Council Decision (EU) 2021/1093 of 28 June 2021 laying down implementing rules concerning the Data Protection Officer of the Council, the application of Regulation (EU) 2018/1725 of the European Parliament and of the Council, and restrictions of data subjects’ rights in the context of the exercise of the tasks of the Data Protection Officer of the Council, and repealing Council Decision 2004/644/EC

.

Before applying restrictions in the circumstances referred to in the first subparagraph, the Council or the GSC shall consult the relevant Union institution or body, unless it is clear that the application of a restriction is provided for by one of the acts referred to in that subparagraph.

1. Any restriction of the rights and obligations referred to in paragraph 2 shall be necessary and proportionate, taking into account the risks to the rights and freedoms of data subjects.

Article 18

Provision of information to data subjects

1. The GSC shall publish on the Council’s website data protection notices that inform data subjects of the DPO tasks involving the processing of their personal data.

1. The GSC shall individually inform, in an appropriate format, any natural person whom it considers a person concerned by the DPO tasks.

1. Where the GSC restricts, wholly or partly, the provision of information to data subjects referred to in paragraph 2 of this Article, the GSC shall record and register the reasons for the restriction, in accordance with Article 21.

Article 19

Right of access by data subjects, right to erasure and right to restriction of processing

1. Where the Council or the GSC restricts, wholly or partly, the right of access to personal data by data subjects, the right to erasure or the right to restriction of processing as referred to in Articles 17, 19 and 20, respectively, of Regulation (EU) 2018/1725, it shall inform the data subject concerned, in its reply to a request for access, erasure or restriction of processing of the restriction applied and of the principal reasons therefor, and of the possibility of lodging a complaint with the EDPS or of seeking a judicial remedy before the Court of Justice of the European Union.

1. The provision of information concerning the reasons for the restriction referred to in paragraph 1 may be deferred, omitted or denied for as long as it would undermine the purpose of the restriction. The Council shall provide the information to the data subject as soon as such information would not undermine that purpose.

1. The GSC shall record and register the reasons for the restriction in accordance with Article 21.

Article 20

Communication of a personal data breach to the data subject

Where the Council or the GSC restricts the communication of a personal data breach to the data subject as referred to in Article 35 of Regulation (EU) 2018/1725, the GSC shall record and register the reasons for the restriction in accordance with Article 21 of this Decision.

Article 21

Recording and registering of restrictions

1. The GSC shall record the reasons for any restriction applied pursuant to this Decision, including a case-by-case assessment of the necessity and proportionality of the restriction, taking into account the relevant elements of Article 25(2) of Regulation (EU) 2018/1725.

To that end, the record shall state how the exercise of any of the rights referred to in Articles 14 to 17, 19, 20 and 35 of that Regulation, or of the principle of transparency laid down in Article 4(1), point (a), thereof, would jeopardise the DPO activities under this Decision, or the restrictions applied pursuant to Article 17(2) or (3) of this Decision, or would adversely affect the rights and freedoms of other data subjects.

1. The record and, where applicable, the documents containing underlying factual and legal elements shall be registered. They shall be made available to the EDPS on request.

Article 22

Duration of restrictions

1. Restrictions referred to in Articles 18, 19 and 20 shall continue to apply as long as the reasons justifying them remain applicable.

1. Where the reasons for a restriction referred to in Articles 18 and 20 no longer apply, the GSC shall lift the restriction and provide the reasons for the restriction to the data subject. At the same time, the GSC shall inform the data subject of the possibility of lodging a complaint with the EDPS at any time or of seeking judicial remedy before the Court of Justice of the European Union.

1. The GSC shall review the application of the restrictions referred to in Articles 18 and 20 every six months after their adoption and in any case at the completion of the relevant DPO task. After the completion, the GSC shall monitor the need to maintain any restriction or deferral on an annual basis.

Article 23

Review by the DPO

1. Where other GSC directorates-general or services conclude that a data subject’s rights should be restricted pursuant to this Decision, they shall inform the DPO. They shall also provide the DPO with access to the record and any documents containing underlying factual and legal elements. The involvement of the DPO in the application of restrictions shall be documented in detail.

1. The DPO may request that the delegated controller concerned review the application of the restrictions. The delegated controller concerned shall inform the DPO in writing about the outcome of the requested review.

SECTION 6

FINAL PROVISIONS

Article 24

Repeal

Decision 2004/644/EC is repealed.

Article 25

Entry into force

This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Done at Luxembourg, 28 June 2021.

For the Council

The President

M. do C. Antunes