{
  "url": "https://openlegislation.uk/eu-decision-2020-1502/introduction",
  "json_url": "https://openlegislation.uk/eu-decision-2020-1502/introduction.json",
  "legislation": "eudn/2020/1502",
  "legislation_title": "Commission Decision (EU) 2020/1502 of 15 October 2020 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their rights in the context of the processing of personal data by the Commission in the cooperation mechanism established by Regulation (EU) 2019/452 of the European Parliament and of the Council",
  "legislation_url": "https://openlegislation.uk/eu-decision-2020-1502",
  "path": "introduction",
  "kind": "introduction",
  "number": null,
  "heading": "Introductory text",
  "text": "Commission Decision (EU) 2020/1502\nof 15 October 2020\nlaying down internal rules concerning the provision of information to data subjects and the restriction of certain of their rights in the context of the processing of personal data by the Commission in the cooperation mechanism established by Regulation (EU) 2019/452 of the European Parliament and of the Council\nTHE EUROPEAN COMMISSION,\nHaving regard to the Treaty on the Functioning of the European Union, and in particular Article 249(1) thereof,\nWhereas:\n(1)\nRegulation (EU) 2019/452 of the European Parliament and of the Council established a cooperation mechanism between the Commission and the Member States on foreign direct investments. That mechanism is based on an exchange of information that may include personal data within the meaning of Article 3(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council. The purpose of the cooperation mechanism is to allow each Member State to examine whether a foreign direct investment in another Member State is likely to affect its security or public order and the Commission to examine whether a foreign direct investment is likely to affect security or public order in more than one Member State.\n(2)\nThe categories of personal data processed by the Commission for the screening of foreign direct investments by the Member States and for ensuring the effectiveness of the cooperation mechanism established by Regulation (EU) 2019/452 include identification and contact data, professional data and data related to foreign direct investment.\n(3)\nPersonal data will be retained by the services of the Commission in charge of the screening activity for as long as it is necessary for the screening of foreign direct investments by Member States and for ensuring the functioning of the cooperation mechanism and will be stored in a secured electronic environment to prevent unlawful access or transfer of data to persons outside the Commission.\n(4)\nWhile carrying out its tasks, the Commission is bound to respect the rights of natural persons in relation to the processing of personal data recognised by Article 8(1) of the Charter of Fundamental Rights of the European Union and by Article 16(1) of the Treaty on the Functioning of the European Union, as well as rights provided for in Regulation (EU) 2018/1725. At the same time, the Commission is required to comply with strict rules of confidentiality as laid down in Article 10 of Regulation (EU) 2019/452.\n(5)\nIn certain circumstances, it is necessary to reconcile the rights of data subjects pursuant to Regulation (EU) 2018/1725 with the need for effectiveness of the cooperation mechanism, as well as with full respect for fundamental rights and freedoms of other data subjects. To that effect, Article 25(1) of Regulation (EU) 2018/1725 provides the Commission with a possibility to restrict the application of Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725, as well as the principle of transparency laid down in Article 4(1)(a) thereof, insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19 and 20 of that Regulation.\n(6)\nThe Union’s common commercial policy requires that the Commission effectively and efficiently carry out its tasks under the cooperation mechanism. In order to do so, while respecting the standards of protection of personal data under Regulation (EU) 2018/1725, it is necessary to adopt internal rules under which the Commission may restrict data subjects’ rights in accordance with Article 25 of Regulation (EU) 2018/1725.\n(7)\nThose internal rules should cover all data processing operations carried out by the Commission in the performance of its functions under the cooperation mechanism established by Regulation (EU) 2019/452, from the moment it receives information on the foreign direct investments concerned.\n(8)\nIn order to comply with Articles 14, 15 and 16 of Regulation (EU) 2018/1725, the Commission should inform all individuals of its activities involving the processing of their personal data and of their rights in a transparent and coherent manner in the form of the data protection notices published on the Commission’s website. Where relevant, the Commission should adduce additional safeguards to ensure that the data subjects are informed individually in an appropriate format.\n(9)\nWithout prejudice to Article 14(5) and Article 16(5) of Regulation (EU) 2018/1725, the Commission has the possibility, on the basis of Article 25 of that Regulation, to restrict the provision of information to data subjects about the processing of their personal data and the application of their other rights in order to protect the Commission’s powers to conduct analyses and procedures related to the screening of foreign direct investments or the cooperation mechanism under Regulation (EU) 2019/452. In this respect, it may be necessary that the Commission restrict the application of those rights and obligations pursuant to Article 25(1)(a),(c),(d),(g) and (h) of that Regulation. This may be necessary where the purpose of the Commission’s analyses and procedures related to the screening of foreign direct investments or the cooperation mechanism in relation to the effective implementation of the Union’s common commercial policy would otherwise be jeopardised.\n(10)\nIn addition, in order to maintain effective cooperation, it may be necessary for the Commission to restrict the application of data subjects’ rights in order to protect processing operations of other Union institutions, bodies, offices and agencies or of Member States’ authorities. The Commission may do so in a situation where the purpose of such a restriction by another Union institution, body, office or agency or of a Member State authority would be jeopardised were the Commission not to apply an equivalent restriction in respect of the same personal data. To that effect, the Commission should consult those institutions, bodies, offices, agencies, and authorities on the relevant grounds for imposing restrictions and the necessity and proportionality of the restrictions.