# Official Journal L 213/2020

| | ISSN 1977-0677 |
| --- | --- |
| Official Journal
  of the European Union | L 213 |
| | |
| English edition | Legislation | Volume 636 July 2020 |

ISSN 1977-0677

Official Journal

of the European Union

L 213

English edition

Legislation

Volume 636 July 2020

---

| Contents | | II   Non-legislative acts | page |
| --- | --- | --- | --- |
| | | REGULATIONS |
| | * | Commission Implementing Regulation (EU) 2020/966 of 1 July 2020 terminating a new exporter review of Implementing Regulation (EU) 2019/1379 imposing a definitive anti-dumping duty on imports of bicycles originating in the People’s Republic of China for one Chinese exporting producer, imposing the duty with regard to that producer’s imports and terminating the registration of these imports | 1 |
| | * | Commission Implementing Regulation (EU) 2020/967 of 3 July 2020 laying down the detailed rules on the signal and implementation characteristics of acoustic deterrent devices as referred to in Part A of Annex XIII of Regulation (EU) 2019/1241 of the European Parliament and of the Council on the conservation of fisheries resources and the protection of marine ecosystems through technical measures | 4 |
| | * | Commission Implementing Regulation (EU) 2020/968 of 3 July 2020 renewing the approval of the active substance pyriproxyfen in accordance with Regulation (EC) No 1107/2009 of the European Parliament and of the Council concerning the placing of plant protection products on the market, and amending the Annex to Commission Implementing Regulation (EU) No 540/2011 (
  1
  ) | 7 |
| | | DECISIONS |
| | * | Commission Decision (EU) 2020/969 of 3 July 2020 laying down implementing rules concerning the Data Protection Officer, restrictions of data subjects’ rights and the application of Regulation (EU) 2018/1725 of the European Parliament and of the Council, and repealing Commission Decision 2008/597/EC | 12 |

Contents

II   Non-legislative acts

page

REGULATIONS

*

Commission Implementing Regulation (EU) 2020/966 of 1 July 2020 terminating a new exporter review of Implementing Regulation (EU) 2019/1379 imposing a definitive anti-dumping duty on imports of bicycles originating in the People’s Republic of China for one Chinese exporting producer, imposing the duty with regard to that producer’s imports and terminating the registration of these imports

1

*

Commission Implementing Regulation (EU) 2020/967 of 3 July 2020 laying down the detailed rules on the signal and implementation characteristics of acoustic deterrent devices as referred to in Part A of Annex XIII of Regulation (EU) 2019/1241 of the European Parliament and of the Council on the conservation of fisheries resources and the protection of marine ecosystems through technical measures

4

*

Commission Implementing Regulation (EU) 2020/968 of 3 July 2020 renewing the approval of the active substance pyriproxyfen in accordance with Regulation (EC) No 1107/2009 of the European Parliament and of the Council concerning the placing of plant protection products on the market, and amending the Annex to Commission Implementing Regulation (EU) No 540/2011 (
  1
  )

1

7

DECISIONS

*

Commission Decision (EU) 2020/969 of 3 July 2020 laying down implementing rules concerning the Data Protection Officer, restrictions of data subjects’ rights and the application of Regulation (EU) 2018/1725 of the European Parliament and of the Council, and repealing Commission Decision 2008/597/EC

12

| | | Corrigenda |
| --- | --- | --- |
| | * | Corrigendum to Council Decision (EU) 2019/753 of 30 March 2020 on the conclusion of the Free Trade Agreement between the European Union and the Socialist Republic of Viet Nam ( OJ L 186, 12.6.2020 ) | 23 |

Corrigenda

*

Corrigendum to Council Decision (EU) 2019/753 of 30 March 2020 on the conclusion of the Free Trade Agreement between the European Union and the Socialist Republic of Viet Nam ( OJ L 186, 12.6.2020 )

( OJ L 186, 12.6.2020 )

23

| | |
| --- | --- |
| | (1)   Text with EEA relevance. |

---

(1)   Text with EEA relevance.

1

| EN | Acts whose titles are printed in light type are those relating to day-to-day management of agricultural matters, and are generally valid for a limited period.
  The titles of all other Acts are printed in bold type and preceded by an asterisk. |
| --- | --- |

EN

Acts whose titles are printed in light type are those relating to day-to-day management of agricultural matters, and are generally valid for a limited period.

The titles of all other Acts are printed in bold type and preceded by an asterisk.

---

II Non-legislative acts

REGULATIONS

| 6.7.2020 | EN | Official Journal of the European Union | L 213/1 |
| --- | --- | --- | --- |

6.7.2020

EN

Official Journal of the European Union

L 213/1

---

COMMISSION IMPLEMENTING REGULATION (EU) 2020/966

of 1 July 2020

terminating a ‘new exporter’ review of Implementing Regulation (EU) 2019/1379 imposing a definitive anti-dumping duty on imports of bicycles originating in the People’s Republic of China for one Chinese exporting producer, imposing the duty with regard to that producer’s imports and terminating the registration of these imports

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2016/1036 of the European Parliament and of the Council of 8 June 2016 on protection against dumped imports from countries not members of the European Union (1) (‘the basic Regulation’) and in particular Articles 11(4) and 14(5) thereof,

Whereas:

1.   MEASURES IN FORCE

| (1) | By Regulation (EEC) No 2474/93 (2) (‘the original investigation’), the Council imposed a definitive anti-dumping duty of 30,6 % on imports of bicycles originating in the People’s Republic of China (‘the PRC’). Several trade defence investigations followed since then, amending the initial measures. |
| --- | --- |

(1)

By Regulation (EEC) No 2474/93 (2) (‘the original investigation’), the Council imposed a definitive anti-dumping duty of 30,6 % on imports of bicycles originating in the People’s Republic of China (‘the PRC’). Several trade defence investigations followed since then, amending the initial measures.

| (2) | By Regulation (EU) No 502/2013 (3), the Council, following an interim review pursuant to Article 11(3) of the basic Regulation, amended the measures. In that investigation, sampling was not applied for exporting producers in the PRC and the countrywide anti-dumping duty of 48,5 %, based on the dumping margin, established by Council Regulation (EC) No 1095/2005 (4), was maintained. |
| --- | --- |

(2)

By Regulation (EU) No 502/2013 (3), the Council, following an interim review pursuant to Article 11(3) of the basic Regulation, amended the measures. In that investigation, sampling was not applied for exporting producers in the PRC and the countrywide anti-dumping duty of 48,5 %, based on the dumping margin, established by Council Regulation (EC) No 1095/2005 (4), was maintained.

| (3) | The measures currently in force are anti-dumping measures imposed by Commission Implementing Regulation (EU) 2019/1379 (5). |
| --- | --- |

(3)

The measures currently in force are anti-dumping measures imposed by Commission Implementing Regulation (EU) 2019/1379 (5).

2.   CURRENT INVESTIGATION

| (4) | On 27 May 2019, the Commission received a request to initiate a ‘new exporter’ review pursuant to Article 11(4) of the basic Regulation. The request was lodged by Universal Cycle Corporation (Guangzhou) Co. Ltd. (‘the applicant’), an exporting producer of bicycles in the PRC, whose exports to the Union are subject to a definitive anti-dumping duty of 48,5 %. The applicant claimed that it did not export bicycles to the Union during the investigation period on which the anti-dumping measures were based (1 January 2011 to 31 December 2011), that it began exporting the product under review to the Union as of September 2018, and that it was not related to any of the exporting producers of bicycles which are subject to the measures in force. |
| --- | --- |

(4)

On 27 May 2019, the Commission received a request to initiate a ‘new exporter’ review pursuant to Article 11(4) of the basic Regulation. The request was lodged by Universal Cycle Corporation (Guangzhou) Co. Ltd. (‘the applicant’), an exporting producer of bicycles in the PRC, whose exports to the Union are subject to a definitive anti-dumping duty of 48,5 %. The applicant claimed that it did not export bicycles to the Union during the investigation period on which the anti-dumping measures were based (1 January 2011 to 31 December 2011), that it began exporting the product under review to the Union as of September 2018, and that it was not related to any of the exporting producers of bicycles which are subject to the measures in force.

| (5) | The Commission considered that the prima facie evidence submitted by the applicant was sufficient to justify the initiation of a review pursuant to Article 11(4) of the basic Regulation. After the Union producers had been given an opportunity to comment, the Commission initiated, by Commission Implementing Regulation (EU) 2019/2149 (6), a review of Implementing Regulation (EU) 2019/1379 with regard to the applicant. |
| --- | --- |

(5)

The Commission considered that the prima facie evidence submitted by the applicant was sufficient to justify the initiation of a review pursuant to Article 11(4) of the basic Regulation. After the Union producers had been given an opportunity to comment, the Commission initiated, by Commission Implementing Regulation (EU) 2019/2149 (6), a review of Implementing Regulation (EU) 2019/1379 with regard to the applicant.

| (6) | Pursuant to Article 2 of Implementing Regulation (EU) 2019/2149, the anti-dumping duty imposed by Implementing Regulation (EU) 2019/1379 was repealed with regard to the applicant. Simultaneously, pursuant to Articles 11(4) and 14(5) of the basic Regulation and as stated in Article 3 of Implementing Regulation (EU) 2019/2149, the Commission directed the customs authorities to register the applicant’s imports. |
| --- | --- |

(6)

Pursuant to Article 2 of Implementing Regulation (EU) 2019/2149, the anti-dumping duty imposed by Implementing Regulation (EU) 2019/1379 was repealed with regard to the applicant. Simultaneously, pursuant to Articles 11(4) and 14(5) of the basic Regulation and as stated in Article 3 of Implementing Regulation (EU) 2019/2149, the Commission directed the customs authorities to register the applicant’s imports.

| (7) | On 9 January 2020, the applicant formally withdrew its request for a ‘new exporter’ review. Consequently, the Commission considered that the review investigation should be terminated. |
| --- | --- |

(7)

On 9 January 2020, the applicant formally withdrew its request for a ‘new exporter’ review. Consequently, the Commission considered that the review investigation should be terminated.

