(1)

The Commission conducts administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings, on the basis of Article 86 of the Staff Regulations of Officials of the European Union (1) and in accordance with Annex IX thereto as well as Commission Decision C(2004) 1588 (2). Those tasks are mainly the responsibility of the Investigation and Disciplinary Office of the Commission (‘IDOC’), which is a directorate attached to the Directorate-General for Human Resources and Security. Disciplinary proceedings may include investigations conducted by the Disciplinary Board of the Commission pursuant to Article 17 of Annex IX to the Staff Regulations.

(2)

In the context of these activities, the relevant Commission services collect and process relevant information. That information includes personal data, in particular identification, contact and behavioural data. The relevant Commission services transmit personal data to other Commission services on a need to know basis.

(3)

The personal data are stored in a secured physical and electronic environment, to prevent unlawful access or transfer of data to persons who do not have a need to know. After the end of the processing, the data are retained in accordance with the applicable Commission rules (3).

(4)

While carrying out its tasks, the Commission is bound to respect the rights of natural persons in relation to the processing of personal data recognised by Article 8(1) of the Charter of Fundamental Rights of the European Union and by Article 16(1) of the Treaty, as well as the rights provided for in Regulation (EU) 2018/1725 of the European Parliament and of the Council (4), which replaced Regulation (EC) No 45/2001 of the European Parliament and of the Council (5). At the same time, the Commission is required to comply with strict rules of confidentiality and professional secrecy and to ensure respect for the procedural rights of persons concerned and witnesses, in particular the presumption of innocence of the person concerned.

(5)

In certain circumstances it is necessary to reconcile the rights of data subjects pursuant to Regulation (EU) 2018/1725 with the need for effectiveness of administrative inquiries and pre-disciplinary, disciplinary and suspension proceedings, as well as with full respect for fundamental rights and freedoms of other data subjects. To that effect, Article 25(1)(c), (g) and (h) of Regulation (EU) 2018/1725 provides the Commission with the possibility to restrict the application of Articles 14 to 17, 19, 20 and 35, as well as the principle of transparency laid down in Article 4(1)(a), insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19, 20 and 35 of that Regulation.

(6)

This might, in particular, be the case as regards the provision of information about the processing of personal data to the person concerned at the start of an administrative inquiry. The provision of such information might affect the Commission's capacity to conduct the administrative inquiry, for example because the person concerned could destroy evidence before it is examined by the Commission or interfere with potential witnesses before they are themselves heard. Similarly, providing access to personal data during phases of the procedure in which the person concerned does not have access to the file, such as during the preliminary assessment or the administrative inquiry, might reveal information that could adversely affect the conduct of the administrative inquiry. In both cases, restricting the rights of the person concerned might be necessary to safeguard a monitoring, inspection or regulatory function connected to the exercise of official authority in a case where an important objective of general public interest of the Union is at stake, namely ensuring that the staff of the Commission abide by their statutory obligations and behave in an ethical manner.

(7)

It might also be necessary to restrict the right of access to personal data by the person concerned when such access would reveal information about a witness or a whistle-blower who has asked not to have their identity disclosed. In such a case, the Commission may decide to restrict access to the statement relating to the person concerned in order to protect the rights and freedoms of this witness or whistle-blower.

(8)

In order to ensure the confidentiality and effectiveness of administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings, while respecting the standards of protection of personal data under Regulation (EU) 2018/1725, it is necessary to adopt internal rules under which the Commission may restrict data subjects' rights in line with Article 25(1)(c),(g) and (h) of Regulation (EU) 2018/1725.

(9)

The internal rules should apply to all processing operations carried out by the Commission in the performance of its tasks, including processing operations carried out prior to the opening of an administrative inquiry and during assistance and cooperation provided by the Commission to national authorities and international organisations outside of its activities.

(10)

In order to comply with Articles 14, 15 and 16 of Regulation (EU) 2018/1725, the Commission should inform all individuals of its activities involving processing of their personal data and of their rights, in a transparent and coherent manner, by means of data protection notices published on the Commission's website. In addition, the Commission should individually inform, in an appropriate format, the data subjects involved in an administrative inquiry or in pre-disciplinary, disciplinary or suspension proceedings.

(11)

In addition, in order to maintain effective cooperation it may be necessary for the Commission to restrict the application of data subjects' rights in order to protect processing operations of other Union institutions, bodies, offices and agencies or of Member States' and third countries' authorities and international organisations. To that effect, the Commission should consult those institutions, bodies, offices, agencies, authorities and international organisations on the relevant grounds for imposing restrictions and on the necessity and proportionality of the restrictions, unless this would jeopardise the Commission's activities.

(12)

The Commission may also have to restrict the provision of information to data subjects and the application of other rights of data subjects in relation to personal data received from third countries or international organisations, in order to fulfil its duty of cooperation with those countries or organisations and thus safeguard an important objective of general public interest of the Union. However, in some circumstances the interest or fundamental rights of the data subject may override the interest of international cooperation.

(13)

The Commission should handle all restrictions in a transparent manner and register each application of restrictions in the corresponding record system.

(14)

Pursuant to Article 25(8) of Regulation (EU) 2018/1725, controllers may defer, omit or deny the provision of information on the reasons for the application of a restriction to the data subject if providing that information would in any way compromise the purpose of the restriction. This is, in particular, the case of restrictions to the rights provided for in Articles 16 and 35 of Regulation (EU) 2018/1725.

(15)

The Commission should regularly review the restrictions imposed in order to ensure that the data subject's rights to be informed in accordance with Articles 16 and 35 of Regulation (EU) 2018/1725 are restricted only as long as such restrictions are necessary to allow the Commission to conduct its administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings.

(16)

Where other rights of data subjects are restricted, the controller should assess on a case-by-case basis whether the communication of the restriction would compromise its purpose.

(17)

The Data Protection Officer of the European Commission should carry out an independent review of the application of restrictions, with a view to ensuring compliance with this Decision.

(18)

The European Data Protection Supervisor delivered an opinion on 5 December 2018,