COMMISSION DECISION (EU) 2020/1502

16.10.2020 | EN | Official Journal of the European Union | L 342/25 ---|---|---|--- * * * COMMISSION DECISION (EU) 2020/1502 of 15 October 2020 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their rights in the context of the processing of personal data by the Commission in the cooperation mechanism established by Regulation (EU) 2019/452 of the European Parliament and of the Council THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249(1) thereof, Whereas: (1) | Regulation (EU) 2019/452 of the European Parliament and of the Council (1) established a cooperation mechanism between the Commission and the Member States on foreign direct investments. That mechanism is based on an exchange of information that may include personal data within the meaning of Article 3(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (2). The purpose of the cooperation mechanism is to allow each Member State to examine whether a foreign direct investment in another Member State is likely to affect its security or public order and the Commission to examine whether a foreign direct investment is likely to affect security or public order in more than one Member State. ---|--- (2) | The categories of personal data processed by the Commission for the screening of foreign direct investments by the Member States and for ensuring the effectiveness of the cooperation mechanism established by Regulation (EU) 2019/452 include identification and contact data, professional data and data related to foreign direct investment. ---|--- (3) | Personal data will be retained by the services of the Commission in charge of the screening activity for as long as it is necessary for the screening of foreign direct investments by Member States and for ensuring the functioning of the cooperation mechanism and will be stored in a secured electronic environment to prevent unlawful access or transfer of data to persons outside the Commission (3). ---|--- (4) | While carrying out its tasks, the Commission is bound to respect the rights of natural persons in relation to the processing of personal data recognised by Article 8(1) of the Charter of Fundamental Rights of the European Union and by Article 16(1) of the Treaty on the Functioning of the European Union, as well as rights provided for in Regulation (EU) 2018/1725. At the same time, the Commission is required to comply with strict rules of confidentiality as laid down in Article 10 of Regulation (EU) 2019/452. ---|--- (5) | In certain circumstances, it is necessary to reconcile the rights of data subjects pursuant to Regulation (EU) 2018/1725 with the need for effectiveness of the cooperation mechanism, as well as with full respect for fundamental rights and freedoms of other data subjects. To that effect, Article 25(1) of Regulation (EU) 2018/1725 provides the Commission with a possibility to restrict the application of Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725, as well as the principle of transparency laid down in Article 4(1)(a) thereof, insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19 and 20 of that Regulation. ---|--- (6) | The Union’s common commercial policy requires that the Commission effectively and efficiently carry out its tasks under the cooperation mechanism. In order to do so, while respecting the standards of protection of personal data under Regulation (EU) 2018/1725, it is necessary to adopt internal rules under which the Commission may restrict data subjects’ rights in accordance with Article 25 of Regulation (EU) 2018/1725. ---|--- (7) | Those internal rules should cover all data processing operations carried out by the Commission in the performance of its functions under the cooperation mechanism established by Regulation (EU) 2019/452, from the moment it receives information on the foreign direct investments concerned. ---|--- (8) | In order to comply with Articles 14, 15 and 16 of Regulation (EU) 2018/1725, the Commission should inform all individuals of its activities involving the processing of their personal data and of their rights in a transparent and coherent manner in the form of the data protection notices published on the Commission’s website. Where relevant, the Commission should adduce additional safeguards to ensure that the data subjects are informed individually in an appropriate format. ---|--- (9) | Without prejudice to Article 14(5) and Article 16(5) of Regulation (EU) 2018/1725, the Commission has the possibility, on the basis of Article 25 of that Regulation, to restrict the provision of information to data subjects about the processing of their personal data and the application of their other rights in order to protect the Commission’s powers to conduct analyses and procedures related to the screening of foreign direct investments or the cooperation mechanism under Regulation (EU) 2019/452. In this respect, it may be necessary that the Commission restrict the application of those rights and obligations pursuant to Article 25(1)(a),(c),(d),(g) and (h) of that Regulation. This may be necessary where the purpose of the Commission’s analyses and procedures related to the screening of foreign direct investments or the cooperation mechanism in relation to the effective implementation of the Union’s common commercial policy would otherwise be jeopardised. ---|--- (10) | In addition, in order to maintain effective cooperation, it may be necessary for the Commission to restrict the application of data subjects’ rights in order to protect processing operations of other Union institutions, bodies, offices