(1)

The Commission needs to operate in a safe and secure environment. To accomplish that it needs a coherent, integrated approach as regards its security, providing appropriate levels of protection for persons, assets and information commensurate with identified risks, and ensuring efficient and timely delivery of security. The Commission faces major threats and challenges in the field of security, in particular as regards terrorism, cyber-attacks and political and commercial espionage.

(2)

In order to ensure security of persons, assets and information, the Commission, notably through its Security Directorate of the Directorate General for Human Resources and Security takes measures as provided for in Commission Decision (EU, Euratom) 2015/443 (1) which involve the processing of several categories of personal data. Those measures include the conduct of security background checks pursuant to Article 7(5), threat assessments pursuant to Article 12 and security inquiries pursuant to Article 13 of Decision (EU, Euratom) 2015/443. In the framework of its investigative mandate, the Commission collects information of investigative interest, including personal data, from various sources — public authorities and natural persons — and exchanges it with other Union institutions, bodies, offices and agencies, with competent authorities of Member States and third countries, and with international organisations before, during and after the inquiry or coordination activities.

(3)

The categories of personal data processed by the Commission are, for example, identification data, contact data, professional data and data related to or brought in connection with the subject matter of a security background check, threat assessment or a security inquiry. The personal data are stored in a secured electronic environment, to prevent unlawful access or transfer of data to persons outside the Commission. The personal data are retained in the services of the Commission in charge of the inquiry until the end of the inquiry. Different retention periods apply to different processing activities, depending on the category of the inquiry, namely whether in the field of suspected criminal offences, counter-intelligence or counter-terrorism. At the end of the retention period, the case-related information including personal data is eliminated (2).

(4)

While carrying out its tasks, the Commission, as a controller, is bound to respect the rights of natural persons in relation to the processing of personal data recognised by Article 8(1) of the Charter of Fundamental Rights of the European Union and by Article 16(1) of the Treaty on the Functioning of the European Union, as well as the rights provided for in Regulation (EU) 2018/1725 of the European Parliament and of the Council (3). At the same time, the Commission is required to comply with strict rules of confidentiality as laid down in Article 9 of Decision (EU, Euratom) 2015/443.

(5)

In certain circumstances, it is necessary to reconcile the rights of data subjects pursuant to Regulation (EU) 2018/1725 with the need that the Commission effectively carries out its tasks of ensuring the security of persons, assets and information in the Commission pursuant to Decision (EU, Euratom) 2015/443, in particular security inquiries, as well as with full respect for fundamental rights and freedoms of other data subjects. To that effect, Article 25(1) (c), (d) and (h) of Regulation (EU) 2018/1725 provides the Commission with the possibility to restrict the application of Articles 14 to 17, 19, 20, and 35, as well as the principle of transparency laid down in Article 4(1)(a), insofar its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19 and 20 of that Regulation.

(6)

In order to ensure that the Commission effectively carries out its tasks of ensuring the security of persons, assets and information in the Commission pursuant to Decision (EU, Euratom) 2015/443, in particular its security inquiries, while respecting the standards of protection of personal data under Regulation (EU) 2018/1725, it is necessary to adopt internal rules under which the Commission may restrict data subjects' rights in accordance with Article 25(1)(c), (d) and (h) of Regulation (EU) 2018/1725.

(7)

Those internal rules should cover all processing operations carried out by the Commission in the performance of its tasks to ensure security of persons, assets and information in the Commission pursuant to Decision (EU, Euratom) 2015/443, in particular its investigative function in the area of security. They should apply to processing operations carried out prior to the opening of an investigation, during investigations and during the monitoring of the follow-up to the outcome of investigations.

(8)

In order to comply with Articles 14, 15 and 16 of Regulation (EU) 2018/1725, the Commission should inform all individuals of its activities involving processing of their personal data and of their rights in a transparent and coherent manner by means of a data protection notice published on the Commission's website.

(9)

In addition, the Commission should individually inform, in an appropriate format, the data subjects involved in a security inquiry that is to say, the persons concerned and witnesses. The Commission should furthermore individually inform persons whose data are processed in the context of security measures taken under Article 7(5) and 12(1)(d) and (e) of Decision (EU, Euratom) 2015/443, namely in searches of Commission premises and communication and information systems and equipment.

(10)

On the basis of Article 25 of Regulation (EU) 2018/1725, it may be necessary for the Commission to restrict the provision of information to data subjects and the exercise of other rights of data subjects in order to protect, in particular, a security inquiry, its investigation tools and methods, the security inquiries and proceedings of other public authorities, as well as the rights of other persons related to that security inquiry, investigations and/or proceedings.

(11)

In some cases, providing particular information to the data subjects or revealing the existence of an inquiry or of security measures taken under Article 12(1)(d) and (e) of Decision (EU, Euratom) 2015/443, namely searches of Commission premises and communication and information systems and equipment, could render impossible or seriously impair the purpose of the inquiry and the capability of the Commission to ensure its security and in particular to conduct security inquiries effectively in the future.

(12)

In addition, in order to maintain effective cooperation, as referred to in Article 17(2) and (3) of Decision (EU, Euratom) 2015/443, it may be necessary for the Commission to restrict the application of data subjects' rights in order to protect processing operations of other Union institutions, bodies, offices and agencies, or of competent authorities of the Member States. To that effect, the Commission should consult those institutions, bodies, offices, agencies, authorities on the relevant grounds for imposing restrictions and on the necessity and proportionality of the restrictions.

(13)

The Commission may also have to restrict the provision of information to data subjects and the application of other rights of data subjects in relation to personal data received from third countries or international organisations, in order to fulfil its duty of cooperation with those countries or organisation and thus safeguard an important objective of general public interest of the Union. However, in some circumstances the interest or fundamental rights of the data subject may override the interest of international cooperation.

(14)

The Commission should handle all restrictions in a transparent manner and register each application of restrictions in the corresponding record system.

(15)

Pursuant to Article 25(8) of Regulation (EU) 2018/1725, controllers may defer, omit or deny the provision of information on the reasons for the application of a restriction to the data subject if providing that information would in any way compromise the purpose of the restriction. This is, in particular, the case of restrictions to the rights provided for in Articles 16 and 35 of Regulation (EU) 2018/1725.

(16)

The Commission should regularly review the restrictions imposed in order to ensure that the data subject's rights to be informed in accordance with Articles 16 and 35 of Regulation (EU) 2018/1725 are restricted only as long as such restrictions are necessary to allow the Commission to ensure its security and in particular to conduct its security inquiries.

(17)

Where other rights of data subjects are restricted, the controller should assess on a case-by-case basis whether the communication of the restriction would compromise its purpose.

(18)

The Data Protection Officer of the Commission should carry out an independent review of the application of restrictions, with a view to ensuring compliance with this Decision.

(19)

The European Data Protection Supervisor delivered an opinion on 10 December 2018,