# Official Journal L 198/2021

| | ISSN 1977-0677 |
| --- | --- |
| Official Journal
  of the European Union | L 198 |
| | |
| English edition | Legislation | Volume 644 June 2021 |

ISSN 1977-0677

Official Journal

of the European Union

L 198

English edition

Legislation

Volume 644 June 2021

---

| Contents | | II   Non-legislative acts | page |
| --- | --- | --- | --- |
| | | RECOMMENDATIONS |
| | * | Council Recommendation (EU) 2021/892 of 3 June 2021 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction | 1 |
| | | RULES OF PROCEDURE |
| | * | Decision of the Steering Committee of the Research Executive Agency (REA) on internal rules concerning restrictions of certain rights of data subjects in relation to the processing of personal data in the framework of activities carried out by the Agency | 5 |
| | | ACTS ADOPTED BY BODIES CREATED BY INTERNATIONAL AGREEMENTS |
| | * | Decision No 1/2021 of the EU-Colombia-Peru-Ecuador Trade Committee of 17 May 2021 amending Appendix 1 of Annex XII (Government Procurement) to the Trade Agreement between the European Union and its Member States, of the one part, and Colombia, Peru and Ecuador, of the other part (2021/894) | 15 |

Contents

II   Non-legislative acts

page

RECOMMENDATIONS

*

Council Recommendation (EU) 2021/892 of 3 June 2021 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction

1

RULES OF PROCEDURE

*

Decision of the Steering Committee of the Research Executive Agency (REA) on internal rules concerning restrictions of certain rights of data subjects in relation to the processing of personal data in the framework of activities carried out by the Agency

5

ACTS ADOPTED BY BODIES CREATED BY INTERNATIONAL AGREEMENTS

*

Decision No 1/2021 of the EU-Colombia-Peru-Ecuador Trade Committee of 17 May 2021 amending Appendix 1 of Annex XII (Government Procurement) to the Trade Agreement between the European Union and its Member States, of the one part, and Colombia, Peru and Ecuador, of the other part (2021/894)

15

| EN | Acts whose titles are printed in light type are those relating to day-to-day management of agricultural matters, and are generally valid for a limited period.
  The titles of all other Acts are printed in bold type and preceded by an asterisk. |
| --- | --- |

EN

Acts whose titles are printed in light type are those relating to day-to-day management of agricultural matters, and are generally valid for a limited period.

The titles of all other Acts are printed in bold type and preceded by an asterisk.

---

II Non-legislative acts

RECOMMENDATIONS

| 4.6.2021 | EN | Official Journal of the European Union | L 198/1 |
| --- | --- | --- | --- |

4.6.2021

EN

Official Journal of the European Union

L 198/1

---

COUNCIL RECOMMENDATION (EU) 2021/892

of 3 June 2021

amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article Article 77(2)(b) and (e) and Article 292, first and second sentence thereof,

Whereas:

| (1) | On 30 June 2020, the Council adopted a Recommendation on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (1) (‘Council Recommendation’). |
| --- | --- |

(1)

On 30 June 2020, the Council adopted a Recommendation on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (1) (‘Council Recommendation’).

| (2) | On 16 July 2020, the Council adopted Recommendation (EU) 2020/1052 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (2). On 30 July 2020, the Council adopted Recommendation (EU) 2020/1144 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (3). On 7 August 2020, the Council adopted Recommendation (EU) 2020/1186 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (4). On 22 October 2020, the Council adopted Recommendation (EU) 2020/1551 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (5).
  On 17 December 2020, the Council adopted Recommendation (EU) 2020/2169 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (6). On 28 January 2021, the Council adopted Recommendation (EU) 2021/89 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (7). On 2 February 2021, the Council adopted Recommendation (EU) 2021/132 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (8) and on 6 May 2021 Recommendation (EU) 2021/767 (9) amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction. |
| --- | --- |

(2)

On 16 July 2020, the Council adopted Recommendation (EU) 2020/1052 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (2). On 30 July 2020, the Council adopted Recommendation (EU) 2020/1144 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (3). On 7 August 2020, the Council adopted Recommendation (EU) 2020/1186 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (4). On 22 October 2020, the Council adopted Recommendation (EU) 2020/1551 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (5).

On 17 December 2020, the Council adopted Recommendation (EU) 2020/2169 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (6). On 28 January 2021, the Council adopted Recommendation (EU) 2021/89 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (7). On 2 February 2021, the Council adopted Recommendation (EU) 2021/132 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (8) and on 6 May 2021 Recommendation (EU) 2021/767 (9) amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction.

| (3) | On 20 May 2021, the Council adopted Recommendation (EU) 2021/816 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (10) in order to update the criteria used to assess whether non-essential travel from third countries is safe and should be allowed. |
| --- | --- |

(3)

On 20 May 2021, the Council adopted Recommendation (EU) 2021/816 amending Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (10) in order to update the criteria used to assess whether non-essential travel from third countries is safe and should be allowed.

| (4) | The Council Recommendation provides that Member States should gradually lift the temporary restriction on non-essential travel to the EU as from 1 July 2020 in a coordinated manner with regard to the residents of the third countries listed in Annex I to the Council Recommendation. Every two weeks, the list of third countries referred to in Annex I should be reviewed, and as the case may be updated, by the Council, after close consultation with the Commission and the relevant EU agencies and services following an overall assessment based on the methodology, criteria and information referred to in the Council Recommendation. |
| --- | --- |

(4)

The Council Recommendation provides that Member States should gradually lift the temporary restriction on non-essential travel to the EU as from 1 July 2020 in a coordinated manner with regard to the residents of the third countries listed in Annex I to the Council Recommendation. Every two weeks, the list of third countries referred to in Annex I should be reviewed, and as the case may be updated, by the Council, after close consultation with the Commission and the relevant EU agencies and services following an overall assessment based on the methodology, criteria and information referred to in the Council Recommendation.

| (5) | Discussions have since then taken place within the Council, in close consultation with the Commission and the relevant EU agencies and services, on the review of the list of third countries set out in Annex I to the Council Recommendation and in application of the criteria and methodology laid down in the Council Recommendation, as amended by Recommendation (EU) 2021/816. As a result of these discussions, the list of third countries set out in Annex I should be amended. In particular, Japan should be added to the list. |
| --- | --- |

(5)

Discussions have since then taken place within the Council, in close consultation with the Commission and the relevant EU agencies and services, on the review of the list of third countries set out in Annex I to the Council Recommendation and in application of the criteria and methodology laid down in the Council Recommendation, as amended by Recommendation (EU) 2021/816. As a result of these discussions, the list of third countries set out in Annex I should be amended. In particular, Japan should be added to the list.

| (6) | Border control is in the interest not only of the Member State at whose external borders it is carried out but of all Member States which have abolished internal border control. Member States should therefore ensure that measures taken at the external borders are coordinated in order to ensure a well functioning Schengen area. To that end, as of 3 June 2021, Member States should continue lifting the temporary restriction on non-essential travel into the EU in a coordinated manner with regard to the residents of the third countries listed in Annex I of the Council Recommendation as amended by this Recommendation. |
| --- | --- |

(6)

Border control is in the interest not only of the Member State at whose external borders it is carried out but of all Member States which have abolished internal border control. Member States should therefore ensure that measures taken at the external borders are coordinated in order to ensure a well functioning Schengen area. To that end, as of 3 June 2021, Member States should continue lifting the temporary restriction on non-essential travel into the EU in a coordinated manner with regard to the residents of the third countries listed in Annex I of the Council Recommendation as amended by this Recommendation.

