12.12.2018 EN Official Journal of the European Union L 315/35 COMMISSION DECISION (EU) 2018/1961 of 11 December 2018 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their rights in the context of the processing of personal data for the purpose of internal audit activities THE COMMISSION, Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249(1), Whereas: (1) Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council (1) requires each Union institution to establish an internal audit function which shall be performed in compliance with the relevant international standards. Internal audit activities in the Commission are carried out by the Internal Audit Service (‘the Service’), which was established on 11 April 2000. Internal audit activities are also carried out by the Service in Union decentralised agencies and other autonomous bodies receiving contributions from the Union budget. (2) The Service conducts internal audit activities in accordance with Articles 117 to 123 of Regulation (EU, Euratom) 2018/1046 and its mission charter (2). In this respect, the Service has complete independence and full and unlimited access to all information required in the conduct of its internal audit activities in relation to all the activities and departments of the Union institution concerned. (3) The Service advises other Commission departments, executive agencies, as well as Union decentralised agencies and other autonomous bodies receiving contributions from the Union budget on how to deal with risks, i.e. any event or issue that could occur and adversely impact the achievement of the Commission's political, strategic and operational objective, by issuing independent opinions on the quality of management and control systems and by issuing recommendations for improving the conditions of implementation of operations and promoting sound financial management, in accordance with Articles 117 to 123 of Regulation (EU, Euratom) 2018/1046. Therefore, the internal audit activities of the Service do not typically target natural persons as such. Nevertheless, during the course of its activities, personal data within the meaning of Article 3(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (3) are inevitably processed. The internal audit activities carried out by the Service involve assessing the suitability and effectiveness of internal management systems and the performance of departments in implementing policies, programmes and actions, the efficiency and effectiveness of the internal control and audit systems applicable to each budget implementation operation. Therefore, they contribute to the safeguarding of important economic and financial interests of the Union and of the Member States. The Service is a controller for the processing operations it carries out in accordance with Articles 118 and 119(2) of the Financial Regulation. (4) The internal audit activities performed in the Commission and its executive agencies, and in the Union decentralised agencies and other autonomous bodies vary in form and content, ranging from assurance (including risk assessments) and consulting engagements, to reviews with a limited scope and follow-up engagements. (5) The Audit Progress Committee (APC), in accordance with its Mission Charter updated on 21 November 2018 (C(2018)7707), is an advisory body (4) that assists the Commission in fulfilling its obligations under the Treaties and other statutory instruments [Regulation (EU, Euratom) 2018/1046] by ensuring the independence of the Internal Audit Service, by monitoring the quality of internal audit work, and by ensuring that internal and external audit recommendations are properly taken into account by the Commission services and that they receive appropriate follow-up. In this way, the APC contributes to the overall further improvement of the Commission's effectiveness and efficiency in achieving its goals and facilitates the College's oversight of the Commission's governance, risk management, and internal control practices. The APC is a controller for the processing operation(s) it carries out in accordance with Article 123 of the Financial Regulation. (6) For the purpose of its activities under Articles 118 and 119(2) of Regulation (EU, Euratom) 2018/1046, whether acting on its own initiative or on the basis of received input, the Commission processes personal data acquired or received from legal persons, natural persons, Member States and international bodies and organisations. During such internal audit activities, the Service may also process personal data acquired or received from publicly available sources, from anonymous or from identified sources that require protection of their identity. (7) The Commission may, in turn, exchange personal data with the Union institutions, bodies, offices and agencies, with competent authorities of Member States and, within the framework of the Commission relevant international or cooperation agreements, with third countries and international organisations. (8) Personal data processing activities, within the meaning of Article 3(3) of Regulation (EU) 2018/1725, carried out in the course of an internal audit activity, may take place even before the Commission formally initiates it, continue throughout the performance of the audit activity and may continue even after the formal closure of the audit activity (for example, for reasons of monitoring of implementation of recommendations, assessing the need for initiating new internal audit activities). (9) The categories of personal data processed by the Commission include identification data, contact data, professional data and data related to or brought in connection with the subject matter of the activity. These categories of personal data are stored in a secured electronic environment to prevent unlawful access or transfer of data to persons who do not have a need to know. The personal data are retained for a maximum period of ten years. At the end of the retention period, the information related to the internal audit activity, including personal data is transferred to the historical archives of the Commission (5) or destroyed. (10) While carrying out internal audit activities, the Commission is bound to respect the rights of natural persons in relation to the processing of personal data recognised by Article 8(1) of the Charter of Fundamental Rights of the European Union and by Article 16(1) of the Treaty, as well as the rights provided for in Regulation (EU) 2018/1725. At the same time, the Commission is required to comply with strict rules of confidentiality referred to in the international internal audit standards, in accordance with Article 117 of Regulation (EU, Euratom) 2018/1046. (11) In certain circumstances, it is necessary to reconcile the rights of data subjects pursuant to Regulation (EU) 2018/1725 with the needs of internal audit activities, and confidentiality of exchanges of information with natural and legal persons as well as with full respect for fundamental rights and freedoms of other data subjects. To that effect Article 25(1)(c), (g) and (h) of Regulation (EU) 2018/1725 provides the Service with the possibility to restrict the application of Articles 14 to 17, 19, 20 and 35, as well as the principle of transparency laid down in Article 4(1)(a), insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19, 20 and 35 of that Regulation. (12) In order to ensure the effectiveness of internal audit activities, while respecting the standards of protection of personal data under Regulation (EU) 2018/1725, which replaced Regulation (EC) No 45/2001 of the European Parliament and of the Council (6), it is necessary to adopt internal rules under which the Commission may restrict data subjects' rights in accordance with Article 25(1)(c), (g) and (h) of Regulation (EU) 2018/1725. (13) The internal rules should cover all processing operations carried out by the Commission in the performance of its internal audit activities, whether acting on its own initiative or on the basis of received input, whenever the exercise of data subjects' rights may jeopardise the conduct of internal audit activities. Those rules should apply to processing operations carried out prior to the formal initiation of an engagement, during the engagement as well as during the monitoring of the follow-up to its outcome. (14) In order to comply with Articles 14, 15 and 16 of Regulation (EU) 2018/1725, the Commission should inform all individuals of its activities involving processing of their personal data and of their rights in a transparent and coherent manner by means of a data protection notice published on the Commission's website. Where relevant, the Commission should adduce additional safeguards to ensure that the data subjects are informed individually in an appropriate format. (15) On the basis of Article 25 of Regulation (EU) 2018/1725, the Commission is also able to restrict the provision of information to data subjects and the exercise of other rights of data subjects in order to protect its own internal audit activities, audits of public authorities of the Member States, the audit tools and methods, as well as the rights of other persons related to its internal audit activities. (16) In addition, in order to maintain effective cooperation it may be necessary for the Commission to restrict the application of data subjects' rights in order to protect processing operations of Commission services or other Union institutions, bodies, offices and agencies or of Member States' authorities and international organisations, as well as of the Audit Progress Committee. To that effect, the Commission should consult those services, institutions, bodies, offices, agencies, authorities and organisations, as well as the Audit Progress Committee on the relevant grounds for imposing restrictions and the necessity and proportionality of the restrictions. (17) The Commission may also have to restrict the provision of information to data subjects and the application of other rights of data subjects in relation to personal data received from third countries or international organisations, in order to cooperate with those countries or organisations and thus safeguard an important objective of general public interest of the Union. However, in some circumstances the interest or fundamental rights of the data subject may override the interest of international cooperation. (18) The Commission should handle all restrictions in a transparent manner and register each application of restrictions in the corresponding record system. (19) Pursuant to Article 25(8) of Regulation (EU) 2018/1725, controllers may defer, omit or deny provision of information on the reasons for the application of a restriction to the data subject if providing that information would in any way compromise the purpose of the restriction. This is, in particular, the case of restrictions to the rights provided for in Articles 16 and 35 of Regulation (EU) 2018/1725. (20) Where other rights of data subjects are restricted, the controller of the Internal Audit Service should assess on a case-by-case basis whether the communication of the restriction would compromise its purpose. (21) The Data Protection Officer of the European Commission should carry out an independent review of the application of restrictions, with a view to ensuring compliance with this Decision. (22) Regulation (EU) 2018/1725 replaces Regulation (EC) No 45/2001, without any transitional period, from the date on which it enters into force. The possibility to apply restrictions to certain rights was provided for in Regulation (EC) No 45/2001. In order to avoid jeopardising the lawfulness of internal audit activities, this Decision should apply from the date of entry into force of Regulation (EU) 2018/1725. (23) The European Data Protection Supervisor delivered an opinion on 27 November 2018, HAS ADOPTED THIS DECISION: Article 1 Subject-matter and scope 1. This Decision lays down the rules to be followed by the Commission to inform data subjects of the processing of their data in accordance with Articles 14, 15 and 16 of Regulation (EU) 2018/1725, when conducting its internal audit activities in accordance with Articles 117 to 123 of Regulation (EU, Euratom) 2018/1046. It also lays down the conditions under which the Commission may restrict the application of Articles 4, 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725, in accordance with Article 25(1)(c), (g) and (h) of that Regulation. 2. This Decision applies to the processing of personal data by the Commission for the purpose of or in relation to the activities carried out in order to fulfil its tasks pursuant to Articles 118 and 119 (2) of Regulation (EU, Euratom) 2018/1046. 3. This Decision applies to the processing of personal data within the Commission, in so far as the Commission processes personal data contained in information which it is required to process for the purpose of, or in relation to, the activities referred to in this Article. Article 2 Applicable exceptions and restrictions 1. Where the Commission exercises its duties with respect to data subjects' rights under Regulation (EU) 2018/1725, it shall consider whether any of the exceptions laid down in that Regulation apply. 2. Subject to Articles 3 to 7 of this Decision, the Commission may restrict the application of Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725, as well as the principle of transparency laid down in Article 4(1)(a) of that Regulation, in so far as its provisions correspond to the right and obligations provided for in Articles 14 to 17, 19, 20 and 35 of that Regulation, where the exercise of those rights and obligations would jeopardise the purpose of the Commission's activities under Articles 118 and 119 (2) of Regulation (EU, Euratom) 2018/1046, including by revealing its audit tools and methods or would adversely affect the rights and freedoms of other data subjects. 3. Subject to Articles 3 to 7, the Commission may restrict the rights and obligations referred to in paragraph 2 of this Article in relation to personal data obtained from other Union institutions, bodies, agencies and offices, competent authorities of Member States or third countries or from international organisations in the following circumstances: (a) where the exercise of those rights and obligations could be restricted by other Union institutions, bodies, agencies and offices on the basis of other acts provided for in Article 25 of Regulation (EU) 2018/1725 or in accordance with Chapter IX of that Regulation or in accordance with Regulation (EU) 2016/794 of the European Parliament and of the Council (7) or Council Regulation (EU) 2017/1939 (8); (b) where the exercise of those rights and obligations could be restricted by competent authorities of Member States on the basis of acts referred to in Article 23 of Regulation (EU) 2016/679 of the European Parliament and of the Council (9), or under national measures transposing Articles 13(3), 15(3) or 16(3) of Directive (EU) 2016/680 of the European Parliament and of the Council (10); (c) where the exercise of those rights and obligations could jeopardise the Commission's cooperation with third countries or international organisations in the conduct of internal audit activities. Before applying restrictions in the circumstances referred to in points (a) and (b) of the first subparagraph, the Commission shall consult the relevant Union institutions, bodies, agencies, offices or competent authorities of the Member States unless it is clear to the Commission that the application of a restriction is provided for by one of the acts referred to in those points or such consultation would jeopardise the purpose of its activities under Articles 118 and 119(2) of Regulation (EU, Euratom) 2018/1046. Point (c) of the first subparagraph shall not apply where the interest of the Commission to cooperate with third countries or international organisations is overridden by the interests or fundamental rights and freedoms of the data subjects. 4. Paragraphs 1, 2 and 3 are without prejudice to the application of other Commission decisions laying down internal rules concerning the provision of information to data subjects and the restriction of certain rights under Article 25 of Regulation (EU) 2018/1725 and to Article 23 of the Rules of Procedure of the Commission. Article 3 Provision of information to data subjects The Commission shall publish on its website data protection notices that inform all data subjects of its activities involving processing of their personal data for the purposes of its activities under Articles 118 and 119(2) of Regulation (EU, Euratom) 2018/1046. Where relevant, the Commission shall ensure that the data subjects are informed individually in an appropriate format. Where the Commission restricts, wholly or partly, the provision of information to data subjects, whose data are processed for the purposes of its activities under Articles 118 and 119(2) of Regulation (EU, Euratom) 2018/1046 it shall record and register the reasons for the restriction in accordance with Article 6. Article 4 Right of access by data subjects, right of erasure and right to restriction of processing 1. Where the Commission restricts, wholly or partly, the right of access to personal data by data subjects, the right of erasure, or the right to restriction of processing as referred to in Articles 17, 19 and 20 respectively of Regulation (EU) 2018/1725 it shall inform the data subject concerned, in its reply to the request for access, erasure or restriction of processing, of the restriction applied and of the principal reasons therefore, and of the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking a judicial remedy in the Court of Justice of the European Union. 2. The provision of information concerning the reasons for the restriction referred to in paragraph 1 of this article may be deferred, omitted or denied for as long as it would undermine the purpose of the restriction. 3. The Commission shall record the reasons for the restriction in accordance with Article 6 of this Decision. 4. Where the right of access is wholly or partly restricted, the data subject shall exercise his or her right of access through the intermediary of the European Data Protection Supervisor, in accordance with Article 25 (6), (7) and (8) of Regulation (EU) 2018/1725. Article 5 Communication of personal data breaches to data subjects Where the Commission restricts the communication of a personal data breach to the data subject, as referred to in Article 35 of Regulation (EU) 2018/1725, it shall record and register the reasons for the restriction in accordance with Article 6 of this Decision. Article 6 Recording and registering of restrictions The Commission shall record the reasons for any restriction applied pursuant to this Decision, including an assessment of the necessity and proportionality of the restriction, taking into account the relevant elements in Article 25(2) of Regulation (EU) 2018/1725. To that end, the record shall state how the exercise of the right would jeopardise the purpose of the Commissions' activities under Articles 118 and 119(2) of Regulation (EU, Euratom) 2018/1046, or of restrictions applied pursuant to Article 2(2) or (3), or would adversely affect the rights and freedoms of other data subjects. The record and, where applicable, the documents containing the underlying factual and legal elements shall be registered. They shall be made available to the European Data Protection Supervisor on request. Article 7 Duration of restrictions 1. Restrictions referred to in Articles 3, 4 and 5 of this Decision shall continue to apply as long as the reasons justifying them remain applicable. 2. Where the reasons for a restriction referred to in Articles 3 or 5 of this Decision no longer apply, the Commission shall lift the restrictions and provide the principal reasons for the restriction to the data subject. At the same time, the Commission shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor at any time or of seeking a judicial remedy in the Court of Justice of the European Union. 3. The Commission shall review the application of the restriction referred to in Articles 3 and 5 of this Decision every six months from its adoption and before and after the closure of the relevant internal audit activity. Thereafter, the Commission shall monitor the need to maintain any restriction/deferral on an annual basis. Article 8 Review by the Data Protection Officer of the European Commission The Data Protection Officer of the European Commission shall be informed, without undue delay, whenever data subjects' rights are restricted in accordance with this Decision. Upon request, the Data Protection Officer shall be provided with access to the record and any documents containing underlying factual and legal elements. The Data Protection Officer may request a review of the restrictions. The Data Protection Officer shall be informed in writing of the outcome of the requested review. Article 9 Entry into force This Decision shall enter into force on the day of its publication in the Official Journal of the European Union. It shall apply from 11 December 2018. Done at Brussels, 11 December 2018. For the Commission The President Jean-Claude JUNCKER (1) Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012 (OJ L 193, 30.7.2018, p. 1). (2) C(2017) 4435 final. (3) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39). (4) Established in October 2000, SEC(2000)1808/3. (5) Retention of files in the Commission is regulated by the Common retention list, a regulatory document (the last version is SEC(2012)713) in the form of a retention schedule that establishes the retention periods for the different types of Commission files. (6) Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regards to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1). (7) Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ L 135, 24.5.2016, p. 53). (8) Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor's Office (‘the EPPO’, OJ L 283, 31.10.2017, p. 1). (9) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). (10) Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).

Summary: Restrictions of data subjects’ rights — Commission’s internal rules Restrictions of data subjects’ rights — Commission’s internal rules SUMMARY OF: Commission Decision (EU) 2018/1927 — internal rules concerning the processing of personal data by the Commission in the field of competition in relation to the provision of information to data subjects and the restriction of certain rights Commission Decision (EU) 2018/1961 — internal rules concerning the provision of information to data subjects and the restriction of certain of their rights in the context of the processing of personal data for the purpose of internal audit activities Commission Decision (EU) 2018/1962 — internal rules concerning the processing of personal data by the European Anti-Fraud Office (OLAF) in relation to the provision of information to data subjects and the restriction of certain of their rights Commission Decision (EU) 2018/1996 — internal rules concerning the provision of information to data subjects and the restriction of certain of their rights in the context of the processing of personal data for the purpose of trade defence and trade policy investigations Commission Decision (EU) 2019/154 — internal rules concerning the restriction of the right of access of data subjects to their medical files Commission Decision (EU) 2019/165 — internal rules concerning the provision of information to data subjects and the restriction of certain of their data protection rights by the Commission in the context of administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings Commission Decision (EU) 2019/236 — internal rules concerning the provision of information to data subjects and the restriction of certain of their rights in the context of the processing of personal data by the Commission for the purposes of internal security of the EU institutions WHAT IS THE AIM OF THESE DECISIONS? They set out internal rules, based on which the European Commission may restrict the rights of individuals, which they exercise under Regulation (EU) 2018/1725. The internal rules apply to the processing of personal data within specific fields and for specific purposes. KEY POINTS Personal data are any information relating to an identified or identifiable natural person (‘data subject’). A natural person is identifiable, if he/she can be identified, directly or indirectly, in particular by reference to an identifier (such as a name, an identification number, location data, or an online identifier) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. The new EU legal framework on the protection and free flow of personal data consists of, in particular: the General Data Protection Regulation (GDPR), which sets outs the rights of individuals as regards their personal data, protects them with regard to the processing of their personal data within the EU countries, and ensures the free flow of such data; Regulation (EU) 2018/1725, which sets out the rights of individuals as regards their personal data, protects them with regard to the processing of their personal data by the EU institutions, bodies, offices and agencies, and ensures the free flow of such data. These regulations are considered as equivalent and have to be interpreted as being the same. Article 25 of Regulation (EU) 2018/1725 provides for the possibility that, in certain cases, the EU institutions and bodies can restrict the rights of individuals, on the condition that such restrictions are laid down in EU law. In line with that, the Commission has adopted 7 Commission decisions, which provide the grounds for possible restrictions in order to safeguard important objectives of general EU public interest. Based on those decisions and following a case-by-case assessment of the necessity and proportionality of restrictions, the European Commission decides whether the rights of an individual should be restricted in an individual case. The following rights of individuals may be restricted: their right to information about;processing of their personal data; andbreaches of their personal data that might result in a high risk to their rights and freedoms; their right to access their personal data, have their personal data erased, or to restrict the processing of their personal data. The 7 Commission decisions all follow a similar format, each including some or all of these elements: Subject matter and scope Requirement of a case-by case assessment of each request of a data subject. Applicable exceptions and/or restrictions Before applying a restriction, the Commission must first consider whether any of the exceptions to the rights of data subjects, as set out in Regulation (EU) 2018/1725, apply. Provision of information to data subjects The Commission must publish on its website data protection notices that inform all data subjects of its data processing activities in the relevant area. The Commission must individually inform, in an appropriate format, any person individually affected by an inquiry or by a measure carried out in one of the relevant fields. Rights of data subjects to access their personal data, have them erased or have their processing restricted If the Commission restricts access to personal data, the right of erasure and/or right to restriction of processing, it must inform the data subject concerned of the restriction applied, of the main reasons for applying it and of the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking a judicial remedy in the Court of Justice of the European Union. Recording and registering of restrictions The Commission must record the reasons for any restriction applied, including an assessment of necessity and proportionality. Duration of restrictions Restrictions continue to apply as long as the reasons justifying them remain. Review by the Data Protection Officer (DPO) of the European Commission The DPO must be informed, without undue delay, whenever data subjects’ rights are restricted. Upon request, the DPO must be provided with access to the record and any documents containing underlying factual and legal elements. The DPO can request a review of the restriction and must be informed in writing of the outcome of the requested review. The 7 Commission decisions cover the restriction of data subjects in the following fields: Internal security of the EU institutions Applies to the processing of personal data to ensure the security of persons, assets and information in the Commission. The Commission must individually inform witnesses and the persons concerned by a security inquiry of the processing of their personal data. Furthermore, the Commission must individually inform data subjects whose data are processed in the case of background checks according to Article 7(5) of Commission Decision (EU, Euratom) 2015/443. It must also individually inform persons whose data are processed in the context of searches of Commission premises and communication and information systems and equipment. Administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings The rights and obligations under Regulation (EU) 2018/1725 can be restricted if they would jeopardise the purpose of administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings or would affect the rights and freedoms of other data subjects. Personal medical data The Commission can restrict, on a case-by-case basis, data subjects’ right to access directly personal medical data of a psychological or psychiatric nature concerning them, where access to such data is likely to represent a risk to the data subject’s health. This restriction must be proportionate to what is strictly necessary to protect the data subject. Trade defence and trade policy investigations The rights and obligations under Regulation (EU) 2018/1725 can be restricted if they would jeopardise the purpose of the Commission’s trade policy and trade defence activities, or would adversely affect the rights and freedoms of other data subjects. European Anti-Fraud Office (OLAF) Applies to the processing of personal data by OLAF (as well as to the processing of personal data by Commission services and executive agencies which must be transmitted to OLAF) in order to fulfil its tasks; Investigations by OLAF are completely independent of the Commission; OLAF decides whether any exceptions to the rights of data subjects should be applied. Data protection notices informing data subjects of the activities involving the processing of their personal data are published on OLAF’s website. OLAF’s DPO reviews any restriction of the rights of data subjects. Internal audit activities The rights and obligations under Regulation (EU) 2018/1725 can be restricted as part of the processing operations carried out by the Commission in the performance of its internal audit activities, whenever the exercise of data subjects’ rights may jeopardise the conduct of internal audit activities, including by revealing its audit tools and methods or would adversely affect the rights and freedoms of other data subjects. In addition, it may be necessary for the Commission to restrict the application of data subjects’ rights in order to protect processing operations of Commission services or other Union institutions, bodies, offices and agencies or of Member States’ authorities and international organisations, as well as of the Audit Progress Committee. The Commission informs individuals of its internal audit activities involving processing of their personal data and of their rights by means of a data protection notice published on the Commission’s website. Where relevant, the Commission ensures that the data subjects are informed individually in an appropriate format. Competition The rights and obligations under Regulation (EU) 2018/1725 can be restricted if they would jeopardise the purpose of the Commission’s investigative and enforcement activities, including by revealing its investigative tools and methods, or would adversely affect the rights and freedoms of other data subjects. FROM WHEN DO THE DECISIONS APPLY? Decisions (EU) 2018/1927, (EU) 2018/1961, (EU) 2018/1962, (EU) 2018/1996 and (EU) 2019/154 have applied since 11 December 2018. Decisions (EU) 2019/165 has applied since 7 February 2019. Decision (EU) 2019/236 has applied since 