Commission Decision (EU) 2018/1996 of 14 December 2018 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their rights in the context of the processing of personal data for the purpose of trade defence and trade policy investigations
Commission Decision (EU) 2018/1996 of 14 December 2018 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their rights in the context of the processing of personal data for the purpose of trade defence and trade policy investigations
THE EUROPEAN COMMISSION
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249(1) thereof,
Whereas:
In the framework of its mandate under Regulations (EU) 2015/478(1), (EU) 2015/755(2), (EU) 2016/1036(3), (EU) 2016/1037(4), of the European Parliament and of the Council, the Commission conducts the trade policy of the Union.
In particular, during trade defence investigations, personal data within the meaning of Article 3(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council(5) are inevitably processed. The Commission collects information of investigative interest, including personal data. Subject to the requirement to protect confidential information, all information made available by any party to an investigation should be made available promptly to other interested parties participating in an investigation via access to the non-confidential file. This transmission of data is necessary and legally required for the defence of legal claims of the interested parties. The Commission's tasks in the field of trade policy and trade defence are the primary responsibility of the Directorate-General for Trade (‘DG Trade’), the organisational entities of which act as a controller.
The personal data processed by the Commission are, for example, identification data, contact data, professional data and data related to or brought in connection with the subject matter of the investigation. The personal data are stored in a secured electronic environment to prevent unlawful access or transfer of data to persons outside the Commission. Certain personal data may be included in a separate electronic environment for access by a regulated number of parties with an interest in the investigation. The personal data are retained in the services of the Commission in charge of the investigation until the end of the investigation. The administrative retention period is 5 years, which starts running from the end of the investigation. At the end of the retention period, the case-related information including personal data is transferred to Historical Archives of the Commission(6).
While carrying out its tasks, the Commission is bound to respect the rights of natural persons in relation to the processing of personal data recognised by Article 8(1) of the Charter of Fundamental Rights of the European Union and by Article 16(1) of the Treaty, as well as the rights provided for in Regulation (EU) 2018/1725. At the same time, the Commission is required to comply with strict rules of confidentiality as laid down in Article 19 of Regulation (EU) 2016/1036, Article 29 of Regulation (EU) 2016/1037, Article 8 of Regulation (EU) 2015/478 and Article 5 of Regulation (EU) 2015/755.
In certain circumstances, it is necessary to reconcile the rights of data subjects pursuant to Regulation (EU) 2018/1725 with the need for effectiveness of investigations, as well as with full respect for fundamental rights and freedoms of other data subjects. To that effect, Article 25(1)(c), (g) and (h) of Regulation (EU) 2018/1725 provides the Commission with the possibility to restrict the application of Articles 14 to 17, 19, 20 and 35, as well as the principle of transparency laid down in Article 4(1)(a), insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19, 20 and 35 of that Regulation.
In order to ensure the effectiveness of trade defence investigations while respecting the standards of protection of personal data under Regulation (EU) 2018/1725, which replaced Regulation (EC) No 45/2001 of the European Parliament and of the Council(7), it is necessary to adopt internal rules under which the Commission may restrict data subjects' rights in accordance with Article 25(1)(c)(g) and (h) of Regulation (EU) 2018/1725.
It is therefore necessary to establish internal rules to cover all processing operations carried out by the Commission in the performance of its investigative function in the area of trade defence. Those rules should apply to processing operations carried out prior to the opening of an investigation, during investigations and during the monitoring of the follow-up to the outcome of investigations.
In order to comply with Articles 14, 15 and 16 of Regulation (EU) 2018/1725, the Commission should inform all individuals of its activities involving processing of their personal data and of their rights in a transparent and coherent manner by means of a data protection notice published on the Commission's website. Where relevant, the Commission should adduce additional safeguards to ensure that the data subjects are informed individually in an appropriate format.
On the basis of Article 25 of Regulation (EU) 2018/1725, the Commission is also able to restrict the provision of information to data subjects, and the exercise of other rights of data subjects in order to protect its own trade defence investigations as well as the rights of other persons related to its investigations.
In addition, in order to maintain effective cooperation, it may be necessary for the Commission to restrict the application of data subjects' rights in order to protect processing operations of other Union institutions, bodies, offices and agencies, or of competent authorities of the Member States. To that effect, the Commission should consult those institutions, bodies, offices, agencies, authorities on the relevant grounds for imposing restrictions and on the necessity and proportionality of the restrictions.
The Commission may also have to restrict the provision of information to data subjects and the application of other rights of data subjects in relation to personal data received from third countries or international organisations, in order to fulfil its duty of cooperation with those countries or organisations and thus safeguard an important objective of general public interest of the Union. However, in some circumstances the interest or fundamental rights of the data subject may override the interest of international cooperation.
The Commission should handle all restrictions in a transparent manner and register each application of restrictions in the corresponding record system.
Pursuant to Article 25(8) of Regulation (EU) 2018/1725, controllers may defer, omit or deny providing information on the reasons for the application of a restriction to the data subject if this would in any way compromise the purpose of the restriction. This is, in particular, the case of restrictions to the rights provided for in Articles 16 and 35 of Regulation (EU) 2018/1725.
The Commission should regularly review the restrictions imposed in order to ensure that the data subject's rights to be informed in accordance with Articles 16 and 35 of Regulation (EU) 2018/1725 are restricted only as long as such restrictions are necessary to allow the Commission to conduct its trade defence investigations.