3.   DISCLOSURE

| (8) | The Commission informed the interested parties of the intention to terminate the review investigation, to impose a definitive anti-dumping duty on imports from Universal Cycle Corporation (Guangzhou) Co. Ltd and to levy this duty retroactively on imports subject to registration under Implementing Regulation (EU) 2019/2149. Interested parties were given the opportunity to comment. No comments were received. |
| --- | --- |

(8)

The Commission informed the interested parties of the intention to terminate the review investigation, to impose a definitive anti-dumping duty on imports from Universal Cycle Corporation (Guangzhou) Co. Ltd and to levy this duty retroactively on imports subject to registration under Implementing Regulation (EU) 2019/2149. Interested parties were given the opportunity to comment. No comments were received.

4.   RETROACTIVE LEVYING OF ANTI-DUMPING DUTY

| (9) | In view of the findings outlined above, the Commission concluded that the review concerning imports of bicycles manufactured by the applicant and originating in the PRC should be terminated. Consequently, the registration of the applicant’s imports should cease and the country-wide duty applicable to all other companies (48,5 %), imposed by Implementing Regulation (EU) 2019/1379, should be levied retroactively on these imports from the date of initiation of this review. |
| --- | --- |

(9)

In view of the findings outlined above, the Commission concluded that the review concerning imports of bicycles manufactured by the applicant and originating in the PRC should be terminated. Consequently, the registration of the applicant’s imports should cease and the country-wide duty applicable to all other companies (48,5 %), imposed by Implementing Regulation (EU) 2019/1379, should be levied retroactively on these imports from the date of initiation of this review.

| (10) | The measures provided for in this Regulation are in accordance with the opinion of the Committee established by Article 15(1) of the basic Regulation, |
| --- | --- |

(10)

The measures provided for in this Regulation are in accordance with the opinion of the Committee established by Article 15(1) of the basic Regulation,

HAS ADOPTED THIS REGULATION:

Article 1

The ‘new exporter’ review initiated by Implementing Regulation (EU) 2019/2149 is hereby terminated.

Article 2

1.   The anti-dumping duty applicable according to Article 1(2) of Commission Implementing Regulation (EU) 2019/1379 to all other companies (TARIC additional code B999) in the People’s Republic of China is hereby imposed on imports identified in Article 1 of that Implementing Regulation (EU) 2019/2149.

2.   The anti-dumping duty referred to in paragraph 1 is hereby levied with effect from 17 December 2019 on imports of bicycles, which were registered pursuant to Article 3 of Implementing Regulation (EU) 2019/2149.

Article 3

1.   The customs authorities are hereby directed to cease the registration of imports carried out pursuant to Article 3 of Implementing Regulation (EU) 2019/2149.

2.   Unless otherwise specified, the provisions in force concerning customs duties shall apply.

Article 4

This Regulation shall enter into force on the day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 1 July 2020.

For the Commission

The President

Ursula VON DER LEYEN

---

(1)  OJ L 176, 30.6.2016, p. 21.

1

(2)  Council Regulation (EEC) No 2474/93 of 8 September 1993 imposing a definitive anti-dumping duty on imports into the Community of bicycles originating in the People’s Republic of China and collecting definitively the provisional anti-dumping duty (OJ L 228, 9.9.1993, p. 1).

2

(3)  Council Regulation (EU) No 502/2013 of 29 May 2013 amending Implementing Regulation (EU) No 990/2011 imposing a definitive anti-dumping duty on imports of bicycles originating in the People’s Republic of China following an interim review pursuant to Article 11(3) of Regulation (EC) No 1225/2009 (OJ L 153, 5.6.2013, p. 17).

3

(4)  Council Regulation (EC) No 1095/2005 of 12 July 2005 imposing a definitive anti-dumping duty on imports of bicycles originating in Vietnam, and amending Regulation (EC) No 1524/2000 imposing a definitive anti-dumping duty on imports of bicycles originating in the People’s Republic of China (OJ L 183, 14.7.2005, p. 1).

4

(5)  Commission Implementing Regulation (EU) 2019/1379 of 28 August 2019 imposing a definitive anti-dumping duty on imports of bicycles originating in the People’s Republic of China as extended to imports of bicycles consigned from Indonesia, Malaysia, Sri Lanka, Tunisia, Cambodia, Pakistan and the Philippines, whether declared as originating in these countries or not, following an expiry review pursuant to Article 11(2) of Regulation (EU) 2016/1036 (OJ L 225, 29.8.2019, p. 1).

5

(6)  Commission Implementing Regulation (EU) 2019/2149 of 13 December 2019 initiating a ‘new exporter’ review of Implementing Regulation (EU) 2019/1379 imposing a definitive anti-dumping duty on imports of bicycles originating in the People’s Republic of China for one Chinese exporting producer, repealing the duty with regard to imports from that exporting producer and making these imports subject to registration (OJ L 325, 16.12.2019, p. 159).

6

---

| 6.7.2020 | EN | Official Journal of the European Union | L 213/4 |
| --- | --- | --- | --- |

6.7.2020

EN

Official Journal of the European Union

L 213/4

---

COMMISSION IMPLEMENTING REGULATION (EU) 2020/967

of 3 July 2020

laying down the detailed rules on the signal and implementation characteristics of acoustic deterrent devices as referred to in Part A of Annex XIII of Regulation (EU) 2019/1241 of the European Parliament and of the Council on the conservation of fisheries resources and the protection of marine ecosystems through technical measures

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2019/1241 of the European Parliament and of the Council of 20 June 2019 on the conservation of fisheries resources and the protection of marine ecosystems through technical measures (1), and in particular Article 24(1)(e) thereof,

Whereas:

| (1) | A number of acoustic devices have been developed to deter cetaceans from fishing gear, and have proven successful in reducing incidental by-catch of cetacean species in static net fisheries. The use of such devices is required in areas and fisheries with known or foreseeable high levels of by-catch of cetaceans, as established in Annex XIII Part A Point 1.1 of Regulation (EU) 2019/1241. |
| --- | --- |

(1)

A number of acoustic devices have been developed to deter cetaceans from fishing gear, and have proven successful in reducing incidental by-catch of cetacean species in static net fisheries. The use of such devices is required in areas and fisheries with known or foreseeable high levels of by-catch of cetaceans, as established in Annex XIII Part A Point 1.1 of Regulation (EU) 2019/1241.

| (2) | Regulation (EU) 2019/1241 simplifies the existing legal framework for technical conservation measures in the European Union, which had become highly complex over the years. As part of the simplification, Regulation (EU) 2019/1241 repealed Council Regulation (EC) No 812/2004 (2), laying down measures concerning incidental catches of cetaceans in fisheries, and took over only the core technical measures to mitigate incidental catches, such as the requirement to use the fishing gear in specific areas with acoustic deterrent devices to reduce incidental catches of cetaceans. |
| --- | --- |

(2)

Regulation (EU) 2019/1241 simplifies the existing legal framework for technical conservation measures in the European Union, which had become highly complex over the years. As part of the simplification, Regulation (EU) 2019/1241 repealed Council Regulation (EC) No 812/2004 (2), laying down measures concerning incidental catches of cetaceans in fisheries, and took over only the core technical measures to mitigate incidental catches, such as the requirement to use the fishing gear in specific areas with acoustic deterrent devices to reduce incidental catches of cetaceans.

| (3) | Detailed technical specifications for the efficiency of acoustic deterrent devices that were established in Article 3 and Annex II of Council Regulation (EC) No 812/2004 were not taken over by Regulation (EU) 2019/1241. Accordingly, this Regulation should establish such detailed technical specifications or conditions for the use of acoustic deterrent devices required now under Annex XIII Part A Point 1.1 of Regulation (EU) 2019/1241, similarly to those previously specified in Article 3 and Annex II of Regulation (EC) No 812/2004. |
| --- | --- |

(3)

Detailed technical specifications for the efficiency of acoustic deterrent devices that were established in Article 3 and Annex II of Council Regulation (EC) No 812/2004 were not taken over by Regulation (EU) 2019/1241. Accordingly, this Regulation should establish such detailed technical specifications or conditions for the use of acoustic deterrent devices required now under Annex XIII Part A Point 1.1 of Regulation (EU) 2019/1241, similarly to those previously specified in Article 3 and Annex II of Regulation (EC) No 812/2004.

| (4) | Nevertheless, following advice of the Scientific, Technical and Economic Committee for Fisheries (STECF) (3), the development of new acoustic deterrent devices should not be constrained by technical specifications. Member States should, therefore, be allowed, for the purpose of this Regulation, to authorise the use of newly developed and efficient types of acoustic deterrent devices not in conformity with the technical specifications laid down in this Regulation, provided there is evidence that such devices are at least as effective in reducing incidental by-catch of cetacean species as those set in Regulation (EU) 2019/1241 (including further implementing rules adopted under this Regulation). It is therefore appropriate to establish the conditions under which the Member States can authorise use of acoustic deterrent devices that fulfil such alternative technical specifications or conditions. |
| --- | --- |

(4)

Nevertheless, following advice of the Scientific, Technical and Economic Committee for Fisheries (STECF) (3), the development of new acoustic deterrent devices should not be constrained by technical specifications. Member States should, therefore, be allowed, for the purpose of this Regulation, to authorise the use of newly developed and efficient types of acoustic deterrent devices not in conformity with the technical specifications laid down in this Regulation, provided there is evidence that such devices are at least as effective in reducing incidental by-catch of cetacean species as those set in Regulation (EU) 2019/1241 (including further implementing rules adopted under this Regulation). It is therefore appropriate to establish the conditions under which the Member States can authorise use of acoustic deterrent devices that fulfil such alternative technical specifications or conditions.

| (5) | In view of the deficiencies highlighted by reports on the control and implementation of the provisions on technical specifications for the use of the acoustic deterrent devices received by the Commission so far, this Regulation should clarify that the acoustic deterrent devices need to be functional during the whole duration of the fishing operation, and not only at the moment when nets are set. |
| --- | --- |

(5)

In view of the deficiencies highlighted by reports on the control and implementation of the provisions on technical specifications for the use of the acoustic deterrent devices received by the Commission so far, this Regulation should clarify that the acoustic deterrent devices need to be functional during the whole duration of the fishing operation, and not only at the moment when nets are set.

| (6) | The measures provided for in this Regulation are in accordance with the opinion of the Committee for Fisheries and Aquaculture, |
| --- | --- |

(6)

The measures provided for in this Regulation are in accordance with the opinion of the Committee for Fisheries and Aquaculture,

HAS ADOPTED THIS REGULATION:

Article 1

This Regulation establishes detailed rules on the signal and implementation characteristics of acoustic deterrent devices as referred to in Part A of Annex XIII of Regulation (EU) 2019/1241.

Article 2

1.   The masters of Union fishing vessels shall ensure that the acoustic deterrent devices referred to in point 1.1 of Annex XIII to Regulation (EU) 2019/1241 are fully operational, during the whole fishing operation.

2.   Such acoustic deterrent devices shall comply with one of the sets of the technical specifications and conditions of use defined in Annex I to this Regulation.

3.   By way of derogation from paragraph 2, Member States may authorise the use of acoustic deterrent devices that do not fulfil the technical specifications or conditions of use defined in the Annex, provided that such devices are at least equally effective in the reduction of incidental catches of cetaceans as the acoustic deterrent devices with the technical specifications or conditions defined in the Annex, and this has been duly documented.

4.   Member States shall inform the Commission of the authorisations issued in accordance with paragraph 3 within two months of the date of issue.

5.   The notification referred to in paragraph 4 shall be accompanied with detailed technical and scientific information on the acoustic deterrent devices authorised according to paragraph 3 and their effects on incidental catches of cetaceans.

Article 3

This Regulation shall enter into force on the thirtieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 3 July 2020.

For the Commission

The President

Ursula VON DER LEYEN

---

(1)  OJ L 198, 25.7.2019, p. 105.

1

(2)  Council Regulation (EC) No 812/2004 of 26.4.2004 laying down measures concerning incidental catches of cetaceans in fisheries and amending Regulation (EC) No 88/98 (OJ L 150, 30.4.2004, p. 12).

2

(3)  STECF (19-07) of July 2019: https://stecf.jrc.ec.europa.eu/documents/43805/2489016/STECF+19-07+-+Incid+catches+cetaceans.pdf/3485bafd-4350-40af-8d72-0226a68cb86e

3

---

ANNEX

TECHNICAL SPECIFICATIONS AND CONDITIONS OF USE OF ACOUSTIC DETERRENT DEVICES

Any acoustic deterrent devices used in application of Article 2(2) shall meet one of the following sets of signal and implementation characteristics:

| | Set 1 | Set 2 |
| --- | --- | --- |
| | Signal characteristics |
| Signal synthesis | Digital | Analogue |
| Tonal/wide band | Wide band/Tonal | Tonal |
| Source levels (max-min)
  Re 1 μPa@1 m | 145 dB | 130-150dB |
| Fundamental frequency | (a) | 20-160 KHz
  Wide band sweeps |

Set 1

Set 2

Signal characteristics

Signal synthesis

Digital

Analogue

Tonal/wide band

Wide band/Tonal

Tonal

Source levels (max-min)

Re 1 μPa@1 m

145 dB

130-150dB

Fundamental frequency

(a)

20-160 KHz

Wide band sweeps

| (b) | 10KHz tonal |
| --- | --- |

(b)

10KHz tonal

10 KHz

High frequency harmonics

Yes

Yes

Pulse duration (nominal)

300 ms

300 ms

Interpulse interval

| (a) | 4-30 seconds randomised |
| --- | --- |

(a)

4-30 seconds randomised

| (b) | 4 seconds |
| --- | --- |

(b)

4 seconds

4 seconds

Implementation characteristics

Maximum spacing between two acoustic deterrent devices along nets

200 m with one acoustic device fixed at each end of the net (or combination of nets attached together)

100 m with one acoustic device fixed at each end of the net (or combination of nets attached together)

---

| 6.7.2020 | EN | Official Journal of the European Union | L 213/7 |
| --- | --- | --- | --- |

6.7.2020

EN

Official Journal of the European Union

L 213/7

---

COMMISSION IMPLEMENTING REGULATION (EU) 2020/968

of 3 July 2020

renewing the approval of the active substance pyriproxyfen in accordance with Regulation (EC) No 1107/2009 of the European Parliament and of the Council concerning the placing of plant protection products on the market, and amending the Annex to Commission Implementing Regulation (EU) No 540/2011

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EC) No 1107/2009 of the European Parliament and of the Council of 21 October 2009 concerning the placing of plant protection products on the market and repealing Council Directives 79/117/EEC and 91/414/EEC (1), and in particular Article 20(1) thereof,

Whereas:

| (1) | Commission Directive 2008/69/EC (2) included pyriproxyfen as an active substance in Annex I to Council Directive 91/414/EEC (3). |
| --- | --- |

(1)

Commission Directive 2008/69/EC (2) included pyriproxyfen as an active substance in Annex I to Council Directive 91/414/EEC (3).

| (2) | Active substances included in Annex I to Directive 91/414/EEC are deemed to have been approved under Regulation (EC) No 1107/2009 and are listed in Part A of the Annex to Commission Implementing Regulation (EU) No 540/2011 (4). |
| --- | --- |

(2)

Active substances included in Annex I to Directive 91/414/EEC are deemed to have been approved under Regulation (EC) No 1107/2009 and are listed in Part A of the Annex to Commission Implementing Regulation (EU) No 540/2011 (4).

| (3) | The approval of the active substance pyriproxyfen, as set out in Part A of the Annex to Implementing Regulation (EU) No 540/2011, expires on 31 December 2020. |
| --- | --- |

(3)

The approval of the active substance pyriproxyfen, as set out in Part A of the Annex to Implementing Regulation (EU) No 540/2011, expires on 31 December 2020.

| (4) | An application for the renewal of the approval of the active substance pyriproxyfen was submitted in accordance with Article 1 of Commission Implementing Regulation (EU) No 844/2012 (5) within the time period provided for in that Article. |
| --- | --- |

(4)

An application for the renewal of the approval of the active substance pyriproxyfen was submitted in accordance with Article 1 of Commission Implementing Regulation (EU) No 844/2012 (5) within the time period provided for in that Article.

| (5) | The applicant submitted the supplementary dossiers required in accordance with Article 6 of Implementing Regulation (EU) No 844/2012. The application was found to be complete by the rapporteur Member State. |
| --- | --- |

(5)

The applicant submitted the supplementary dossiers required in accordance with Article 6 of Implementing Regulation (EU) No 844/2012. The application was found to be complete by the rapporteur Member State.

| (6) | The rapporteur Member State prepared a renewal assessment report in consultation with the co-rapporteur Member State and submitted it to the European Food Safety Authority (‘the Authority’) and the Commission on 14 December 2017. |
| --- | --- |

(6)

The rapporteur Member State prepared a renewal assessment report in consultation with the co-rapporteur Member State and submitted it to the European Food Safety Authority (‘the Authority’) and the Commission on 14 December 2017.

| (7) | The Authority made the supplementary summary dossier available to the public. The Authority also circulated the renewal assessment report to the applicants and to the Member States for comments and launched a public consultation on it. The Authority forwarded the comments received to the Commission. |
| --- | --- |

(7)

The Authority made the supplementary summary dossier available to the public. The Authority also circulated the renewal assessment report to the applicants and to the Member States for comments and launched a public consultation on it. The Authority forwarded the comments received to the Commission.

| (8) | On 17 May 2019, the Authority communicated to the Commission its conclusion (6) on whether pyriproxyfen can be expected to meet the approval criteria provided for in Article 4 of Regulation (EC) No 1107/2009. The Commission presented the draft renewal report on pyriproxyfen to the Standing Committee on Plants, Animals, Food and Feed on 21 October 2019. |
| --- | --- |

(8)

On 17 May 2019, the Authority communicated to the Commission its conclusion (6) on whether pyriproxyfen can be expected to meet the approval criteria provided for in Article 4 of Regulation (EC) No 1107/2009. The Commission presented the draft renewal report on pyriproxyfen to the Standing Committee on Plants, Animals, Food and Feed on 21 October 2019.

| (9) | As regards the criteria to identify endocrine disrupting properties introduced by Commission Regulation (EU) 2018/605 (7), the conclusion of the Authority indicates that pyriproxyfen is not an endocrine disrupter. |
| --- | --- |

(9)

As regards the criteria to identify endocrine disrupting properties introduced by Commission Regulation (EU) 2018/605 (7), the conclusion of the Authority indicates that pyriproxyfen is not an endocrine disrupter.

| (10) | The Commission invited the applicant to submit its comments on the conclusion of the Authority and, in accordance with the third paragraph of Article 14(1) of Implementing Regulation (EU) No 844/2012, on the renewal report. The applicant submitted its comments, which have been carefully examined. |
| --- | --- |

(10)

The Commission invited the applicant to submit its comments on the conclusion of the Authority and, in accordance with the third paragraph of Article 14(1) of Implementing Regulation (EU) No 844/2012, on the renewal report. The applicant submitted its comments, which have been carefully examined.

| (11) | It has been established with respect to one or more representative uses of at least one plant protection product containing the active substance pyriproxyfen that the approval criteria provided for in Article 4 of Regulation (EC) No 1107/2009 are satisfied. |
| --- | --- |

(11)

It has been established with respect to one or more representative uses of at least one plant protection product containing the active substance pyriproxyfen that the approval criteria provided for in Article 4 of Regulation (EC) No 1107/2009 are satisfied.

| (12) | The risk assessment for the renewal of the approval of the active substance pyriproxyfen is based on a limited number of representative uses, which however do not restrict the uses for which plant protection products containing pyriproxyfen may be authorised. |
| --- | --- |

(12)

The risk assessment for the renewal of the approval of the active substance pyriproxyfen is based on a limited number of representative uses, which however do not restrict the uses for which plant protection products containing pyriproxyfen may be authorised.

| (13) | It is therefore appropriate to renew the approval of pyriproxyfen. |
| --- | --- |

(13)

It is therefore appropriate to renew the approval of pyriproxyfen.

| (14) | In accordance with Article 14(1) of Regulation (EC) No 1107/2009, in conjunction with Article 6 thereof and in the light of current scientific and technical knowledge, it is, however, necessary to provide for certain conditions. It is, in particular, appropriate to require further confirmatory information. |
| --- | --- |

(14)

In accordance with Article 14(1) of Regulation (EC) No 1107/2009, in conjunction with Article 6 thereof and in the light of current scientific and technical knowledge, it is, however, necessary to provide for certain conditions. It is, in particular, appropriate to require further confirmatory information.

| (15) | In accordance with Article 20(3) of Regulation (EC) No 1107/2009, in conjunction with Article 13(4) thereof, the Annex to Implementing Regulation (EU) No 540/2011 should be amended accordingly. |
| --- | --- |

(15)

In accordance with Article 20(3) of Regulation (EC) No 1107/2009, in conjunction with Article 13(4) thereof, the Annex to Implementing Regulation (EU) No 540/2011 should be amended accordingly.

| (16) | Commission Implementing Regulation (EU) 2019/1589 (8) extended the approval period of pyriproxyfen to 31 December 2020 in order to allow the renewal process to be completed before the expiry of the approval period of that active substance. However, given that a decision on renewal of the approval is taken ahead of the expiry of that extended approval period, this Regulation should apply from 1 August 2020, except for the provision concerning toluene content specified in column ‘Purity’ of the table in Annex I, which should apply from 1 August 2021. |
| --- | --- |

(16)

Commission Implementing Regulation (EU) 2019/1589 (8) extended the approval period of pyriproxyfen to 31 December 2020 in order to allow the renewal process to be completed before the expiry of the approval period of that active substance. However, given that a decision on renewal of the approval is taken ahead of the expiry of that extended approval period, this Regulation should apply from 1 August 2020, except for the provision concerning toluene content specified in column ‘Purity’ of the table in Annex I, which should apply from 1 August 2021.

| (17) | The measures provided for in this Regulation are in accordance with the opinion of the Standing Committee on Plants, Animals, Food and Feed, |
| --- | --- |

(17)

The measures provided for in this Regulation are in accordance with the opinion of the Standing Committee on Plants, Animals, Food and Feed,

HAS ADOPTED THIS REGULATION:

Article 1

Renewal of the approval of the active substance

The approval of the active substance pyriproxyfen is renewed as set out in Annex I.

Article 2

Amendments to Implementing Regulation (EU) No 540/2011

The Annex to Implementing Regulation (EU) No 540/2011 is amended in accordance with Annex II to this Regulation.

Article 3

Entry into force and date of application

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

It shall apply from 1 August 2020.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 3 July 2020.

For the Commission

The President

Ursula VON DER LEYEN

---

(1)  OJ L 309, 24.11.2009, p. 1.

1

(2)  Commission Directive 2008/69/EC of 1 July 2008 amending Council Directive 91/414/EEC to include clofentezine, dicamba, difenoconazole, diflubenzuron, imazaquin, lenacil, oxadiazon, picloram and pyriproxyfen as active substances (OJ L 172, 2.7.2008, p. 9).

2

(3)  Council Directive 91/414/EEC of 15 July 1991 concerning the placing of plant protection products on the market (OJ L 230, 19.8.1991, p. 1).

3

(4)  Commission Implementing Regulation (EU) No 540/2011 of 25 May 2011 implementing Regulation (EC) No 1107/2009 of the European Parliament and of the Council as regards the list of approved active substances (OJ L 153, 11.6.2011, p. 1).

4

(5)  Commission Implementing Regulation (EU) No 844/2012 of 18 September 2012 setting out the provisions necessary for the implementation of the renewal procedure for active substances, as provided for in Regulation (EC) No 1107/2009 of the European Parliament and of the Council concerning the placing of plant protection products on the market (OJ L 252, 19.9.2012, p. 26).

5

(6)  EFSA Journal 2018;16(7):5307; Available online: www.efsa.europa.eu

6

EFSA Journal

(7)  Commission Regulation (EU) 2018/605 of 19 April 2018 amending Annex II to Regulation (EC) No 1107/2009 by setting out scientific criteria for the determination of endocrine disrupting properties (OJ L 101, 20.4.2018, p. 33).

7

(8)  Commission Implementing Regulation (EU) 2019/1589 of 26 September 2019 amending Implementing Regulation (EU) No 540/2011 as regards the extension of the approval periods of the active substances amidosulfuron, beta-cyfluthrin, bifenox, chlorotoluron, clofentezine, clomazone, cypermethrin, daminozide, deltamethrin, dicamba, difenoconazole, diflubenzuron, diflufenican, fenoxaprop-P, fenpropidin, fludioxonil, flufenacet, fosthiazate, indoxacarb, lenacil, MCPA, MCPB, nicosulfuron, picloram, prosulfocarb, pyriproxyfen, thiophanate-methyl, triflusulfuron and tritosulfuron (OJ L 248, 27.9.2019, p. 24).

8

---

ANNEX I

| Common Name, Identification Numbers | IUPAC Name | Purity (1) | Date of approval | Expiration of approval | Specific provisions |
| --- | --- | --- | --- | --- | --- |
| Pyriproxyfen.
  2-((1-(4-Phenoxyphenoxy)propan-2-yl)oxy)pyridine.
  CIPAC No: 715.
  CAS No: 95737-68-1.
  EC No (Einecs or ELINCS): 429-800-1 | 4-phenoxyphenyl (RS)-2(2-pyridyloxy) propyl ether | ≥ 970 g/kg
  From 1 August 2021 Max. impurity: Toluene
  5 g/Kg | 1 August 2020 | 31 July 2035 | For the implementation of the uniform principles, as referred to in Article 29(6) of Regulation (EC) No 1107/2009, the conclusions of the renewal report on pyriproxyfen and in particular Appendices I and II thereto, shall be taken into account.
  In this overall assessment Member States shall pay particular attention to:






  — | the dietary exposure of consumers to residues of pyriproxyfen, |

Common Name, Identification Numbers

IUPAC Name

Purity (1)

Date of approval

Expiration of approval

Specific provisions

Pyriproxyfen.

2-((1-(4-Phenoxyphenoxy)propan-2-yl)oxy)pyridine.

CIPAC No: 715.

CAS No: 95737-68-1.

EC No (Einecs or ELINCS): 429-800-1

4-phenoxyphenyl (RS)-2(2-pyridyloxy) propyl ether

≥ 970 g/kg

From 1 August 2021 Max. impurity: Toluene

5 g/Kg

1 August 2020

31 July 2035

For the implementation of the uniform principles, as referred to in Article 29(6) of Regulation (EC) No 1107/2009, the conclusions of the renewal report on pyriproxyfen and in particular Appendices I and II thereto, shall be taken into account.

In this overall assessment Member States shall pay particular attention to:

—

the dietary exposure of consumers to residues of pyriproxyfen,

| — | the protection of sediment-dwelling organisms and aquatic organisms, |
| --- | --- |

—

the protection of sediment-dwelling organisms and aquatic organisms,

| — | the protection of bees. |
| --- | --- |

—

the protection of bees.

As regards the protection of sediment-dwelling organisms and aquatic organisms, for outdoor use of the plant protection products containing pyriproxyfen Member States shall include in the specific conditions appropriate risk mitigation measures, e.g. no-spray buffer zones and/or spray drift reduction, to achieve a low risk for sediment-dwelling organisms and aquatic organisms.

As regards the protection of bees, for outdoor use of plant protection products containing pyriproxyfen Member States shall include in the specific conditions a restriction of application to periods outside of the flowering of bee attractive crops, and appropriate risk mitigation measures, e.g. no-spray buffer zones and/or spray drift reduction, to achieve a low risk for bees and bee larvae.

The applicant shall submit to the Commission, the Member States and the Authority confirmatory information as regards the effect of water treatment processes on the nature of residues present in surface and groundwater, when surface water is abstracted for drinking water.

The applicant shall submit the requested confirmatory information within two years from the date of publication, by the Commission, of a guidance document on evaluation of the effect of water treatment processes on the nature of residues present in surface and groundwater.

---

(1)  Further details on the identity and the specification of the active substance are provided in the renewal report.

---

ANNEX II

The Annex to Implementing Regulation (EU) No 540/2011 is amended as follows:

| (1) | in Part A, entry 179 on pyriproxyfen is deleted; |
| --- | --- |

(1)

in Part A, entry 179 on pyriproxyfen is deleted;

| (2) | in Part B, the following entry is added:











  No | Common Name, Identification Numbers | IUPAC Name | Purity (1) | Date of approval | Expiration of approval | Specific provisions |
| --- | --- | --- | --- | --- | --- | --- | --- |
| ‘142 | Pyriproxyfen.
  2-((1-(4-Phenoxyphenoxy)propan-2-yl)oxy)pyridine.
  CIPAC No: 715.
  CAS No: 95737-68-1.
  EC No (Einecs or ELINCS): 429-800-1 | 4-phenoxyphenyl (RS)-2(2-pyridyloxy) propyl ether | ≥ 970 g/kg Max. impurity: Toluene
  5 g/Kg | 1 August 2020 | 31 July 2035 | For the implementation of the uniform principles, as referred to in Article 29(6) of Regulation (EC) No 1107/2009, the conclusions of the renewal report on pyriproxyfen and in particular Appendices I and II thereto, shall be taken into account.
  In this overall assessment Member States shall pay particular attention to:






  — | the dietary exposure of consumers to residues of pyriproxyfen, |

(2)

in Part B, the following entry is added:

No

Common Name, Identification Numbers

IUPAC Name

Purity (1)

Date of approval

Expiration of approval

Specific provisions

‘142

Pyriproxyfen.

2-((1-(4-Phenoxyphenoxy)propan-2-yl)oxy)pyridine.

CIPAC No: 715.

CAS No: 95737-68-1.

EC No (Einecs or ELINCS): 429-800-1

4-phenoxyphenyl (RS)-2(2-pyridyloxy) propyl ether

≥ 970 g/kg Max. impurity: Toluene

5 g/Kg

1 August 2020

31 July 2035

For the implementation of the uniform principles, as referred to in Article 29(6) of Regulation (EC) No 1107/2009, the conclusions of the renewal report on pyriproxyfen and in particular Appendices I and II thereto, shall be taken into account.

In this overall assessment Member States shall pay particular attention to:

—

the dietary exposure of consumers to residues of pyriproxyfen,

| — | the protection of sediment-dwelling organisms and aquatic organisms, |
| --- | --- |

—

the protection of sediment-dwelling organisms and aquatic organisms,

| — | the protection of bees. |
| --- | --- |

—

the protection of bees.

As regards the protection of sediment-dwelling organisms and aquatic organisms, for outdoor use of the plant protection products containing pyriproxyfen Member States shall include in the specific conditions appropriate risk mitigation measures, e.g. no-spray buffer zones and/or spray drift reduction, to achieve a low risk for sediment-dwelling organisms and aquatic organisms.

As regards the protection of bees, for outdoor use of plant protection products containing pyriproxyfen Member States shall include in the specific conditions a restriction of application to periods outside of the flowering of bee attractive crops, and appropriate risk mitigation measures, e.g. no-spray buffer zones and/or spray drift reduction, to achieve a low risk for bees and bee larvae.

