Introductory text

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249(1) thereof,

Whereas:

The Commission conducts administrative investigations for the purpose of enforcing the competition rules in accordance with the Treaty and secondary legislation as well as international agreements adopted for that purpose.^f1 To that end, it exercises powers of investigation and enforcement (including related operational activities) in the fields of antitrust, merger control and State aid control conferred on the Commission by the relevant Union acts.

Commission investigations and enforcement activities in the field of competition target undertakings or Member States which are subject to the competition rules of the Treaty, and not natural persons as such. Nevertheless, during competition investigations, personal data within the meaning of Article 3(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council^f2 are inevitably processed within the meaning of Article 3(3) of Regulation (EU) 2018/1725. The Commission needs to process such personal data in order to fulfil the tasks assigned to it as the public authority enforcing Union competition rules. Investigation in the field of antitrust, merger control and State aid control, and enforcement of competition rules constitute monitoring, inspection or regulatory functions connected to the exercise of official authority in the cases referred to in Article 25(1)(c) and (g) of Regulation (EU) 2018/1725. Those activities serve the promotion and protection of a competitive internal market, thereby safeguarding an important economic and financial interest of the Union and of the Member States.

For the purpose of its investigation and enforcement activities in the fields of antitrust, merger control and State aid control, the Commission processes personal data acquired or received from legal persons, natural persons, Member States and other entities (such as National Competition Authorities, regulatory bodies and other public bodies and authorities), competition authorities of third countries and international bodies and organisations. During competition investigations and enforcement activities, whether acting on its own initiative or on the basis of received input, the Commission may also process personal data acquired or received from publicly available sources (for example, in the context of market monitoring or screening activities), from anonymous sources (for example, whistle-blowers/informants) or identified sources (for example, complainants) that require protection of their identity.

The Commission may, in turn, transmit personal data to legal or natural persons (for example, in the context of the access to file procedure), to National Competition Authorities and other authorities and bodies in the context of bilateral or multilateral cooperation with Member States or third country authorities and organisations, as necessary and appropriate to exercise its powers, to safeguard the rights of defence of parties subject to Commission proceedings and to ensure the efficient and effective application of Union competition rules.

Personal data processing activities, within the meaning of Article 3(3) of Regulation (EU) 2018/1725, carried out in the course of investigation and enforcement activities in the field of competition, may take place even before the Commission formally initiates proceedings, continue throughout the handling of the investigation and may continue even after the formal closure of the investigation (for example, for the purposes of market or compliance monitoring or screening activities, assessing the need for initiating new investigative activities, legal proceedings, etc.).

The personal data processed by the Commission are, for example, identification data, contact data, professional data and data related to or brought in connection with the subject matter of the investigation or procedure. The personal data are stored in a secured electronic environment to prevent unlawful access or transfer of data to persons who do not have a need to know. The personal data are retained in the services of the Commission in charge of the investigation for the time necessary for the investigation, for assessing the need to initiate new investigative activities, during the administrative procedure, and throughout any subsequent judicial review proceedings, and the administrative retention period that follows the definitive closure of the file. At the end of the retention period, the case related information including personal data is transferred to the historical archives of the Commission^f3.

While carrying out its tasks, the Commission is bound to respect the rights of natural persons in relation to the processing of personal data recognised by Article 8(1) of the Charter of Fundamental Rights of the European Union and by Article 16(1) of the Treaty. At the same time, the Commission is responsible for enforcing competition rules, which requires the Commission to conduct investigations in a timely manner, while respecting rules of confidentiality and professional secrecy^f4 as well as the rights of defence of parties subject to its investigations,^f5 and the rights of individuals that require protection of their identity.

In certain circumstances, it is necessary to reconcile the rights of data subjects pursuant to Regulation (EU) 2018/1725 with the needs of investigations and enforcement activities, as well as with full respect for fundamental rights and freedoms of other data subjects. To that effect, Article 25 of Regulation (EU) 2018/1725 provides the Commission with the possibility to restrict the application of Articles 14 to 22 and 35, as well as Article 4 thereof, insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 22 of that Regulation.

These internal rules should cover all processing operations carried out by the Commission in the performance of its powers of investigation, whether acting on its own initiative or on the basis of received input, and enforcement and related operational activities in the fields of antitrust, merger control and State aid control whenever the exercise of data subjects' rights may jeopardise the conduct of investigations or enforcement activities. These rules should apply to processing operations carried out prior to the formal initiation of proceedings, during the handling of investigations as well as after the formal closure of investigations, including processing in the context of bilateral or multilateral cooperation with National Competition Authorities, Member States or third country authorities and organisations.

In order to comply with Articles 14, 15 and 16 of Regulation (EU) 2018/1725, the Commission should inform all individuals of its activities involving processing of their personal data and of their rights in a transparent and coherent manner in the form of the data protection notices published on the Commission's website.

Without prejudice to Articles 14(5) and 16(5) of Regulation (EU) 2018/1725, the Commission is also able on the basis of Article 25 of that Regulation to restrict the provision of information to data subjects and the application of other rights of data subjects in order to protect its own competition investigations and enforcement of competition rules, investigations and proceedings of competition authorities of the Member States, the investigation tools and methods, as well as the rights of other persons related to its investigations.

In addition, in order to maintain effective cooperation it may be necessary for the Commission to restrict the application of data subjects' rights in order to protect processing operations of other Union institutions, bodies, offices and agencies or of Member States' authorities. To that effect, the Commission should consult those services, institutions, bodies, offices, agencies, and authorities on the relevant grounds for imposing restrictions and the necessity and proportionality of the restrictions.

The Commission may also have to restrict the provision of information to data subjects and the application of other rights of data subjects in relation to personal data received from third countries or international organisations, in order to cooperate with those countries or organisation and thus safeguard an important objective of general public interest of the Union. However, in some circumstances the interest or fundamental rights of the data subject may override the interest of international cooperation.

The Commission has therefore identified the grounds listed in Article 25(1)(c), (g) and (h) of Regulation (EU) 2018/1725 as grounds for restrictions under Article 25 of the Regulation that may be necessary to apply to data processing operations carried out in the framework of the Commission's investigative and enforcement activities in the area of competition, encompassing antitrust, merger control and State aid control.

The Commission should handle all restrictions in a transparent manner and register each application of restrictions in the corresponding record system.

Pursuant to Article 25(8) of Regulation (EU) 2018/1725, controllers may defer or refrain from providing information on the reasons for the application of a restriction to the data subject if providing that information would in any way compromise the purpose of the restriction. This is, in particular, the case of restrictions to the rights provided for in Articles 16 and 35 of Regulation (EU) 2018/1725. In order to ensure that the data subject's rights under Articles 16 and 35 of Regulation (EU) 2018/1725 are restricted only as long as the reasons for the restriction last, the Commission should review its position regularly and at the closure of the relevant investigation.

Where a restriction of other rights of data subjects is applied, the controller should assess on a case-by-case basis whether the communication of the restriction would compromise its purpose. The controller is the service in charge of the competition policy within the Commission.

The Data Protection Officer of the Commission should carry out an independent review of the application of restrictions, with a view to ensuring compliance with this Decision.

This Decision is adopted for the purposes of Article 25 of Regulation (EU) 2018/1725 and should enter into force at the same time as that Regulation in order to ensure legal certainty.

The European Data Protection Supervisor has been consulted.

HAS ADOPTED THIS DECISION: