COMMISSION DECISION (EU) 2019/154

of 30 January 2019

laying down internal rules concerning the restriction of the right of access of data subjects to their medical files

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249(1) thereof,

Whereas:

(1) Pursuant to Article 26

of the Staff Regulations and Articles 16 and 91 of the Conditions of Employment of other servants, officials and agents have the right to acquaint themselves with their medical files, in accordance with arrangements to be laid down by the appointing authorities of the institutions.

(2) Since 2004, Conclusion 221/04 of the Heads of administrations (1) has regulated access to medical files and does not allow direct access of data subject to all documents of a psychological or psychiatric nature concerning them. That general restriction does not entail a case-by-case analysis.

(3) In order to comply with Regulation (EU) 2018/1725 of the European Parliament and of the Council (2), restrictions on access to such documents applied by the Commission must be proportionate and involve a case-by-case analysis.

(4) While access to medical files should be granted to the fullest extent possible to data subjects, restrictions based on Article 25 of Regulation (EU) 2018/1725 may in some cases be necessary to protect the staff member's health or the legitimate interests of third parties. The medical officer, acting on behalf of the Commission, should give the reasons for any such restriction and those reasons should become part of the medical files of the staff member concerned.

(5) The personal data are stored in secured physical and electronic environments preventing unlawful access or transfer of data to persons who do not have a need to know.

(6) The storage periods that apply to processing of medical files are laid down in the Common Commission-level retention list for European Commission files (3).

(7) The Data Protection Officer of the European Commission should carry out an independent review of the application of restrictions, with a view to ensuring compliance with this decision.

(8) The European Data Protection Supervisor delivered an opinion on 10 December 2018.

(9) Regulation (EU) 2018/1725 replaces Regulation (EC) No 45/2001 of the European Parliament and of the Council (4), without any transitional period, from the date on which it enters into force. The possibility to apply restrictions to certain rights was provided for in Regulation (EC) No 45/2001. In order to avoid jeopardising the data subjects' rights, this Decision should apply from the date of entry into force of Regulation (EU) 2018/1725.

HAS ADOPTED THIS DECISION:

Article 1

Subject matter and scope

1. This Decision lays down the conditions under which the Commission may restrict the application of Article 17 of Regulation (EU) 2018/1725, in accordance with Article 25(1)(h) of that Regulation.

2. This Decision applies to the access to personal medical data processed by the Commission pursuant to Articles 26

, 33, 59, 72, 73 and 78 of the Staff Regulations and Articles 1, 13 to 15 of its Annex VIII, and Articles 13, 16, 28, 32, 33, 83, 91, 95, 100, 101 and 102 of the Conditions of Employment of Other Servants.

Article 2

Applicable restrictions

1. Subject to Articles 3 to 5, the Commission may restrict, on a case-by-case basis, data subjects' right to access directly personal medical data of a psychological or psychiatric nature concerning them which is processed by the Commission, where access to such data is likely to represent a risk for the data subject's health. This restriction shall be proportionate to what is strictly necessary to protect the data subject.

2. Access to the information referred to in paragraph 1 shall be given to a doctor of the data subject's choice.

3. In such cases, the data subject shall, upon request, be reimbursed by the Medical Service of the part of the cost of the medical consultation with the doctor who received access to the medical files that has not been reimbursed by the Joint Sickness Insurance Scheme (JSIS). The reimbursement shall not exceed the difference between the ceiling laid down in the General Implementing Provisions for the reimbursement of medical expenses (5) and the amount reimbursed to the data subject by the Join Sickness Insurance Scheme pursuant to those rules.

4. Such reimbursement by the Medical Service shall be subject to the condition that access has not already been granted for the same data.

5. Subject to Articles 3 to 5 of this Decision, the Commission may restrict, on a case-by-case basis and in accordance with Article 25(1)(h) of Regulation (EU) 2018/1725, data subjects' right to access their personal medical data in its possession where the exercise of that right would adversely affect the rights and freedoms of the data subject or other data subjects.

Article 3

Right of access by data subjects

1. Where the Commission restricts, wholly or partly, the right of access to personal medical data by data subjects, as referred to in Article 17 of Regulation (EU) 2018/1725, it shall inform the data subject concerned, in writing, in its reply to the request for access without undue delay of the restriction applied and of the principal reasons therefor. The Commission will also inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking judicial remedy in the Court of Justice of the European Union.

2. The provision of information concerning the reasons for the restriction referred to in paragraph 1 may be deferred, omitted or denied for as long as it would undermine the purpose of the restriction.

3. The Commission shall record the reasons for the restriction in accordance with Article 5.

4. Where the right of access is wholly or partly restricted, the data subject shall exercise his or her right of access through the intermediary of the European Data Protection Supervisor, in accordance with Article 25(6), (7) and (8) of Regulation (EU) 2018/1725.

Article 4

Recording and registering of restrictions

1. The Commission shall record the reasons for any restriction applied pursuant to this Decision, including an assessment of the necessity and proportionality of the restriction, taking into account the relevant elements in Article 25(2) of Regulation (EU) 2018/1725.

To that end, the record shall state how the exercise of the right would present a risk for the data subject's health or would adversely affect the rights and freedoms of other data subjects.

2. The record and, where applicable, the documents containing the underlying factual and legal elements shall be registered in the relevant medical file.

Article 5

Duration of restrictions

1. Restrictions referred to in Articles 2 shall continue to apply as long as the reasons justifying them remain applicable.

2. Where the reasons for a restriction no longer apply and the data subject has asked again for access to the personal medical data concerned, the Commission shall lift the restriction and provide the principal reasons for the restriction to the data subject. At the same time, the Commission shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor at any time or of seeking a judicial remedy in the Court of Justice of the European Union.

Article 6

Review by the Data Protection Officer of the European Commission

1. The Data Protection Officer shall be informed, without undue delay, whenever data subjects' rights are restricted in accordance with this Decision. Upon request, the Data Protection Officer shall be provided with access to the record and any documents containing underlying factual and legal elements.

2. The Data Protection Officer may request a review of the restriction. The Data Protection Officer shall be informed in writing of the outcome of the requested review.

Article 7

Entry into force

This Decision shall enter into force on the day of its publication in the

Official Journal of the European Union

It shall apply from 11 December 2018.

Done at Brussels, 30 January 2019.

For the Commission

The President

Jean-Claude JUNCKER

(1) That conclusion was approved by the Heads of Administration at their 236th meeting on 19 February 2004.

(2) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002 (

OJ L 295, 21.11.2018, p. 39

(3) Common Commission-level retention list for European Commission files SEC(2007) 970 of 4 July 2007 updated and completed by SEC(2012) 713 of 17 December 2012.

(4) Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (

OJ L 8, 12.1.2001, p. 1

(5) Commission Decision C(2007) 3195 of 2 July 2007 laying down General Implementing Provisions for the reimbursement of medical expenses.