The applicant shall submit to the Commission, the Member States and the Authority confirmatory information as regards the effect of water treatment processes on the nature of residues present in surface and groundwater, when surface water is abstracted for drinking water.

The applicant shall submit the requested confirmatory information within two years from the date of publication, by the Commission, of a guidance document on evaluation of the effect of water treatment processes on the nature of residues present in surface and groundwater.’

---

(1)  Further details on the identity and the specification of the active substance are provided in the renewal report.

---

DECISIONS

| 6.7.2020 | EN | Official Journal of the European Union | L 213/12 |
| --- | --- | --- | --- |

6.7.2020

EN

Official Journal of the European Union

L 213/12

---

COMMISSION DECISION (EU) 2020/969

of 3 July 2020

laying down implementing rules concerning the Data Protection Officer, restrictions of data subjects’ rights and the application of Regulation (EU) 2018/1725 of the European Parliament and of the Council, and repealing Commission Decision 2008/597/EC

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249(1) thereof,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (1), and in particular Article 45(3) thereof,

Whereas:

| (1) | In order to ensure the proper functioning of the office of the Commission’s data protection officer (‘DPO’), it is necessary to determine in detail the tasks, duties and powers of the DPO. |
| --- | --- |

(1)

In order to ensure the proper functioning of the office of the Commission’s data protection officer (‘DPO’), it is necessary to determine in detail the tasks, duties and powers of the DPO.

| (2) | Regulation (EU) 2018/1725 assigns clear responsibilities to data controllers, in particular vis-à-vis the data subjects. With a view to ensuring that the Commission, as a controller, operates in a uniform and transparent manner with regard to its responsibilities, rules should be set out on how to identify who in the Commission service or services is responsible for a processing operation which is carried out on behalf of the Commission. In this respect, it is appropriate to introduce the notion of delegated controller in order to indicate precisely the responsibilities of the entities of the Commission, in particular as regards individual decisions concerning data subjects’ rights. In addition, it is appropriate to introduce the notion of operational controller who, under the responsibility of the delegated controller, is designated to ensure compliance in practice, and to process requests from data subjects with regard to a processing operation. The appointment of an operational controller does not prevent the use in practice of a contact point, for example in the form of a functional mailbox to be made available for data subjects’ requests. |
| --- | --- |

(2)

Regulation (EU) 2018/1725 assigns clear responsibilities to data controllers, in particular vis-à-vis the data subjects. With a view to ensuring that the Commission, as a controller, operates in a uniform and transparent manner with regard to its responsibilities, rules should be set out on how to identify who in the Commission service or services is responsible for a processing operation which is carried out on behalf of the Commission. In this respect, it is appropriate to introduce the notion of delegated controller in order to indicate precisely the responsibilities of the entities of the Commission, in particular as regards individual decisions concerning data subjects’ rights. In addition, it is appropriate to introduce the notion of operational controller who, under the responsibility of the delegated controller, is designated to ensure compliance in practice, and to process requests from data subjects with regard to a processing operation. The appointment of an operational controller does not prevent the use in practice of a contact point, for example in the form of a functional mailbox to be made available for data subjects’ requests.

| (3) | In certain cases, several Commission services may jointly carry out a processing operation in order to fulfil their mission. In such cases, they should ensure that internal arrangements are in place in order to determine in a transparent manner their respective responsibilities under Regulation (EU) 2018/1725, in particular responsibilities vis-à-vis the data subjects, notification to the European Data Protection Supervisor (‘EDPS’) and record keeping. |
| --- | --- |

(3)

In certain cases, several Commission services may jointly carry out a processing operation in order to fulfil their mission. In such cases, they should ensure that internal arrangements are in place in order to determine in a transparent manner their respective responsibilities under Regulation (EU) 2018/1725, in particular responsibilities vis-à-vis the data subjects, notification to the European Data Protection Supervisor (‘EDPS’) and record keeping.

| (4) | In order to facilitate the exercise of the responsibilities of the delegated controllers, each Commission service should appoint a Data Protection Coordinator (‘DPC’). The DPC should participate in the network of data protection coordinators in the Commission in order to ensure coherent implementation and interpretation of Regulation (EU) 2018/1725 in the Commission, and to discuss subjects of common interest. |
| --- | --- |

(4)

In order to facilitate the exercise of the responsibilities of the delegated controllers, each Commission service should appoint a Data Protection Coordinator (‘DPC’). The DPC should participate in the network of data protection coordinators in the Commission in order to ensure coherent implementation and interpretation of Regulation (EU) 2018/1725 in the Commission, and to discuss subjects of common interest.

| (5) | With a view to the task of the DPO to assign responsibilities pursuant to Article 45(1)(b) of Regulation (EU) 2018/1725, the DPO should issue additional guidance on the function of the DPC. |
| --- | --- |

(5)

With a view to the task of the DPO to assign responsibilities pursuant to Article 45(1)(b) of Regulation (EU) 2018/1725, the DPO should issue additional guidance on the function of the DPC.

| (6) | The Commission processes several categories of personal data for the purpose of the monitoring, investigative, auditing and consultative activities of the DPO. In particular, the Commission processes identification data, contact data, professional data and case involvement data. Those data are retained for five years after the activities are closed in accordance with the Common Commission-Level Retention List (2). |
| --- | --- |

(6)

The Commission processes several categories of personal data for the purpose of the monitoring, investigative, auditing and consultative activities of the DPO. In particular, the Commission processes identification data, contact data, professional data and case involvement data. Those data are retained for five years after the activities are closed in accordance with the Common Commission-Level Retention List (2).

| (7) | In certain circumstances, it is necessary to reconcile the rights of data subjects pursuant to Regulation (EU) 2018/1725 with the need for the Commission to perform the monitoring, investigative, auditing or consultative tasks of the DPO, and the need for confidentiality of exchanges of information with other Commission services, as well as with full respect for fundamental rights and freedoms of other data subjects. To that effect, Article 25(1) of Regulation (EU) 2018/1725 provides the Commission with the possibility to restrict the application of Articles 14 to 17, 19, 20 and 35, as well as the principle of transparency laid down in Article 4(1)(a), insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19 and 20 of that Regulation. |
| --- | --- |

(7)

In certain circumstances, it is necessary to reconcile the rights of data subjects pursuant to Regulation (EU) 2018/1725 with the need for the Commission to perform the monitoring, investigative, auditing or consultative tasks of the DPO, and the need for confidentiality of exchanges of information with other Commission services, as well as with full respect for fundamental rights and freedoms of other data subjects. To that effect, Article 25(1) of Regulation (EU) 2018/1725 provides the Commission with the possibility to restrict the application of Articles 14 to 17, 19, 20 and 35, as well as the principle of transparency laid down in Article 4(1)(a), insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19 and 20 of that Regulation.

| (8) | In order to ensure the confidentiality and effectiveness of the monitoring, investigative, auditing or consultative tasks of the DPO while respecting the standards of protection of personal data under Regulation (EU) 2018/1725, it is necessary to adopt internal rules under which the DPO may restrict data subjects’ rights in line with Article 25 of Regulation (EU) 2018/1725. |
| --- | --- |

(8)

In order to ensure the confidentiality and effectiveness of the monitoring, investigative, auditing or consultative tasks of the DPO while respecting the standards of protection of personal data under Regulation (EU) 2018/1725, it is necessary to adopt internal rules under which the DPO may restrict data subjects’ rights in line with Article 25 of Regulation (EU) 2018/1725.

| (9) | The internal rules should apply to all data processing operations carried out by the Commission in the performance of the monitoring, investigative, auditing or consultative tasks of the DPO. They should apply to processing operations carried out prior to the opening of an investigation or audit, during the course of an investigation or audit, and during the monitoring of the follow-up to their outcome. Those rules should also apply to processing operations which form part of the tasks linked to the investigative or auditing function of the DPO, such as complaint processes conducted by the DPO. The rules should also apply to the monitoring of the DPO and the consultations of the DPO, when the DPO provides assistance and cooperation to the Commission services outside of its administrative investigations and audits. |
| --- | --- |

(9)

The internal rules should apply to all data processing operations carried out by the Commission in the performance of the monitoring, investigative, auditing or consultative tasks of the DPO. They should apply to processing operations carried out prior to the opening of an investigation or audit, during the course of an investigation or audit, and during the monitoring of the follow-up to their outcome. Those rules should also apply to processing operations which form part of the tasks linked to the investigative or auditing function of the DPO, such as complaint processes conducted by the DPO. The rules should also apply to the monitoring of the DPO and the consultations of the DPO, when the DPO provides assistance and cooperation to the Commission services outside of its administrative investigations and audits.

| (10) | In order to comply with Articles 14, 15 and 16 of Regulation (EU) 2018/1725, the Commission should inform all individuals of the monitoring, investigative, auditing or consultative tasks of the DPO that involve processing of their personal data and of their rights pursuant to Regulation (EU) 2018/1725. The Commission should inform those individuals in a transparent and coherent manner, in the form of the data protection notices published on Commission website, as well as inform each data subject concerned by a monitoring, investigative, auditing or consultative activity of the DPO. |
| --- | --- |

(10)

In order to comply with Articles 14, 15 and 16 of Regulation (EU) 2018/1725, the Commission should inform all individuals of the monitoring, investigative, auditing or consultative tasks of the DPO that involve processing of their personal data and of their rights pursuant to Regulation (EU) 2018/1725. The Commission should inform those individuals in a transparent and coherent manner, in the form of the data protection notices published on Commission website, as well as inform each data subject concerned by a monitoring, investigative, auditing or consultative activity of the DPO.

| (11) | In certain circumstances, the Commission may have to restrict the provision of information to data subjects and the application of other rights of data subjects. It may do so in order to protect the monitoring, investigative, auditing or consultative tasks of the DPO, related investigations and proceedings of other Commission services, the tools and methods of DPO investigations and audits, as well as the rights of other persons related to the tasks of the DPO. |
| --- | --- |

(11)

In certain circumstances, the Commission may have to restrict the provision of information to data subjects and the application of other rights of data subjects. It may do so in order to protect the monitoring, investigative, auditing or consultative tasks of the DPO, related investigations and proceedings of other Commission services, the tools and methods of DPO investigations and audits, as well as the rights of other persons related to the tasks of the DPO.

| (12) | In some cases, providing particular information to the data subjects or revealing the existence of a monitoring, investigative, auditing or consultative activity of the DPO could render impossible or seriously impair the purpose of the processing operation and the capability of the DPO to conduct such activity. |
| --- | --- |

