Article 86 General rules on processing of personal data by the Agency

The Agency shall apply Regulation (EU) 2018/1725 when processing personal data.

The management board shall adopt internal rules on the application of Regulation (EU) 2018/1725 by the Agency, including rules concerning the data protection officer of the Agency.

The Agency may, in accordance with Article 25 of Regulation (EU) 2018/1725, adopt internal rules restricting the application of Articles 14 to 22, 35 and 36 of that Regulation. In particular, the Agency may, for the performance of its tasks in the area of return, provide for internal rules restricting the application of those provisions on a case-by-case basis as long as the application of those provisions would risk jeopardising return procedures. Such restrictions shall respect the essence of the fundamental rights and freedoms, shall be necessary and proportionate to the objectives pursued and shall contain specific provisions, where relevant, as referred to in Article 25(2) of Regulation (EU) 2018/1725.

The Agency may transfer the personal data referred to in Articles 49, 88 and 89 to a third country or to an international organisation in accordance with Chapter V of Regulation (EU) 2018/1725 insofar as such transfer is necessary for the performance of the Agency's tasks. The Agency shall ensure that personal data that are transferred to a third country or to an international organisation are only processed for the purpose for which they were provided. The Agency shall indicate, at the moment of transferring personal data to a third country or to an international organisation, any restrictions on access to or use of those data, in general or specific terms, including as regards transfer, erasure or destruction. Where the need for such restrictions becomes apparent after the transfer of personal data, the Agency shall inform the third country or the international organisation accordingly. The Agency shall ensure that the third country or international organisation concerned complies with such restrictions.

Transfers of personal data to third countries shall not prejudice the rights of applicants for international protection and of beneficiaries of international protection, in particular as regards non-refoulement and the prohibition against disclosing or obtaining information set out in Article 30 of Directive 2013/32/EU of the European Parliament and of the Council^f1.

Member States and the Agency, as appropriate, shall ensure that information that is transferred or disclosed to third countries pursuant to this Regulation is not transmitted onward to other third countries or third parties. Provisions to that effect shall be included in any agreement or arrangement concluded with a third country providing for the exchange of information.