11 February 2019. BACKGROUND For more information, see: 2018 reform of data protection rules (European Commission). MAIN DOCUMENTS Commission Decision (EU) 2018/1927 of 5 December 2018 laying down internal rules concerning the processing of personal data by the European Commission in the field of competition in relation to the provision of information to data subjects and the restriction of certain rights (OJ L 313, 10.12.2018, pp. 39-44) Commission Decision (EU) 2018/1961 of 11 December 2018 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their rights in the context of the processing of personal data for the purpose of internal audit activities (OJ L 315, 12.12.2018, pp. 35-40) Commission Decision (EU) 2018/1962 of 11 December 2018 laying down internal rules concerning the processing of personal data by the European Anti-Fraud Office (OLAF) in relation to the provision of information to data subjects and the restriction of certain of their rights in accordance with Article 25 of Regulation (EU) 2018/1725 of the European Parliament and of the Council (OJ L 315, 12.12.2018, pp. 41-46) Commission Decision (EU) 2018/1996 of 14 December 2018 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their rights in the context of the processing of personal data for the purpose of trade defence and trade policy investigations (OJ L 320, 17.12.2018, pp. 40-44) Commission Decision (EU) 2019/154 of 30 January 2019 laying down internal rules concerning the restriction of the right of access of data subjects to their medical files (OJ L 27, 31.1.2019, pp. 33-35) Commission Decision (EU) 2019/165 of 1 February 2019 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their data protection rights by the Commission in the context of administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings (OJ L 32, 4.2.2019, pp. 9-13) Commission Decision (EU) 2019/236 of 7 February 2019 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their rights in the context of the processing of personal data by the European Commission for the purposes of internal security of the Union institutions (OJ L 37, 8.2.2019, pp. 144-149) RELATED DOCUMENTS Applicable for the European Commission: Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, pp. 39-98) Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission (OJ L 6, 11.1.2017, pp. 40-51) Successive amendments to Decision (EU, Euratom) 2017/46 have been incorporated in the basic text. This consolidated version is of documentary value only. Commission Decision (EU, Euratom) 2015/443 of 13 March 2015 on Security in the Commission (OJ L 72, 17.3.2015, pp. 41-52) Applicable in the EU countries: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, pp. 1-88) See consolidated version. Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, pp. 89-131) See consolidated version. last update 03.04.2019


7.9.2018 EN Official Journal of the European Union L 226/7 COMMISSION DECISION (EU) 2018/1220 of 6 September 2018 on the rules of procedure of the panel referred to in Article 143 of Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012 (1), and in particular Article 143(4) thereof, Whereas: (1) Regulation (EU, Euratom) 2018/1046 has replaced Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council (2) which established a panel for assessing centrally certain situations of exclusion of economic operators and adopting appropriate recommendations (‘the Panel’). (2) Regulation (EU, Euratom) 2018/1046 extends the powers of the Panel to issuing opinions and recommendations to determine whether a financial irregularity has occurred, and it is appropriate for the exercise of this power to be regulated in its rules of procedure. (3) Article 143 of Regulation (EU, Euratom) 2018/1046 establishes the composition of the Panel, the procedure for appointing its Chair and the management of conflicts of interests. It provides for the Panel's rules of procedure to be adopted by the Commission and for the Panel to be assisted by a permanent secretariat, provided by the Commission. (4) To ensure the Panel's continuity and proper functioning, it is appropriate to specify the procedure for the appointment and dismissal of the Chair and to lay down provisions on deputising for him/her where he/she is absent or prevented from attending to his/her duties. (5) To ensure the Panel's continuity and proper functioning, it is also necessary to lay down detailed rules on its composition in any given case, in particular those relating to the designation of the two permanent members, their deputies and the additional member representing the authorising officer responsible; (6) It is necessary to specify that observers will participate in the Panel's meetings to ensure that it is fully and adequately informed. (7) In the interests of proper administration, it is appropriate to specify the support functions to be provided to the Panel by the permanent secretariat in the framework of its proceedings. (8) The procedure for referring a case to the Panel must be clarified, in particular as regards the minimum content of the referral. (9) For the benefit of economic operators, it is necessary to establish the procedure for ensuring that their right to be heard is respected. (10) It is appropriate to specify the practical arrangements for close cooperation between the Panel and the European Anti-Fraud Office (OLAF) in the light of the administrative arrangements on cooperation and timely exchange of information between the Commission and OLAF. (11) It is appropriate to clarify the rules for the adoption of the Panel's recommendations and opinions. (12) Since the Panel replaces that referred to in Article 73(6) of Regulation (EU, Euratom) No 966/2012 and succeeds that referred to in Article 108(4) thereof, it is appropriate to repeal the two Commission Decisions C(2011) 6109 final and (EU) 2015/2463 (3) on the rules of procedure of those panels. (13) Any processing of personal data by the Panel and its permanent secretariat should be carried out in accordance with Regulation (EC) No 45/2001 of the European Parliament and of the Council (4). (14) Regulation (EC) No 1049/2001 of the European Parliament and of the Council (5) applies to the recommendations adopted by the Panel, HAS ADOPTED THIS DECISION: CHAPTER I GENERAL PROVISIONS Article 1 Subject matter This Decision lays down the rules of procedure of the Panel referred to in Article 143 of Regulation (EU, Euratom) 2018/1046. Article 2 Appointment, termination of appointment and dismissal of the Chair and of his/her deputy 1. The Chair of the Panel shall be appointed by the Commission for a non-renewable term of five years, following a call for expressions of interest. His/her term of office shall begin on the date fixed for that purpose in the decision on the appointment. This Decision shall be published in the C series of the Official Journal of the European Union. 2. The Chair shall be appointed as a special adviser of the Commission within the meaning of Article 5 of the Conditions of Employment of Other Servants of the European Union. His/her contract as special adviser shall fully respect his/her independence and shall not affect the duration of his/her term of office. 3. If the Chair no longer fulfils the conditions required for the performance of his/her duties, he/she may be dismissed by the Commission. 4. The rules applicable to the appointment, termination of appointment and dismissal of the Chair shall also apply to his/her deputy. The provisions laid down in paragraphs 1 to 3 of this Article and in Article 143 of Regulation (EU, Euratom) 2018/1046 shall also apply to the Chair's deputy. Article 3 Deputising for the Chair 1. If the Chair is prevented from attending to his/her duties, they shall be carried out by his/her deputy. 2. Should the office of Chair fall vacant, his/her duties shall be carried out by his/her deputy until a new Chair is appointed. 3. Where both the Chair and his/her deputy are prevented from attending to their duties, the most senior permanent member representing the Commission shall deputise. Article 4 Responsibilities of the Chair 1. The Chair shall represent the Panel. 2. He/she shall chair the Panel's meetings and organise its work. 3. He/she shall be assisted to this end by the permanent secretariat referred to in Article 7. 4. He/she may delegate to each of the permanent members representing the Commission the power to sign on his/her behalf, at his/her direction, documents relating to a particular case or to administrative matters. 5. He/she shall set the schedule of the Panel's meetings, after consulting the permanent members. 6. He/she shall exercise the other powers conferred on him/her by this decision. Article 5 Designation of the other Panel members and their deputies 1. The Director of the Central Financial Service in the Directorate-General for Budget shall be one of the two permanent members of the Panel representing the Commission, pursuant to Article 143(2)(b) of Regulation (EU, Euratom) 2018/1046. The Director-General for Budget shall designate an official of grade AD11 or above to deputise for this permanent member. The Director-General for Budget shall designate the second permanent member representing the Commission and his/her deputy ad personam among Commission officials of at least grade AD14 and AD11 respectively. 2. The member representing the competent authorising officer (‘the referring authority’) and his/her deputy shall be officials or temporary staff members designated in accordance with the rules of procedure and the internal administrative rules of the institution, office, body or agency concerned, as referred to in Article 73(3) of Regulation (EU, Euratom) 2018/1046. They shall perform at least the functions of head of unit or head of delegation. Article 6 Observers 1. Observers shall participate in the Panel's deliberations without taking part in the adoption of recommendations. 2. The Commission's Legal Service shall be fully entitled to observer status for each matter submitted to the Panel and shall provide comments on its own initiative or at the request of the Chair. To this end, one of its members shall attend all the Panel's deliberations. The Legal Service shall be informed of all written procedures. 3. In matters where the request of the referring authority is based, inter alia, on information transmitted by the European Anti-Fraud Office (OLAF), OLAF's representative shall attend the Panel's meetings and participate in oral and written procedures. He/she may provide comments on his/her own initiative or at the request of the Chair. 4. In other cases, OLAF may be invited to provide information or advice, at the request of the Chair. 5. Authorising officers (other than the referring authority) of the Commission, of a European office set up by the Commission, of an executive agency, of another institution, or of another European office, body or agency who are concerned by the case referred to the Panel shall have observer status. These authorising officers may attend the Panel's deliberations, shall be informed of written procedures and shall provide oral and written comments at the request of the Chair. 6. The Chair, after consulting the permanent members of the Panel, may invite other observers to attend the Panel's deliberations and call on them to provide oral and written comments. Article 7 Permanent secretariat 1. The Panel's permanent secretariat shall be provided by officials or staff members of the Directorate-General for Budget and shall be attached administratively to that Directorate-General. 2. Under the Chair's authority, the permanent secretariat shall: (a) verify the capacity of the referring authorities, of their designated representatives and of the observers; (b) verify that referrals are complete and contain all the necessary documents and information, in particular the information sheet; (c) identify any other authorising officers concerned by the case who may be proposed as possible observers; (d) organise the necessary dealings and contacts with the referring authority, the Commission's Legal Service and other bodies that are or may be associated with the case in question in order to obtain updates on the information contained in the referrals; (e) draw up the drafts to be submitted to the Panel for examination and send them to the Chair, the other members and the observers who are to participate in settling a case; (f) propose to the Chair the draft schedule of the Panel's meetings; (g) draw up the draft agenda for the Panel's meetings and send it to the members and participants; (h) verify the presence of the persons and documents required to ensure that the Panel's deliberations are conducted properly; (i) attend the deliberations of the Panel and ensure that they are followed up; (j) draw up summary minutes of each meeting for the file and send them to the members; (k) notify the economic operators; (l) notify the referring authority of the recommendation adopted by the Panel; (m) ensure that all correspondence addressed to the Panel or relating to its activities is followed up; (n) keep the register of the recommendations adopted by the Panel and the decisions taken by the authorising officer responsible; (o) ensure publication of the decisions on exclusion and financial penalties referred to in Article 140 of Regulation (EU, Euratom) 2018/1046. Article 8 Prevention and management of conflicts of interests 1. Where the Chair or his/her deputy, any other member or that member's deputy, the officials and staff members making up the Panel's secretariat, and any other person who participates in the Panel's meetings or is aware of the documents relating to a case finds himself/herself in a situation that might give rise to a risk of conflict of interest, he/she shall immediately inform the other members and the secretariat. The same applies where they find themselves in a situation that might objectively be perceived as a conflict of interest. 2. None of the persons referred to in paragraph 1 shall participate in the deliberations or in the adoption of the recommendation. A note recording the way in which the risk of a conflict of interests has been dealt with shall be included in the file. Article 9 Cooperation between the Panel and OLAF 1. OLAF shall cooperate closely with the Panel in accordance with Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council (6), with due regard for the respect of procedural and fundamental rights and for the protection of whistle-blowers. 2. Where the request of the referring authority is based on information transmitted by OLAF, the Panel shall consult OLAF before sending notification to the economic operator in order not to breach the confidentiality of the judicial proceedings and investigations conducted or coordinated by OLAF, including the protection of whistle-blowers, and of national investigations or judicial proceedings, where known. 3. Disclosure to economic operators or their agents of information stemming from, or relating to, investigations conducted or coordinated by OLAF shall require OLAF's agreement. Article 10 Referral of cases to the Panel 1. A request for a recommendation shall be referred to the Panel by any authorising officer of the Commission, of another institution, of a European office set up by the Commission, of an executive agency, or of another European office, body or agency. Where the referral is made by an authority that does not come under the Commission, the necessary contacts shall be established immediately by the permanent secretariat in order to make sure that both sides ensure the confidentiality of the exchanges on the case in question. 2. The request shall be emailed in confidential form to the secretariat at the following email address: Panel-secretariat-BUDG@ec.europa.eu. 3. Where the referring authority becomes aware of the information referred to in Articles 136 of Regulation (EU, Euratom) 2018/1046, it shall inform the Panel thereof as soon as possible after this information has been brought to its knowledge, except in duly justified cases. 4. The request for a recommendation shall contain the information required in Article 142(3) of Regulation (EU, Euratom) 2018/1046. It shall also contain the other relevant information referred to in Article 136 of the aforementioned Regulation, including, where applicable, OLAF reports. It shall include a duly completed information sheet. Article 11 Convening the Panel A meeting of the Panel shall be convened by the Chair for the purpose of: (a) establishing the preliminary classification in law, pursuant to Article 136(2) of Regulation (EU, Euratom) 2018/1046 with a view to notifying the economic operator concerned thereof; (b) adopting a recommendation as referred to in Article 143(6) of Regulation (EU, Euratom) 2018/1046. (c) dealing with any questions relating to the Panel's functioning. Article 12 Written procedure On the initiative of the Chair or at the request of another member of the Panel, the facts and the preliminary classification in law may be established, and the recommendation may be adopted, by written procedure. Any member of the Panel may object to the use of the written procedure. Observers shall be associated with this procedure. Article 13 The economic operator's right to be heard 1. Except where there are compelling legitimate grounds to preserve the confidentiality of the investigation or of national judicial proceedings, the economic operator shall have the right to submit observations pursuant to Article 143(5) of Regulation (EU, Euratom) 2018/1046. 2. A letter disclosing the facts and their preliminary classification in law, in which the Panel shall have regard only to documents which the economic operator has been able to examine, shall be sent to the economic operator subject to the provisions of Article 143(5) of Regulation (EU, Euratom) 2018/1046. In principal, this letter shall be sent by email. 3. The economic operator shall submit observations to the secretariat in writing by email to the following address: Panel-secretariat-BUDG@ec.europa.eu or to the email address given in the letter indicating the facts, together with any annexes, as an ordinary electronic file produced using word-processing software. 4. The written observations shall be no more than ten pages in length excluding annexes, except in duly justified cases involving complex legal or factual issues. 5. As a general rule, the economic operator shall be granted a period of three weeks to submit observations. This period shall start on the day following the letter disclosing the facts and their preliminary classification in law. Where the economic operator has agreed contractually to communicate with the authorising officer responsible electronically, the letter notifying the operator of the facts shall be sent electronically. 6. By way of an exception, following a reasoned request by the economic operator, a deadline may be extended, by no more than half the period initially granted. 7. On the expiry of the deadline set, if there has been no duly reasoned request for an extension, or on the expiry of the extended deadline, the adversarial procedure shall be terminated. 8. Where the Chair finds that the economic operator has not submitted observations by the prescribed deadline, the procedure shall continue and the Chair shall convene the Panel in order to adopt the recommendation. Article 14 Adoption of letters and recommendations The Chair and the other members shall endeavour to reach a consensus on the content of the letter notifying the economic operator concerned of the alleged facts and their preliminary classification in law and, subsequently, on the recommendation. In the absence of a consensus, the matter shall be put to a majority vote in which: (a) the Chair has one vote; (b) the two permanent members together have one vote; (c) the member representing the referring authority has one vote. Article 15 Notification of the recommendation The Panel shall notify its recommendation to the referring authority and the observers. Article 16 Time limits for the settlement of a case 1. Once the secretariat has verified the referral and examined the case as provided for in the applicable provisions of Article 7, it shall send it to the Chair and the members of the Panel. The Chair shall verify the preparation of the file, after requesting additional measures of verification or examination, where applicable. 