| (7) | In accordance with Articles 1 and 2 of Protocol No 22 on the Position of Denmark annexed to the Treaty on European Union and to the TFEU, Denmark is not taking part in the adoption of this Recommendation and is not bound by it or subject to its application. Given that this Recommendation builds upon the Schengen acquis, Denmark shall, in accordance with Article 4 of the said Protocol, decide within a period of six months after the Council has decided on this Recommendation whether it will implement it. |
| --- | --- |

(7)

In accordance with Articles 1 and 2 of Protocol No 22 on the Position of Denmark annexed to the Treaty on European Union and to the TFEU, Denmark is not taking part in the adoption of this Recommendation and is not bound by it or subject to its application. Given that this Recommendation builds upon the Schengen acquis, Denmark shall, in accordance with Article 4 of the said Protocol, decide within a period of six months after the Council has decided on this Recommendation whether it will implement it.

| (8) | This Recommendation constitutes a development of the provisions of the Schengen acquis in which Ireland does not take part, in accordance with Council Decision 2002/192/EC (11); Ireland is therefore not taking part in its adoption and is not bound by it or subject to its application. |
| --- | --- |

(8)

This Recommendation constitutes a development of the provisions of the Schengen acquis in which Ireland does not take part, in accordance with Council Decision 2002/192/EC (11); Ireland is therefore not taking part in its adoption and is not bound by it or subject to its application.

| (9) | As regards Iceland and Norway, this Recommendation constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latter’s association with the implementation, application and development of the Schengen acquis which fall within the area referred to in Article 1, point A, of Council Decision 1999/437/EC (12). |
| --- | --- |

(9)

As regards Iceland and Norway, this Recommendation constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latter’s association with the implementation, application and development of the Schengen acquis which fall within the area referred to in Article 1, point A, of Council Decision 1999/437/EC (12).

| (10) | As regards Switzerland, this Recommendation constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis which fall within the area referred to in Article 1, point A, of Decision 1999/437/EC (13) read in conjunction with Article 3 of Council Decision 2008/146/EC (14). |
| --- | --- |

(10)

As regards Switzerland, this Recommendation constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis which fall within the area referred to in Article 1, point A, of Decision 1999/437/EC (13) read in conjunction with Article 3 of Council Decision 2008/146/EC (14).

| (11) | As regards Liechtenstein, this Recommendation constitutes a development of provisions of the Schengen acquis within the meaning of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis which fall within the area referred to in Article 1 point A, of Decision 1999/437/EC (15) read in conjunction with Article 3 of Council Decision 2011/350/EU (16). |
| --- | --- |

(11)

As regards Liechtenstein, this Recommendation constitutes a development of provisions of the Schengen acquis within the meaning of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis which fall within the area referred to in Article 1 point A, of Decision 1999/437/EC (15) read in conjunction with Article 3 of Council Decision 2011/350/EU (16).

HAS ADOPTED THIS RECOMMENDATION:

Council Recommendation (EU) 2020/912, as amended by Recommendation (EU) 2020/1052, by Recommendation (EU) 2020/1144, by Recommendation (EU) 2020/1186, by Recommendation (EU) 2020/1551, by Recommendation (EU) 2020/2169, by Recommendation (EU) 2021/89, by Recommendation (EU) 2021/132, by Recommendation (EU) 2021/767 and by Recommendation (EU) 2021/816 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction is amended as follows:

| (1) | first paragraph of point 1 of the Council Recommendation is replaced by the following:






  ‘1. | As from 3 June 2021, Member States should gradually lift the temporary restriction on non-essential travel to the EU in a coordinated manner with regard to the residents of the third countries listed in Annex I.’; |
| --- | --- | --- |

(1)

first paragraph of point 1 of the Council Recommendation is replaced by the following:

‘1.

As from 3 June 2021, Member States should gradually lift the temporary restriction on non-essential travel to the EU in a coordinated manner with regard to the residents of the third countries listed in Annex I.’;

| (2) | Annex I to the Recommendation is replaced by the following:


  ‘ANNEX I
  Third countries and Special Administrative Regions, whose residents should not be affected by temporary external borders restriction on non-essential travel into the EU:






  I. | STATES






  1. | AUSTRALIA |
| --- | --- | --- | --- |

(2)

Annex I to the Recommendation is replaced by the following:

‘ANNEX I

Third countries and Special Administrative Regions, whose residents should not be affected by temporary external borders restriction on non-essential travel into the EU:

I.

STATES

1.

AUSTRALIA

| 2. | ISRAEL |
| --- | --- |

2.

ISRAEL

| 3. | JAPAN |
| --- | --- |

3.

JAPAN

| 4. | NEW ZEALAND |
| --- | --- |

4.

NEW ZEALAND

| 5. | RWANDA |
| --- | --- |

5.

RWANDA

| 6. | SINGAPORE |
| --- | --- |

6.

SINGAPORE

| 7. | SOUTH KOREA |
| --- | --- |

7.

SOUTH KOREA

| 8. | THAILAND |
| --- | --- |

8.

THAILAND

| 9. | CHINA (*) |
| --- | --- |

9.

CHINA (*)

| II. | SPECIAL ADMINISTRATIVE REGIONS OF THE PEOPLE’S REPUBLIC OF CHINA





  Hong Kong SAR (*1) |
| --- | --- |

II.

SPECIAL ADMINISTRATIVE REGIONS OF THE PEOPLE’S REPUBLIC OF CHINA

Hong Kong SAR (*1)

| Macao SAR  (*1) |
| --- |

Macao SAR  (*1)

(*1)  Subject to confirmation of reciprocity."

*1

(*1)  Subject to confirmation of reciprocity."

*1

Done at Luxembourg, 3 June 2021.

For the Council

The President

P. N. SANTOS

---

(1)  OJ L 208 I, 1.7.2020, p. 1.

1

(2)  OJ L 230, 17.7.2020, p. 26.

2

(3)  OJ L 248, 31.7.2020, p. 26.

3

(4)  OJ L 261, 11.8.2020, p. 83.

4

(5)  OJ L 354, 26.10.2020, p. 19.

5

(6)  OJ L 431, 21.12.2020, p. 75.

6

(7)  OJ L 33, 29.1.2021, p. 1.

7

(8)  OJ L 41, 4.2.2021, p. 1.

8

(9)  OJ L 165 I, 11.5.2021, p. 66.

9

(10)  OJ L 182, 21.5.2021, p. 1.

10

(11)  Council Decision 2002/192/EC of 28 February 2002 concerning Ireland’s request to take part in some of the provisions of the Schengen acquis (OJ L 64, 7.3.2002, p. 20).

11

acquis

(12)  OJ L 176, 10.7.1999, p. 31.

12

(13)  OJ L 53, 27.2.2008, p. 52.

13

(14)  Council Decision 2008/146/EC of 28 January 2008 on the conclusion, on behalf of the European Community, of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (OJ L 53, 27.2.2008, p. 1).

14

acquis

(15)  OJ L 160, 18.6.2011, p. 21.

15

(16)  Council Decision 2011/350/EU of 7 March 2011 on the conclusion, on behalf of the European Union, of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis, relating to the abolition of checks at internal borders and movement of persons (OJ L 160, 18.6.2011, p. 19).