(12)

In some cases, providing particular information to the data subjects or revealing the existence of a monitoring, investigative, auditing or consultative activity of the DPO could render impossible or seriously impair the purpose of the processing operation and the capability of the DPO to conduct such activity.

| (13) | Furthermore, the Commission should protect the identity of informants, who should not suffer negative repercussions as a consequence of their cooperation with the DPO. |
| --- | --- |

(13)

Furthermore, the Commission should protect the identity of informants, who should not suffer negative repercussions as a consequence of their cooperation with the DPO.

| (14) | For those reasons, the Commission may need to apply the grounds for restrictions referred to in Article 25(1)(c), (g) and (h) of Regulation (EU) 2018/1725 to data processing operations carried out in the framework of the monitoring, investigative, auditing or consultative tasks of the DPO set out in Article 45 of that Regulation. |
| --- | --- |

(14)

For those reasons, the Commission may need to apply the grounds for restrictions referred to in Article 25(1)(c), (g) and (h) of Regulation (EU) 2018/1725 to data processing operations carried out in the framework of the monitoring, investigative, auditing or consultative tasks of the DPO set out in Article 45 of that Regulation.

| (15) | In addition, in order to maintain effective cooperation, the Commission may need to apply restrictions to data subjects’ rights to protect information containing personal data originating from other Commission services, Union institutions or bodies. To that effect, the DPO should consult those services, institutions or bodies on the relevant grounds for and the necessity and proportionality of the restrictions. |
| --- | --- |

(15)

In addition, in order to maintain effective cooperation, the Commission may need to apply restrictions to data subjects’ rights to protect information containing personal data originating from other Commission services, Union institutions or bodies. To that effect, the DPO should consult those services, institutions or bodies on the relevant grounds for and the necessity and proportionality of the restrictions.

| (16) | In the framework of the monitoring, investigative, auditing or consultative tasks of the DPO, the DPO exchanges information, including personal data, with other Commission services. Therefore, all Commission services processing personal data, which are processed by the DPO in the performance of his or her tasks, should apply the rules set out in this Decision with a view to protecting the processing operations carried out by the DPO. In such circumstances, the Commission services concerned should therefore consult the DPO on the relevant grounds for the restrictions and their necessity and proportionality in order to ensure their coherent application. |
| --- | --- |

(16)

In the framework of the monitoring, investigative, auditing or consultative tasks of the DPO, the DPO exchanges information, including personal data, with other Commission services. Therefore, all Commission services processing personal data, which are processed by the DPO in the performance of his or her tasks, should apply the rules set out in this Decision with a view to protecting the processing operations carried out by the DPO. In such circumstances, the Commission services concerned should therefore consult the DPO on the relevant grounds for the restrictions and their necessity and proportionality in order to ensure their coherent application.

| (17) | The DPO – and, where relevant, other Commission services – should handle all restrictions in a transparent manner and register each application of restrictions in the corresponding record system. |
| --- | --- |

(17)

The DPO – and, where relevant, other Commission services – should handle all restrictions in a transparent manner and register each application of restrictions in the corresponding record system.

| (18) | Pursuant to Article 25(8) of Regulation (EU) 2018/1725, the controllers may defer or refrain from providing information on the reasons for the application of a restriction to the data subject if this would in any way compromise the purpose of the restriction. In particular, where a restriction to the rights provided for in Articles 16 and 35 is applied, the notification of such a restriction would compromise the purpose of the restriction. In order to ensure that the data subject’s right to be informed in accordance with Articles 16 and 35 of Regulation (EU) 2018/1725 is restricted only as long as the reasons for the deferral last, the Commission should regularly review its position. |
| --- | --- |

(18)

Pursuant to Article 25(8) of Regulation (EU) 2018/1725, the controllers may defer or refrain from providing information on the reasons for the application of a restriction to the data subject if this would in any way compromise the purpose of the restriction. In particular, where a restriction to the rights provided for in Articles 16 and 35 is applied, the notification of such a restriction would compromise the purpose of the restriction. In order to ensure that the data subject’s right to be informed in accordance with Articles 16 and 35 of Regulation (EU) 2018/1725 is restricted only as long as the reasons for the deferral last, the Commission should regularly review its position.

| (19) | Where a restriction of other data subjects’ rights is applied, the DPO should assess, on a case-by-case basis, whether the communication of the restriction would compromise its purpose. |
| --- | --- |

(19)

Where a restriction of other data subjects’ rights is applied, the DPO should assess, on a case-by-case basis, whether the communication of the restriction would compromise its purpose.

| (20) | The DPO should carry out an independent review of the application of restrictions based on this Decision, by other Commission services, with a view to ensuring compliance with this Decision. |
| --- | --- |

(20)

The DPO should carry out an independent review of the application of restrictions based on this Decision, by other Commission services, with a view to ensuring compliance with this Decision.

| (21) | Any restriction applied on the basis of this Decision should be necessary and proportionate taking into account the risks to the rights and freedoms of data subjects. |
| --- | --- |

(21)

Any restriction applied on the basis of this Decision should be necessary and proportionate taking into account the risks to the rights and freedoms of data subjects.

| (22) | The European Data Protection Supervisor was informed and consulted in accordance with Article 41(1) and (2) of Regulation (EU) 2018/1725 and delivered an opinion on 16 September 2019. |
| --- | --- |

(22)

The European Data Protection Supervisor was informed and consulted in accordance with Article 41(1) and (2) of Regulation (EU) 2018/1725 and delivered an opinion on 16 September 2019.

| (23) | Commission Decision 2008/597/EC (3) lays down implementing rules concerning the Data Protection Officer pursuant to Regulation (EC) No 45/2001 of the European Parliament and of the Council (4). Regulation (EU) 2018/1725 repealed Regulation (EC) No 45/2001 with effect from 11 December 2019. In order to ensure that only one set of implementing rules apply to the Data Protection Officer, Decision 2008/597/EC should also be repealed, |
| --- | --- |

(23)

Commission Decision 2008/597/EC (3) lays down implementing rules concerning the Data Protection Officer pursuant to Regulation (EC) No 45/2001 of the European Parliament and of the Council (4). Regulation (EU) 2018/1725 repealed Regulation (EC) No 45/2001 with effect from 11 December 2019. In order to ensure that only one set of implementing rules apply to the Data Protection Officer, Decision 2008/597/EC should also be repealed,

HAS ADOPTED THIS DECISION:

CHAPTER 1

GENERAL PROVISIONS

Article 1

Subject matter and scope

1.   This Decision provides rules and procedures for the application of Regulation (EU) 2018/1725 by the Commission, and sets out implementing rules concerning the Data Protection Officer for the Commission (‘DPO’).

2.   This Decision also lays down the rules to be followed by the Commission, in relation to the monitoring, investigative, auditing or consultative tasks of the DPO, to inform data subjects of the processing of their personal data in accordance with Articles 14, 15 and 16 of Regulation (EU) 2018/1725.

3.   This Decision also lays down the conditions under which the Commission, in relation to the monitoring, investigative, auditing or consultative tasks of the DPO, may restrict the application of Articles 4, 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725, in accordance with Article 25(1)(c), (g) and (h) thereof.

4.   This Decision applies to the processing of personal data by the Commission for the purpose of or in relation to the tasks of the DPO referred to in Article 45 of Regulation (EU) 2018/1725, in particular the monitoring, investigative, auditing and consultative tasks of the DPO.

Article 2

Controllership

For the purposes of this Decision, the Commission shall be considered to be the controller within the meaning of Article 3(8) of Regulation (EU) 2018/1725.

Article 3

Definitions

For the purpose of this Decision, the following definitions apply:

| (1) | ‘Data Protection Officer’ (DPO) means the person whom the Commission has designated pursuant to Article 43 of Regulation (EU) 2018/1725; |
| --- | --- |

(1)

‘Data Protection Officer’ (DPO) means the person whom the Commission has designated pursuant to Article 43 of Regulation (EU) 2018/1725;

| (2) | ‘DPO tasks’ means the DPO tasks referred to in Article 45 of Regulation (EU) 2018/1725, in particular the monitoring, investigative, auditing and consultative tasks of the DPO; |
| --- | --- |

(2)

‘DPO tasks’ means the DPO tasks referred to in Article 45 of Regulation (EU) 2018/1725, in particular the monitoring, investigative, auditing and consultative tasks of the DPO;

| (3) | ‘Data Protection Coordinator’ (DPC) means the Commission staff member whom a Directorate-General or Service of the Commission appointed to advise and assist that Directorate-General or Service in all aspects of the protection of personal data; |
| --- | --- |

(3)

‘Data Protection Coordinator’ (DPC) means the Commission staff member whom a Directorate-General or Service of the Commission appointed to advise and assist that Directorate-General or Service in all aspects of the protection of personal data;

| (4) | ‘delegated controller’ means the Head of the Directorate-General, Service or Cabinet, which carries out a processing operation on behalf of the Commission in fulfilment of the mission of that Directorate-General, Service or Cabinet; |
| --- | --- |

(4)

‘delegated controller’ means the Head of the Directorate-General, Service or Cabinet, which carries out a processing operation on behalf of the Commission in fulfilment of the mission of that Directorate-General, Service or Cabinet;

| (5) | ‘operational controller’ means the Commission staff member of middle or senior management level, designated by the delegated controller to ensure record keeping for the processing operation and to serve as primary contact point for data subjects in relation to that processing operation; |
| --- | --- |

(5)

‘operational controller’ means the Commission staff member of middle or senior management level, designated by the delegated controller to ensure record keeping for the processing operation and to serve as primary contact point for data subjects in relation to that processing operation;

| (6) | ‘internal arrangement’ means any arrangement between two or more Directorates-General or Services to determine their respective responsibilities and coordinate the keeping of a record of processing regarding a processing operation which they carry out jointly or where one or more Directorates-General or Services carry out a part of the delegated controller’s processing operation; |
| --- | --- |

(6)

‘internal arrangement’ means any arrangement between two or more Directorates-General or Services to determine their respective responsibilities and coordinate the keeping of a record of processing regarding a processing operation which they carry out jointly or where one or more Directorates-General or Services carry out a part of the delegated controller’s processing operation;

| (7) | ‘informant’ means an individual who brings a matter alleging that a breach of the provisions of Regulation (EU) 2018/1725 has taken place to the attention of the DPO, or requests that the DPO investigate matters and occurrences directly relating to the DPO’s tasks, which that individual brings to the DPO’s notice. |
| --- | --- |

(7)

‘informant’ means an individual who brings a matter alleging that a breach of the provisions of Regulation (EU) 2018/1725 has taken place to the attention of the DPO, or requests that the DPO investigate matters and occurrences directly relating to the DPO’s tasks, which that individual brings to the DPO’s notice.

