COMMISSION DECISION (EU) 2024/1043

| Official Journal of the European Union | EN L series ---|---|--- * * * | 2024/1043 | 11.4.2024 ---|---|--- COMMISSION DECISION (EU) 2024/1043 of 9 April 2024 laying down internal rules concerning the restriction of certain data subjects’ rights in the context of processing of personal data by the Chief Confidential Counsellor and the confidential counsellors in the performance of the tasks relating to the prevention of and fight against psychological and sexual harassment THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (1), and in particular Article 25(1) thereof, Whereas: (1) | The Staff Regulations of Officials of the European Union and the Conditions of Employment of Other Servants of the European Union, laid down in Council Regulation (EEC, Euratom, ECSC) No 259/68 (the ‘Staff Regulations’) (2) provide that staff members are to refrain from any action or behaviour which might reflect adversely upon their position, including any form of psychological or sexual harassment. ---|--- (2) | The Commission has put in place a policy to prevent and deal effectively with actual or potential cases of psychological or sexual harassment in the world of work at the Commission, as provided for in Commission Decision C(2023) 8630 (3). ---|--- (3) | Decision C(2023) 8630 establishes the function of Chief Confidential Counsellor and lays down an informal procedure whereby the victim of harassment or a witness of such harassment can contact the Chief Confidential Counsellor. The Chief Confidential Counsellor is the main entry point for victims of harassment to provide prompt and confidential advice, information on available services, and support. They may assign a case to one of the confidential counsellors under the informal procedure or, in exceptional situations, decide to perform the same tasks as confidential counsellors. The confidential counsellors receive, listen to, support, inform, and guide victims in their efforts to find satisfactory solution in a situation which victims perceive as involving harassment. The informal procedure aims at offering an appropriate assistance to the issues raised by the victim, without providing an assessment of the behaviour in legal terms. In cases of recurrent allegations of harassment occurring in the same Directorate-General or Service, the Chief Confidential Counsellor may inform the Director-General or the Head of Service concerned, and, if the victim agrees, the Investigation and Disciplinary Office of the Commission (‘IDOC’). The Chief Confidential Counsellor can also contact the relevant actors or services to provide information or advice on appropriate measures without prejudice to their respective competences. ---|--- (4) | In the context of this informal procedure conducted by the Chief Confidential Counsellor and the confidential counsellors, the Commission collects and processes information. That information may include personal data of the victim, the alleged harasser, potential witnesses, and any other persons concerned. ---|--- (5) | Beyond the informal procedure, the Chief Confidential Counsellor should also be able to, where relevant, facilitate the implementation of interim protective measures and accompanying measures and contact the relevant services. In this context, the Chief Confidential Counsellor also has access to personal data of the victim, the alleged harassers, potential witnesses and any other person concerned. ---|--- (6) | Moreover, the Chief Confidential Counsellor may be asked to advise victims of harassment who engaged in the formal procedure. As part of this procedure, in conformity with Article 39(2) of Decision C(2023) 8630 the victim may ask the Chief Confidential Counsellor to provide an independent opinion on aspects of the preliminary examination and who may, for this purpose, have access to personal data of the victim, the alleged harasser, witnesses, and any other person concerned. ---|--- (7) | To fulfil their task, the Chief Confidential Counsellor and the confidential counsellors may collect and process several categories of personal data, including identification, contact and behavioural data as well as personal data referred to in Article 10(1) and Article 11 of Regulation (EU) 2018/1725. The Commission acts as data controller. ---|--- (8) | While carrying out its tasks under the Staff Regulations, the Commission is bound to respect the rights of natural persons in relation to the processing of personal data recognised by Article 8(1) of the Charter of Fundamental Rights of the European Union and by Article 16(1) of the Treaty on the Functioning of the European Union, as well as the rights provided for in Regulation (EU) 2018/1725. At the same time, all staff of the Commission are required to comply with rules of confidentiality. ---|--- (9) | In certain circumstances, it is necessary to reconcile the rights of certain data subjects pursuant to Regulation (EU) 2018/1725 with the need to ensure effectiveness of the Commission’s response to allegations of harassment and other inappropriate behaviour, as well as with full respect for the fundamental rights and freedoms of other data subjects. To that effect, Article 25 of Regulation (EU) 2018/1725 gives the Commission the possibility to restrict, under strict conditions, the application of Articles 14 to 22, 35 and 36 of Regulation (EU) 2018/1725, as well as Article 4 thereof in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 20 of Regulation (EU) 2018/1725. Unless restrictions are provided for in a legal act adopted on the basis of the Treaties, it is necessary to adopt internal rules under which the Commission is entitled to restrict those rights. ---|--- (10) | In order to ensure the confidentiality and effectiveness of the anti-harassment procedures, including administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings, the Commission adopted Decision (EU) 2019/165 (4) and Decision (EU) 2022/121 (5), which restrict, respectively, the exercise of data subjects’ rights