Commission Decision (EU) 2022/121 of 27 January 2022 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their rights in the context of processing of personal data for the purposes of handling requests and complaints under the Staff Regulations

• Published date: 28 January 2022
• Official Gazette Publication: Official Journal of the European Union, L 019, 28 January 2022

28.1.2022 EN Official Journal of the European Union L 19/77

---

COMMISSION DECISION (EU) 2022/121

of 27 January 2022

laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their rights in the context of processing of personal data for the purposes of handling requests and complaints under the Staff Regulations

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249(1) thereof,

Whereas:

(1) The Staff Regulations of Officials of the European Union and the Conditions of Employment of Other Servants of the Union, laid down in Council Regulation (EEC, Euratom, ECSC) No 259/68 (1) (‘the Staff Regulations’), require the Commission to respond to certain requests and complaints. Those tasks are mainly carried out by Unit ‘Appeals and Case Monitoring’ of the Directorate-General responsible for Human Resources and Security (‘DG HR’), which establishes the relevant facts and assesses them from a legal point of view in order to assist the Appointing Authority or the Authority responsible for Concluding Contracts of Employment (‘the Authority’) in taking a decision.

(2) Article 22c of the Staff Regulations requires the Commission, in accordance with Articles 24 and 90 of the Staff Regulations, to put in place a procedure for the handling of complaints made by officials concerning the way in which they are treated after or as a consequence of having reported a serious irregularity pursuant to Articles 22a and 22b of the Staff Regulations (2).

(3) Article 24 of the Staff Regulations requires the Commission to assist officials in proceedings against persons perpetrating threats, insulting or defamatory acts or utterances, or attacks to person or property to which he or a member of their family is subjected by reason of his position or duties.

(4) Article 90(1) and (2) of the Staff Regulations allow any person to whom the Staff Regulations apply to request the Authority to take a decision relating to him, or to submit a complaint against a decision affecting him adversely.

(5) In the context of those activities, the Commission collects and processes relevant information. That information includes personal data, in particular identification, contact and behavioural data. The competent Commission services transmit personal data to other Commission services on ‘a need to know’ basis.

(6) The personal data are stored in a secured physical and electronic environment, to prevent unlawful access or transfer of data to persons who do not have a need to know. After the end of the processing, the data are retained in accordance with the applicable Commission rules (3).

(7) While carrying out its tasks under the Staff Regulations, the Commission is bound to respect the rights of natural persons in relation to the processing of personal data recognised by Article 8(1) of the Charter of Fundamental Rights of the European Union and by Article 16(1) of the Treaty, as well as the rights provided for in Regulation (EU) 2018/1725 of the European Parliament and of the Council (4). At the same time, the Commission is required to comply with strict rules of confidentiality and professional secrecy.

(8) In certain circumstances, it is necessary to reconcile the rights of data subjects pursuant to Regulation (EU) 2018/1725 with the need to safeguard the prevention, investigation, detection and prosecution of criminal offences and to ensure the effectiveness of the Commission’s response to allegations of harassment and other inappropriate behaviour or attacks, as well as with full respect for the fundamental rights and freedoms of other data subjects. To that effect, Article 25(1), points (b), (c), (g) and (h), of Regulation (EU) 2018/1725 provide the Commission with the possibility to restrict the application of Articles 14 to 17, 19, 20 and 35, as well as the principle of transparency laid down in Article 4(1), point (a), insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19 and 20 of that Regulation.

(9) This might, in particular, be the case as regards the provision of information about the processing of personal data to the person in respect of whom a request or complaint is submitted (‘the person concerned’), in particular where the procedure originates from a request for assistance under Article 24 of the Staff Regulations alleging harassment. The Commission may decide to restrict the provision of such information to the person concerned in order to protect the rights and freedoms of the requestor, complainant or witness pursuant to Article 25(1), point (h), of Regulation (EU) 2018/1725. The Commission may decide to do so, in particular to protect those persons against possible retaliation by the persons concerned against whom allegations in good faith were made, which however have not led to measures by the administration. In some situations it might be necessary to restrict the provision of such information to prevent harassment or other inappropriate behaviour or attacks from occurring in the Commission (in particular in the organisational entity where the person concerned works together with the requestor, complainant and or witness).

(10) It might also be necessary to restrict other rights of the person concerned when the exercise of these rights would reveal information about the requestor, complainant or a witness who has asked not to have their identity disclosed. In such a case, the Commission may decide to restrict the right of access to the statement relating to the person concerned or his or her other rights in order to protect the rights and freedoms of the requestor, complainant or witness for the reasons set out in recital 9. The Commission may decide to do so pursuant to Article 25(1), point (h), of Regulation (EU) 2018/1725.

(11) It might also be necessary to restrict the rights of the person concerned in order to safeguard a monitoring, inspection or regulatory function connected to the exercise of official authority in a case where an important objective of general public interest of the Union, namely ensuring the effectiveness of the Commission’s response to allegations of harassment and of any other inappropriate behaviour or attacks, is at stake. The combat of harassment and of any other inappropriate behaviour or attacks constitutes an important objective of general public interest of the Union, including of the Commission. In addition, the Commission has a duty to assist its staff pursuant to Article 24 of the Staff Regulations. In order not to discourage staff members from reporting perceived instances of harassment and other inappropriate behaviour or attacks and from requesting assistance in this context, which is in the public interest of the Union, it must be ensured that persons concerned do not gain knowledge of the request for assistance which concerns them. This might be particularly pertinent in cases where the Authority finds that no harassment within the meaning of the Staff Regulations occurred. In such a situation, the public interest of the Union would require that the person concerned does not gain knowledge of the request for assistance in order to preserve the recourse by staff members to the procedure under Article 24 of the Staff Regulations and to prevent new conflicts. In this respect, the Commission may decide to restrict the rights of the person concerned pursuant to Article 25(1), points (c) and (g) of Regulation (EU) 2018/1725.

(12) It might also be necessary to restrict the rights of the person concerned in order to safeguard the prevention, investigation, detection and prosecution of criminal offences, which requestors, complainants or witnesses report to the Commission in relation to the person concerned. For example, requestors, complainants and witnesses may report inappropriate behaviour

...