16

acquis

---

RULES OF PROCEDURE

| 4.6.2021 | EN | Official Journal of the European Union | L 198/5 |
| --- | --- | --- | --- |

4.6.2021

EN

Official Journal of the European Union

L 198/5

---

DECISION OF THE STEERING COMMITTEE OF THE RESEARCH EXECUTIVE AGENCY (REA)

on internal rules concerning restrictions of certain rights of data subjects in relation to the processing of personal data in the framework of activities carried out by the Agency

THE STEERING COMMITTEE,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249(1) thereof,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (1) (‘the Regulation’), and in particular Article 25 thereof,

Having regard to Council Regulation (EC) No 58/2003 of 19 December 2002 laying down the statute for executive agencies to be entrusted with certain tasks in the management of Community programmes (2),

Having regard to Commission Implementing Decision 2013/778/EU of 13 December 2013 establishing the Research Executive Agency and repealing Decision 2008/46/EC (3),

Having regard to Commission Decision of 20 December 2013 delegating powers to the Research Executive Agency with a view to performance of tasks linked to the implementation of Union programmes in the field of research and innovation comprising, in particular, implementation of appropriations entered in the general budget of the Union, as last amended by Commission Decision of 30 April 2019 (4),

Having consulted the European Data Protection Supervisor,

Whereas:

| (1) | The Research Executive Agency (‘the Agency’) was established by Commission Implementing Decision 2013/778/EU of 13 December 2013 in view of the performance of tasks linked to the implementation of Union programmes in the field of research and innovation. |
| --- | --- |

(1)

The Research Executive Agency (‘the Agency’) was established by Commission Implementing Decision 2013/778/EU of 13 December 2013 in view of the performance of tasks linked to the implementation of Union programmes in the field of research and innovation.

| (2) | Within the framework of its administrative and operational functioning, the Agency may conduct administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings in accordance with the Staff Regulations of Officials of the European Union and the Conditions of Employment of Other Servants of the European Union, laid down in Council Regulation (EEC, Euratom, ECSC) No 259/68 (‘Staff Regulations’) (5) and with implementing provisions regarding the conduct of administrative inquiries and disciplinary proceedings. If required the Agency may carry out preliminary activities related to cases of potential fraud and irregularities and may notify cases to OLAF. |
| --- | --- |

(2)

Within the framework of its administrative and operational functioning, the Agency may conduct administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings in accordance with the Staff Regulations of Officials of the European Union and the Conditions of Employment of Other Servants of the European Union, laid down in Council Regulation (EEC, Euratom, ECSC) No 259/68 (‘Staff Regulations’) (5) and with implementing provisions regarding the conduct of administrative inquiries and disciplinary proceedings. If required the Agency may carry out preliminary activities related to cases of potential fraud and irregularities and may notify cases to OLAF.

| (3) | Agency staff members are under an obligation to report potentially illegal activities, including fraud and corruption, which are detrimental to the interests of the Union. Staff members are also obliged to report conduct relating to the discharge of professional duties which may constitute a serious failure to comply with the obligations of officials of the Union. This is regulated by the internal rules or policies concerning whistleblowing. |
| --- | --- |

(3)

Agency staff members are under an obligation to report potentially illegal activities, including fraud and corruption, which are detrimental to the interests of the Union. Staff members are also obliged to report conduct relating to the discharge of professional duties which may constitute a serious failure to comply with the obligations of officials of the Union. This is regulated by the internal rules or policies concerning whistleblowing.

| (4) | The Agency has put in place a policy to prevent and deal effectively with actual or potential cases of psychological or sexual harassment in the workplace, as provided for in implementing measures pursuant to the Staff Regulations establishing an informal procedure whereby the alleged victim of the harassment can contact the Agency’s ‘confidential’ counsellors. |
| --- | --- |

(4)

The Agency has put in place a policy to prevent and deal effectively with actual or potential cases of psychological or sexual harassment in the workplace, as provided for in implementing measures pursuant to the Staff Regulations establishing an informal procedure whereby the alleged victim of the harassment can contact the Agency’s ‘confidential’ counsellors.

| (5) | The Agency can also conduct internal (IT) security investigations and on potential breaches of security rules for European Union classified information (‘EUCI’). |
| --- | --- |

(5)

The Agency can also conduct internal (IT) security investigations and on potential breaches of security rules for European Union classified information (‘EUCI’).

| (6) | The Agency is subject to both internal and external audits concerning its activities, including conducted by the Internal Audit Services of the European Commission and the European Court of Auditors. |
| --- | --- |

(6)

The Agency is subject to both internal and external audits concerning its activities, including conducted by the Internal Audit Services of the European Commission and the European Court of Auditors.

| (7) | The Agency may handle requests from the European Public Prosecutors office (EPPO), requests for access to medical files of Agency staff members, carry out investigations by the Data Protection Officer in line with Article 45(2) of the Regulation. |
| --- | --- |

(7)

The Agency may handle requests from the European Public Prosecutors office (EPPO), requests for access to medical files of Agency staff members, carry out investigations by the Data Protection Officer in line with Article 45(2) of the Regulation.

| (8) | In the context of such administrative inquiries, audits, investigations or requests, the Agency cooperates with other Union institutions, bodies, offices and agencies. |
| --- | --- |

(8)

In the context of such administrative inquiries, audits, investigations or requests, the Agency cooperates with other Union institutions, bodies, offices and agencies.

| (9) | The Agency may cooperate with third countries’ national authorities and international organisations, either at their request or on its own initiative. |
| --- | --- |

(9)

The Agency may cooperate with third countries’ national authorities and international organisations, either at their request or on its own initiative.

| (10) | The Agency may also cooperate with EU Member States’ public authorities, either at their request or on its own initiative. |
| --- | --- |

(10)

The Agency may also cooperate with EU Member States’ public authorities, either at their request or on its own initiative.

| (11) | The Agency may be subject to complaints, proceeding or investigations via whistle-blowers or the European Ombudsman. |
| --- | --- |

(11)

The Agency may be subject to complaints, proceeding or investigations via whistle-blowers or the European Ombudsman.

| (12) | The Agency may be involved in cases before the Court of Justice of the European Union when it either refers a matter to the Court, defends a decision it has taken and which has been challenged before the Court, or intervenes in cases relevant to its tasks. In this context, the Agency may need to preserve the confidentiality of personal data contained in documents obtained by the parties or the interveners. |
| --- | --- |

(12)

The Agency may be involved in cases before the Court of Justice of the European Union when it either refers a matter to the Court, defends a decision it has taken and which has been challenged before the Court, or intervenes in cases relevant to its tasks. In this context, the Agency may need to preserve the confidentiality of personal data contained in documents obtained by the parties or the interveners.

| (13) | In the context of its activities the Agency processes several categories of personal data, including identification data of natural persons, contact information, professional roles and tasks, information on private and professional conduct and performance, and financial data as well as in some specific cases sensitive data (e.g. health data). Personal data includes factual ‘hard’ data and ‘soft’ assessment data.
  ‘Hard data’ is objective factual data such as identification data, contact data, professional data, administrative details, metadata related to electronic communications and traffic data.
  ‘Soft data’ is subjective data and include in particular the description and assessment of situations and circumstances, opinions, observations related to data subjects, evaluation of the conduct and performance of data subjects and reasoning underpinning individual decisions related to or brought forward in connection with the subject matter of the procedure or activity carried out by the Agency in line with the applicable legal framework.
  Assessments, observations and opinions are considered personal data in the meaning of Article 3(1) of the Regulation. |
| --- | --- |

(13)

In the context of its activities the Agency processes several categories of personal data, including identification data of natural persons, contact information, professional roles and tasks, information on private and professional conduct and performance, and financial data as well as in some specific cases sensitive data (e.g. health data). Personal data includes factual ‘hard’ data and ‘soft’ assessment data.

‘Hard data’ is objective factual data such as identification data, contact data, professional data, administrative details, metadata related to electronic communications and traffic data.

‘Soft data’ is subjective data and include in particular the description and assessment of situations and circumstances, opinions, observations related to data subjects, evaluation of the conduct and performance of data subjects and reasoning underpinning individual decisions related to or brought forward in connection with the subject matter of the procedure or activity carried out by the Agency in line with the applicable legal framework.

