(1)

Council Regulation (EU) 2018/120 (2) lays down quotas for 2018.

(2)

According to the information received by the Commission, catches of the stock referred to in the Annex to this Regulation by vessels flying the flag of or registered in the Member State referred to therein have exhausted the quota allocated for 2018.

(3)

It is therefore necessary to prohibit fishing activities for that stock,

(1)

Council Regulation (EU) 2018/120 (2) lays down quotas for 2018.

(2)

According to the information received by the Commission, catches of the stock referred to in the Annex to this Regulation by vessels flying the flag of or registered in the Member State referred to therein have exhausted the quota allocated for 2018.

(3)

It is therefore necessary to prohibit fishing activities for that stock,

(1)

Council Regulation (EU) 2018/120 (2) lays down quotas for 2018.

(2)

According to the information received by the Commission, catches of the stock referred to in the Annex to this Regulation by vessels flying the flag of or registered in the Member State referred to therein have exhausted the quota allocated for 2018.

(3)

It is therefore necessary to prohibit fishing activities for that stock,

(1)

Council Regulation (EU) 2016/2285 (2) lays down quotas for 2018.

(2)

According to the information received by the Commission, catches of the stock referred to in the Annex to this Regulation by vessels flying the flag of or registered in the Member State referred to therein have exhausted the quota allocated for 2018.

(3)

It is therefore necessary to prohibit fishing activities for that stock,

(1)

Council Regulation (EU) 2018/120 (2) lays down quotas for 2018.

(2)

According to the information received by the Commission, catches of the stock referred to in the Annex to this Regulation by vessels flying the flag of or registered in the Member State referred to therein have exhausted the quota allocated for 2018.

(3)

It is therefore necessary to prohibit fishing activities for that stock,

(1)

Council Regulation (EU) 2018/120 (2) lays down quotas for 2018.

(2)

According to the information received by the Commission, catches of the stock referred to in the Annex to this Regulation by vessels flying the flag of or registered in the Member State referred to therein have exhausted the quota allocated for 2018.

(3)

It is therefore necessary to prohibit fishing activities for that stock,

(1)

Council Regulation (EU) 2018/120 (2) lays down quotas for 2018.

(2)

According to the information received by the Commission, catches of the stock referred to in the Annex to this Regulation by vessels flying the flag of or registered in the Member State referred to therein have exhausted the quota allocated for 2018.

(3)

It is therefore necessary to prohibit fishing activities for that stock,

(1)

The Commission has examined the application for the approval of an amendment to the specification for the Protected Designation of Origin ‘Μαντινεία’ (Mantinia), sent by Greece in accordance with Article 105 of Regulation (EU) No 1308/2013.

(2)

The Commission has published the application for the approval of an amendment to the specification in the Official Journal of the European Union, as required by Article 97(3) of Regulation (EU) No 1308/2013 (2).

(3)

No statement of objection has been received by the Commission under Article 98 of Regulation (EU) No 1308/2013.

(4)

The amendment to the specification should therefore be approved in accordance with Article 99 of Regulation (EU) No 1308/2013.

(5)

The measures provided for in this Regulation are in accordance with the opinion of the Committee for the Common Organisation of the Agricultural Markets,

(1)

Regulation (EC) No 1831/2003 provides for the authorisation of additives for use in animal nutrition and for the grounds and procedures for granting such authorisation.

(2)

The use of preparation of narasin and nicarbazin as a feed additive was authorised for 10 years for chickens for fattening by Commission Regulation (EU) No 885/2010 (2).

(3)

In accordance with Article 13(3) of Regulation (EC) No 1831/2003, the holder of the authorisation proposed changing the terms of authorisation of the preparation by submitting an application to modify the content of micro tracer red from 11 g/kg to a range of 4-11g/kg. The application was accompanied by the relevant supporting data.

(4)

The European Food Safety Authority (‘the Authority’) concluded in its opinion of 18 October 2016 (3) that the reduction of the content of micro tracer red from 11g/kg to a range of 4-11g/kg of additive has no effect on the physicochemical and biological properties of the additive. Therefore it came to the conclusion that the assessment of safety and efficacy made for the former formulation with 11g/kg micro tracer red is still valid for the new formulation. The Authority does not consider that there is a need for specific requirements of post-market monitoring. It also verified the report on the method of analysis of the feed additive in feed submitted by the Reference Laboratory set up by Regulation (EC) No 1831/2003.

(5)

On 10 July 2018 Eli Lilly and Company Ltd has also submitted an application under Article 13(3) of Regulation (EC) No 1831/2003 proposing to change the name of the holder of the authorisation. The applicant claimed that, with effect from 3 April 2018, Elanco GmbH, a division of Eli Lilly and Company Ltd, is to be considered holder of the marketing rights for the above mentioned additive. The application was accompanied by the relevant supporting data.

(6)

The proposed change of the terms of the authorisation concerning the name of the holder of the authorisation is purely administrative in nature and does not entail a new assessment of the additive concerned. The Authority was informed of the application.

(7)

The assessment of the preparation of narasin and nicarbazin with the new content of micro-tracer red shows that the conditions for authorisation, as provided for in Article 5 of Regulation (EC) No 1831/2003, are satisfied.

(8)

Regulation (EU) No 885/2010 should therefore be amended accordingly.

(9)

Since safety reasons do not require the immediate application of the amendments made by this Regulation, it is appropriate to provide for a transitional period during which the existing stocks of the feed additive narasin and nicarbazin, which are in conformity with the provisions applying before the date of entry into force of this Regulation may continue to be placed on the market and used until they are exhausted.

(10)

The measures provided for in this Regulation are in accordance with the opinion of the Standing Committee on Plants, Animals, Food and Feed,

(1)

On 15 October 2013 the Council adopted Regulation (EU) No 1024/2013, conferring specific tasks on the European Central Bank (ECB) concerning policies relating to the prudential supervision of credit institutions.

(2)

The planning and execution of the tasks conferred on the ECB should be fully undertaken by its Supervisory Board, which is composed of the Chair, the Vice Chair and four representatives of the ECB as well as one representative of the national competent authority in each participating Member State.

(3)

The Supervisory Board is an essential body in the exercise of supervisory tasks by the ECB. Regulation (EU) No 1024/2013 therefore conferred upon the Council the power to appoint the Chair and the Vice Chair of the Supervisory Board.

(4)

On 16 December 2013 the Council appointed the first Chair of the Supervisory Board by means of Council Implementing Decision 2013/797/EU (2). Pursuant to Article 26(3) of Regulation (EU) No 1024/2013, the term of office of the Chair of the Supervisory Board is five years and is not renewable.

(5)

In accordance with Article 26(3) of Regulation (EU) No 1024/2013, on 7 November 2018 the ECB, on the basis of an open selection procedure from among individuals of recognised standing and experience in banking and financial matters and after hearing the Supervisory Board, submitted to the European Parliament a proposal for the appointment of Mr Andrea ENRIA as Chair of the Supervisory Board. The European Parliament approved that proposal on 29 November 2018,

(1)

Agrilus planipennis (Fairmaire) is a harmful organism listed under point (a)1.2 in Annex I, Part A, Section I to Directive 2000/29/EC as an organism not known to occur in the Union.

(2)

The provisions set out under point 2.3 in Annex IV, Part A, Section I to Directive 2000/29/EC establish special requirements to prevent the introduction into and the spread within the Union of the harmful organism Agrilus planipennis (Fairmaire) through wood originating in certain third countries.

(3)

Following the information collected in 2018 during two audits of the European Commission in Canada and the United States of America, the implementation of the conditions set out under option (b) of point 2.3 in Annex IV, Part A, Section I to Directive 2000/29/EC is not sufficiently verified prior to export.

(4)

It is therefore appropriate not to allow the introduction into the Union of wood of Fraxinus L., Juglans ailantifolia Carr., Juglans Mandshurica Maxim., Ulmus davidiana Planch. and Pterocarya rhoifolia Siebold and Zucc. originating in Canada and the United States of America under an official statement as referred to in that option (b).

(5)

This Decision should expire on 30 June 2020, to allow for the review of point 2.3 in Annex IV, Part A, Section I to Directive 2000/29/EC on the basis of the scientific and technical developments.

(6)

The measures provided for in this Decision are in accordance with the opinion of the Standing Committee on Plants, Animals, Food and Feed,

(1)

On 18 December 2013, Sweden informed the Commission of its decision of 30 August 2013 to take a safeguard measure to prohibit the placing on the market of a pinsetter machine Brunswick GSX (the ‘pinsetter machine’) and its supplementary kit of parts ‘Advanced Guards’ (the ‘supplementary kit’) and to withdraw such machinery from the market. Both products were manufactured by Brunswick Bowling & Billiards (the ‘manufacturer’).

(2)

As to the withdrawal, Sweden offered the manufacturer the possibility either to correct the defects relating the operator's working environment, to take back the pinsetter machine and the supplementary kit and replace them with another technically faultless products of the same or equivalent kind, or take back the pinsetter and the supplementary kit and compensate the owner for it.

(3)

The reasons invoked by Sweden behind that safeguard measure were the failure of the pinsetter machine and the supplementary kit to satisfy certain essential health and safety requirements (‘EHSRs’) set out in Annex I of Directive 2006/42/EC and the incorrect application of some of the harmonised standards.

(4)

After receiving the notification of the safeguard measure from Sweden, the Commission entered into consultation with the parties concerned in order to hear their views. The Commission sent a letter to the manufacturer on 11 April 2014 and the manufacturer provided its observations on 24 June 2014. The Commission met the manufacturer on 24 September 2014 and 24 May 2016. The manufacturer sent additional explanation to the Commission on 6 December 2016. The Commission had also several information exchanges with the Swedish authorities, the Swedish Work Environment Agency (exchange of e-mails, discussions in the Machinery Working Group meetings and the Machinery Market Surveillance Group).

(5)

Sweden stated that before taking the safeguard measure, its authorities had been in contact with the manufacturer several times to explain them the deficiencies of the pinsetter machines and supplementary kits to be fixed in order to comply with Directive 2006/42/EC. However, given that after several years of discussion only half of the deficiencies were resolved, Sweden considered necessary to trigger the safeguard clause mechanism. Regarding the measures adopted, the Swedish authorities explained that they respected the principle of proportionality, laid down in Article 18 of Regulation (EC) No 765/2008 of the European Parliament and of the Council (2). Based on that principle, considering the severity of the risks and the costs of the withdrawal, some of the actions required to address the deficiencies for the new pinsetter machines and supplementary kits, were not required in the case of the withdrawal of the existing pinsetter machines and supplementary kit. Namely, those concerning the fitting of three separate lights that indicate different modes in the control panel, the enlargement of the access points between the machines also used as work platforms and the overview of the danger zone.

(6)

In 2015, Sweden informed the Commission that the manufacturer addressed the deficiencies set out in the safeguard measure regarding the pinsetter machine and the supplementary kit only in the bowling centre in Gustavsberg.

(7)

Apart from these consultations, the Commission conducted an independent study (3) (the ‘study’) to assess whether or not the pinsetter machine and the supplementary kit complied with the EHSR set out in Annex I to Directive 2006/42/EC at the time when Sweden took the safeguard measure. In order to elaborate the study, the independent experts inspected the pinsetter machine with the supplementary kit installed in Gustavsberg and met the Swedish authorities and the Vice-President of Capital Marketing & Engineering of the manufacturer.

(8)

The parties concerned were consulted on the Commission's study. The manufacturer's comments do not put the conclusions of the study into question because they refer to the compliance of the pinsetter machine and the supplementary kit installed in Gustavsberg after Sweden notified the safeguard measure to the Commission.

(9)

As for the EHSRs invoked by Sweden, the EHSR 1.2.2 on control devices and 1.7.1 on information and warnings on the machinery, require that control devices are visible, placed in a way as to be safely operated and that the information and warnings on them are expressed in the Union language determined by the Member State in which the machinery is placed.

In this regard, Sweden indicated that one of the buttons on the control panel of the machine was not marked and the text on the control panel was in English although the official language of the Member State in which the machinery is placed is Swedish. Furthermore, three separate lights indicated different modes. The colors of these three lights were placed differently on different machines and could therefore be misunderstood. The emergency stop sign was mounted upside down.

The manufacturer stated that with respect to the lights on the control panels, there could be minor confusion.

Regarding the clear visibility and marking of the control devices, the manufacturer admitted some mismatches between the actual machines, the labels and the manuals.

Furthermore, the manufacturer stated that the labels, having no impact to safety functions, did not have to be necessarily translated.

Furthermore, the EHSR 1.2.2 requires also that control devices must be designed to prevent its operation if there is someone in the danger zone.

According to Sweden, the machine could be restarted even though the operator did not have an overview of the danger zone, which entailed the risk of someone being inside the risk area.

The manufacturer disagreed with Sweden on the operator's poor visibility from the control zone due to the absence of reported safety incidents and other Member States' conclusions that ‘the visibility, while perhaps not perfect, was indeed adequate given that the operator practiced reasonable and expected care while when starting the machines’.

However, the Commission considers that relying on the expected care of the operator when starting the machine does not address the risk because the remaining lack of overview of the danger zone prevents the operator from checking if there is someone in the danger zone.

Thus, considering the above arguments and taking into account the study confirming those arguments, it can be concluded that the EHSRs set out in Section 1.2.2 and 1.7.1 of Annex I to Directive 2006/42/EC have not been fulfilled as regards the pinsetter machine and the supplementary kit.

(10)

The EHSR 1.1.6 on ergonomics, 1.6.1 on machinery maintenance and 1.6.2 on access to operating positions and servicing points, require a design and construction of the machine that ease the operator's work, allowing him to work in a comfortable and safe way, outside danger zones.

In this respect, Sweden highlighted that the access points and work platforms of the pinsetter machines at stake would not respect these EHSRs because the access route that doubles as a work platform between those machines was measured to be only 190 mm. In some cases, the operators were requested to balance on narrow metal edges. This work environment entailed an unnecessary risk of falling into the machine. In addition, the access route between these machines ended abruptly by the front where there is a risk of falling approximately from 1 000 mm.

In its EC declaration of conformity, the manufacturer referred to the harmonised standard EN ISO 14122-2:2001 but did not provide in the technical file a link between the references of the harmonised standards and the respective EHSR as required by Annex VII to Directive 2006/42/EC. Despite this deficiency on the side of the manufacturer, Sweden identified the EHSR that the reference to that harmonised standard could have covered. Specifically, Sweden identified that the reference to the harmonised standard concerned the EHSR set out in Sections 1.1.6, 1.6.1 and 1.6.2 of Annex I to Directive 2006/42/EC.

Harmonised standard EN ISO 14122-2:2001 lays down safety technical requirements for permanent means of access to machinery and specifically for machinery working platforms and walkways. Sweden stated that whilst the standard in question requires a 500 mm of width, the pinsetter machine walkway at stake was 190 mm wide.

In this respect, the manufacturer stated that the narrow walkway of 190 mm was considered a safe and appropriate width bearing in mind the intended and expected use, the frequency of access and the state of the art for the ball return area even though it did not fully apply EN ISO 14122-2:2001. Therefore, although the manufacturer had referred to that standard in the declaration of conformity, it did not apply it.

Regarding the risk of falling associated with access in front of the pinsetter machine, the manufacturer estimated that the alternative platform for an easier access on and off to the front platform, requested by Sweden, was not necessary because the front access to the pinsetter machine is very infrequent considering the design of existing machines in the world, where access is provided primarily from the back.

The Commission considers that the risk of injury when accessing the pinsetter machines (by falling or lacking balance) due to the narrow walkway between the machines or to an abrupt end of the front of the machine of 1 000 mm cannot be neglected by arguing an infrequent access or the impossibility to do better.