Where other rights of data subjects are restricted, the controller should assess on a case-by-case basis whether the communication of the restriction would compromise its purpose.
The Data Protection Officer of the European Commission should carry out an independent review of the application of restrictions, with a view to ensuring compliance with this Decision.
Regulation (EU) 2018/1725 replaces Regulation (EC) No 45/2001, without any transitional period, from the date on which it enters into force. The possibility to apply restrictions to certain rights of data subjects was provided for in Regulation (EC) No 45/2001. In order to avoid jeopardising trade policy and the conduct of trade defence investigations, this Decision should apply from the date of entry into force of Regulation (EU) 2018/1725.
The European Data Protection Supervisor delivered an opinion on 30 November 2018,
HAS ADOPTED THIS DECISION:
Article 1 Subject matter and scope
This Decision lays down the rules to be followed by the Commission to inform data subjects of the processing of their data in accordance with Articles 14, 15 and 16 of Regulation (EU) 2018/1725, when conducting trade policy and trade defence investigations.
It also lays down the conditions under which the Commission may restrict the application of Articles 4, 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725, in accordance with Article 25(1)(c), (g) and (h) of that Regulation.
This Decision applies to the processing of personal data by the Commission for the purpose of, or in relation to, the activities carried out in order to fulfil the Commission's tasks pursuant to Regulations (EU) 2016/1036, (EU) 2016/1037, (EU) 2015/478 and (EU) 2015/755.
This Decision applies to the processing of personal data by all Commission services in so far as they process personal data contained in information which they are required to transmit to the Commission or personal data already processed by it for the purpose of, or in relation to, the activities referred to in paragraph 2 of this Article.
Article 2 Applicable exceptions and restrictions
Where the Commission exercises its duties with respect to data subjects' rights under Regulation (EU) 2018/1725, it shall consider whether any of the exceptions laid down in that Regulation apply.
Subject to Articles 3 to 7 of this Decision, the Commission may restrict the application of Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725, as well as the principle of transparency laid down in Article 4(1)(a) of that Regulation in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19, 20 and 35 of that Regulation, where the exercise of those rights and obligations would jeopardise the purpose of the Commission's trade policy and trade defence activities, or would adversely affect the rights and freedoms of other data subjects.
Subject to Articles 3 to 7 of this Decision, the Commission may also restrict the rights and obligations referred to in paragraph 2 of this Article in relation to personal data obtained from other Union institutions, bodies, agencies and offices, competent authorities of Member States or third countries or from international organisations, in the following circumstances:
-
where the exercise of those rights and obligations could be restricted by other Union institutions, bodies, agencies and offices on the basis of other acts provided for in Article 25 of Regulation (EU) 2018/1725 or in accordance with Chapter IX of that Regulation or in accordance with Regulation (EU) 2016/794 of the European Parliament and of the Council(8) or Council Regulation (EU) 2017/1939(9);
-
where the exercise of those rights and obligations could be restricted by competent authorities of Member States on the basis of acts referred to in Article 23 of Regulation (EU) 2016/679 of the European Parliament and of the Council(10), or under national measures transposing Articles 13(3), 15(3) or 16(3) of Directive (EU) 2016/680 of the European Parliament and of the Council(11);
-
where the exercise of those rights and obligations could jeopardise the Commission's cooperation with third countries or international organisations in the conduct of trade defence investigations.
Before applying restrictions in the circumstances referred to in points (a) and (b) of the first subparagraph, the Commission shall consult the relevant Union institutions, bodies, agencies, offices or competent authorities of the Member States unless it is clear to the Commission that the application of a restriction is provided for by one of the acts referred to in those points.
Point (c) of the first subparagraph shall not apply where the interest of the Commission to cooperate with third countries or international organisations is overridden by the interests or fundamental rights and freedoms of the data subjects.
Paragraphs 1, 2 and 3 are without prejudice to the application of other Commission decisions laying down internal rules concerning the provision of information to data subjects and the restriction of certain rights under Article 25 of Regulation (EU) 2018/1725 and to Article 23 of the Rules of Procedure of the Commission.
Article 3 Provision of information to data subjects
The Commission shall publish on its website a data protection notice that informs all data subjects of its trade defence activities involving processing of their personal data. Where relevant, the Commission shall ensure that the data subjects are informed individually in an appropriate format.
Where the Commission restricts, wholly or partly, the provision of information to data subjects, whose data are processed for purposes of trade policy or trade defence investigation it shall record and register the reasons for the restriction in accordance with Article 6.
Article 4 Right of access by data subjects, right of erasure and right to restriction of processing
Where the Commission restricts, wholly or partly, the right of access to personal data by data subjects, the right of erasure or the right to restriction of processing as referred to in Articles 17, 19 and 20 respectively of Regulation (EU) 2018/1725 it shall inform the data subject concerned, in its reply to the request for access, erasure or restriction of processing, of the restriction applied and of the principal reasons thereof, and of the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking a judicial remedy in the Court of Justice of the European Union.
The provision of information concerning the reasons for the restriction referred to in paragraph 1 may be deferred, omitted or denied for as long as it would undermine the purpose of the restriction.
The Commission shall record the reasons for the restriction in accordance with Article 6.
Where the right of access is wholly or partly restricted, the data subject shall exercise his or her right of access through the intermediary of the European Data Protection Supervisor, in accordance with Article 25(6), (7) and (8) of Regulation (EU) 2018/1725.