pursuant to Article 25(1) points (b), (c), (g) and (h), of Regulation (EU) 2018/1725. ---|--- (11) | The Commission might be required to reconcile the rights of data subjects with the need to safeguard both the objectives of the informal procedure conducted by the Chief Confidential Counsellor and the confidential counsellors and the performance of other tasks of the Chief Confidential Counsellor as provided for in the Decision C(2023) 8630. ---|--- (12) | It might notably be required to balance the alleged harasser’s data subject rights, such as their right to access their personal data collected by the Chief Confidential Counsellor and the confidential counsellors, against the fundamental rights and freedoms of all other persons concerned, such as the victim and potential witnesses. The Commission may decide to do so in particular to protect those persons against possible retaliation by the persons concerned against whom allegations were made, which however have not led to measures by the administration. The Commission may decide to do so pursuant to Article 25(1), point (h), of Regulation (EU) 2018/1725. ---|--- (13) | It might be necessary to protect confidential information concerning a staff member who has contacted the Chief Confidential Counsellor or confidential counsellors in the context of a harassment procedure. In such cases, the Commission might need to restrict access to the identity, statements and other personal data of the alleged victim, the witnesses, and other persons concerned, in order to protect the rights and freedoms of all concerned. ---|--- (14) | In order to comply with Articles 14, 15 and 16 of Regulation (EU) 2018/1725, the Commission should inform all individuals of its activities involving the processing of their personal data and of their rights, in a transparent and coherent manner, by means of a data protection notice published on the Commission’s website. Where relevant, the Commission should individually inform, by appropriate means, the data subjects involved in the informal reporting procedure. ---|--- (15) | Article 16(5) of Regulation (EU) 2018/1725 provides for exceptions to data subjects’ right to information. If those exceptions apply, the Commission does not need to apply a restriction to the right to information under this Decision. In cases of allegations of psychological and sexual harassment that give rise to an informal procedure, the personal data should remain confidential. Providing this information to the alleged harasser would seriously impair the achievement of the objectives of that processing. Therefore, those exceptions should be applied to alleged harassers’ right of information as regards personal data collected by the Chief Confidential Counsellor and the confidential counsellors. ---|--- (16) | The Commission should apply restrictions only when they respect the essence of fundamental rights and freedoms, are strictly necessary and are a proportionate measure in a democratic society. The Commission should provide a justification for those restrictions. In application of the principles of transparency, fairness and accountability, the Commission should handle all restrictions in a transparent manner and keep a record of its application of restrictions. ---|--- (17) | Article 25(6) of Regulation (EU) 2018/1725 obliges the controller to inform data subjects of the principal reasons on which the application of the restriction is based and of their right to lodge a complaint with the European Data Protection Supervisor. ---|--- (18) | Pursuant to Article 25(8) of Regulation (EU) 2018/1725, controllers may defer, omit or deny the provision of information relating to the principal reasons for the application of a restriction to the data subject if providing that information would in any way cancel the effect of the restriction. The Commission should assess on a case-by-case basis whether the communication of the restriction would cancel its effect. ---|--- (19) | The Commission should lift the restriction as soon as the reasons that justify the restriction no longer apply and assess those conditions on a regular basis. ---|--- (20) | The Data Protection Coordinator of the Directorate-General responsible for Human Resources should be consulted in advance of any restrictions that may be applied and verify their compliance with this Decision. ---|--- (21) | The Data Protection Officer of the Commission should carry out an independent review of the application of restrictions, with a view to ensuring compliance with this Decision. ---|--- (22) | The European Data Protection Supervisor has been consulted in accordance with Article 41(2) of Regulation (EU) 2018/1725 and delivered his opinion on 13 October 2023, ---|--- HAS ADOPTED THIS DECISION: Article 1 Scope and subject matter 1\. This Decision applies to the processing of personal data by the Commission as controller for the purposes of the performance of the tasks of the Chief Confidential Counsellor and the confidential counsellors to prevent and fight psychological or sexual harassment, as set out in Decision C(2023) 8630. 2\. The categories of personal data covered by this Decision include identification, contact and behavioural data related to the behaviour of the alleged harasser towards the victim or other persons concerned, as well as personal data referred to in Article 10(1) and Article 11 of Regulation (EU) 2018/1725. 3\. This Decision lays down the rules to be followed by the Commission to inform data subjects of the processing of their personal data in accordance with Articles 14, 15 and 16 of Regulation (EU) 2018/1725. 