being applied and verify compliance with this Decision.

(17)

The application of the above-mentioned restrictions is without prejudice to the possible application of the provisions of Article 16(5) and 17(4) of the Regulation, relating, respectively, to the right of information when data have not been obtained from the data subject, and to the right of access by the data subject.

(18)

The European Data Protection Supervisor (‘EDPS’) has been consulted on 27 May 2019,

(a)

an adequate definition of roles, responsibilities and procedural steps;

(b)

if applicable, a secure electronic environment which prevents unlawful or accidental access or transfer of electronic data to unauthorised persons;

(c)

if applicable, secure storage and processing of paper-based documents.

(d)

due monitoring of restrictions and a periodical revision, which shall be done at least every six months. A revision must also be carried out when essential elements of the case at hand change. The restrictions shall be lifted as soon as the circumstances that justify them no longer apply.