Assessments, observations and opinions are considered personal data in the meaning of Article 3(1) of the Regulation.

| (14) | Under the Regulation, the Agency is therefore obliged to provide information to data subjects on those processing activities and to respect their rights as data subjects. |
| --- | --- |

(14)

Under the Regulation, the Agency is therefore obliged to provide information to data subjects on those processing activities and to respect their rights as data subjects.

| (15) | The Agency is committed to respect, to the maximum extent possible, the fundamental rights of the data subjects in particular, the right of provision of information, access and rectification, the right to erasure, restriction of processing, the right of communication of a personal data breach to the data subject or confidentiality of communication as enshrined in the Regulation. However, the Agency may also be required to restrict data subject's rights and obligations for the purpose of protecting its activities and the fundamental rights and freedoms of others. |
| --- | --- |

(15)

The Agency is committed to respect, to the maximum extent possible, the fundamental rights of the data subjects in particular, the right of provision of information, access and rectification, the right to erasure, restriction of processing, the right of communication of a personal data breach to the data subject or confidentiality of communication as enshrined in the Regulation. However, the Agency may also be required to restrict data subject's rights and obligations for the purpose of protecting its activities and the fundamental rights and freedoms of others.

| (16) | Therefore Article 25(1) and (5) of the Regulation, gives the Agency the possibility to restrict, under conditions, the application of Articles 14 to 22, 35 and 36, as well as Article 4 of the Regulation in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 20 shall be based on internal rules to be adopted at the highest level of management of the Agency and subject to publication in the Official Journal of the European Union, where they are not based on legal acts adopted on the basis of the Treaties. |
| --- | --- |

(16)

Therefore Article 25(1) and (5) of the Regulation, gives the Agency the possibility to restrict, under conditions, the application of Articles 14 to 22, 35 and 36, as well as Article 4 of the Regulation in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 20 shall be based on internal rules to be adopted at the highest level of management of the Agency and subject to publication in the Official Journal of the European Union, where they are not based on legal acts adopted on the basis of the Treaties.

| (17) | Restrictions may apply to different data subject rights, including the provision of information to data subjects, right of access, rectification, erasure, restriction of processing, communication of a personal data breach to the data subject or confidentiality of communication as enshrined in the Regulation. |
| --- | --- |

(17)

Restrictions may apply to different data subject rights, including the provision of information to data subjects, right of access, rectification, erasure, restriction of processing, communication of a personal data breach to the data subject or confidentiality of communication as enshrined in the Regulation.

| (18) | The Agency may be required to reconcile those rights with the objectives of administrative inquiries, audits, investigations and court proceedings. It may also be required to balance a data subject’s rights against the fundamental rights and freedoms of other data subjects. |
| --- | --- |

(18)

The Agency may be required to reconcile those rights with the objectives of administrative inquiries, audits, investigations and court proceedings. It may also be required to balance a data subject’s rights against the fundamental rights and freedoms of other data subjects.

| (19) | The Agency may, for instance, need to restrict the information it provides to a data subject about the processing of his or her personal data during the preliminary assessment phase of an administrative inquiry or during the inquiry itself, prior to a possible dismissal of case or at the pre-disciplinary stage. In certain circumstances, providing such information may seriously affect the Agency’s capacity to conduct the inquiry in an effective way, whenever, for example, there is a risk that the person concerned may destroy evidence or interfere with potential witnesses before they are interviewed. The Agency may also need to protect the rights and freedoms of witnesses as well as those of other persons involved. |
| --- | --- |

(19)

The Agency may, for instance, need to restrict the information it provides to a data subject about the processing of his or her personal data during the preliminary assessment phase of an administrative inquiry or during the inquiry itself, prior to a possible dismissal of case or at the pre-disciplinary stage. In certain circumstances, providing such information may seriously affect the Agency’s capacity to conduct the inquiry in an effective way, whenever, for example, there is a risk that the person concerned may destroy evidence or interfere with potential witnesses before they are interviewed. The Agency may also need to protect the rights and freedoms of witnesses as well as those of other persons involved.

| (20) | The Agency may need to protect the anonymity of a witness or whistle-blower who has asked not to be identified. In such a case, the Agency may decide to restrict access to the identity, statements and other personal data of such persons or the suspect, in order to protect their rights and freedoms. |
| --- | --- |

(20)

The Agency may need to protect the anonymity of a witness or whistle-blower who has asked not to be identified. In such a case, the Agency may decide to restrict access to the identity, statements and other personal data of such persons or the suspect, in order to protect their rights and freedoms.

| (21) | The Agency may need to protect confidential information concerning a staff member who has contacted Agency’s confidential counsellors in the context of a harassment procedure. In such cases, the Agency may need to restrict access to the identity, statements and other personal data of the alleged victim, the alleged harasser and other persons involved, in order to protect the rights and freedoms of all concerned individuals. |
| --- | --- |

(21)

The Agency may need to protect confidential information concerning a staff member who has contacted Agency’s confidential counsellors in the context of a harassment procedure. In such cases, the Agency may need to restrict access to the identity, statements and other personal data of the alleged victim, the alleged harasser and other persons involved, in order to protect the rights and freedoms of all concerned individuals.

| (22) | In relation to selection and recruitment procedures, staff evaluation and public procurement procedures the right to access, rectification, erasure and restriction can be exercised only at certain points in time and under the conditions as provided for in the relevant procedures in order to safeguard the rights of other data subjects and to respect the principles of equal treatment and the secrecy of deliberations. |
| --- | --- |

(22)

In relation to selection and recruitment procedures, staff evaluation and public procurement procedures the right to access, rectification, erasure and restriction can be exercised only at certain points in time and under the conditions as provided for in the relevant procedures in order to safeguard the rights of other data subjects and to respect the principles of equal treatment and the secrecy of deliberations.

| (23) | The Agency may also restrict access of individuals to their medical data for instance of psychological or psychiatric nature due to the potential sensitivity of these data, and the medical service of the Commission may want to give the data subjects only indirect access through their own practitioner. The data subject may exercise the right to rectification of assessments or opinions of the Commission’s Medical service by providing their comments or a report of a medical practitioner of their choice. |
| --- | --- |

(23)

The Agency may also restrict access of individuals to their medical data for instance of psychological or psychiatric nature due to the potential sensitivity of these data, and the medical service of the Commission may want to give the data subjects only indirect access through their own practitioner. The data subject may exercise the right to rectification of assessments or opinions of the Commission’s Medical service by providing their comments or a report of a medical practitioner of their choice.

| (24) | The Agency, represented by its Director, acts as the data controller irrespective of further delegations of the controller role within the Agency to reflect operational responsibilities for specific personal data processing activities to competent ‘delegated data controllers’. |
| --- | --- |

(24)

The Agency, represented by its Director, acts as the data controller irrespective of further delegations of the controller role within the Agency to reflect operational responsibilities for specific personal data processing activities to competent ‘delegated data controllers’.

| (25) | The personal data are stored securely in an electronic environment compliant with Commission Decision (EU, Euratom) 2017/46 (6) or on paper, preventing unlawful access or transfer of data to persons who do not have a need to know. The personal data processed are retained for no longer than necessary and appropriate for the purposes for which the data are processed for the period specified in the data protection notices and records of the Agency. |
| --- | --- |

(25)

The personal data are stored securely in an electronic environment compliant with Commission Decision (EU, Euratom) 2017/46 (6) or on paper, preventing unlawful access or transfer of data to persons who do not have a need to know. The personal data processed are retained for no longer than necessary and appropriate for the purposes for which the data are processed for the period specified in the data protection notices and records of the Agency.

