6.2.2023   

EN

Official Journal of the European Union

C 44/1

DECISION OF THE BUREAU OF THE EUROPEAN PARLIAMENT

of 16 January 2023

amending the Decision of the Bureau of the European Parliament of 17 June 2019 on the implementing rules relating to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC

(2023/C 44/01)

THE BUREAU OF THE EUROPEAN PARLIAMENT,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and the of the Council (1), and in particular Article 25 thereof,

Having regard to Rule 25(2) of the Rules of Procedure of the European Parliament,

Whereas:

(1)

The main purposes of the Decision of the Bureau of the European Parliament of 17 June 2019 on the implementing rules relating to Regulation (EU) 2018/1725 (‘the Bureau Decision’) (2) are to implement the provisions set out in that Regulation, which relate to the tasks, duties and powers of the Data Protection Officer of the European Parliament (‘the Data Protection Officer’), to lay down detailed rules pursuant to which a data subject may exercise his or her rights, and to lay down internal rules pursuant to which the European Parliament may apply exceptions, derogations or restrictions with regard to the rights of data subjects pursuant to Article 25 of Regulation (EU) 2018/1725,

(2)

The European Data Protection Supervisor launched a remote audit on 17 May 2021 to assess the state of play related to the existence and the quality of institutions’ and bodies’ implementing rules provided for in Article 25 of Regulation (EU) 2018/1725. The aim of the audit was to ensure coherence and harmonisation in the application of the restrictions to the rights of data subjects among the Union institutions and bodies.

(3)

As a result of that audit, the European Parliament received an informal recommendation to revise the Bureau Decision and to remove the possibility to restrict access to selection and staff evaluation procedures, since those restrictions did not appear to be necessary.

(4)

The Data Protection Officer and the Legal Service of the European Parliament concurred with the European Data Protection Supervisor that the selection and staff evaluation procedures were already protected by other administrative rules and organisational measures and did not need further protection through data protection rules. Annex III to the Bureau Decision should therefore no longer deal with those procedures.

(5)

The creation of the European Public Prosecutor’s Office (‘EPPO’) has an impact on the application of Article 25 of the Regulation (EU) 2018/1725. Annex III should therefore be replaced, taking into account the need to potentially restrict the rights of data subjects at the request of the EPPO.

(6)

Article 36(3) should be amended to include Annex III among the list of cases that require an annual monitoring activity to be carried out in order to assess the need to maintain a restriction. In addition, Annex IX, which concerns the European Anti-Fraud Office (‘OLAF’), should be amended to allow restrictions necessary to safeguard the rights and freedoms of others in accordance with Article 25(1), point (h), of Regulation (EU) 2018/1725.

(7)

The Bureau Decision should be amended accordingly.

HAS ADOPTED THIS DECISION:

Article 1

1.   In Article 36 of the Bureau Decision, paragraph 3 is replaced by the following:

‘3.   The controller shall review the application of restrictions referred to in Articles 29 and 31 to 34 of this Decision, read in conjunction with the applicable Annexes to this Decision, every six months from its adoption and at the closure of the relevant procedure. Thereafter, for the purposes of the activities and procedures laid down in Annexes I, II, III, V, VI, VII, VIII, IX and X to this Decision, the controller shall monitor the need to maintain any restriction on an annual basis.’.

2.   Annex III of the Bureau Decision is replaced by the following:

‘ANNEX III

Cooperation with the European Public Prosecutor’s Office (“EPPO”)

(1)   Subject-matter and scope

1.

 This Annex applies to the processing of personal data, especially the transfer of personal data, by the controller for the purposes of providing the EPPO with information and documents, notifying cases to the EPPO or processing information and documents coming from the EPPO.

2.

 This Annex lays down the specific conditions under which, when providing information and documents to the EPPO at the request of the EPPO or on its own initiative, when notifying cases to the EPPO or when processing information and documents coming from the EPPO, the controller may restrict the application of Articles 14 to 21, 35 and 36 of Regulation (EU) 2018/1725, as well as Article 4 thereof in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 21 of that Regulation, in order to safeguard:

(a)

the prevention, investigation, detection and prosecution of criminal offences or the execution of criminal penalties, in accordance with Article 25(1), point (b), of that Regulation, and

(b)

the rights and freedoms of others, in accordance with Article 25(1), point (h), of that Regulation.

3.

 This Annex applies to the following categories of personal data:

(a)

identification data;

(b)

contact data;

(c)

professional data, including data relating to the contracts of accredited parliamentary assistants, local assistants and service providers and data relating to missions;

(d)

financial data;

(e)

traffic data;

(f)

data on the presence of persons;

(g)

data on the external activities of persons;

(h)

political affiliation data;

(i)

all other data relating to the subject matter of the relevant investigation conducted by the EPPO.

(2)   Applicable restrictions

1.

 Subject to Articles 30 to 36 of this Decision, the controller may restrict the application of Articles 14 to 21, 35 and 36 of Regulation (EU) 2018/1725, as well as Article 4 thereof in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 21 of that Regulation where the exercise of those rights would jeopardise the purpose of the EPPO’s investigative activities, including by revealing its investigative tools and methods, or would adversely affect the rights and freedoms of other data subjects.

2.

 Subject to Articles 30 to 36 of this Decision, the European Parliament may restrict the rights and obligations referred to in paragraph 1 in relation to personal data obtained from the EPPO where the exercise of those rights and obligations could be restricted by the EPPO on the basis of acts adopted in accordance with Article 25 of Regulation (EU) 2018/1725, as regards administrative personal data, or on the basis of the provisions of Chapter VIII of Regulation (EU) 2017/1939 and Article 9 of the Decision of the College of the EPPO of 28 October 2020 establishing the rules concerning the processing of personal data by the European Public Prosecutor’s Office, as regards operational personal data.
’.

3.   In Annex IX of the Bureau Decision, point 2 in part (1) is replaced by the following:

‘2.

This Annex lays down the specific conditions under which, when providing information and documents to OLAF at the request of OLAF or on its own initiative, when notifying cases to OLAF or when processing information and documents coming from OLAF, the controller may restrict the application of Articles 14 to 21, 35 and 36 of Regulation (EU) 2018/1725, as well as Article 4 thereof in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 21 of that Regulation, in order to safeguard:

(a)

the prevention, investigation, detection and prosecution of criminal offences or the execution of criminal penalties, in accordance with Article 25(1), point (b), of that Regulation,

(b)

the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions, in accordance with Article 25(1), point (f), of that Regulation, and

(c)

the rights and freedoms of others, in accordance with Article 25(1), point (h), of that Regulation.’.

4.   In Annex IX of the Bureau Decision, point 1 in part (2) is replaced by the following:

‘1.

Subject to Articles 30 to 36 of this Decision, the controller may restrict the application of Articles 14 to 21, 35 and 36 of Regulation (EU) 2018/1725, as well as Article 4 thereof in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 21 of that Regulation where the exercise of those rights would jeopardise the purpose of OLAF’s investigative activities or the European Parliament’s investigative activities in cooperation with OLAF, including by revealing their investigative tools and methods, or would adversely affect the rights and freedoms of other data subjects.’.

Article 2

This Decision shall enter into force on the day following that of its publication in the Official Journal of the European Union.

(1)  Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

(2)  Decision of the Bureau of the European Parliament of 17 June 2019 on the implementing rules relating to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union Institutions, Bodies, Offices and Agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ C 259, 2.8.2019, p. 2).