Decision of the Management Board of the European Insurance and Occupational Pensions Authority of 23 May 2019 on internal rules concerning restrictions of certain rights of data subjects in relation to processing of personal data in the framework of the functioning of EIOPA Article 6: Right of access by data subject

Article 6 - Right of access by data subject

‹

Article 6

Right of access by data subject

›

1. In duly justified cases and under the conditions stipulated in this decision, the right to access may be restricted by the controller in the context of the following processing operations, where necessary and proportionate:

((a))

the performance of administrative inquiries and disciplinary proceedings;

((b))

preliminary activities related to cases of potential irregularities reported to OLAF;

((c))

whistleblowing procedures;

((d))

(formal and informal) procedures for cases of harassment;

((e))

processing internal and external complaints;

((f))

internal audits;

((g))

the investigations carried out by the DPO in line with Article 45(2) of Regulation (EU) 2018/1725;

((h))

(IT) security investigations handled internally or with external involvement (e.g. CERT-EU).

Where data subjects request access to their personal data processed in the context of one or more specific cases or to a particular processing operation, in accordance with Article 17 of Regulation (EU) 2018/1725, EIOPA shall limit its assessment of the request to such personal data only.

2. Where EIOPA restricts, wholly or partly, the right of access, referred to in Article 17 of Regulation (EU) 2018/1725, it shall take the following steps:

((a))

it shall inform the data subject concerned, in its reply to the request, of the restriction applied and of the principal reasons thereof, and of the possibility of lodging a complaint with the EDPS or of seeking a judicial remedy in the Court of Justice of the European Union;

((b))

it shall document in an internal assessment note the reasons for the restriction, including an assessment of the necessity, proportionality of the restriction and its duration.

The provision of information referred to in point (a) may be deferred, omitted or denied if it would cancel the effect of the restriction in accordance with Article 25(8) of Regulation (EU) 2018/1725.

3. EIOPA shall review the application of the restriction every six months from its adoption and at the closure of the relevant investigation. Thereafter, the controller shall monitor the need to maintain any restriction every six months. The DPO shall be informed accordingly.

4. The record and, where applicable, the documents containing underlying factual and legal elements shall be registered. They shall be made available to the EDPS on request.