| (26) | The Agency shall apply restrictions only when they respect the essence of fundamental rights and freedoms, are strictly necessary and are a proportionate measure in a democratic society. The Agency shall give reasons explaining the justification for those restrictions and inform accordingly the data subjects on those grounds and their right to lodge a complaint to the EDPS as provided for by Article 25(6) of the Regulation. |
| --- | --- |

(26)

The Agency shall apply restrictions only when they respect the essence of fundamental rights and freedoms, are strictly necessary and are a proportionate measure in a democratic society. The Agency shall give reasons explaining the justification for those restrictions and inform accordingly the data subjects on those grounds and their right to lodge a complaint to the EDPS as provided for by Article 25(6) of the Regulation.

| (27) | In application of the principle of accountability, the Agency shall keep a record of its application of restrictions. |
| --- | --- |

(27)

In application of the principle of accountability, the Agency shall keep a record of its application of restrictions.

| (28) | When processing personal data exchanged with other organisations in the context of its tasks, the Agency and those organisations shall consult each other on potential grounds for imposing restrictions and the necessity and proportionality of those restrictions, unless this would jeopardise the activities of the Agency. |
| --- | --- |

(28)

When processing personal data exchanged with other organisations in the context of its tasks, the Agency and those organisations shall consult each other on potential grounds for imposing restrictions and the necessity and proportionality of those restrictions, unless this would jeopardise the activities of the Agency.

| (29) | These internal rules shall thus apply to all processing activities carried out by the Agency involving personal data in the performance of administrative inquiries, disciplinary proceedings, preliminary activities related to cases of potential irregularities reported to OLAF, investigations of the European Public Prosecutors office (EPPO), whistleblowing procedures, (formal and informal) procedures for cases of harassment, processing of internal and external complaints, requests of access to or rectification of own medical files, the investigations carried out by the Data Protection Officer in line with Article 45(2) of the Regulation, (IT) security investigations handled internally or with external involvement (e.g. CERT-EU), audits, proceedings before the Court of Justice of the European Union or national public authorities, selection and recruitment procedures, staff evaluation and public procurement, as listed above. |
| --- | --- |

(29)

These internal rules shall thus apply to all processing activities carried out by the Agency involving personal data in the performance of administrative inquiries, disciplinary proceedings, preliminary activities related to cases of potential irregularities reported to OLAF, investigations of the European Public Prosecutors office (EPPO), whistleblowing procedures, (formal and informal) procedures for cases of harassment, processing of internal and external complaints, requests of access to or rectification of own medical files, the investigations carried out by the Data Protection Officer in line with Article 45(2) of the Regulation, (IT) security investigations handled internally or with external involvement (e.g. CERT-EU), audits, proceedings before the Court of Justice of the European Union or national public authorities, selection and recruitment procedures, staff evaluation and public procurement, as listed above.

| (30) | These internal rules shall apply to processing activities carried out prior to the launch of the procedures referred to above, during these procedures and during the monitoring of the follow-up to the outcome of these procedures. It should also include assistance and cooperation provided by the Agency to other EU Institutions, national authorities and international organisations outside of its administrative investigations. |
| --- | --- |

(30)

These internal rules shall apply to processing activities carried out prior to the launch of the procedures referred to above, during these procedures and during the monitoring of the follow-up to the outcome of these procedures. It should also include assistance and cooperation provided by the Agency to other EU Institutions, national authorities and international organisations outside of its administrative investigations.

| (31) | Pursuant to Article 25(8) of the Regulation, the Agency is entitled to defer, omit or deny the provision of information on the reasons for the application of a restriction to the data subject if this would in any way cancel the effect of the restriction. The Agency shall assess on a case-by-case basis whether the communication of the restriction would cancel its effect. |
| --- | --- |

(31)

Pursuant to Article 25(8) of the Regulation, the Agency is entitled to defer, omit or deny the provision of information on the reasons for the application of a restriction to the data subject if this would in any way cancel the effect of the restriction. The Agency shall assess on a case-by-case basis whether the communication of the restriction would cancel its effect.

| (32) | The Agency shall lift the restriction as soon as the conditions that justify the restriction no longer apply, and assess those conditions on a regular basis. |
| --- | --- |

(32)

The Agency shall lift the restriction as soon as the conditions that justify the restriction no longer apply, and assess those conditions on a regular basis.

| (33) | To guarantee utmost protection of the rights and freedoms of data subjects and in accordance with Article 44(1) of the Regulation, the Data Protection Officer of the Agency shall be consulted in due time before any restriction may be applied or reviewed and verify its compliance with this Decision. |
| --- | --- |

(33)

To guarantee utmost protection of the rights and freedoms of data subjects and in accordance with Article 44(1) of the Regulation, the Data Protection Officer of the Agency shall be consulted in due time before any restriction may be applied or reviewed and verify its compliance with this Decision.

| (34) | Articles 16(5) and 17(4) of the Regulation provide for exceptions to data subjects’ right to information and right of access. If these exceptions apply, the Agency does not need to apply a restriction under this Decision, |
| --- | --- |

(34)

Articles 16(5) and 17(4) of the Regulation provide for exceptions to data subjects’ right to information and right of access. If these exceptions apply, the Agency does not need to apply a restriction under this Decision,

HAS ADOPTED THIS DECISION:

Article 1

Subject matter and scope

1.   This Decision lays down rules relating to the conditions under which the Research Executive Agency (REA) may restrict the application of Articles 4, 14 to 22, 35 and 36, pursuant to Article 25 of the Regulation.

2.   The Agency, as the Data controller, is represented by the Director of the Agency, who may delegate further the function of the Data controller.

Article 2

Applicable restrictions

1.   The Agency may restrict the application of Articles 14 to 22, 35 and 36, as well as Article 4 of the Regulation in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 20.

2.   This Decision applies to the processing of personal data by the Agency within the framework of its administrative and operational functioning:

| (a) | pursuant to Article 25(1)(b), (c), (f), (g) and (h) of the Regulation when conducting internal investigations, including based on external complaints, administrative inquiries, pre-disciplinary, disciplinary or suspension proceedings under Article 86 and Annex IX of the Staff Regulations and its implementing rules, security investigations or OLAF investigations; |
| --- | --- |

(a)

pursuant to Article 25(1)(b), (c), (f), (g) and (h) of the Regulation when conducting internal investigations, including based on external complaints, administrative inquiries, pre-disciplinary, disciplinary or suspension proceedings under Article 86 and Annex IX of the Staff Regulations and its implementing rules, security investigations or OLAF investigations;

| (b) | pursuant to Article 25(1)(h) of the Regulation, when ensuring that Agency’s staff members may report facts confidentially where they believe there are serious irregularities, as set out in the internal rules or policies concerning whistleblowing; |
| --- | --- |

(b)

pursuant to Article 25(1)(h) of the Regulation, when ensuring that Agency’s staff members may report facts confidentially where they believe there are serious irregularities, as set out in the internal rules or policies concerning whistleblowing;

| (c) | pursuant to Article 25(1)(h) of the Regulation, when ensuring that Agency’s staff members are able to report to confidential counsellors in the context of a harassment procedure, as defined by internal rules; |
| --- | --- |

(c)

pursuant to Article 25(1)(h) of the Regulation, when ensuring that Agency’s staff members are able to report to confidential counsellors in the context of a harassment procedure, as defined by internal rules;

| (d) | pursuant to Article 25(1)(c), (g) and (h) of the Regulation, when conducting internal or external audits in relation to activities or the functioning of the Agency; |
| --- | --- |