Thus, on the basis of the above arguments and taking into account the study confirming those arguments, it can be concluded that the EHSR set out in Sections 1.1.6, 1.6.1 and 1.6.2 of Annex I to Directive 2006/42/EC have not been fulfilled as regards the pinsetter machine.

(11)

As regards the EHSR set out in Sections 1.3.8 and 1.4 of Annex I to Directive 2006/42/EC, Sweden indicated that the screens between the pinsetter machines must be high enough to prevent workers to be in contact with dangerous, moving parts of adjacent machines, which are in operation. The screen must cover the entire side of the machine i.e. right up to the front of the machine cage. However, the fence of the pinsetter that was mounted between the machines was only 500 mm high at some workstations and was completely missing at other places where people were working. This entailed a risk of falling down into the adjoining machine. Therefore, that structure would not comply with the EHSR 1.3.8 on the choice of protection against risks arising from moving parts.

In its EC declaration of conformity, the manufacturer referred to the harmonised standard EN ISO 13857:2008 but did not provide in the technical file a link between the references of the harmonised standards and the respective EHSR as required by Annex VII to Directive 2006/42/EC. Despite this deficiency on the side of the manufacturer, Sweden identified the EHSR that the reference to that harmonised standard could have covered. Specifically, Sweden identified that the reference to the harmonised standard concerned the EHSR set out in Sections 1.3.8 of Annex I to Directive 2006/42/EC.

Harmonised standard EN ISO 13857:2008 lays down technical requirements on machinery safety distances to prevent hazard zones being reached by upper and lower limbs. Sweden refers to this standard to reinforce its justification on the manufacturer's lack of compliance with EHSRs 1.3.8.

Despite the standard being referred to in the declaration of conformity, the manufacturer did not rely on the standard to prove the conformity of the product with the Directive when providing explanations to the Swedish authorities. Instead, the manufacturer specified that the 500 mm fence mounted between the machines was designed to provide maximum protection while still accommodating the height requirements of common ceiling heights throughout Europe. A higher guard would provide a measure of incremental safety but this incremental safety would be diminished if ceiling obstructions prevented installation of the guards or if the guards were incorrectly modified to accommodate ceiling obstructions.

The Commission considers that to keep the fence of the pinsetter, mounted between the machines, at 500 mm high due to ceiling obstructions, does not explain why at some workstations the fences were completely missing and it does not tackle the risk of falling down into the adjoining machine.

Thus, on the basis of the above arguments and taking into account the study confirming those arguments it can be concluded that the EHSRs set out in Section 1.3.8 of Annex I to Directive 2006/42/EC have not been fulfilled as regards the pinsetter machine and the supplementary kit.

Furthermore, as regards the pinsetter machine Sweden explained that the machine cage contained small doors that could be opened but did not have a locking mechanism that stops the machine when the doors were opened.

In its EC declaration of conformity, the manufacturer referred to the harmonised standard EN 953:1998 but did not provide in the technical file a link between the references of the harmonised standards and the respective EHSR as required by Annex VII to Directive 2006/42/EC. Despite this deficiency on the side of the manufacturer, Sweden identified the EHSR that the reference to that harmonised standard could have covered. Specifically, Sweden identified that the reference to the harmonised standard concerned the EHSR set out in Sections 1.3.8 and 1.4 of Annex I to Directive 2006/42/EC.

Harmonised standard EN 953:1997+A1:2009 lays down safety technical requirements on machinery guards and the general requirements for the design and construction of fixed and movable guards. Sweden refers to this standard to reinforce its justification on the manufacturer's lack of compliance with EHSRs 1.3.8 and 1.4.

In this regard, the manufacturer explained that the fact that the machine cage contained a second smaller door into each cell with no interlock that stopped the machine was not contrary to Directive 2006/42/EC because the rear division guards required very infrequent access and fixed guards provided enough safety in this case. The manufacturer indicated that based on this justification and on EN 953, a fixed guard was selected. It did not address the absence of the interlocking mechanism.

The Commission considers that the risk arising from moving parts was not addressed because the locking mechanism did not stop the machine when the worker approached it.

Thus, on the basis of the above arguments and taking into account the study confirming those arguments, it can be concluded that the EHSR set out in Sections 1.3.8 and 1.4 of Annex I to Directive 2006/42/EC have not been fulfilled as regards the pinsetter machine.

Sweden also indicated that the protective cap over the ball return mechanism did not meet the ESHR on fixed guards set out in Section 1.4.2.1 of Annex I to Directive 2006/42/EC as it was not fixed in any way and it did not meet the requirements for interlocking guards set out in Section 1.4.2.2 of Annex I to Directive 2006/42/EC since there was no interlocking mechanism.

Sweden referred also in this case to EN 953:1997+A1:2009 to reinforce its justification on the manufacturer's lack of compliance with EHSRs 1.4.2.1 and 1.4.2.2.

However, the manufacturer stated that the access into the ball return cover was required far less frequently than once per shift and limited its explanations to a statement that a fixed guard was recommended by the standards. In its view, there was no need to take the actions required by Sweden.

The Commission considers that the risk arising from moving parts was not addressed in the protective cap over the ball return mechanism because, in addition to the absence of interlocking mechanisms, the fixed guards were not fixed.

Thus, on the basis of the above arguments and taking into account the study confirming those arguments, it can be concluded that the EHSR set out in Sections 1.4.2.1 and 1.4.2.2 of Annex I to Directive 2006/42/EC have not been fulfilled as regards the pinsetter machine.