and agencies or of Member States’ authorities. The Commission may do so in a situation where the purpose of such a restriction by another Union institution, body, office or agency or of a Member State authority would be jeopardised were the Commission not to apply an equivalent restriction in respect of the same personal data. To that effect, the Commission should consult those institutions, bodies, offices, agencies, and authorities on the relevant grounds for imposing restrictions and the necessity and proportionality of the restrictions. ---|--- (11) | The Commission may have to restrict the provision of information to data subjects and the application of other rights of data subjects in relation to personal data received from the Member States or other, be it anonymous or identified sources, where it is necessary to safeguard the national security, public security or defence of the Member States, as referred to in Article 25(1)(a) of Regulation (EU) 2018/1725, or to safeguard the internal security of Union institutions and bodies, as referred to in Article 25(1)(d) of that Regulation. The internal security of Union institutions and bodies may be at stake in particular in those cases of foreign direct investment, which are likely to affect projects or programmes of Union interest on grounds of security or public order. ---|--- (12) | The Commission may also have to restrict the provision of information to data subjects and the application of other rights of data subjects in relation to personal data received from the Member States, third countries or international organisations, in order to cooperate with the Member States, those third countries or organisations and thus safeguard an important objective of general public interest of the Union, as referred to in Article 25(1)(c) of Regulation (EU) 2018/1725. However, in some circumstances the interest of fundamental rights of the data subject may override the interest of international cooperation. ---|--- (13) | Accordingly, where necessary for a monitoring, inspection or regulatory function connected to the exercise of its official authority when carrying out its tasks under the cooperation mechanism established by Regulation (EU) 2019/452, the Commission may have to restrict the provision of information to data subjects and the application of other rights, as referred to in Article 25(1)(g) of Regulation (EU) 2018/1725. ---|--- (14) | In addition, the Commission may have to restrict the provision of information to data subjects and the application of other rights of data subjects in relation to personal data received from anonymous or identified sources, such as informants, that require protection of their rights and freedoms, pursuant to Article 25(1)(h) of Regulation (EU) 2018/1725. ---|--- (15) | The Commission has therefore identified the grounds listed in Article 25(1)(a), (c), (d), (g) and (h) of Regulation (EU) 2018/1725 as grounds for restrictions that may be necessary to apply to data processing operations carried out in the framework of the Commission’s analyses and procedures related to the screening of foreign direct investments or the cooperation mechanism established by Regulation (EU) 2019/452. ---|--- (16) | Any restriction, applied on the basis of this Decision, should be necessary and proportionate taking into account the risks to the rights and freedoms of data subjects. ---|--- (17) | The Commission should handle all restrictions in a transparent manner and register each application in the corresponding record system. ---|--- (18) | The Commission processes personal data under Regulation (EU) 2019/452 jointly with the Member States’ competent authorities. The Commission’s assessment and procedures in relation to the screening of foreign direct investments or the cooperation mechanism are carried out through different services, but the primary responsibility of coordination lays with the Directorate-General responsible for Trade. ---|--- (19) | Pursuant to Article 25(8) of Regulation (EU) 2018/1725, controllers may defer, omit or deny the provision of information based on the reasons for the application of a restriction to the data subject if providing that information would in any way cancel the effect of restriction. This is, in particular, the case of restrictions provided for in Articles 16 and 35 of that Regulation. ---|--- (20) | The Commission should regularly review the restrictions imposed in order to ensure that the data subject’s rights to be informed in accordance with Articles 16 and 35 of Regulation (EU) 2018/1725 are restricted only as long as such restrictions are necessary to allow the Commission to conduct analyses and procedures related to the screening of foreign direct investments or the cooperation mechanism. ---|--- (21) | Where other rights of data subjects are restricted, the controller should assess on a case-by-case basis whether the communication of the restriction would compromise its purpose. ---|--- (22) | The Data Protection Officer of the Commission should carry out an independent review of the application of restrictions, with a view to ensuring compliance with this Decision. ---|--- (23) | In order to immediately allow the Commission to restrict the application of certain rights and obligations in accordance with Article 25 of Regulation (EU) 2018/1725 and not to jeopardise analyses and procedures related to the screening of foreign direct investments or the cooperation mechanism established by Regulation (EU) 2019/452, this Decision should enter into force on the third day following that of its publication in the Official Journal of the European Union. ---|--- (24) | The European Data Protection Supervisor has been consulted and delivered his opinion on 29 July 2020, ---|--- HAS ADOPTED THIS DECISION: Article 1 Subject-matter and scope 1\. This Decision lays down the rules to be followed by the Commission when informing the data subjects of the processing of their personal data in accordance with Articles 14, 15 and 16 of Regulation (EU) 2018/1725 in the framework of the cooperation mechanism established by Regulation (EU) 2019/452. It also lays down the conditions under which the Commission may restrict the application of Articles 4, 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725, in accordance with Article 25(1)(a),(c), (d), (g) and (h) thereof, in the framework of that cooperation mechanism. 