4\. It also lays down the conditions under which the Commission may restrict the application of Articles 4, 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725, in accordance with Article 25(1), point (h), thereof. Article 2 Applicable restrictions 1\. Subject to Articles 3 to 7 of this Decision, where the exercise of the rights and obligations referred to in the following provisions would adversely affect the protection of the data subject or the rights and freedoms of others in accordance with Article 25(1), point (h), of Regulation (EU) 2018/1725, the Commission may restrict the application of: (a) | Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725; ---|--- (b) | the principle of transparency laid down in Article 4(1), point (a), of Regulation (EU) 2018/1725 insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19 and 20 of that Regulation. ---|--- The Commission shall exercise the power granted in the first subparagraph only in order to safeguard either of the following: (a) | the objectives of the informal procedure set out in Chapter II of Title II of Decision C(2023) 8630; ---|--- (b) | the performance of the tasks of the Chief Confidential Counsellor and of the confidential counsellors of the Commission for the prevention of and fight against psychological and sexual harassment. ---|--- The Commission shall exercise the power granted in the first subparagraph only in respect of either of the following personal data categories processed by the Commission: (a) | data which victims report to the Chief Confidential Counsellor and the confidential counsellors of the Commission; ---|--- (b) | data which are detected by the Chief Confidential Counsellor as part of their task to inform the Director-General or the Head of Service concerned, and, if the victim agrees, IDOC, of recurrent allegations of harassment occurring in the same Directorate-General or Service. ---|--- 2\. The Commission may do so where the exercise of those rights and obligations would adversely affect the protection of the data subjects or the rights and freedoms of others in line with Article 25(1), point (h) of Regulation (EU) 2018/1725. 3\. Paragraph 1 shall not affect the application of other Commission decisions laying down internal rules concerning the provision of information to data subjects and the restrictions under Article 25 of Regulation (EU) 2018/1725. 4\. Before restrictions are applied, the Commission shall carry out a case-by- case assessment of their necessity and proportionality. Restrictions shall be limited to what is strictly necessary to achieve their objective. Article 3 Provision of information to data subjects 1\. The Commission shall publish on its website a data protection notice that informs all data subjects of its activities involving processing of their personal data for the purposes set out in Article 2(1), second subparagraph. 2\. The data protection notice shall include a section providing general information to data subjects on the potential for restriction of data subjects’ rights pursuant to Article 2(1). It shall cover the rights that may be restricted, the grounds on which restrictions may be applied and potential duration of those restrictions. 3\. The Commission shall individually inform, by appropriate means, victims and witnesses who report cases of psychological and sexual harassment, about the processing of their personal data. 4\. Upon completion of the informal procedure with the Chief Confidential Counsellor, the Commission shall inform the alleged harasser whose data subject rights have been restricted in accordance with this Decision individually, in writing and without undue delay of the relevant restrictions of their rights. The Commission shall inform the data subject of the principal reasons on which the application of the restriction is based, of their right to consult the Data Protection Officer with a view to challenging the restriction, and of their right to lodge a complaint with the European Data Protection Supervisor. The Commission may continue to restrict certain data subject rights linked to personal data processed for the purposes of the informal procedure after the completion of the informal procedure if this is strictly necessary for the protection of the victim or other persons concerned, and shall, if possible, provide an indication of a period in which the rights will be fully restored. Article 4 Right of access by data subjects, right of erasure and right to restriction of processing 1\. Where the Commission restricts, wholly or partly, the right of access to personal data by data subjects, the right of erasure, or the right to restriction of processing as referred to in Articles 17, 19 and 20 of Regulation (EU) 2018/1725, it shall inform the data subject concerned in writing and without undue delay, in its reply to the request for access, erasure or restriction of processing, of the following: (a) | the restriction applied and the principal reasons on which the application of the restriction is based; ---|--- (b) | the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking a judicial remedy with Court of Justice of the European Union. ---|--- 2\. The provision of information concerning the principal reasons for the restriction referred to in paragraph 1, point (a), may be deferred, omitted, or denied for as long as this would cancel the effect of the restriction The Commission shall assess if such a restriction is justified on a case-by-case basis. Article 5 Communication and notification of personal data breaches 1\. Where the Commission is under an obligation to communicate a personal data breach to the data subject under Article 35(1) of Regulation (EU) 2018/1725, it may, in exceptional circumstances, restrict such communication wholly or partly. It shall document in a note the reasons for the restriction, the legal ground for it under Article 2 and an assessment of its necessity and proportionality. The note shall be communicated to the European Data Protection Supervisor at the time of the notification of the personal data breach. 2\. Where the reasons for the restriction no longer apply, the Commission shall communicate the personal data breach to the data subject concerned and inform them of the principal reasons for the restriction and of their right to lodge a complaint with the European Data Protection Supervisor. 