Decision of the Management Board of the European Insurance and Occupational Pensions Authority of 23 May 2019 on internal rules concerning restrictions of certain rights of data subjects in relation to processing of personal data in the framework of the functioning of EIOPA Article 8: Communication of a personal data breach to the data subject and confidentiality of electronic communications

Article 8 - Communication of a personal data breach to the data subject and confidentiality of electronic communications

‹

Article 8

Communication of a personal data breach to the data subject and confidentiality of electronic communications

›

1. In duly justified cases and under the conditions stipulated in this decision, the right to the communication of a personal data breach may be restricted by the controller in the context of the following processing operations, where necessary and appropriate:

((a))

the performance of administrative inquiries and disciplinary proceedings;

((b))

preliminary activities related to cases of potential irregularities reported to OLAF;

((c))

whistleblowing procedures;

((d))

(formal and informal) procedures for cases of harassment;

((e))

processing internal and external complaints;

((f))

internal audits;

((g))

the investigations carried out by the DPO in line with Article 45(2) of Regulation (EU) 2018/1725;

((h))

(IT) security investigations handled internally or with external involvement (e.g. CERT-EU).

2. In duly justified cases and under the conditions stipulated in this decision, the right to confidentiality of electronic communications may be restricted by the controller in the context of the following processing operations, where necessary and appropriate:

((a))

the performance of administrative inquiries and disciplinary proceedings;

((b))

preliminary activities related to cases of potential irregularities reported to OLAF;

((c))

whistleblowing procedures;

((d))

formal procedures for cases of harassment;

((e))

processing internal and external complaints;

((f))

(IT) security investigations handled internally or with external involvement (e.g. CERT-EU).

3. Where EIOPA restricts the communication of a personal data breach to the data subject or the confidentiality of electronic communications referred to in Articles 35 and 36 of Regulation (EU) 2018/1725, it shall record and register the reasons for the restriction in accordance with Article 5(3) of this decision. Article 5(4) of this Decision shall apply.