(d)

pursuant to Article 25(1)(c), (g) and (h) of the Regulation, when conducting internal or external audits in relation to activities or the functioning of the Agency;

| (e) | pursuant to Article 25(1)(d) and (h) of the Regulation, when ensuring security analyses, including cyber security and IT system abuses, handled internally or with external involvement (e.g. CERT-EU), ensuring internal security by means of video surveillance, access control and investigation purposes, securing communication and information systems and carrying out technical security counter measures; |
| --- | --- |

(e)

pursuant to Article 25(1)(d) and (h) of the Regulation, when ensuring security analyses, including cyber security and IT system abuses, handled internally or with external involvement (e.g. CERT-EU), ensuring internal security by means of video surveillance, access control and investigation purposes, securing communication and information systems and carrying out technical security counter measures;

| (f) | pursuant to Article 25(1)(g) and (h) of the Regulation, when the Data Protection Officer (‘DPO’) of the Agency investigates matters directly related to the his/her tasks; |
| --- | --- |

(f)

pursuant to Article 25(1)(g) and (h) of the Regulation, when the Data Protection Officer (‘DPO’) of the Agency investigates matters directly related to the his/her tasks;

| (g) | pursuant to Article 25(1)(b), (g) and (h) of the Regulation, in the context of investigations from the European Public Prosecutor Office (EPPO); |
| --- | --- |

(g)

pursuant to Article 25(1)(b), (g) and (h) of the Regulation, in the context of investigations from the European Public Prosecutor Office (EPPO);

| (h) | pursuant to Article 25(1)(h) of the Regulation, when individuals request to access or rectify their medical data, including if they are held by the Commission’s Medical Service. |
| --- | --- |

(h)

pursuant to Article 25(1)(h) of the Regulation, when individuals request to access or rectify their medical data, including if they are held by the Commission’s Medical Service.

| (i) | pursuant to Article 25(1)(c), (d), (g) and (h) of the Regulation, when providing or receiving assistance to or from other Union institutions, bodies, offices and agencies or cooperating with them in the context of activities under points (a) to (h) of this paragraph and pursuant to relevant service level agreements, memoranda of understanding and cooperation agreements of their respective establishment act; |
| --- | --- |

(i)

pursuant to Article 25(1)(c), (d), (g) and (h) of the Regulation, when providing or receiving assistance to or from other Union institutions, bodies, offices and agencies or cooperating with them in the context of activities under points (a) to (h) of this paragraph and pursuant to relevant service level agreements, memoranda of understanding and cooperation agreements of their respective establishment act;

| (j) | pursuant to Article 25(1)(c), (g) and (h) of the Regulation, when providing or receiving assistance to or from third countries national authorities and international organisations or cooperating with such authorities and organisations, either at their request or on its own initiative; |
| --- | --- |

(j)

pursuant to Article 25(1)(c), (g) and (h) of the Regulation, when providing or receiving assistance to or from third countries national authorities and international organisations or cooperating with such authorities and organisations, either at their request or on its own initiative;

| (k) | pursuant to Article 25(1)(c), (g) and (h) of the Regulation, when providing or receiving assistance and cooperation to and from EU Member States’ public authorities, either at their request or on its own initiative; |
| --- | --- |

(k)

pursuant to Article 25(1)(c), (g) and (h) of the Regulation, when providing or receiving assistance and cooperation to and from EU Member States’ public authorities, either at their request or on its own initiative;

| (l) | pursuant to Article 25(1)(e) of the Regulation, when processing personal data in documents obtained by the parties or interveners in the context of proceedings before the Court of Justice of the European Union. |
| --- | --- |

(l)

pursuant to Article 25(1)(e) of the Regulation, when processing personal data in documents obtained by the parties or interveners in the context of proceedings before the Court of Justice of the European Union.

For the purpose of this Decision, the above activities shall include preparatory and follow-up actions directly related to the same activity.

3.   The Agency may also apply restrictions on a case-by-case basis to data subjects’ rights referred to in this Decision, in the following circumstances:

| (a) | where the Commission services or other Union institutions, bodies, agencies and offices are entitled to restrict the exercise of the listed rights and the purpose of such a restriction by that Commission Service, Union institution, body or agency would be jeopardised where the Agency does not apply an equivalent restriction in respect of the same personal data; |
| --- | --- |

(a)

where the Commission services or other Union institutions, bodies, agencies and offices are entitled to restrict the exercise of the listed rights and the purpose of such a restriction by that Commission Service, Union institution, body or agency would be jeopardised where the Agency does not apply an equivalent restriction in respect of the same personal data;

| (b) | where the competent authorities of Member States are entitled to restrict the exercise of the listed rights and the purpose of such a restriction by that Member State authority would be jeopardised where the Agency does not apply an equivalent restriction in respect of the same personal data; |
| --- | --- |

(b)

where the competent authorities of Member States are entitled to restrict the exercise of the listed rights and the purpose of such a restriction by that Member State authority would be jeopardised where the Agency does not apply an equivalent restriction in respect of the same personal data;

| (c) | where the exercise of those rights and obligations would jeopardise the Agency’s cooperation with third countries or international organisations in the conduct of its tasks, unless this need to cooperate is overridden by the interests or fundamental rights and freedoms of the data subject; |
| --- | --- |

(c)

where the exercise of those rights and obligations would jeopardise the Agency’s cooperation with third countries or international organisations in the conduct of its tasks, unless this need to cooperate is overridden by the interests or fundamental rights and freedoms of the data subject;

| (d) | before applying restrictions under this paragraph, the Agency shall consult where necessary the relevant Commission services, other Union institutions, bodies, agencies, offices, international organisations or the competent authorities of Member States, unless it is clear that the restriction is provided for by one of the acts referred to above or such a consultation would jeopardise the Agency’s activities. |
| --- | --- |

(d)

before applying restrictions under this paragraph, the Agency shall consult where necessary the relevant Commission services, other Union institutions, bodies, agencies, offices, international organisations or the competent authorities of Member States, unless it is clear that the restriction is provided for by one of the acts referred to above or such a consultation would jeopardise the Agency’s activities.

4.   The categories of personal data processed related to the above activities may contain factual ‘hard’ data and ‘soft’ assessment data.

5.   Any restriction shall respect the essence of fundamental rights and freedoms and be necessary and proportionate in a democratic society.

Article 3

Recording and registering of restrictions

1.   The Data controller shall draw up a record of the restriction describing:

| (a) | the reasons for any restriction applied pursuant to this Decision; |
| --- | --- |

(a)

the reasons for any restriction applied pursuant to this Decision;

| (b) | which grounds among those listed in Article 2 apply; |
| --- | --- |

(b)

which grounds among those listed in Article 2 apply;

| (c) | how the exercise of the right would present a risk for the data subject or would jeopardise the purpose of the Agency’s tasks or would adversely affect the rights and freedoms of other data subjects; |
| --- | --- |

(c)

how the exercise of the right would present a risk for the data subject or would jeopardise the purpose of the Agency’s tasks or would adversely affect the rights and freedoms of other data subjects;

| (d) | outcome of the assessment of the necessity and proportionality of the restriction, taking into account the relevant elements in Article 25(2) of the Regulation. |
| --- | --- |

(d)

outcome of the assessment of the necessity and proportionality of the restriction, taking into account the relevant elements in Article 25(2) of the Regulation.

2.   A necessity and proportionality test of a restriction shall be carried out on a case-by-case basis before restrictions are applied. The Data controller shall consider the potential risks to the rights and freedoms of the data subject. Restrictions shall be limited to what is strictly necessary to achieve their objective.

3.   The record of the restriction and, where applicable, the documents containing underlying factual and legal elements shall be registered. They shall be made available to the European Data Protection Supervisor on request.