CHAPTER 2

DATA PROTECTION OFFICER AND DATA PROTECTION COORDINATOR

DATA PROTECTION OFFICER AND DATA PROTECTION COORDINATOR

Article 4

Designation and position

The DPO shall be selected from the staff of the Commission on the basis of his or her professional qualities, including a sound knowledge of the Commission Services, their structure, and their administrative rules and procedures.

Article 5

Tasks and duties

1.   The DPO shall contribute to creating a culture of protection of personal data within the Commission based on risk assessment and accountability.

2.   The DPO shall monitor implementation of Regulation (EU) 2018/1725 in the Commission by, inter alia, annually establishing and carrying out a work programme on inspections and audits.

3.   The DPO shall organise and chair regular meetings of DPCs.

4.   The DPO shall keep the Commission’s records of processing activities in a central register and shall make it publicly accessible.

The DPO shall also keep an internal Commission register of personal data breaches within the meaning of Article 3(16) of Regulation (EU) 2018/1725.

5.   In the discharge of his or her functions, the DPO shall cooperate with the data protection officers designated by the other Union institutions and bodies.

6.   The DPO shall be considered to be the delegated controller for the purpose of individual decisions concerning the rights of data subjects under Regulation (EU) 2018/1725 in relation to processing operations of the DPO.

Article 6

Powers

In performing the DPO tasks, the DPO:

| (a) | shall, where necessary for his or her tasks have access to the data forming the subject matter of processing operations on personal data and to all offices, data processing installations and data carriers; |
| --- | --- |

(a)

shall, where necessary for his or her tasks have access to the data forming the subject matter of processing operations on personal data and to all offices, data processing installations and data carriers;

| (b) | may request legal opinions from the Legal Service of the Commission; |
| --- | --- |

(b)

may request legal opinions from the Legal Service of the Commission;

| (c) | may, in the event of conflict between the DPO and the delegated controller, operational controller or processor relating to the interpretation or implementation of Regulation (EU) 2018/1725, inform the competent delegated controller and the Secretary-General; |
| --- | --- |

(c)

may, in the event of conflict between the DPO and the delegated controller, operational controller or processor relating to the interpretation or implementation of Regulation (EU) 2018/1725, inform the competent delegated controller and the Secretary-General;

| (d) | may assign files to the Commission’s Directorates-General or Services concerned for appropriate follow-up; |
| --- | --- |

(d)

may assign files to the Commission’s Directorates-General or Services concerned for appropriate follow-up;

| (e) | may perform investigations on request, or upon the DPO’s own initiative, into matters and occurrences directly relating to the DPO tasks in accordance with the procedure set out in Article 11; |
| --- | --- |

(e)

may perform investigations on request, or upon the DPO’s own initiative, into matters and occurrences directly relating to the DPO tasks in accordance with the procedure set out in Article 11;

| (f) | may, when making recommendations and rendering advice:






  (i) | call upon the delegated controller or the processor to comply with a data subject’s request for the exercise of his or her rights pursuant to Regulation (EU) 2018/1725; |
| --- | --- | --- |

(f)

may, when making recommendations and rendering advice:

(i)

call upon the delegated controller or the processor to comply with a data subject’s request for the exercise of his or her rights pursuant to Regulation (EU) 2018/1725;

| (ii) | issue warnings to the delegated controller or the processor when a processing operation infringes provisions of Regulation (EU) 2018/1725, and call upon them to bring processing operations into compliance, where appropriate, in a specified manner and within a specified period; |
| --- | --- |

(ii)

issue warnings to the delegated controller or the processor when a processing operation infringes provisions of Regulation (EU) 2018/1725, and call upon them to bring processing operations into compliance, where appropriate, in a specified manner and within a specified period;

| (iii) | call upon the delegated controller or the processor to suspend data flows to a recipient in a Member State, to a third country or to an international organisation; |
| --- | --- |

(iii)

call upon the delegated controller or the processor to suspend data flows to a recipient in a Member State, to a third country or to an international organisation;

| (iv) | request the delegated controller or the processor to report within a set deadline to the DPO on the follow-up given to the DPO’s recommendation or advice; |
| --- | --- |

(iv)

request the delegated controller or the processor to report within a set deadline to the DPO on the follow-up given to the DPO’s recommendation or advice;

| (g) | may bring to the attention of the Secretary-General any failure of a delegated controller, an operational controller or a processor to comply with the measures taken pursuant to Article 6(f); |
| --- | --- |

(g)

may bring to the attention of the Secretary-General any failure of a delegated controller, an operational controller or a processor to comply with the measures taken pursuant to Article 6(f);

| (h) | shall be responsible for initial decisions on requests for access to documents held by his or her office under Regulation (EC) No 1049/2001 of the European Parliament and of the Council (5). |
| --- | --- |

(h)

shall be responsible for initial decisions on requests for access to documents held by his or her office under Regulation (EC) No 1049/2001 of the European Parliament and of the Council (5).

Article 7

Data Protection Coordinators

1.   The delegated controller shall appoint a DPC and, where appropriate one or more assistant DPCs in the Directorate-General or Service under his or her responsibility. Two or more delegated controllers may, for reasons of coherence or efficiency, decide to appoint a common DPC or assistant DPC or share the services of an already appointed DPC or assistant DPC. The delegated controllers concerned shall record their agreement to do so in writing.

2.   The DPC appointed by a Directorate-General or Service shall also be competent for the Cabinet responsible for that Directorate-General or Service. The DPC appointed for the Secretariat-General shall be competent for the President’s Cabinet as well as for Cabinets for which the Secretariat-General is the only supporting Service. Where a Cabinet is responsible for several Directorates-General or Services, the delegated controllers shall decide which of their respective DPCs are to be competent for that Cabinet.

3.   The DPO, the staff of the relevant Directorate-General or Service and the relevant Cabinet shall be informed whenever a new DPC is appointed.

Newly appointed DPCs shall complete training to acquire the necessary competences for the role of DPC within six months of appointment. A DPC who has previously held a DPC post in another Directorate-General or Service or has been a staff member of the DPO within two years prior to appointment as DPC shall be exempt from that training requirement.

4.   Delegated controllers shall put appropriate arrangements in place in order to ensure that the DPC is involved properly and in a timely manner in all issues which relate to data protection in their Directorate-General or Service and that opinions delivered by the DPC are promptly brought to the attention of the delegated controller at the request of the DPC.

5.   DPCs shall be chosen on the basis of their knowledge and experience of the functioning of the respective Directorate-General or Service, motivation for the function, competences relating to data protection, understanding of information systems principles, and communication skills.

6.   The function of DPC may be combined with other functions. The delegated controller shall ensure that those functions are compatible with the function of DPC.

7.   The DPC function shall be part of the job description of each member of staff appointed as DPC. Reference to their responsibilities and achievements shall be made in the annual appraisal report.

8.   The DPC shall act as a contact point between the delegated controller, the operational controller and the processor, and the DPO.

9.   DPCs shall have the right to obtain any information in their Directorate-General or Service to the extent that this is necessary for the performance of the tasks of DPC. DPCs shall access personal data, only if it is necessary for the performance of their tasks.

10.   The DPC shall keep records and provide anonymised statistics of requests from data subjects to the Directorate-General, Service or Cabinet, specifying the numbers of requests and the number of requests rejected fully or in part. The DPO shall specify the categories of requests of which statistics shall be kept. The DPO may specify which further details are to be provided.

The DPC shall keep anonymised statistics of personal data breaches managed by the Directorate-General, Service or Cabinet, specifying the total number of personal data breaches, the number of personal data breaches notified to the EDPS and the number of personal data breaches communicated to data subjects.

11.   The DPC shall raise awareness on data protection matters within his or her DG or Service and shall advice and assist the delegated controllers and operational controllers in complying with their obligations, especially as regards:

| (a) | implementation of the general principles of Regulation (EU) 2018/1725; |
| --- | --- |

(a)

implementation of the general principles of Regulation (EU) 2018/1725;

| (b) | documentation of the processing operations; |
| --- | --- |

(b)

documentation of the processing operations;

| (c) | submission of the records of delegated controllers’ processing operations to the DPO pursuant to Article 10; |
| --- | --- |

(c)

submission of the records of delegated controllers’ processing operations to the DPO pursuant to Article 10;

| (d) | the preparation of privacy statements. |
| --- | --- |

(d)

the preparation of privacy statements.

12.   DPCs shall participate in the meetings and, where necessary, in working groups of the DPCs.

13.   The DPO shall issue additional guidance on the responsibilities and the functions of the DPC.

CHAPTER 3

CONTROLLERS

CONTROLLERS

Article 8

Delegated controllers and operational controllers

1.   Delegated controllers shall act on behalf of the Commission as controller for the purposes of the application of Regulation (EU) 2018/1725.

2.   Delegated controllers and operational controllers:

| (a) | may consult the DPO, through the DPC, on the conformity of processing operations, in particular in the event of doubt as to conformity; |
| --- | --- |

(a)

may consult the DPO, through the DPC, on the conformity of processing operations, in particular in the event of doubt as to conformity;

| (b) | shall report to the DPO, through the DPC, on the handling of any request received from a data subject for the exercise of his or her rights. |
| --- | --- |

(b)

shall report to the DPO, through the DPC, on the handling of any request received from a data subject for the exercise of his or her rights.

3.   The delegated controller shall:

| (a) | designate an operational controller to assist the delegated controller in ensuring compliance with Regulation (EU) 2018/1725, in particular vis-à-vis data subjects; |
| --- | --- |

(a)

designate an operational controller to assist the delegated controller in ensuring compliance with Regulation (EU) 2018/1725, in particular vis-à-vis data subjects;

| (b) | ensure that internal arrangements with other Directorates-General or Services are in place, where the delegated controller carries out processing operations jointly with those Directorates-General or Services or where those Directorates-General or Services carry out a part of the delegated controller’s processing operation. |
| --- | --- |

(b)

ensure that internal arrangements with other Directorates-General or Services are in place, where the delegated controller carries out processing operations jointly with those Directorates-General or Services or where those Directorates-General or Services carry out a part of the delegated controller’s processing operation.