(12)

As regards the EHSR set out in Sections 1.7.4, 1.7.4.1 and 1.7.4.2, regarding the requirements on instructions, Sweden informed that a posted picture on the pinsetter machine and the supplementary kit was supposed to show where the guards were located, but it did not correspond to where they were actually located on the machine. As for the user instructions, Sweden said that there were no instructions for use corresponding to the machines delivered and which should cover the various operations to be performed.

Regarding the absence of operating and instructions manual, the manufacturer stated that translated manuals were supplied with the machines so it could be possible that the manuals were misplaced at the inspected bowling centre. Labels having no impact on safety functions were not translated. Furthermore, the machine labels and manuals observed by the inspectors may not have matched the machine due to manufacturer's accommodation of specific demands from regional inspectors and the time constraints to adapt to those demands.

The Commission considers, on the basis of the above arguments and taking into account the study confirming those arguments, that the EHSR set out in Sections 1.7.4, 1.7.4.1 and 1.7.4.2 Annex I to Directive 2006/42/EC have not been fulfilled as regards the pinsetter machine and the supplementary kit.

(13)

EHSR set out in Section 1.1.2 of Annex I to Directive 2006/42/EC regarding principles of safety integration requires that machinery must be designed and constructed to prevent putting persons at risk when operating the machinery under the conditions foreseen but also taking into account any reasonably foreseeable misuse.

Sweden indicated that the mounting brackets used for the safety interlocks were fastened with standard screws, which are easy to remove with standard tools, contrary to the principle of safety integration. This entails a risk of foreseeable misuse to defeat the mounting brackets instead using the interlocked doors.

The manufacturer stated that the reason was that the interlocked doors provide reasonable access that reduces the operator's motivation to defeat the interlocks when making extensive maintenance. Standard screws would reduce the risk of permanent damage to the guarding system or permanent removal of the guards.

Furthermore, Sweden explained that the fixed guards were mounted with quick-release fasteners, which entailed a risk that someone would open the fixed guard and use it for access instead of using the interlocked door. Sweden added that where the risk assessment shows that there should be a fixed guard, it must not be designed in such a way that it is an attractive option to access the machine by opening the fixed guard rather than by using the locked gate.

The manufacturer justified the use of quick-release fasteners to diminish the workers' motivation to defeat the fixed guards.

In its EC declaration of conformity, the manufacturer referred to the harmonised standard EN 1088:1995+A1:2007 but did not provide in the technical file a link between the reference of the harmonised standard and the respective EHSR as required by Annex VII to Directive 2006/42/EC. Despite this deficiency, Sweden linked the reference of that harmonised standard with the EHSR set out in Section 1.1.2 of Annex I to Directive 2006/42/EC.

Harmonised standard EN 1088+A2:2008 lays down safety technical requirements on machinery interlocking devices associated with guards and the principles for design and selection. Sweden refers to this standard to reinforce its justification on the manufacturer's lack of compliance with EHSRs 1.1.2. The manufacturer indicated that Section 5.7.1 Note 4 of the standard states that avoiding ‘defeat in a reasonably foreseeable manner’ needs to take into account the characteristics of the specific application and therefore based on the risk assessment. According to the manufacturer, the interlocked doors provide reasonable access that reduces the operator's motivation to defeat the interlocks.

The Commission considers that the mounting brackets and the fixed guards could be easily removed with standard tools, which entailed a reasonably foreseeable misuse of accessing the machine by bypassing the locked gates.

Thus, on the basis of the above arguments and taking into account the study confirming those arguments, it can be concluded that the EHSR set out in Section 1.1.2 of Annex I to Directive 2006/42/EC on principles of safety integration has not been fulfilled as regards the pinsetter machine and the supplementary kit.

(14)

Examination of the justification provided by Sweden with respect to the safeguard measure, the independent study confirming the conclusions made by Sweden and the observations communicated by the manufacturer, confirm that the pinsetter machine did not comply with the ESHRs set out in Sections 1.1.2, 1.1.6, 1.2.2, 1.3.8, 1.4, 1.6.1, 1.6.2, 1.7.1, 1.7.4, 1.7.4.1, 1.7.4.2 of Annex I to Directive 2006/42/EC and the supplementary kit did not comply with the ESHRs set out in Sections 1.1.2, 1.2.2, 1.3.8, 1.4, 1.7.1, 1.7.4, 1.7.4.1 and 1.7.4.2 at the time that Sweden notified the measures to the Commission in December 2013. Those deficiencies are liable to compromise the health and safety of persons. Therefore, the safeguard measures taken by Sweden should be considered as justified,

(1)

Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council (1) requires each Union institution to establish an internal audit function which shall be performed in compliance with the relevant international standards. Internal audit activities in the Commission are carried out by the Internal Audit Service (‘the Service’), which was established on 11 April 2000. Internal audit activities are also carried out by the Service in Union decentralised agencies and other autonomous bodies receiving contributions from the Union budget.

(2)

The Service conducts internal audit activities in accordance with Articles 117 to 123 of Regulation (EU, Euratom) 2018/1046 and its mission charter (2). In this respect, the Service has complete independence and full and unlimited access to all information required in the conduct of its internal audit activities in relation to all the activities and departments of the Union institution concerned.