2\. This Decision applies to the processing of personal data by the Commission for the purpose of, or in relation to, the activities carried out in order to fulfil the Commission’s tasks pursuant to Regulation (EU) 2019/452. Article 2 Applicable exceptions and restrictions 1\. Where the Commission exercises its duties with respect to the data subjects’ rights under Regulation (EU) 2018/1725, it shall consider whether any of the exceptions laid down in that Regulation apply. 2\. Subject to Articles 3 to 7 of this Decision, where the exercise of the rights and obligations provided for in Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725 in relation to personal data processed by the Commission would jeopardise the purpose of the Commission’s analyses and procedures with regard to the screening of foreign direct investments or the cooperation mechanism pursuant to Regulation (EU) 2019/452, including by revealing its tools and methods, or would adversely affect the rights and freedoms of other data subjects, the Commission may restrict the application of: (a) | Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725; and ---|--- (b) | the principle of transparency laid down in Article 4(1)(a) of that Regulation insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725. ---|--- 3\. Subject to Articles 3 to 7, the Commission may restrict the rights and obligations referred to in paragraph 2 of this Article: (a) | where the exercise of those rights and obligations in respect of the personal data obtained from another Union institution, body, agency or office could be restricted by that other Union institution, body, agency or office on the basis of legal acts referred to in Article 25 of Regulation (EU) 2018/1725, or in accordance with Chapter IX of that Regulation; or in accordance with Regulation (EU) 2016/794 of the European Parliament and of the Council (4) or with Council Regulation (EU) 2017/1939 (5); ---|--- (b) | where the exercise of those rights and obligations in respect of the personal data obtained from a competent authority of a Member State could be restricted by competent authorities of that Member State on the basis of acts referred to in Article 23 of Regulation (EU) 2016/679 of the European Parliament and of the Council (6) or under national measures transposing Article 13(3), Article 15(3) or Article 16(3) of Directive (EU) 2016/680 of the European Parliament and of the Council (7); ---|--- (c) | where the exercise of those rights and obligations would jeopardise the Commission’s cooperation with third countries or international organisations with regard to the screening of foreign direct investments. ---|--- Before applying restrictions in the circumstances referred to in points (a) and (b) of the first subparagraph, the Commission shall consult the relevant Union institutions, bodies, agencies or offices or competent authorities of the Member States, unless it is clear to the Commission that the application of a restriction is provided for by one of the acts referred to in those points. Point (c) of the first subparagraph shall not apply where the interests or fundamental rights and freedoms of the data subject override the interest of the Commission to cooperate with third countries or international organisations. 4\. Paragraphs 1, 2 and 3 shall be without prejudice to: (a) | the application of other Commission decisions laying down internal rules concerning the provision of information to data subjects and the restrictions of certain rights under Article 25 of Regulation (EU) 2018/1725; ---|--- (b) | Article 23 of the Rules of Procedure of the Commission (8). ---|--- 5\. Any restriction of the rights and obligations, referred to in paragraph 2, shall be necessary and proportionate taking into account the risks to the rights and freedoms of data subjects. Article 3 Provision of information to data subjects 1\. The Commission shall publish on its website data protection notices that inform all data subjects of its activities involving processing of their personal data for the purposes of analyses and procedures with regard to the screening of foreign direct investments or the cooperation mechanism under Regulation (EU) 2019/452. Where it is possible to do so without jeopardising the functioning of the cooperation mechanism, the Commission shall ensure that the data subjects are informed individually in an appropriate format. 