2. The duration of the procedure, which shall start when the Chair verifies the preparation of the file and terminate when an opinion and, if applicable, a recommendation is notified to the referring authority, shall, in principle, be no more than three months. This period may be extended by the Chair in order, inter alia, to ensure that the right to be heard is respected. Article 17 Confidentiality of the proceedings and deliberations Without prejudice to the application of Article 8(1) of Regulation (EU, Euratom) No 883/2013 and Article 22a of the Staff Regulations (7), the members of the Panel and of its secretariat, as well as any persons who, in any capacity, have participated in the proceedings or meetings of the Panel or have been involved in preparing the documents, opinions or positions issued by it, shall comply with the strictest confidentiality in this respect, in accordance with their possible administrative or contractual liability or liability under the Staff Regulations. The same applies to the Chair and his/her deputy. Article 18 Handling of requests for access to documents and protection of personal data Regulation (EC) No 1049/2001 and Regulation (EC) No 45/2001 shall apply to the proceedings of the Panel. CHAPTER II SPECIFIC PROVISIONS ON THE EXERCISE OF THE CONSULTATIVE POWERS REFERRED TO IN ARTICLE 93 OF THE FINANCIAL REGULATION Article 19 Principles 1. The provisions of Articles 1 to 4, 8, 12, 13, 17 and 18 in Chapter I of these Rules of Procedure shall apply to the Panel's exercise of the consultative powers conferred on it by Article 93 of Regulation (EU, Euratom) 2018/1046. 2. The provisions of the other articles in Chapter I of these Rules of Procedure shall also apply to the Panel's exercise of the powers referred to in paragraph 1, unless specifically provided for in this Chapter. Article 20 Additional members of the Panel and their deputies 1. When issuing the opinion referred to in Article 93(1) of Regulation (EU, Euratom) 2018/1046, the Panel shall be composed of the members referred to in Article 143(2) of Regulation (EU, Euratom) 2018/1046 and the following three additional members: (a) a representative of the appointing authority in charge of disciplinary matters of the institution or body concerned; (b) a member designated by the staff committee of the institution or body concerned; (c) a member of the legal service of the institution, European office set up by the Commission, executive agency or other European office, body or agency of the staff member concerned. 2. Each of these three members shall have a deputy designated, as appropriate, by: (a) the appointing authority concerned; (b) the staff committee concerned; (c) the legal service concerned. Article 21 Designation of the observers 1. The Commission's Legal Service shall designate an observer when the staff member concerned does not belong to the Commission. 2. The authorising officer responsible or, where appropriate, the Head of a Union Delegation acting as authorising officer by subdelegation, or their representatives, shall have observer status. 3. OLAF shall designate an observer when the information relating to the alleged breach of a provision of Regulation (EU, Euratom) 2018/1046 or of any other provision relating to financial management or control of transactions results from information transmitted by OLAF. 4. The disciplinary office of the institution or body concerned shall designate an observer in cases where a case is referred to the Panel by the appointing authority. In other cases, it may be invited by the Chair to designate an observer. 5. After consulting the members, the Chair may invite other observers. Article 22 Permanent secretariat of the Panel 1. The provisions of Article 7, except for those in paragraph 2(k) thereof, shall apply. 2. In particular, the secretariat shall: (a) where the Panel is directly informed of a case by a staff member, ensure that the file is sent to the appointing authority and shall notify this to the staff member who transmitted the information, as specified in Article 23(2); (b) where a case is referred to the Panel, verify the capacity of the referring authority and of its designated representatives; (c) identify, in agreement with the Chair, the three additional members of the Panel and the observers and verify their capacity; (d) verify that the files are complete and contain all the necessary documents and information, in particular the information sheet, a description of the facts and the alleged irregularity, and the supporting documents, including the investigation reports; (e) verify that the staff member concerned has been properly heard by the appointing authority or the authorising officer responsible, as appropriate; (f) draw up the draft opinions to be submitted for examination by the Panel for a decision and send them to the Chair, to the other members and to the observers who have been called upon to participate in settling a case; (g) send the recommendations referred to in Article 93(3) of Regulation (EU, Euratom) 2018/1046 to the authorising officer responsible and the internal audit service responsible; (h) where the Panel considers that the case is a matter for OLAF, transmit the file to the appointing authority without delay and inform OLAF. Article 23 Referral of cases to the Panel 1. In accordance with Article 93(1) of Regulation (EU, Euratom) 2018/1046, the panel shall be convened at the request of any appointing authority responsible for disciplinary matters or of an authorising officer responsible, including a head of a Union delegation or his/her deputy acting as the authorising officer by subdelegation, hereinafter ‘referring authorities’. 2. Where the Panel is directly informed by a staff member, it shall send the file to the competent appointing authority or, as appropriate, to the authority empowered to conclude contracts and inform that staff member. If the competent appointing authority decides to refer the case to the Panel, it shall inform the staff member. If it decides not to refer the case to the Panel, it shall inform the Panel and the staff member. In order to ensure that whistle-blowers are effectively protected, as provided for in Article 22a(3) of the Staff Regulations, the Panel may decide, by way of derogation from the preceding subparagraph, not to inform the competent appointing officer and to inform OLAF. Article 24 Written procedure At the initiative of the Chair or at the request of a member of the Panel, the opinion may be established by written procedure. Any member of the Panel or, if appropriate, the Chair may object to the use of the written procedure. In that case, the Chair shall convene a meeting within a reasonable time. The same rule shall apply as regards the recommendation referred to in Article 93(3) of Regulation (EU, Euratom) 2018/1046. Article 25 Adoption of the opinion and the recommendation 1. The Panel shall seek to reach consensus on whether a financial irregularity has occurred and on the reasoning underlying the opinion or recommendation. 2. In the absence of a consensus, the matter shall be put to a vote in which: (a) the Chair has one vote; (b) the two permanent members representing the Commission together have one vote; (c) the member representing the referring authority has one vote; (d) the three additional members have one vote each. In the event of a tied vote, the Chair shall have the casting vote. 3. Paragraphs 1 and 2 shall apply mutatis mutandis to the adoption of the recommendations. The consensus or the vote shall concern in particular the systemic nature of the financial irregularity. Article 26 Notification of the opinion and the recommendation The Panel shall notify the opinion without delay to the referring authority, the authorising officer responsible and the observers. Article 27 The staff member's right to be heard In accordance with Article 93(2) second subparagraph of Regulation (EU, Euratom) 2018/1046, before referring a case to the Panel, the appointing authority or, as applicable, the authorising officer responsible shall give the staff member the opportunity to present his/her observations on the facts concerning him/her. In accordance with Article 22(2)(e), after the referral of the case the permanent secretariat shall verify that the interested party has been properly heard. CHAPTER III FINAL PROVISIONS Article 29 Review This Decision shall be reviewed at the latest at the date determined by the Commission in accordance with Article 120(2), second and third subparagraphs, of Council Regulation (EU, Euratom) 2017/1939 (8). Article 30 Repeal 1. Decision C(2013) 6109 final is repealed. 2. Decision (EU, Euratom) 2015/2463 is repealed. Article 31 Entry into force and application This Decision shall enter into force on the third day following that of its publication in the Official Journal of the European Union. It shall apply from the date of entry into force of Article 143(4) of Regulation (EU, Euratom) 2018/1046. Done at Brussels, 6 September 2018. For the Commission The President Jean-Claude JUNCKER (1) OJ L 193, 30.7.2018, p. 1. (2) Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council of 25 October 2012 on the financial rules applicable to the general budget of the Union and repealing Council Regulation (EC, Euratom) No 1605/2002 (OJ L 298, 26.10.2012, p. 1). (3) Commission Decision (EU) 2015/2463 of 18 December 2015 on the rules of procedure of the panel referred to in Article 108 of Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council (OJ L 342, 29.12.2015, p. 57). (4) Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1). (5) Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ L 145, 31.5.2001, p. 43). (6) Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Ant-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ L 248, 18.9.2013, p. 1). (7) Regulation (EEC, Euratom, ECSC) No 259/68 of the Council of 29 February 1968 laying down the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Communities and instituting special measures temporarily applicable to officials of the Commission (OJ L 56, 4.3.1968, p. 1). (8) Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor's Office (‘the EPPO’), (OJ L 283, 31.10.2017, p. 1).