3\. Where the Commission notifies the personal data breach to the European Data Protection Supervisor pursuant to Article 34(1) of Regulation (EU) 2018/1725, it shall accompany the notification with the record it made pursuant to Article 6 of this Decision. Article 6 Recording and registering of restrictions 1\. Assessments of the risks to the rights and freedoms of data subjects of imposing restrictions and details of the period of application of those restrictions shall be registered in the record of processing activities maintained by the Commission under Article 31 of the Regulation (EU) 2018/1725. The record shall state how the exercise of the right by the relevant data subject would undermine the applicable ground set out in Article 25(1), point (h), of Regulation (EU) 2018/1725. 2\. The Commission shall record the reasons for any individual assessment concerning each restriction applied pursuant to this Decision, including an assessment of the risks to the rights and freedoms of data subjects of imposing a restriction and the necessity and proportionality of the restriction, taking into account the relevant elements set out in Article 25(2) of Regulation (EU) 2018/1725. 3\. The record and, where applicable, the documents containing underlying factual and legal elements shall be registered. They shall be made available to the European Data Protection Supervisor on request. 4\. The Commission shall prepare periodic reports on the application of Article 25 of the Regulation (EU) 2018/1725. Article 7 Duration of restrictions 1\. Restrictions referred to in Articles 3, 4 and 5 shall continue to apply as long as the reasons justifying them remain applicable. 2\. Where the reasons justifying the restriction referred to in Articles 3, 4 or 5 no longer apply, the Commission shall lift the restriction. At the same time, the Commission shall also provide the principal reasons for applying that restriction to the data subject and inform them of the possibility of lodging a complaint with the European Data Protection Supervisor at any time or of seeking a judicial remedy in the Court of Justice of the European Union. 3\. The Commission shall review the application of the restrictions referred to in Articles 3, 4 and 5 every six months. The review shall include an assessment of the necessity and proportionality of the restriction, taking into account the relevant elements set out in Article 25(2) of Regulation (EU) 2018/1725. Article 8 Safeguards and storage periods 1\. The Commission shall implement safeguards to prevent abuse and unlawful access to or transfer of personal data in respect of which restrictions apply or could be applied. Such safeguards shall include technical and organisational measures such as: (a) | a clear definition of roles, responsibilities, access rights and procedural steps; ---|--- (b) | a secure electronic environment to prevent unlawful or accidental access to or transfer of electronic data to unauthorised persons; ---|--- (c) | a secure storage and processing of paper documents limited to what is strictly necessary to achieve the purpose of processing; ---|--- (d) | due monitoring of restrictions and a periodic review of their application, which shall be conducted at least every six months. ---|--- 2\. Restrictions referred to in Article 2 shall be lifted as soon as the reasons justifying them cease to exist. 3\. The personal data shall be retained in accordance with the applicable Commission retention rules, to be defined in the records kept under Article 31 of Regulation (EU) 2018/1725. At the end of the retention period, the personal data shall be deleted, anonymised or transferred to the archives in accordance with Article 13 of Regulation (EU) 2018/1725. Article 9 Ex-ante review by the Data Protection Coordinator and ex-post review by the Data Protection Officer of the Commission 1\. The Data Protection Coordinator of the Directorate-General responsible for Human Resources shall be consulted in advance of any restrictions that may be applied and verify their compliance with this Decision. 2\. The Data Protection Officer of the Commission shall be informed, without undue delay, whenever data subjects’ rights are restricted in accordance with this Decision. Upon request, the Data Protection Officer shall be provided with access to the record and any documents containing underlying factual and legal elements. 3\. The Data Protection Officer may request a review of the application of a restriction. The Data Protection Officer shall be informed in writing of the outcome of the requested review. 4\. The Commission shall document the involvement of the Data Protection Officer and the Data Protection Coordinator, including what information is shared with them, in each case where the rights and obligations referred to in Article 2(1), first subparagraph, are restricted. Article 10 Entry into force This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. Done at Brussels, 9 April 2024. For the Commission The President Ursula VON DER LEYEN * * * (1) OJ L 295, 21.11.2018, p. 39. (2) Regulation (EEC, Euratom, ECSC) No 259/68 of the Council of 29 February 1968 laying down the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Communities and instituting special measures temporarily applicable to officials of the Commission (OJ L 56, 4.3.1968, p. 1). (3) Commission Decision C(2023) 8630 of 12 December 2023 on the prevention of and fight against psychological and sexual harassment. (4) Commission Decision (EU) 2019/165 of 1 February 2019 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their data protection rights by the Commission in the context of administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings (OJ L 32, 4.2.2019, p. 9). (5) Commission Decision (EU) 2022/121 of 27 January 2022 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their rights in the context of processing of personal data for the purposes of handling requests and complaints under the Staff Regulations (OJ L 19, 28.1.2022, p. 77). * * * ELI: http://data.europa.eu/eli/dec/2024/1043/oj ISSN 1977-0677 (electronic edition) * * *