2\. Where the Commission restricts, wholly or partly, the provision of information to data subjects whose data are processed for the purposes of analyses and procedures with regard to the screening of foreign direct investments or the cooperation mechanism under Regulation (EU) 2019/452, it shall record and register the reasons for the restriction in accordance with Article 6 of this Decision. Article 4 Right of access by data subject, right of erasure and right to restriction of processing 1\. Where the Commission restricts, wholly or partly, the right of access to personal data by data subjects, the right of erasure, or the right to restriction of processing, as referred to respectively in Articles 17, 19 and 20 of Regulation (EU) 2018/1725, it shall inform the data subject concerned, in its reply to the request for access, erasure or restriction of processing: (a) | of the restriction applied and of the principal reasons thereof; and ---|--- (b) | of the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking a judicial remedy in the Court of Justice of the European Union. ---|--- 2\. The provision of information concerning the reasons for the restriction referred to in paragraph 1 may be deferred, omitted or denied for as long as it would undermine the purpose of the restriction. 3\. The Commission shall record and register the reasons for the restriction in accordance with Article 6. 4\. Where the right of access is wholly or partly restricted, the data subject may exercise his or her right of access through the intermediary of the European Data Protection Supervisor, in accordance with Article 25(6), (7) and (8) of Regulation (EU) 2018/1725. Article 5 Communication of personal data breaches to data subjects Where the Commission restricts the communication of a personal data breach to the data subject, as referred to in Article 35 of Regulation (EU) 2018/1725, it shall record and register the reasons for the restriction in accordance with Article 6 of this Decision. Article 6 Recording and registering of restrictions 1\. The Commission shall record the reasons for any restriction applied pursuant to this Decision, including an assessment of the necessity and proportionality of the restriction, taking into account the relevant elements set out in Article 25(2) of Regulation (EU) 2018/1725. 2\. The record shall state how the exercise of a right by the relevant data subject would jeopardise the purpose of the Commission’s analyses and procedures with regard to the screening of foreign direct investments or the cooperation mechanism under Regulation (EU) 2019/452, or of restrictions applied pursuant to Article 2(2) or (3) of this Decision, or would adversely affect the rights and freedoms of other data subjects. 3\. The record and, where applicable, the documents containing underlying factual and legal elements shall be registered. They shall be made available to the European Data Protection Supervisor on request. Article 7 Duration of restrictions 1\. The restrictions referred to in Articles 3, 4 and 5 shall continue to apply as long as the reasons justifying them remain applicable. 2\. Where the reasons for a restriction referred to in Article 3 or 5 no longer apply, the Commission shall lift the restriction and provide the principal reasons for the restriction to the data subject. At the same time, the Commission shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor at any time or of seeking a judicial remedy in the Court of Justice of the European Union. 3\. The Commission shall review the application of the restrictions referred to in Articles 3 and 5 one year after adoption and at the closure of the relevant Commission analyses and procedures carried out with regard to the screening of foreign direct investments or the cooperation mechanism under Regulation (EU) 2019/452. Thereafter, the Commission shall monitor the need to maintain any restriction. The review shall include an assessment of the necessity and proportionality of the restriction, taking into account the relevant elements set out in Article 25(2) of Regulation (EU) 2018/1725. Article 8 Review by the Data Protection Officer of the Commission 1\. The Data Protection Officer of the Commission shall be informed, without undue delay, whenever data subjects’ rights are restricted in accordance with this Decision. Upon request, the Data Protection Officer shall be provided with access to the record and any documents containing underlying factual and legal elements. 2\. The Data Protection Officer may request a review of the restriction. The Data Protection Officer shall be informed about the outcome of the requested review. 3\. The Commission shall document the involvement of the Data Protection Officer in each case where the application of rights and obligations referred to in Article 2(2) is restricted. Article 9 Entry into force This Decision shall enter into force on the third day following that of its publication in the Official Journal of the European Union. Done at Brussels, 15 October 2020. For the Commission The President Ursula VON DER LEYEN * * * (1) Regulation (EU) 2019/452 of the European Parliament and of the Council of 19 March 2019 establishing a framework for the screening of foreign direct investments into the Union (OJ L 79 I, 21.3.2019, p. 1). (2) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39). (3) The retention of files in the Commission is regulated by the Common Commission-Level Retention List (SEC (2019) 900). The retention period will be defined in the data protection records for this particular processing. (4) Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ L 135, 24.5.2016, p. 53). (5) Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’) (OJ L 283, 31.10.2017, p. 1). (6) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). (7) Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89). (8) C(2000) 3614 (OJ L 308, 8.12.2000, p. 26). * * *