Article 4

Risks to the rights and freedoms of data subjects

1.   Assessments of the risks to the rights and freedoms of data subjects of imposing restrictions and details of the period of application of those restrictions shall be registered in the record of processing activities maintained by the data controller based on Article 31 of the Regulation. They shall also be recorded in any data protection impact assessments regarding those restrictions conducted under Article 39 of the Regulation, when applicable.

2.   Where the data controller considers applying a restriction, the risk to the rights and freedoms of the data subject shall be weighed, in particular, against the risk to the rights and freedoms of other data subjects and the risk of negatively impacting investigations or procedures, for example, by destroying evidence. The risks to the rights and freedoms of the data subject concern primarily, but are not limited to, reputational risks and risks to the right of defence and the right to be heard.

Article 5

Safeguards and storage periods

1.   The Agency shall put in place specific safeguards to prevent abuse and unlawful access or transfer of personal data in respect of which restrictions apply or could be applied. Such safeguards shall include technical and organisational measures and be detailed as necessary in the Agency’s internal decisions, procedures and implementing rules. These safeguards shall include:

| (a) | a clear definition of roles, responsibilities and procedural steps; |
| --- | --- |

(a)

a clear definition of roles, responsibilities and procedural steps;

| (b) | if appropriate, a secure electronic environment which prevents unlawful and accidental access or transfer of electronic data to unauthorised persons; |
| --- | --- |

(b)

if appropriate, a secure electronic environment which prevents unlawful and accidental access or transfer of electronic data to unauthorised persons;

| (c) | if appropriate, secure storage and processing of paper-based documents; |
| --- | --- |

(c)

if appropriate, secure storage and processing of paper-based documents;

| (d) | ensure compliance with confidentiality obligations for all persons having access to the personal data. |
| --- | --- |

(d)

ensure compliance with confidentiality obligations for all persons having access to the personal data.

2.   The retention period of personal data under a restriction shall be defined in the related record under Article 31 of the Regulation taking into account the purpose of the processing and shall include the timeframe necessary for administrative and judicial review. At the end of the retention period, the personal data shall be deleted, anonymised or transferred to archives in accordance with Article 13 of the Regulation.

Article 6

Duration of restrictions

1.   Restrictions referred to in Article 2 shall continue to apply as long as the reasons justifying them remain applicable.

2.   Where the reasons for a restriction no longer apply, the Data controller shall lift the restriction if the exercise of the restricted right would no longer negatively impact the relevant applicable procedure or adversely affect the rights or freedoms of other data subjects.

3.   In case the data subject has asked again for access to the personal data concerned, the Data controller shall provide the principal reasons for the restriction to the data subject. At the same time, the Agency shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor at any time or of seeking a judicial remedy in the Court of Justice of the European Union.

4.   The Agency shall review the application of the restrictions referred to in Article 2 every six months.

Article 7

Involvement of the Data Protection Officer

1.   The data controller of the Agency shall inform the DPO of the Agency without undue delay and prior to any decision to restrict data subject rights in accordance with this Decision or to extend the application of the restriction. The data controller shall provide the DPO access to the associated records and any document concerning the factual or legal context.

2.   The DPO may request the data controller to review the application of a restriction. The data controller shall inform the DPO in writing of the outcome of the requested review.

3.   The data controller shall document the involvement of the DPO in the application of the restriction, including what information is shared. The documents under this article shall be part of the record related to the restriction and made available to the EDPS on request.

Article 8

Information to data subject on restrictions of their rights

1.   The data controller shall include in the data protection notices and records under Article 31 of the Regulation, published on its website and on the Intranet general information on the potential restrictions of data subjects’ rights pursuant to Article 2(2) of this decision. The information shall cover which rights and obligations may be restricted, the grounds on which restrictions may be applied and their potential duration.

2.   The data controller shall inform data subjects individually, in writing and without undue delay of ongoing or future restrictions of their rights. The data controller shall inform the data subject of the principal reasons on which the application of the restriction is based, of their right to consult the DPO with a view to challenging the restriction and of their rights to lodge a complaint with the EDPS.

3.   The data controller may defer, omit or deny the provision of information concerning the reasons for a restriction and the right to lodge a complaint with the EDPS for as long as it would cancel the effect of the restriction. The assessment of this justification shall take place on a case-by-case basis and the data controller shall provide the information to the data subject, as soon as this would no longer cancel the effect of the restriction.

Article 9

Right of access by data subject

1.   In duly justified cases and under the conditions stipulated in this Decision, the right to access under Article 17 of the Regulation may be restricted by the data controller where necessary and proportionate with regards to the activities under this Decision.

2.   Where data subjects request access to their personal data processed in the context of a specific processing activity referred to in Article 2(2) of this Decision, the Agency shall limit its response to the personal data processed for that activity.

3.   The data subjects rights to directly access the documents of a psychological or psychiatric nature may be restricted. Neither indirect access, nor the right to rectification and communication of a personal data breach shall be limited with these internal rules. Therefore, an intermediary physician should be granted access on request of the concerned individual to all related information and discretionary power as to how and what access to provide to the data subject.

4.   Where the data controller restricts, wholly or partly, the right of access to personal data, as referred to in Article 17 of the Regulation, it shall inform the data subject concerned in writing, in its reply to the request for access, of the restriction applied and of the principal reasons thereof and of the possibility of lodging a complaint with the EDPS or of seeking a judicial remedy in the Court of Justice of the European Union.

5.   The information on the restriction of access may be deferred, omitted or denied if it would cancel the effect of the restriction in accordance with Article 25(8) of the Regulation.

6.   A restriction under this article shall be applied in accordance with this Decision.

Article 10

Right of rectification, erasure and restriction of processing

1.   In duly justified cases and under the conditions stipulated in this Decision, the right to rectification, erasure and restriction of processing under Articles 18, 19(1) and 20(1) of the Regulation may be restricted by the data controller where necessary and appropriate, with regards to activities under Article 2(2) of this Decision.

2.   In relation to medical data, data subjects may exercise the right to rectification of the assessment or opinion of the Commission’s Medical Service by providing their comments or a report of a medical practitioner of their choice including, directly to the Commission’s Medical Service.

3.   A restriction under this article shall be applied in accordance with this Decision.

Article 11

Communication of a personal data breach to the data subject

1.   Where the data controller is under an obligation to communicate a data breach under Article 35(1) of the Regulation, he/she may, in exceptional circumstances, restrict such communication wholly or partly. He/she shall document in a note the reasons for the restriction, the legal ground for it under Article 2 and an assessment of its necessity and proportionality. The note shall be communicated to the EDPS at the time of the notification of the personal data breach.

2.   Where the reasons for the restriction no longer apply, the Agency shall communicate the personal data breach to the data subject concerned and inform him or her of the principal reasons for the restriction and of his or her right to lodge a complaint with the EDPS.

Article 12

Confidentiality of electronic communications

1.   In exceptional circumstances, the Agency may restrict the right to confidentiality of electronic communications provided for by Article 36 of the Regulation. Such restrictions shall comply with Directive 2002/58/EC of the European Parliament and of the Council (7).

2.   Notwithstanding Article 8(3), where the Agency restricts the right to confidentiality of electronic communications, it shall inform the data subject concerned, in its reply to any request from the data subject, of the principal reasons on which the application of the restriction is based and of his or her right to lodge a complaint with the EDPS.

Article 13

Entry into force

This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Done at Brussels, 18 December 2020.

For the REA Steering Committee

(e-signed)

Jean-Eric PAQUET

The Chairperson

---

(1)  OJ L 295, 21.11. 2018, p. 39.

1

(2)  OJ L 011, 16.01.2003, p. 1.

2

(3)  Commission Implementing Decision 2013/778/EU of 13 December 2013 establishing the Research Executive Agency and repealing Decision 2008/46/EC ( OJ L346, 20.12.2013, p. 54) has been repealed with effect from 1 April 2021 by Commission Implementing Decision (EU) 2021/173 of 12 February 2021 establishing the European Climate, Infrastructure and Environment Executive Agency, the European Health and Digital Executive Agency, the European Research Executive Agency, the European Innovation Council and SMEs Executive Agency, the European Research Council Executive Agency, and the European Education and Culture Executive Agency and repealing Implementing Decisions 2013/801/EU, 2013/771/EU, 2013/778/EU, 2013/779/EU, 2013/776/EU and 2013/770/EU, OJ L50,15.2.2021, p. 9. Therefore as of 1 April 2021 the European Research Executive Agency has succeeded and replaced the Research Executive Agency.

3

(4)  Commission Decision C(2013)9418 of 20 December 2013 delegating powers to the Research Executive Agency with a view to performance of tasks linked to the implementation of Union programmes in the field of research and innovation comprising, in particular, implementation of appropriations entered in the general budget of the Union, as last amended by Commission Decision C(2019)3353 of 30 April 2019 has been repealed with effect from 1 April 2021 by Commission Decision C(2021) 952 of 12 February 2021 delegating powers to the European Research Executive Agency with a view to the performance of tasks linked to the implementation of Union programmes in the field of Research and Innovation, Research of the Fund for Coal and Steel and Information Provision and Promotion Measures concerning Agricultural Products comprising, in particular, implementation of appropriations entered in the general budget of the Union. As of 1 April 2021 the European Research Executive Agency has succeeded and replaced the Research Executive Agency.

4

(5)  Regulation (EEC, Euratom, ECSC) No 259/68 of the Council of 29 February 1968 laying down the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Communities and instituting special measures temporarily applicable to officials of the Commission (OJ L 56, 4.3.1968, p. 1).

5

(6)  Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission (OJ L 6, 11.1.2017, p. 40).

6

(7)  Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ L 201, 31.7.2002, p. 37).

7

---

ACTS ADOPTED BY BODIES CREATED BY INTERNATIONAL AGREEMENTS

| 4.6.2021 | EN | Official Journal of the European Union | L 198/15 |
| --- | --- | --- | --- |

4.6.2021

EN

Official Journal of the European Union

L 198/15

---

DECISION No 1/2021 OF THE EU-COLOMBIA-PERU-ECUADOR TRADE COMMITTEE

of 17 May 2021

amending Appendix 1 of Annex XII (Government Procurement) to the Trade Agreement between the European Union and its Member States, of the one part, and Colombia, Peru and Ecuador, of the other part (2021/894)

THE TRADE COMMITTEE,

Having regard to the Trade Agreement between the European Union and its Member States, of the one part, and Colombia, Peru and Ecuador, of the other part, and in particular Article 191 thereof,

Whereas:

| (1) | Article 191 of the Trade Agreement between the European Union and its Member States, of the one part, and Colombia, Peru and Ecuador, of the other part (‘the Trade Agreement’), lays down the procedures whereby a Party may modify or rectify its coverage of procurement under Title VI of the Trade Agreement. |
| --- | --- |

(1)

Article 191 of the Trade Agreement between the European Union and its Member States, of the one part, and Colombia, Peru and Ecuador, of the other part (‘the Trade Agreement’), lays down the procedures whereby a Party may modify or rectify its coverage of procurement under Title VI of the Trade Agreement.

| (2) | Subsection 1 on Central government entities of Section A of Appendix 1 of Annex XII to the Trade Agreement specifies the central government entities of Colombia whose procurement is covered under Title VI. |
| --- | --- |

(2)

Subsection 1 on Central government entities of Section A of Appendix 1 of Annex XII to the Trade Agreement specifies the central government entities of Colombia whose procurement is covered under Title VI.

| (3) | At the meeting of the Sub-committee on Government Procurement of 17 October 2019, held in Bogotá, Colombia informed the Union of its intention to update the list of procuring entities at central level by adding six agencies created after 2011, which belong to the executive level. At the time of the conclusion of the negotiations for the Trade Agreement between the Union and Colombia in 2010, competences currently carried out by such agencies were exercised by procuring entities at ministerial level. Those agencies do not currently appear in the list of procuring entities at central level in Colombia’s coverage. |
| --- | --- |

(3)

At the meeting of the Sub-committee on Government Procurement of 17 October 2019, held in Bogotá, Colombia informed the Union of its intention to update the list of procuring entities at central level by adding six agencies created after 2011, which belong to the executive level. At the time of the conclusion of the negotiations for the Trade Agreement between the Union and Colombia in 2010, competences currently carried out by such agencies were exercised by procuring entities at ministerial level. Those agencies do not currently appear in the list of procuring entities at central level in Colombia’s coverage.

| (4) | The Union and Colombia agree that the list of procuring entities at central level of Colombia should be updated by adding those six agencies as set out in this Decision. |
| --- | --- |

(4)

The Union and Colombia agree that the list of procuring entities at central level of Colombia should be updated by adding those six agencies as set out in this Decision.

| (5) | It is therefore necessary to modify Subsection 1 of Section A of Appendix 1 of Annex XII to the Trade Agreement. The Union and Colombia agree that such update should not require compensatory adjustments, as it is a minor amendment under Article 191(2) of the Trade Agreement. |
| --- | --- |

(5)

It is therefore necessary to modify Subsection 1 of Section A of Appendix 1 of Annex XII to the Trade Agreement. The Union and Colombia agree that such update should not require compensatory adjustments, as it is a minor amendment under Article 191(2) of the Trade Agreement.

| (6) | The decision to amend Subsection 1 of Section A of Appendix 1 of Annex XII to the Trade Agreement can be adopted within the Trade Committee established by the Trade Agreement by the Union and Colombia, as the signatory Andean Country concerned, pursuant to Article 14(3) of the Trade Agreement, in conjunction with Article 12(4), as it relates exclusively to the bilateral relationship between them, |
| --- | --- |

(6)

The decision to amend Subsection 1 of Section A of Appendix 1 of Annex XII to the Trade Agreement can be adopted within the Trade Committee established by the Trade Agreement by the Union and Colombia, as the signatory Andean Country concerned, pursuant to Article 14(3) of the Trade Agreement, in conjunction with Article 12(4), as it relates exclusively to the bilateral relationship between them,

HAS ADOPTED THIS DECISION:

Article 1

In Subsection 1 of Section A of Appendix 1 of Annex XII (Government Procurement) to the Trade Agreement, the following heading and six agencies are added to the list of procuring entities at central level:

‘Executive Branch Agencies

| 29. | Agencia Nacional de Minería |
| --- | --- |

29.

Agencia Nacional de Minería

| 30. | Agencia Nacional de Infraestructura |
| --- | --- |

30.

Agencia Nacional de Infraestructura

| 31. | Agencia Nacional de Seguridad Vial |
| --- | --- |

31.

Agencia Nacional de Seguridad Vial

| 32. | Agencia Nacional del Espectro |
| --- | --- |

32.

Agencia Nacional del Espectro

| 33. | Agencia Presidencial de Cooperación Internacional de Colombia |
| --- | --- |

33.

Agencia Presidencial de Cooperación Internacional de Colombia

| 34. | Agencia de Desarrollo Rural’. |
| --- | --- |

34.

Agencia de Desarrollo Rural’.

Article 2

The amendment provided for in Article 1 shall not entail any compensatory adjustments.

Article 3

This Decision shall enter into force on the day of its adoption.

This Decision shall be drawn up in the official languages of the Parties to the Trade Agreement, each of these texts being equally authentic.

For the Trade Committee

Head of EU Delegation

Paolo GARZOTTI

Head of Colombia’s Delegation

Juan CARLOS CADENA

---