The arrangements referred to in point (b) of the first subparagraph shall determine their respective responsibilities for compliance with their data protection obligations. In particular, it shall include identification of the delegated controller determining the means and purposes of the processing operation as well as the operational controller for the processing operation, and where appropriate, which person and/or entities which shall assist the operational controller, inter alia, with information in case of data breaches or to accommodate data subjects rights.

4.   The operational controller shall:

| (a) | receive and process all requests from data subjects; |
| --- | --- |

(a)

receive and process all requests from data subjects;

| (b) | notify the European Data Protection Supervisor (EDPS) in case of personal data breaches; |
| --- | --- |

(b)

notify the European Data Protection Supervisor (EDPS) in case of personal data breaches;

| (c) | inform the DPC and the DPO in case of personal data breaches, and notify the data subject, when relevant; |
| --- | --- |

(c)

inform the DPC and the DPO in case of personal data breaches, and notify the data subject, when relevant;

| (d) | ensure that the DPC is kept aware of all matters relating to data protection, in particular requests from data subjects; |
| --- | --- |

(d)

ensure that the DPC is kept aware of all matters relating to data protection, in particular requests from data subjects;

| (e) | carry out any other task within the scope of this Decision at the request of the delegated controller. |
| --- | --- |

(e)

carry out any other task within the scope of this Decision at the request of the delegated controller.

CHAPTER 4

OTHER OBLIGATIONS AND PROCEDURES

OTHER OBLIGATIONS AND PROCEDURES

Article 9

Information

The delegated controller, in cooperation with the DPC, shall inform the DPO when it consults or informs the EDPS in accordance with Regulation (EU) 2018/1725, and in particular pursuant to Articles 40 and 41 of that Regulation. In addition, the delegated controller, operational controller or DPC shall inform the DPO of any other direct interactions with EDPS related to the implementation of Regulation (EU) 2018/1725.

Article 10

Register

1.   The DPO shall ensure that the register of processing operations of the Commission is accessible through the website of the DPO on the Commission’s Intranet and through the website of the DPO on the Europa website.

2.   Delegated controllers shall notify the records of their processing operations, through their DPC, to the DPO by using the online notification system of the Commission, accessible through the website of the DPO on the Commission’s Intranet.

Article 11

Investigation procedure

1.   The requests for an investigation referred to in Article 6(e) shall be addressed to the DPO in writing. Within 15 working days following receipt, the DPO shall send an acknowledgement of receipt to the person who commissioned the investigation, and verify whether the request is to be treated as confidential to ensure confidentiality governing the request, unless the data subjects concerned gives their unambiguous consent for the request to be handled otherwise. In the event of manifest abuse of the right to request an investigation, the DPO shall not be obliged to report to the requester.

2.   The DPO shall request a written statement on the matter from the delegated controller who is responsible for the data-processing operation in question. The delegated controller shall provide their response to the DPO within 15 working days. The DPO may request complementary information from the delegated controller, the processor or other parties within 15 working days.

3.   The DPO shall report back to the person who commissioned the investigation no later than three months following the receipt of the request. This period may be suspended until the DPO has obtained all necessary information that he or she may have requested.

4.   No one shall suffer prejudice on account of a matter brought to the attention of the DPO alleging a breach of the provisions of Regulation (EU) 2018/1725.

Article 12

Administration and management

1.   The DPO shall be attached for administrative purposes to the Secretariat-General. In this context, the DPO shall participate in preparing the Annual Management Plan and the Draft Preliminary Budget of the Secretariat-General.

2.   The DPO shall be the reporting officer for the staff of the Data Protection Office. The Deputy Secretary-General shall be the countersigning officer. The DPO shall participate in the management coordination of the Secretariat-General as appropriate.

CHAPTER 5

RESTRICTION OF DATA SUBJECTS’ RIGHTS

RESTRICTION OF DATA SUBJECTS’ RIGHTS

Article 13

Applicable exceptions and restrictions

1.   Where the Commission exercises its duties with respect to data subjects’ rights pursuant to Regulation (EU) 2018/1725, it shall consider whether any of the exceptions laid down in that Regulation apply.

2.   Subject to Articles 14 to 18 of this Decision, the Commission may restrict the application of Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725, as well as the principle of transparency laid down in Article 4(1)(a) of that Regulation insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19 and 20 of Regulation (EU) 2018/1725, where the exercise of those rights and obligations would jeopardise the purpose of the DPO tasks, inter alia, by revealing its investigative or auditing tools and methods, or would adversely affect the rights and freedoms of other data subjects in accordance with Article 25(1)(c), (g) and (h).

3.   Subject to Articles 14 to 18 of this Decision, the Commission may restrict the rights and obligations referred to in paragraph 2 of this Article, in relation to personal data obtained by the DPO from Commission services, or other Union institutions and bodies. The Commission may do so where the exercise of those rights and obligations could be restricted by those Commission services, Union institutions or bodies on the basis of other acts provided for in Article 25 of Regulation (EU) 2018/1725 or in accordance with Chapter IX of that Regulation or in accordance with Regulation (EU) 2016/794 of the European Parliament and of the Council (6) or Council Regulation (EU) 2017/1939 (7).

Before applying restrictions in the circumstances referred to in the first subparagraph, the Commission shall consult the relevant Union institution or bodies unless it is clear to the Commission that the application of a restriction is provided for by one of the acts referred to in that subparagraph.

4.   Any restriction of the application of rights and obligations, referred to in paragraph 2 of this Article, shall be necessary and proportionate taking into account the risks to the rights and freedoms of data subjects.

Article 14

Provision of information to data subjects

1.   The Commission shall publish, on its website, data protection notices that inform all data subjects of the DPO tasks involving processing of their personal data.

2.   The Commission shall individually inform, in an appropriate format, any natural person whom it considers a person concerned by the DPO tasks or an informant.

3.   Where the Commission restricts, wholly or partly, the provision of the information to data subjects referred to in paragraph 2, the Commission shall record and register the reasons for the restriction, in accordance with Article 17.

Article 15

Right to access by data subjects, right to erasure and right to restriction of processing

1.   Where the Commission restricts, wholly or partly, the right of access to personal data by data subjects, the right to erasure, or the right to restriction of processing as referred to in Articles 17, 19 and 20 respectively of Regulation (EU) 2018/1725, it shall inform the data subject concerned, in its reply to the request for access, erasure or restriction of processing of the restriction applied and of the principal reasons therefor, and of the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking a judicial remedy in the Court of Justice of the European Union.

2.   The provision of information concerning the reasons for the restriction referred to in paragraph 1 may be deferred, omitted or denied for as long as it would undermine the purpose of the restriction.

3.   The Commission shall record and register the reasons for the restriction in accordance with Article 17.

4.   Where the right of access is wholly or partly restricted, the data subject is entitled to exercise his or her right of access through the intermediary of the EDPS, in accordance with Article 25(6), (7) and (8) of Regulation (EU) 2018/1725.

Article 16

Communication of a personal data breach to the data subject

Where the Commission restricts the communication of a personal data breach to the data subject, as referred to in Article 35 of Regulation (EU) 2018/1725, it shall record and register the reasons for the restriction in accordance with Article 17 of this Decision.

Article 17

Recording and registering of restrictions

1.   The Commission shall record the reasons for any restriction applied pursuant to this Decision, including a case-by-case assessment of the necessity and proportionality of the restriction taking into account the relevant elements in Article 25(2) of Regulation (EU) 2018/1725.

To that end, the record shall state how the exercise of the right would jeopardise the purpose of the DPO tasks under this Decision, or of restrictions applied pursuant to Article 13(2) or (3), or would adversely affect the rights and freedoms of other data subjects.

2.   The record and, where applicable, the documents containing underlying factual and legal elements shall be registered. They shall be made available to the EDPS on request.

Article 18

Duration of restrictions

1.   Restrictions referred to in Articles 14, 15 and 16 shall continue to apply as long as the reasons justifying them remain applicable.

2.   Where the reasons for a restriction referred to in Article 14 or 16 no longer apply, the Commission shall lift the restriction and provide the reasons for the restriction to the data subject. At the same time, the Commission shall inform the data subject of the possibility of lodging a complaint with the EDPS at any time or of seeking a judicial remedy in the Court of Justice of the European Union.

3.   The Commission shall review the application of the restrictions referred to in Articles 14 and 16 every six months from their adoption and in any case at the closure of the relevant DPO activity. Thereafter, the Commission shall monitor the need to maintain any restriction or deferral on an annual basis.

Article 19

Review by the Data Protection Officer

1.   Where other Commission services conclude that a data subject’s rights should be restricted pursuant to this Decision, they shall inform the DPO. They shall also provide the DPO with access to the record and any documents containing underlying factual and legal elements.

2.   The DPO may request that the delegated controller of the Commission service concerned review the application of the restrictions. The delegated controller of the Commission service concerned shall inform the DPO in writing about the outcome of the requested review.

CHAPTER 6

FINAL PROVISIONS

FINAL PROVISIONS

Article 20

Repeal

Decision 2008/597/EC is repealed.

Article 21

Entry into force

This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Done at Brussels, 3 July 2020.

For the Commission

The President

Ursula VON DER LEYEN

---

(1)  OJ L 295, 21.11.2018, p. 39.

1

(2)  SEC(2019)900/2.

2

(3)  Commission Decision 2008/597/EC of 3 June 2008 adopting implementing rules concerning the Data Protection Officer pursuant to Article 24(8) of Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 193, 22.7.2008, p. 7).

3

(4)  Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).

4

(5)  Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ L 145, 31.5.2001, p. 43).

5

(6)  Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ L 135, 24.5.2016, p. 53).

6

(7)  Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’) (OJ L 283, 31.10.2017, p. 1).

7

---

Corrigenda

| 6.7.2020 | EN | Official Journal of the European Union | L 213/23 |
| --- | --- | --- | --- |

6.7.2020

EN

Official Journal of the European Union

L 213/23

---

Corrigendum to Council Decision (EU) 2019/753 of 30 March 2020 on the conclusion of the Free Trade Agreement between the European Union and the Socialist Republic of Viet Nam

(
  Official Journal of the European Union L 186 of 12 June 2020
  )

On the cover page and on page 1, the Decision number in the title:

for:

‘Council Decision (EU) 2019/753 ...’,

read:

‘Council Decision (EU) 2020/753 ...’.

---