1.   This Decision lays down internal rules relating to the conditions under which the SRB in the framework of informal procedure of the SRB policy on protecting the dignity of the person and preventing psychological harassment and sexual harassment. The SRB may restrict the application of the rights enshrined in Articles 14 to 21, 35, as well as Article 4 thereof, following Article 25 of the Regulation (EU) 2018/1725.

2.   This Decision applies to the processing operation(s) of personal data by the SRB for the purpose of initiating, carrying out and closing informal procedure in the framework of the SRB policy on protecting the dignity of the person and preventing psychological harassment and sexual harassment. For the processing operation(s) of personal data by the SRB for the purposes of conducting internal investigations, administrative inquiries and disciplinary proceedings, a different decision concerning the restriction of rights applies (for reference: SRB/ES/2019/32).

3.   The categories of data concerned are hard data (administrative details, telephone, private address, electronic communications, and traffic data and/or soft data (appraisals, opening of inquiries, reports on preliminary investigations) etc.

4.   Subject to the conditions set out in this Decision, the restrictions may apply to the following rights: access, rectification, erasure and portability rights, rights of information, confidentiality of communication, and principles of the data processing operation provided that they relate to a right.

1.   The safeguards in place to avoid data breaches, leakages or unauthorised disclosure are the following: restriction of access rights to electronic folders and to the functional mailbox for submission of complaints, cupboards secured with keys, and specific training of the persons handling the information on confidentiality.

2.   The controller of this processing operation is the SRB, here represented by the SRB Anti-Harassment Coordinator.

3.   The personal data collected are stored and retained in accordance with the SRB rules on retention of documents. The retention period respects the principle of retention no longer than necessary for the fulfilment of the purpose of the processing operation, and eventually, to allow judicial or administrative disputes.

1.   In accordance with Article 25(1) of Regulation (EU) 2018/1725, any restriction shall only be applied to safeguard:

2.   Any restriction shall be necessary and proportionate in a democratic society and respect the essence of the fundamental rights and freedoms.

3.   A necessity and proportionality test shall be carried out based on the present internal rules. It shall be documented through an internal assessment note for accountability purposes on a case by case basis.

4.   Restrictions shall be duly monitored and a periodical revision shall be done every six months.

5.   Restrictions shall be lifted as soon as the circumstances that justify them no longer apply.

6.   The risk to the rights and freedoms of the data subject is the temporary limitation of the effective exercise of the data subject’s rights, inter alia, to information, erasure or defence, as guaranteed by the Regulation (EU) 2018/1725. These risks shall be taken into account in the scope of the necessity and proportionality test mentioned under paragraph 3 of this Article.

1.   The SRB shall, throughout any restriction procedure and without undue delay, inform the Data Protection Officer of the SRB (‘the DPO’) whenever it restricts the application of data subjects’ rights in accordance with this Decision. It shall provide access to the record and the assessment of the necessity and proportionality of the restriction.

2.   The DPO may request the controller in writing to review the application of the restrictions. The SRB shall inform the DPO in writing about the outcome of the requested review and when the restriction has been lifted.

1.   The SRB shall include in the data protection notices published on its intranet informing data subjects of their rights in the framework of a given procedure, information relating to the potential restriction of these rights. The information shall cover which rights may be restricted, the reasons and the potential duration.

2.   Additionally, the SRB shall inform individually data subjects on their rights concerning present or future restrictions without undue delay and in a written form, without prejudice of the following paragraph.

3.   Data subjects shall be informed on the principal reasons on which the application of a restriction is based and of their right to lodge a complaint before the European Data Protection Supervisor.

1.   Where data subjects request access to their personal data processed in the context of one or more specific cases or to a particular processing operation, in accordance with Article 17 of Regulation (EU) 2018/1725, the SRB shall limit its assessment of the request to such personal data only.

2.   Where the SRB restricts, wholly or partly, the right of access, referred to in Article 17 of Regulation (EU) 2018/1725, it shall take the following steps:

The provision of information referred to in point (a) may be deferred, omitted or denied in accordance with Article 25(8) of Regulation (EU) 2018/1725.

3.   The record referred to in point (b) of paragraph 2 and, where applicable, the documents containing underlying factual and legal elements shall be registered. They shall be made available to the European Data Protection Supervisor on request. Article 25(7) of Regulation (EU) 2018/1725 shall apply.