(3)

The Service advises other Commission departments, executive agencies, as well as Union decentralised agencies and other autonomous bodies receiving contributions from the Union budget on how to deal with risks, i.e. any event or issue that could occur and adversely impact the achievement of the Commission's political, strategic and operational objective, by issuing independent opinions on the quality of management and control systems and by issuing recommendations for improving the conditions of implementation of operations and promoting sound financial management, in accordance with Articles 117 to 123 of Regulation (EU, Euratom) 2018/1046. Therefore, the internal audit activities of the Service do not typically target natural persons as such. Nevertheless, during the course of its activities, personal data within the meaning of Article 3(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (3) are inevitably processed. The internal audit activities carried out by the Service involve assessing the suitability and effectiveness of internal management systems and the performance of departments in implementing policies, programmes and actions, the efficiency and effectiveness of the internal control and audit systems applicable to each budget implementation operation. Therefore, they contribute to the safeguarding of important economic and financial interests of the Union and of the Member States. The Service is a controller for the processing operations it carries out in accordance with Articles 118 and 119(2) of the Financial Regulation.

(4)

The internal audit activities performed in the Commission and its executive agencies, and in the Union decentralised agencies and other autonomous bodies vary in form and content, ranging from assurance (including risk assessments) and consulting engagements, to reviews with a limited scope and follow-up engagements.

(5)

The Audit Progress Committee (APC), in accordance with its Mission Charter updated on 21 November 2018 (C(2018)7707), is an advisory body (4) that assists the Commission in fulfilling its obligations under the Treaties and other statutory instruments [Regulation (EU, Euratom) 2018/1046] by ensuring the independence of the Internal Audit Service, by monitoring the quality of internal audit work, and by ensuring that internal and external audit recommendations are properly taken into account by the Commission services and that they receive appropriate follow-up. In this way, the APC contributes to the overall further improvement of the Commission's effectiveness and efficiency in achieving its goals and facilitates the College's oversight of the Commission's governance, risk management, and internal control practices. The APC is a controller for the processing operation(s) it carries out in accordance with Article 123 of the Financial Regulation.

(6)

For the purpose of its activities under Articles 118 and 119(2) of Regulation (EU, Euratom) 2018/1046, whether acting on its own initiative or on the basis of received input, the Commission processes personal data acquired or received from legal persons, natural persons, Member States and international bodies and organisations. During such internal audit activities, the Service may also process personal data acquired or received from publicly available sources, from anonymous or from identified sources that require protection of their identity.

(7)

The Commission may, in turn, exchange personal data with the Union institutions, bodies, offices and agencies, with competent authorities of Member States and, within the framework of the Commission relevant international or cooperation agreements, with third countries and international organisations.

(8)

Personal data processing activities, within the meaning of Article 3(3) of Regulation (EU) 2018/1725, carried out in the course of an internal audit activity, may take place even before the Commission formally initiates it, continue throughout the performance of the audit activity and may continue even after the formal closure of the audit activity (for example, for reasons of monitoring of implementation of recommendations, assessing the need for initiating new internal audit activities).

(9)

The categories of personal data processed by the Commission include identification data, contact data, professional data and data related to or brought in connection with the subject matter of the activity. These categories of personal data are stored in a secured electronic environment to prevent unlawful access or transfer of data to persons who do not have a need to know. The personal data are retained for a maximum period of ten years. At the end of the retention period, the information related to the internal audit activity, including personal data is transferred to the historical archives of the Commission (5) or destroyed.

(10)

While carrying out internal audit activities, the Commission is bound to respect the rights of natural persons in relation to the processing of personal data recognised by Article 8(1) of the Charter of Fundamental Rights of the European Union and by Article 16(1) of the Treaty, as well as the rights provided for in Regulation (EU) 2018/1725. At the same time, the Commission is required to comply with strict rules of confidentiality referred to in the international internal audit standards, in accordance with Article 117 of Regulation (EU, Euratom) 2018/1046.

(11)

In certain circumstances, it is necessary to reconcile the rights of data subjects pursuant to Regulation (EU) 2018/1725 with the needs of internal audit activities, and confidentiality of exchanges of information with natural and legal persons as well as with full respect for fundamental rights and freedoms of other data subjects. To that effect Article 25(1)(c), (g) and (h) of Regulation (EU) 2018/1725 provides the Service with the possibility to restrict the application of Articles 14 to 17, 19, 20 and 35, as well as the principle of transparency laid down in Article 4(1)(a), insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19, 20 and 35 of that Regulation.

(12)

In order to ensure the effectiveness of internal audit activities, while respecting the standards of protection of personal data under Regulation (EU) 2018/1725, which replaced Regulation (EC) No 45/2001 of the European Parliament and of the Council (6), it is necessary to adopt internal rules under which the Commission may restrict data subjects' rights in accordance with Article 25(1)(c), (g) and (h) of Regulation (EU) 2018/1725.

(13)

The internal rules should cover all processing operations carried out by the Commission in the performance of its internal audit activities, whether acting on its own initiative or on the basis of received input, whenever the exercise of data subjects' rights may jeopardise the conduct of internal audit activities. Those rules should apply to processing operations carried out prior to the formal initiation of an engagement, during the engagement as well as during the monitoring of the follow-up to its outcome.

(14)

In order to comply with Articles 14, 15 and 16 of Regulation (EU) 2018/1725, the Commission should inform all individuals of its activities involving processing of their personal data and of their rights in a transparent and coherent manner by means of a data protection notice published on the Commission's website. Where relevant, the Commission should adduce additional safeguards to ensure that the data subjects are informed individually in an appropriate format.

(15)

On the basis of Article 25 of Regulation (EU) 2018/1725, the Commission is also able to restrict the provision of information to data subjects and the exercise of other rights of data subjects in order to protect its own internal audit activities, audits of public authorities of the Member States, the audit tools and methods, as well as the rights of other persons related to its internal audit activities.

(16)

In addition, in order to maintain effective cooperation it may be necessary for the Commission to restrict the application of data subjects' rights in order to protect processing operations of Commission services or other Union institutions, bodies, offices and agencies or of Member States' authorities and international organisations, as well as of the Audit Progress Committee. To that effect, the Commission should consult those services, institutions, bodies, offices, agencies, authorities and organisations, as well as the Audit Progress Committee on the relevant grounds for imposing restrictions and the necessity and proportionality of the restrictions.

(17)

The Commission may also have to restrict the provision of information to data subjects and the application of other rights of data subjects in relation to personal data received from third countries or international organisations, in order to cooperate with those countries or organisations and thus safeguard an important objective of general public interest of the Union. However, in some circumstances the interest or fundamental rights of the data subject may override the interest of international cooperation.

(18)

The Commission should handle all restrictions in a transparent manner and register each application of restrictions in the corresponding record system.

(19)

Pursuant to Article 25(8) of Regulation (EU) 2018/1725, controllers may defer, omit or deny provision of information on the reasons for the application of a restriction to the data subject if providing that information would in any way compromise the purpose of the restriction. This is, in particular, the case of restrictions to the rights provided for in Articles 16 and 35 of Regulation (EU) 2018/1725.

(20)

Where other rights of data subjects are restricted, the controller of the Internal Audit Service should assess on a case-by-case basis whether the communication of the restriction would compromise its purpose.

(21)

The Data Protection Officer of the European Commission should carry out an independent review of the application of restrictions, with a view to ensuring compliance with this Decision.

(22)

Regulation (EU) 2018/1725 replaces Regulation (EC) No 45/2001, without any transitional period, from the date on which it enters into force. The possibility to apply restrictions to certain rights was provided for in Regulation (EC) No 45/2001. In order to avoid jeopardising the lawfulness of internal audit activities, this Decision should apply from the date of entry into force of Regulation (EU) 2018/1725.

(23)

The European Data Protection Supervisor delivered an opinion on 27 November 2018,

(1)

The European Anti-Fraud Office (‘the Office’) was established by Commission Decision 1999/352/EC, ECSC, Euratom (1) as a service of the Commission. The Office conducts investigations in complete independence.

(2)

The Office conducts administrative investigations for the purpose of fighting fraud, corruption and any other illegal activity affecting the financial interests of the Union in accordance with Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council (2). To that end, it exercises the powers of investigation conferred on the Commission by the relevant Union acts in the Member States, as well as in accordance with cooperation and mutual assistance agreements and any other legal instrument in force, in third countries and on the premises of international organisations.

(3)

The Office also conducts administrative investigations within the institutions, bodies, offices and agencies established by, or on the basis of, the Treaties. In the framework of its investigative mandate, the Office collects information of investigative interest, including personal data, from various sources – public authorities, private entities and natural persons – and exchanges it with Union institutions, bodies, offices and agencies, with competent authorities of Member States and third countries, as well as with international organisations before, during and after the investigation or coordination activities.

(4)

In the framework of its activities, the Office processes several categories of personal data, particularly identification data, contact data, professional data and case involvement data. The Office, represented by its Director-General, acts as the data controller. The personal data are stored in a secured electronic environment which prevents unlawful access or transfer of data to persons who do not have a need to know. The personal data processed are retained for fifteen years after the case is dismissed or the investigation or the coordination case is closed by a decision of the Director-General. At the end of the retention period, the case related information including personal data is transferred to the historical archives.

(5)

While carrying out its tasks, the Office is bound to respect the rights of natural persons in relation to the processing of personal data recognised by Article 8(1) of the Charter of Fundamental Rights of the European Union and by Article 16(1) of the Treaty, as well as by legal acts based on those provisions. At the same time, the Office is required to comply with strict rules of confidentiality and professional secrecy referred to in Article 10 of Regulation (EU, Euratom) No 883/2013 and ensure the respect of procedural rights of persons concerned and witnesses, referred to in Article 9 of that Regulation, in particular the right of persons concerned to the presumption of innocence.

(6)

The secured electronic environment in which personal data are stored as well as the procedural guarantees and strict rules of confidentiality and professional secrecy referred to respectively in Articles 9 and 10 of Regulation (EU, Euratom) No 883/2013 ensure a high level of protection against the risks to the rights and freedoms of data subjects involved by the processing.

(7)

In certain circumstances, it is necessary to reconcile the rights of data subjects pursuant to Regulation (EU) 2018/1725 of the European Parliament and of the Council (3) with the needs of investigations and confidentiality of exchanges of information with other competent public authorities, as well as with full respect for fundamental rights and freedoms of other data subjects. To that effect, Article 25 of that Regulation provides the Office with the possibility to restrict the application of Articles 14 to 22, 35 and 36, as well as Article 4 thereof, insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 22.

