# Commission Decision (EU) 2018/1962 of 11 December 2018 laying down internal rules concerning the processing of personal data by the European Anti-Fraud Office (OLAF) in relation to the provision of information to data subjects and the restriction of certain of their rights in accordance with Article 25 of Regulation (EU) 2018/1725 of the European Parliament and of the Council, Article 3: Provision of information to data subjects

Extent: E+W+S+N.I.

1. The Office shall publish on its website data protection notices that inform all data subjects of its activities involving processing of their personal data.
2. The Office shall individually inform all data subjects whom it considers to be persons concerned, witnesses or informants within the meaning of Regulation (EU, Euratom) No 883/2013.
3. Where the Office restricts, wholly or partly, the provision of information to the data subjects referred to in paragraph 2, it shall record the reasons for the restriction, including an assessment of the necessity and proportionality of the restriction.
To that end, the record shall state how the provision of the information would jeopardise the purpose of the Office's investigative activities, or of restrictions applied pursuant to Article 2(3), or would adversely affect the rights and freedoms of others.
The record and, where applicable, the documents containing underlying factual and legal elements shall be registered. They shall be made available to the European Data Protection Supervisor on request.
4. The restriction referred to in paragraph 3 shall continue to apply as long as the reasons justifying it remain applicable.
Where the reasons for the restriction no longer apply, the Office shall provide the information concerned and the reasons for the restriction to the data subject. At the same time, the Office shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor at any time or of seeking a judicial remedy in the Court of Justice of the European Union.
The Office shall review the application of the restriction every six months from its adoption and at the closure of the relevant investigation. Thereafter, the controller shall monitor the need to maintain any restriction on an annual basis.

---
Source: https://www.legislation.gov.uk/eudn/2018/1962/article/3 (the official version)
Page: https://openlegislation.uk/eu-decision-2018-1962/article-3
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.