Summary: Ensuring sound financial management of the EU budget Ensuring sound financial management of the EU budget SUMMARY OF: Decision (EU) 2018/1220 on the rules of procedure of the panel referred to in Article 143 of the EU’s financial regulation WHAT IS THE AIM OF THE DECISION? It establishes the rules of procedure for the interinstitutional panel established by Article 143 of Regulation (EU, Euratom) 2018/1046 (see summary on financial regulation). The panel is the central point across all European Union (EU) institutions, bodies and agencies to assess whether participants and recipients and other persons and entities applying for EU funds should be excluded from EU funding or be subject to a financial penalty, and whether these sanctions should be published. While ensuring the right to be heard of persons and entities concerned, it bases its recommendations on facts and findings from various sources, including European Anti-Fraud Office (OLAF) and European Public Prosecutor’s Office (EPPO) investigations and decisions adopted by national authorities or international organisations. It is also competent (under Article 93 of the financial regulation) to issue opinions and recommendations on financial irregularities resulting from an act or omission of an EU staff member. KEY POINTS The European Commission appoints a high-level independent Chair of the panel for a non-renewable 5-year term. This person must be either a former member of the Court of Justice of the European Union or the European Court of Auditors, or a former director-general of an EU institution other than the Commission. The Chair is deputised by a Vice-Chair. The Chair: represents the panel, chairs and schedules its meetings and organises its work; is assisted by a permanent secretariat; convenes the panel when it is asked to give a recommendation on a case. The Chair is deputised by a Vice-Chair who is appointed under the same conditions and replaces the Chair in case he/she is prevented from attending to his/her duties. The panel also includes: two permanent members: the director of the central financial service of the Directorate-General for Budget and another person designated by the Director-General for Budget; the requested authorising officer; observers, including: from the Commission’s legal service, which attends all of the panel’s meetings;from OLAF and/or the EPPO, where the case concerns information they have provided;authorising officers from whichever EU institution, body or agency is concerned by the case;other observers invited by the Chair. The permanent secretariat is under the Chair’s authority and: is staffed by officials from the Directorate-General for Budget; organises the panel’s work; draws up documents for the panel; verifies the documentation and information submitted; identifies individuals who are potentially involved in a case; keeps a register of all of the panel’s recommendations. Any member of the panel or the secretariat who considers they may have a conflict of interest in a case does not participate in the proceedings. Participation of OLAF: OLAF cooperates closely with the panel to respect procedural and fundamental rights and to protect whistle-blowers; OLAF is consulted before the panel notifies a person or entity concerned, where a case is based on information transmitted by OLAF — this is done to avoid damaging the confidentiality of legal proceedings or ongoing investigations. Participation of the EPPO: The EPPO cooperates with the panel according to the arrangements for cooperation set out in the agreement referred to in Article 103(1) of Council Regulation (EU) 2017/1939; The EPPO participates as an observer in Panel meetings where the request of the referring authority is based, in whole or in part, on information transmitted by the EPPO. Referring cases to the panel. Any authorising official in an EU institution, agency or body: may refer, using a confidential email address, a case to the panel for its recommendation; must inform the panel as soon as they become aware of information which could exclude a person or entity from EU funds; provides all the necessary information they have detected. Right to be heard. Economic operators*: may submit their comments on the case, except where there are compelling legitimate grounds to preserve the confidentiality of the investigation or judicial proceedings; receive a letter and documentation setting out the facts of the case; send by email their comments, limited to 10 pages and within 3 weeks (these conditions can be more flexible in complex cases). The panel: aims for consensus when giving its recommendation on a case involving a person or entity; decides by majority vote in the absence of a consensus, with one vote for the Chair, one vote for the two permanent members (shared vote) and one vote for the authorising officer involved; notifies its recommendation to the observers and the institution, body or agency which referred the case; makes a recommendation within 3 months of receiving a case unless the Chair decides to extend this term, especially in order to ensure the right to be heard of the natural or legal persons concerned; members, the secretariat staff and all other persons involved in the proceedings and its preparation must respect the strictest confidentiality. EU staff members. The panel: may give an opinion as to whether an EU staff member has committed a financial irregularity; includes, in such circumstances, three extra members (one from the disciplinary body of the institution concerned, one from its staff committee and one from its legal service). The adversarial procedure is held by the referring authority before the case is examined by the panel. The decision repeals Commission decisions C(2011) 6109 final and (EU) 2015/2463 which had set out rules of procedure for earlier panels. The decision was amended on 3 July 2021 by Decision (EU) 2021/1081, in order to ensure the panel’s continuity and to include the mention to the arrangements between the EPPO and the Commission. FROM WHEN DOES THE DECISION APPLY? It has applied since 2 August 2018. BACKGROUND For more information, see: Modern and simpler — the new EU financial rules take effect today — press release (European Commission). KEY TERMS Economic operator: a person, entity, business or other organisation which supplies goods, works or services. MAIN DOCUMENT Commission Decision (EU) 2018/1220 of 6 September 2018 on the rules of procedure of the panel referred to in Article 143 of Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council (OJ L 226, 7.9.2018, pp. 7-16) Successive amendments to Commission Decision (EU) 2018/1220 have been incorporated in the original text. This consolidated version is of documentary value only. RELATED DOCUMENTS Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012 (OJ L 193, 30.7.2018, pp. 1-222) last update 29.07.2021


15.3.2018 EN Official Journal of the European Union L 72/20 COMMISSION DECISION (EU) 2018/402 of 13 March 2018 setting up the European Advisory Group for the European Labour Authority (Text with relevance for the EEA and for Switzerland) THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, and in particular Articles 46 and 48, Article 53(1), Article 62, and Article 91(1) thereof, Whereas: (1) In his State of the Union address 2017 (1), President Juncker proposed the establishment of a ‘European Labour Authority’ to strengthen fairness in the Internal Market and ensure that EU rules on labour mobility are enforced in a fair, simple and effective way. (2) On 13 March 2018, the Commission has proposed to set up the European Labour Authority (2), in order to support the Member States and the Commission in facilitating access for individuals and employers to information on their rights and obligations as well as to relevant services in cross-border labour mobility situations, to support cooperation between Member States in the cross-border enforcement of relevant Union law, and to mediate and facilitate solutions in case of cross-border disputes or labour market disruptions. (3) An advisory group should be set up to advise and assist the Commission on the swift establishment and future functioning of the European Labour Authority, which should be called the European Advisory Group for the European Labour Authority (hereafter ‘the Group’). While not taking part in the legislative process leading to the adoption of the proposed Regulation establishing the European Labour Authority, the Group should help lay the ground for setting up the European Labour Authority. (4) The Group should in particular allow exchanging best practices and experiences on cooperation in the areas of cross-border labour mobility and the coordination of social security systems that could be further developed by the European Labour Authority, as well as examining general questions, questions of principle and practical problems arising from the implementation of relevant Union law. The Group should also assist with identifying the means of cooperation and contribution of relevant existing bodies, including EU agencies, towards the establishment and good functioning of the European Labour Authority. (5) The Group should be chaired by the Commission (DG Employment, Social Affairs and Inclusion) and be composed of representatives at senior level of Member States' authorities, Union-level social partners, the European Foundation for the Improvement of Living and Working Conditions (Eurofound), the European Centre for the Development of Vocational Training (Cedefop), the European Training Foundation (ETD) and the European Agency for Safety and Health at Work (EU-OSHA). Union-level social partners should equally represent trade unions and employers' organisations. (6) European Free Trade Association (EFTA) States and the European Union Agency for Law Enforcement Cooperation (Europol) should be granted an observer status. (7) The Group should cooperate with existing bodies in the area of labour mobility and social security coordination. (8) Rules on disclosure of information by the members and observers of the Group should be laid down. (9) Personal data should be processed in accordance with Regulation (EC) No 45/2001 of the European Parliament and of the Council (3). (10) This Decision should apply until the European Labour Authority has been set up, HAS ADOPTED THIS DECISION: Article 1 Subject matter The European Advisory Group for the European Labour Authority (hereafter referred to as ‘the Group’) is set up. Article 2 Tasks The Group shall advise and assist the Commission (DG Employment, Social Affairs and Inclusion) on the swift establishment and future functioning of the European Labour Authority. In particular, the group's tasks shall be: (a) to facilitate cooperation among national authorities and stakeholders and advise the Commission on the swift establishment and operational future functioning of the European Labour Authority. (b) to examine general questions, questions of principle and practical problems arising from the implementation of Union legislation on cross border labour mobility and social security coordination and their impact on the activities of the European Labour Authority. (c) to exchange views on and identify best practices and examples of good cooperation in the area of cross border labour mobility and social security coordination in view of developing the activities of the European Labour Authority. (d) to identify the means of cooperation and the contribution of existing bodies, including decentralised EU agencies, towards the establishment and good functioning of the European Labour Authority. Article 3 Membership 1. The Group shall be composed of: — One representative from each Member State; — Six representatives from Union-level social partners equally representing trade unions and employers' organisations; — One representative from each EU Agency in the field of employment and social affairs. 