(8)

The Office designated, pursuant to Article 10(4) of Regulation (EU, Euratom) No 883/2013 a Data Protection Officer in accordance with Article 24 of Regulation (EC) No 45/2001 of the European Parliament and of the Council (4).

(9)

In order to ensure the confidentiality and effectiveness of investigations and other operational activities carried out by the Office while respecting the standards of protection of personal data under Regulation (EU) 2018/1725, it is necessary to adopt internal rules under which the Office may restrict data subjects' rights in line with Article 25 of that Regulation.

(10)

The scope of this legal act should cover all processing operations carried out by the Office in the performance of its independent investigative function. They should apply to processing operations carried out prior to the opening of an investigation, both during internal and external investigations, as referred to in Articles 3 and 4 of Regulation (EU, Euratom) No 883/2013, and during the monitoring of the follow-up to the outcome of the investigations. The rules should apply to processing operations which form part of the activities linked to the investigative function such as the system to report fraud, operational analyses, international cooperation data bases, as well as operations which can contain investigative data such as in the handling of DPO investigations or in other complaint processes conducted by the Office. It should also include assistance and cooperation provided by the Office to national authorities and international organisations outside of its administrative investigations.

(11)

In order to comply with Articles 14, 15 and 16 of Regulation (EU) 2018/1725, the Office should inform all individuals of its activities involving processing of their personal data and of their rights in a transparent and coherent manner in the form of the data protection notices published on the Office's website, as well as to individually inform data subjects relevant to the investigation – persons concerned, witnesses and informants – in the appropriate format.

(12)

Without prejudice to the application of the exceptions laid down in Regulation (EU) 2018/1725, the Office may have to restrict the provision of information to data subjects and the application of other rights of data subjects' in order to protect its own investigations, investigations and proceedings of public authorities of the Member States, the investigation tools and methods, as well as the rights of other persons related to its investigations.

(13)

In some cases, providing particular information to the data subjects or revealing the existence of an investigation could render impossible or seriously impair the purpose of the processing operation and the capability of the Office or competent national authorities and Union institutions, bodies, offices and agencies to conduct an investigation effectively in the future.

(14)

Furthermore, the Office is required to protect the identity of informants, including whistle-blowers, and witnesses, who should not suffer negative repercussions in relation to their cooperation with the Office.

(15)

For those reasons, the Office may need to apply certain grounds for restrictions referred to in Article 25 of Regulation (EU) 2018/1725 to data processing operations carried out in the framework of the Office's tasks set out in Article 2 of Decision 1999/352/EC, ECSC, Euratom.

(16)

In addition, in order to maintain effective cooperation, the Office may need to apply restrictions to data subjects' rights to protect information containing personal data originating from Commission services or other Union institutions, bodies, offices and agencies, competent authorities of Member States and third countries, as well as from international organisations. To that effect, the Office should consult those services, institutions, bodies, offices, agencies, authorities and international organisations on the relevant grounds for and the necessity and proportionality of the restrictions.

(17)

In the framework of its investigative function, the Office often exchanges information, including personal data, with, inter alia, Commission services and executive agencies assisting the Commission services in the implementation of their programmes. In line with Article 25(5) of Regulation (EU) 2018/1725 – which requires the internal rules to be adopted at the highest level of management of the Union institutions, bodies, agencies and offices concerned – this Decision shall encompass the processing of personal data contained in information which they are required to transmit to the Office. Therefore all Commission services and executing agencies processing personal data subject to their duty to inform the Office under Article 8(1) of Regulation (EU, Euratom) No 883/2013 or where such personal data are processed by the Office in the performance of its tasks should apply the rules set out in this Decision with a view to protecting the processing operations carried out by the Office. In such circumstances, the Commission services and executive agencies concerned should therefore consult the Office on the relevant grounds for the restrictions and their necessity and proportionality in order to ensure their coherent application.

(18)

The Office – and, where relevant, Commission services and executive agencies – should handle all restrictions in a transparent manner and register each application of restrictions in the corresponding record system.

(19)

Pursuant to Article 25(8) of Regulation (EU) 2018/1725, the controllers may defer or refrain from providing information on the reasons for the application of a restriction to the data subject if this would in any way compromise the purpose of the restriction. In particular, where a restriction to the rights provided for in Articles 16 and 35 is applied, the notification of such a restriction would compromise the purpose of the restriction. In order to ensure that the data subject's right to be informed in accordance with Articles 16 and 38 of Regulation (EU) 2018/1725 is restricted only as long as the reasons for the deferral last, the Office should regularly review its position.

(20)

Where a restriction of other data subjects' rights is applied the controller should assess on a case-by-case basis whether the communication of the restriction would compromise its purpose.

(21)

The Data Protection Officer of the Office – and, where relevant, the Data Protection Officer of the Commission or of the executive agency concerned – should also carry out an independent review of the application of restrictions, with a view to ensuring compliance with this Decision.

(22)

Regulation (EU) 2018/1725 replaces Regulation (EC) No 45/2001, without any transitional period, from the date on which it enters into force. The possibility to apply restrictions to certain rights was provided for in Regulation (EC) No 45/2001. In order to avoid jeopardising the purpose of investigations in the Office's remit and adversely affecting the rights and freedoms of others, this Decision should apply from the date of entry into force of Regulation (EU) 2018/1725.

(23)

The European Data Protection Supervisor was consulted on 23 November 2018,