\n(11)\nThe Commission may have to restrict the provision of information to data subjects and the application of other rights of data subjects in relation to personal data received from the Member States or other, be it anonymous or identified sources, where it is necessary to safeguard the national security, public security or defence of the Member States, as referred to in Article 25(1)(a) of Regulation (EU) 2018/1725, or to safeguard the internal security of Union institutions and bodies, as referred to in Article 25(1)(d) of that Regulation. The internal security of Union institutions and bodies may be at stake in particular in those cases of foreign direct investment, which are likely to affect projects or programmes of Union interest on grounds of security or public order.\n(12)\nThe Commission may also have to restrict the provision of information to data subjects and the application of other rights of data subjects in relation to personal data received from the Member States, third countries or international organisations, in order to cooperate with the Member States, those third countries or organisations and thus safeguard an important objective of general public interest of the Union, as referred to in Article 25(1)(c) of Regulation (EU) 2018/1725. However, in some circumstances the interest of fundamental rights of the data subject may override the interest of international cooperation.\n(13)\nAccordingly, where necessary for a monitoring, inspection or regulatory function connected to the exercise of its official authority when carrying out its tasks under the cooperation mechanism established by Regulation (EU) 2019/452, the Commission may have to restrict the provision of information to data subjects and the application of other rights, as referred to in Article 25(1)(g) of Regulation (EU) 2018/1725.\n(14)\nIn addition, the Commission may have to restrict the provision of information to data subjects and the application of other rights of data subjects in relation to personal data received from anonymous or identified sources, such as informants, that require protection of their rights and freedoms, pursuant to Article 25(1)(h) of Regulation (EU) 2018/1725.\n(15)\nThe Commission has therefore identified the grounds listed in Article 25(1)(a), (c), (d), (g) and (h) of Regulation (EU) 2018/1725 as grounds for restrictions that may be necessary to apply to data processing operations carried out in the framework of the Commission’s analyses and procedures related to the screening of foreign direct investments or the cooperation mechanism established by Regulation (EU) 2019/452.\n(16)\nAny restriction, applied on the basis of this Decision, should be necessary and proportionate taking into account the risks to the rights and freedoms of data subjects.\n(17)\nThe Commission should handle all restrictions in a transparent manner and register each application in the corresponding record system.\n(18)\nThe Commission processes personal data under Regulation (EU) 2019/452 jointly with the Member States’ competent authorities. The Commission’s assessment and procedures in relation to the screening of foreign direct investments or the cooperation mechanism are carried out through different services, but the primary responsibility of coordination lays with the Directorate-General responsible for Trade.\n(19)\nPursuant to Article 25(8) of Regulation (EU) 2018/1725, controllers may defer, omit or deny the provision of information based on the reasons for the application of a restriction to the data subject if providing that information would in any way cancel the effect of restriction. This is, in particular, the case of restrictions provided for in Articles 16 and 35 of that Regulation.\n(20)\nThe Commission should regularly review the restrictions imposed in order to ensure that the data subject’s rights to be informed in accordance with Articles 16 and 35 of Regulation (EU) 2018/1725 are restricted only as long as such restrictions are necessary to allow the Commission to conduct analyses and procedures related to the screening of foreign direct investments or the cooperation mechanism.\n(21)\nWhere other rights of data subjects are restricted, the controller should assess on a case-by-case basis whether the communication of the restriction would compromise its purpose.\n(22)\nThe Data Protection Officer of the Commission should carry out an independent review of the application of restrictions, with a view to ensuring compliance with this Decision.\n(23)\nIn order to immediately allow the Commission to restrict the application of certain rights and obligations in accordance with Article 25 of Regulation (EU) 2018/1725 and not to jeopardise analyses and procedures related to the screening of foreign direct investments or the cooperation mechanism established by Regulation (EU) 2019/452, this Decision should enter into force on the third day following that of its publication in the Official Journal of the European Union.\n(24)\nThe European Data Protection Supervisor has been consulted and delivered his opinion on 29 July 2020,\nHAS ADOPTED THIS DECISION:",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "footnote",
      "label": "f1",
      "text": "Regulation (EU) 2019/452 of the European Parliament and of the Council of 19 March 2019 establishing a framework for the screening of foreign direct investments into the Union (OJ L 79 I, 21.3.2019, p. 1)."
    },
    {
      "type": "footnote",
      "label": "f2",
      "text": "Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39)."
    },
    {
      "type": "footnote",
      "label": "f3",
      "text": "The retention of files in the Commission is regulated by the Common Commission-Level Retention List (SEC (2019) 900). The retention period will be defined in the data protection records for this particular processing."
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eudn/2020/1502/introduction",
    "retrieved_at": "2026-11-01T15:12:07.332132+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}