2. Members shall nominate their representatives at senior level and shall be responsible for ensuring that their representatives provide a high level of expertise. 3. Representatives shall be nominated within 30 days of the entry into force of this Decision. Representatives may be accompanied by experts. 4. Members who are no longer capable of contributing effectively to the expert group's deliberations, who, in the opinion of the Commission (DG Employment, Social Affairs and Inclusion), do not comply with the conditions set out in Article 339 of the Treaty on the Functioning of the European Union or who resign, shall no longer be invited to participate in any meetings of the group and may be replaced for the remainder of their term of office. Article 4 Chair The Group shall be chaired by a representative of the Commission (DG Employment, Social Affairs and Inclusion). Article 5 Operation 1. The group shall act at the request of the Commission (DG Employment, Social Affairs and Inclusion), in compliance with the horizontal rules (4). 2. The Group shall meet at least three times per year. Meetings of the group shall, in principle, be held on Commission premises. 3. The Commission (DG Employment, Social Affairs and Inclusion) shall provide secretarial services. Commission officials from other departments with an interest in the proceedings may attend meetings of the group. 4. In agreement with the Commission (DG Employment, Social Affairs and Inclusion), the group may, by simple majority of its members, decide that deliberations shall be public. 5. Minutes on the discussion on each point on the agenda and on the opinions delivered by the group shall be meaningful and complete. Minutes shall be drafted by the secretariat under the responsibility of the Chair. 6. The group shall adopt its opinions, recommendations or reports by consensus. 7. Participation of European Parliament's experts in the work of the Group is governed by point 15 and Annex I of the Framework Agreement on relations between the European Parliament and the European Commission (5). Article 6 Invited experts The Commission (DG Employment, Social Affairs and Inclusion) may invite experts with specific expertise with respect to a subject matter on the agenda to take part in the work of the group on an ad hoc basis. Article 7 Observers 1. European Free Trade Association (EFTA) States and the European Union Agency for Law Enforcement Cooperation shall be granted an observer status, in compliance with the horizontal rules, by direct invitation. 2. Observers shall nominate their representatives. 3. Observers' representatives may be permitted by the Chair to take part in the discussions of the group and provide expertise. However, they shall not participate in the formulation of recommendations or advice of the group. Article 8 Rules of procedure On a proposal by and in agreement with the Commission (DG Employment, Social Affairs and Inclusion) the group shall adopt its rules of procedure by simple majority of its members, on the basis of the standard rules of procedure for expert groups, in compliance with the horizontal rules. Article 9 Professional secrecy and handling of classified information The members of the group and their representatives, as well as invited experts and observers, are subject to the obligation of professional secrecy, which by virtue of the Treaties and the rules implementing them applies to all members of the institutions and their staff, as well as to the Commission's rules on security regarding the protection of Union classified information, laid down in Commission Decisions (EU, Euratom) 2015/443 (6) and (EU, Euratom) 2015/444 (7). Should they fail to respect these obligations, the Commission may take all appropriate measures. Article 10 Transparency 1. The group shall be registered in the Register of Commission expert groups and other similar entities (the ‘Register of expert groups’). 2. As concerns the group composition, the following data shall be published on the Register of expert groups: (a) the name of the Member States; (b) the name of social partners; the interest represented shall be disclosed; (c) the name of the agencies in the field of employment and social affairs; (d) the name of observers, including the name of the third countries. 3. All relevant documents, including the agendas, the minutes and the participants' submissions, shall be made available either on the Register of expert groups or via a link from the Register to a dedicated website, where this information can be found. Access to dedicated websites shall not be submitted to user registration or any other restriction. In particular, the agenda and other relevant background documents shall be published in due time ahead of the meeting, followed by timely publication of minutes. Exceptions to publication shall only be foreseen where it is deemed that disclosure of a document would undermine the protection of a public or private interest as defined in Article 4 of Regulation (EC) No 1049/2001 of the European Parliament and of the Council (8). Article 11 Meeting expenses 1. Participants in the activities of the group shall not be remunerated for the services they offer. 2. Travel and subsistence expenses incurred by participants in the activities of the group shall be reimbursed by the Commission. Reimbursement shall be made in accordance with the provisions in force within the Commission and within the limits of the available appropriations allocated to the Commission departments under the annual procedure for the allocation of resources. Article 12 Applicability This Decision shall enter into force on the day of its publication in the Official Journal of the European Union. It shall apply until the European Labour Authority has been set up. Done at Strasbourg, 13 March 2018. For the Commission The President Jean-Claude JUNCKER (1) The 2017 State of the Union address is available at: https://ec.europa.eu/commission/state-union-2017_en (2) COM(2018) 131. (3) Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1). (4) C(2016) 3301, Article 13 paragraph 1. (5) OJ L 304, 20.11.2010, p. 47. (6) Commission Decision (EU, Euratom) 2015/443 of 13 March 2015 on Security in the Commission (OJ L 72, 17.3.2015, p. 41). (7) Commission Decision (EU, Euratom) 2015/444 of 13 March 2015 on the security rules for protecting EU classified information (OJ L 72, 17.3.2015, p. 53). (8) Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ L 145, 31.5.2001, p. 43).

Summary: Establishing the European Advisory Group for the European Labour Authority Establishing the European Advisory Group for the European Labour Authority SUMMARY OF: Decision (EU) 2018/402 — setting up the European Advisory Group for the European Labour Authority WHAT IS THE AIM OF THIS DECISION? It establishes the European Advisory Group which is to advise and assist the European Commission in the setting up and functioning of the European Labour Authority (ELA). KEY POINTS A proposal to establish the ELA was put forward by the Commission on 13 March 2018. Its purpose is to promote fairness and mutual trust in the EU’s internal market by ensuring that EU rules on labour mobility are enforced in a fair, simple and effective way. It has 3 specific objectives: to help individuals and employers access information about their rights and obligations in the areas of labour mobility and social security coordination (common EU rules protecting individuals’ social security rights when moving within the EU, Iceland, Liechtenstein, Norway and Switzerland), as well as access to relevant services; to support cooperation between national authorities in enforcing EU law across national borders, including to simplify joint and concerted inspections (such as where different countries might organise simultaneous inspections); to provide mediation and help resolve disputes between national authorities or in cases of disruptions to the labour market (such as a restructuring of companies) affecting several countries. This proposal is also part of the roll-out of the European Pillar of Social Rights which aims to promote better working and living conditions in the EU. Tasks The main tasks of the advisory group are to: bring about cooperation among national authorities and interested parties and advise the Commission on the establishment and future operation of the ELA;examine general questions, questions of principle and practical problems arising from the implementation of EU legislation on labour mobility and of social security coordination and their impact on the activities of the ELA; exchange views on and identify best practice and examples of good cooperation in the area of cross-border labour mobility and social security coordination with neighbouring European Free Trade Association (EFTA) countries in order to develop the activities of the ELA; identify the means of cooperation and the contribution of existing bodies, including decentralised EU agencies, in establishing the ELA and ensuring its good functioning. Composition The European Advisory Group’s membership is composed of: 1 representative from each EU country; 6 representatives from EU-level social partners equally representing trade unions and employers’ organisations; 1 representative from each EU agency in the field of employment and social affairs: European Foundation for the Improvement of Living and Working Conditions,European Centre for the Development of Vocational Training,European Training Foundation, andEuropean Agency for Safety and Health at Work. EFTA countries and the European Union Agency for Law Enforcement Cooperation can be granted an observer status by direct invitation. The Commission (DG Employment, Social Affairs and Inclusion) may invite experts with specific expertise on an agenda issue to take part on an ad hoc basis. WHEN DOES THE DECISION APPLY FROM? It has applied since 15 March 2018. BACKGROUND For more information, see: Questions and answers on the European Labour Authority (European Commission) Commission adopts proposals for a European Labour Authority and for access to social protection (European Commission) European Pillar of Social Rights (European Commission). MAIN DOCUMENT Commission Decision (EU) 2018/402 of 13 March 2018 setting up the European Advisory Group for the European Labour Authority (OJ L 72, 15.3.2018, pp. 20-23) RELATED DOCUMENTS Proposal for a Regulation of the European Parliament and of the Council establishing a European Labour Authority (COM(2018) 131 final, 13.3.2018) last update 17.07.2018