{
  "url": "https://openlegislation.uk/eu-decision-2019-154/introduction",
  "json_url": "https://openlegislation.uk/eu-decision-2019-154/introduction.json",
  "legislation": "eudn/2019/154",
  "legislation_title": "Commission Decision (EU) 2019/154 of 30 January 2019 laying down internal rules concerning the restriction of the right of access of data subjects to their medical files",
  "legislation_url": "https://openlegislation.uk/eu-decision-2019-154",
  "path": "introduction",
  "kind": "introduction",
  "number": null,
  "heading": "Introductory text",
  "text": "Commission Decision (EU) 2019/154\nof 30 January 2019\nlaying down internal rules concerning the restriction of the right of access of data subjects to their medical files\nTHE EUROPEAN COMMISSION,\nHaving regard to the Treaty on the Functioning of the European Union, and in particular Article 249(1) thereof,\nWhereas:\n(1)\nPursuant to Article 26a of the Staff Regulations and Articles 16 and 91 of the Conditions of Employment of other servants, officials and agents have the right to acquaint themselves with their medical files, in accordance with arrangements to be laid down by the appointing authorities of the institutions.\n(2)\nSince 2004, Conclusion 221/04 of the Heads of administrations has regulated access to medical files and does not allow direct access of data subject to all documents of a psychological or psychiatric nature concerning them. That general restriction does not entail a case-by-case analysis.\n(3)\nIn order to comply with Regulation (EU) 2018/1725 of the European Parliament and of the Council, restrictions on access to such documents applied by the Commission must be proportionate and involve a case-by-case analysis.\n(4)\nWhile access to medical files should be granted to the fullest extent possible to data subjects, restrictions based on Article 25 of Regulation (EU) 2018/1725 may in some cases be necessary to protect the staff member's health or the legitimate interests of third parties. The medical officer, acting on behalf of the Commission, should give the reasons for any such restriction and those reasons should become part of the medical files of the staff member concerned.\n(5)\nThe personal data are stored in secured physical and electronic environments preventing unlawful access or transfer of data to persons who do not have a need to know.\n(6)\nThe storage periods that apply to processing of medical files are laid down in the Common Commission-level retention list for European Commission files.\n(7)\nThe Data Protection Officer of the European Commission should carry out an independent review of the application of restrictions, with a view to ensuring compliance with this decision.\n(8)\nThe European Data Protection Supervisor delivered an opinion on 10 December 2018.\n(9)\nRegulation (EU) 2018/1725 replaces Regulation (EC) No 45/2001 of the European Parliament and of the Council, without any transitional period, from the date on which it enters into force. The possibility to apply restrictions to certain rights was provided for in Regulation (EC) No 45/2001. In order to avoid jeopardising the data subjects' rights, this Decision should apply from the date of entry into force of Regulation (EU) 2018/1725.\nHAS ADOPTED THIS DECISION:",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "footnote",
      "label": "f1",
      "text": "That conclusion was approved by the Heads of Administration at their 236th meeting on 19 February 2004."
    },
    {
      "type": "footnote",
      "label": "f2",
      "text": "Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002 (OJ L 295, 21.11.2018, p. 39)."
    },
    {
      "type": "footnote",
      "label": "f3",
      "text": "Common Commission-level retention list for European Commission files SEC(2007) 970 of 4 July 2007 updated and completed by SEC(2012) 713 of 17 December 2012."
    },
    {
      "type": "footnote",
      "label": "f4",
      "text": "Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1)."
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eudn/2019/154/introduction",
    "retrieved_at": "2026-11-01T15:12:50.481887+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}