(1)

The European Health and Digital Executive Agency (HaDEA) (‘the Agency’) was established by Implementing Decision (EU) 2021/173 in view to the performance of tasks linked to the implementation of Union programmes in the field of EU4Health, Single Market, Research and Innovation, Digital Europe, Connecting Europe Facility – Digital (3).

(2)

Within the framework of its administrative and operational functioning, the Agency may conduct administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings in accordance with the Staff Regulations of Officials of the European Union and the Conditions of Employment of Other Servants of the European Union, laid down in Council Regulation (EEC, Euratom, ECSC) No 259/68 (‘Staff Regulations’) (4) and with implementing provisions regarding the conduct of administrative inquiries and disciplinary proceedings. If required the Agency may carry out preliminary activities related to cases of potential fraud and irregularities and may notify cases to OLAF.

(3)

Agency staff members are under an obligation to report potentially illegal activities, including fraud and corruption, which are detrimental to the interests of the Union. Staff members are also obliged to report conduct relating to the discharge of professional duties which may constitute a serious failure to comply with the obligations of officials of the Union. This is regulated by the internal rules or policies concerning whistleblowing.

(4)

The Agency has put in place a policy to prevent and deal effectively with actual or potential cases of psychological or sexual harassment in the workplace, as provided for in implementing measures pursuant to the Staff Regulations establishing an informal procedure whereby the alleged victim of the harassment can contact the Agency’s ‘confidential’ counsellors.

(5)

The Agency can also conduct internal (IT) security investigations and on potential breaches of security rules for European Union classified information (‘EUCI’).

(6)

The Agency is subject to both internal and external audits concerning its activities, including conducted by the Internal Audit Services of the European Commission and the European Court of Auditors.

(7)

The Agency may handle requests from the European Public Prosecutors office (EPPO), requests for access to medical files of Agency staff members, carry out investigations by the Data Protection Officer in line with Article 45(2) of the Regulation.

(8)

In the context of such administrative inquiries, audits, investigations or requests, the Agency cooperates with other Union institutions, bodies, offices and agencies.

(9)

The Agency may cooperate with third countries’ national authorities and international organisations, either at their request or on its own initiative.

(10)

The Agency may also cooperate with EU Member States’ public authorities, either at their request or on its own initiative.

(11)

The Agency may be subject to complaints, proceeding or investigations via whistle- blowers or the European Ombudsman.

(12)

The Agency may be involved in cases before the Court of Justice of the European Union when it either refers a matter to the Court, defends a decision it has taken and which has been challenged before the Court, or intervenes in cases relevant to its tasks.

(13)

In the context of its activities, the Agency processes several categories of personal data, including identification data of natural persons, contact information, professional roles and tasks, information on private and professional conduct and performance, and financial data as well as in some specific cases sensitive data (e.g. health data). Personal data includes factual ‘hard’ data and ‘soft’ assessment data.

‘Hard data’ is objective factual data such as identification data, contact data, professional data, administrative details, metadata related to electronic communications and traffic data.

‘Soft data’ is subjective data and include in particular the description and assessment of situations and circumstances, opinions, observations related to data subjects, evaluation of the conduct and performance of data subjects and reasoning underpinning individual decisions related to or brought forward in connection with the subject matter of the procedure or activity carried out by the Agency in line with the applicable legal framework.

Assessments, observations and opinions are considered personal data in the meaning of Article 3(1) of the Regulation.

(14)

Under the Regulation, the Agency is therefore obliged to provide information to data subjects on those processing activities and to respect their rights as data subjects.

(15)

The Agency is committed to respect, to the maximum extent possible, the fundamental rights of the data subjects in particular, the right of provision of information, access and rectification, the right to erasure, restriction of processing, the right of communication of a personal data breach to the data subject or confidentiality of communication as enshrined in the Regulation. However, the Agency may also be required to restrict data subject's rights and obligations for the purpose of protecting its activities and the fundamental rights and freedoms of others.

(16)

Therefore Article 25(1) and (5) of the Regulation, gives the Agency the possibility to restrict, under conditions, the application of Articles 14 to 22, 35 and 36, as well as Article 4 of the Regulation in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 20 shall be based on internal rules to be adopted at the highest level of management of the Agency and subject to publication in the Official Journal of the European Union, where they are not based on legal acts adopted on the basis of the Treaties.

(17)

Restrictions may apply to different data subject rights, including the provision of information to data subjects, right of access, rectification, erasure, restriction of processing, communication of a personal data breach to the data subject or confidentiality of communication as enshrined in the Regulation.

(18)

The Agency may be required to reconcile those rights with the objectives of administrative inquiries, audits, investigations and court proceedings. It may also be required to balance a data subject’s rights against the fundamental rights and freedoms of other data subjects.

(19)

The Agency may, for instance, need to restrict the information it provides to a data subject about the processing of his or her personal data during the preliminary assessment phase of an administrative inquiry or during the inquiry itself, prior to a possible dismissal of case or at the pre-disciplinary stage. In certain circumstances, providing such information may seriously affect the Agency's capacity to conduct the inquiry in an effective way, whenever, for example, there is a risk that the person concerned may destroy evidence or interfere with potential witnesses before they are interviewed. The Agency may also need to protect the rights and freedoms of witnesses as well as those of other persons involved.

(20)

The Agency may need to protect the anonymity of a witness or whistle-blower who has asked not to be identified. In such a case, the Agency may decide to restrict access to the identity, statements and other personal data of such persons or the suspect, in order to protect their rights and freedoms.

(21)

The Agency may need to protect confidential information concerning a staff member who has contacted Agency’s confidential counsellors in the context of a harassment procedure. In such cases, the Agency may need to restrict access to the identity, statements and other personal data of the alleged victim, the alleged harasser and other persons involved, in order to protect the rights and freedoms of all concerned individuals.

(22)

In relation to selection and recruitment procedures, staff evaluation and public procurement procedures the right to access, rectification, erasure and restriction can be exercised only at certain points in time and under the conditions as provided for in the relevant procedures in order to safeguard the rights of other data subjects and to respect the principles of equal treatment and the secrecy of deliberations.

(23)

The Agency may also restrict access of individuals to their medical data for instance of psychological or psychiatric nature due to the potential sensitivity of these data, and the medical service of the Commission may want to give the data subjects only indirect access through their own practitioner. The data subject may exercise the right to rectification of assessments or opinions of the Commission’s Medical service by providing their comments or a report of a medical practitioner of their choice.

(24)

The Agency, represented by its Director, acts as the data controller irrespective of further delegations of the controller role within the Agency to reflect operational responsibilities for specific personal data processing activities to competent ‘delegated data controllers’.

(25)

The personal data are stored securely in an electronic environment compliant with Commission Decision (EU, Euratom) 2017/46 (5) or on paper, preventing unlawful access or transfer of data to persons who do not have a need to know. The personal data processed are retained for no longer than necessary and appropriate for the purposes for which the data are processed for the period specified in the data protection notices and records of the Agency.

(26)

The Agency shall apply restrictions only when they respect the essence of fundamental rights and freedoms, are strictly necessary and are a proportionate measure in a democratic society. The Agency shall give reasons explaining the justification for those restrictions and inform accordingly the data subjects on those grounds and their right to lodge a complaint to the EDPS as provided for by Article 25(6) of the Regulation.

(27)

In application of the principle of accountability, the Agency shall keep a record of its application of restrictions.

(28)

When processing personal data exchanged with other organisations in the context of its tasks, the Agency and those organisations shall consult each other on potential grounds for imposing restrictions and the necessity and proportionality of those restrictions, unless this would jeopardise the activities of the Agency.

(29)

These internal rules shall thus apply to all processing activities carried out by the Agency involving personal data in the performance of administrative inquiries, disciplinary proceedings, preliminary activities related to cases of potential irregularities reported to OLAF, investigations of the European Public Prosecutors office (EPPO), whistleblowing procedures, (formal and informal) procedures for cases of harassment, processing of internal and external complaints, requests of access to or rectification of own medical files, the investigations carried out by the Data Protection Officer in line with Article 45(2) of the Regulation, (IT) security investigations handled internally or with external involvement (e.g. CERT-EU), audits, proceedings before the Court of Justice of the European Union or national public authorities, selection and recruitment procedures, staff evaluation and public procurement, as listed above.

(30)

These internal rules shall apply to processing activities carried out prior to the launch of the procedures referred to above, during these procedures and during the monitoring of the follow-up to the outcome of these procedures. It should also include assistance and cooperation provided by the Agency to other EU Institutions, national authorities and international organisations outside of its administrative investigations.

(31)

Pursuant to Article 25(8) of the Regulation, the Agency is entitled to defer, omit or deny the provision of information on the reasons for the application of a restriction to the data subject if this would in any way cancel the effect of the restriction. The Agency shall assess on a case-by-case basis whether the communication of the restriction would cancel its effect.

(32)

The Agency shall lift the restriction as soon as the conditions that justify the restriction no longer apply, and assess those conditions on a regular basis.

(33)

To guarantee utmost protection of the rights and freedoms of data subjects and in accordance with Article 44(1) of the Regulation, the Data Protection Officer of the Agency shall be consulted in due time before any restriction may be applied or reviewed and verify its compliance with this Decision.

(34)

Articles 16(5) and 17(4) of the Regulation provide for exceptions to data subjects’ right to information and right of access. If these exceptions apply, the Agency does not need to apply a restriction under this Decision,