Introductory text

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249(1) thereof,

Whereas:

Pursuant to Article 26a of the Staff Regulations and Articles 16 and 91 of the Conditions of Employment of other servants, officials and agents have the right to acquaint themselves with their medical files, in accordance with arrangements to be laid down by the appointing authorities of the institutions.

Since 2004, Conclusion 221/04 of the Heads of administrations^f1 has regulated access to medical files and does not allow direct access of data subject to all documents of a psychological or psychiatric nature concerning them. That general restriction does not entail a case-by-case analysis.

In order to comply with Regulation (EU) 2018/1725 of the European Parliament and of the Council^f2, restrictions on access to such documents applied by the Commission must be proportionate and involve a case-by-case analysis.

While access to medical files should be granted to the fullest extent possible to data subjects, restrictions based on Article 25 of Regulation (EU) 2018/1725 may in some cases be necessary to protect the staff member's health or the legitimate interests of third parties. The medical officer, acting on behalf of the Commission, should give the reasons for any such restriction and those reasons should become part of the medical files of the staff member concerned.

The personal data are stored in secured physical and electronic environments preventing unlawful access or transfer of data to persons who do not have a need to know.

The storage periods that apply to processing of medical files are laid down in the Common Commission-level retention list for European Commission files^f3.

The Data Protection Officer of the European Commission should carry out an independent review of the application of restrictions, with a view to ensuring compliance with this decision.

The European Data Protection Supervisor delivered an opinion on 10 December 2018.

Regulation (EU) 2018/1725 replaces Regulation (EC) No 45/2001 of the European Parliament and of the Council^f4, without any transitional period, from the date on which it enters into force. The possibility to apply restrictions to certain rights was provided for in Regulation (EC) No 45/2001. In order to avoid jeopardising the data subjects' rights, this Decision should apply from the date of entry into force of Regulation (EU) 2018/1725.

HAS ADOPTED THIS DECISION: