Right of rectification, erasure and restriction of processing
Where the Office restricts, wholly or partly, the application of the right to rectification, erasure or restriction of processing, referred to in Articles 18, 19(1) and 20(1) of Regulation (EU) 2018/1725, it shall take the steps set out in Article 4(2) of this Decision and register the record in accordance with Article 4(3) thereof.
Article 6
Communication of a personal data breach to the data subject
Where the Office restricts the communication of a personal data breach to the data subject, referred to in Article 35 of Regulation (EU) 2018/1725, it shall record and register the reasons for the restriction in accordance with Article 3(3) of this Decision. Article 3(4) of this Decision shall apply.
Article 7
Review by the Data Protection Officer
1. The Data Protection Officer of the Office (‘the Office DPO’), shall be informed, without undue delay, whenever data subjects' rights are restricted in accordance with this Decision. The Office DPO shall be provided with access to the record and any documents containing underlying factual and legal elements.
The Office DPO may request a review of the restrictions. The Office DPO shall be informed in writing of the outcome of the requested review.
2. Where Commission services and executive agencies process personal data in instances referred to in Article 1(3), the Data Protection Officer of the Commission (‘the Commission DPO’) or, where applicable, the Data Protection Officer of the executive agency concerned (‘the Agency DPO’), shall be informed, without undue delay, whenever data subjects' rights are restricted in accordance with this Decision. Upon request, the Commission DPO or, where applicable, the Agency DPO shall be provided with access to the record and any documents containing underlying factual and legal elements.
The Commission DPO or, where applicable, the Agency DPO, may request a review of the restrictions. The Commission DPO or the Agency DPO shall be informed in writing about the outcome of the requested review.
3. All information exchanges with the DPO throughout the procedure shall be recorded in the appropriate form.
Article 8
Entry into force
This Decision shall enter into force on the day of its publication in the
Official Journal of the European Union
.
It shall apply from 11 December 2018.
Done at Brussels, 11 December 2018.
For the Commission
The President
Jean-Claude JUNCKER
(1) Commission Decision 1999/352/EC, ECSC, Euratom of 28 April 1999 establishing the European Anti-fraud Office (OLAF) (
OJ L 136, 31.5.1999, p. 20
).
(2) Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (
OJ L 248, 18.9.2013, p. 1
).
Feedback