Commission Decision (EU) 2026/1447

Contents

THE EUROPEAN COMMISSION,Having regard to the Treaty on the Functioning of the European Union,Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC^note, and in particular Article 25 thereof,Whereas:

(1)Regulation (EU) 2022/2560 of the European Parliament and of the Council^note empowers the Commission to collect information for investigation, enforcement, and monitoring purposes through several means, such as requests for information, inspections, conducting interviews. Moreover, Regulation (EU) 2022/2560 obliges undertakings and economic operators to notify to the Commission concentrations and public procurement procedures involving foreign financial contributions provided certain thresholds are met. Effective investigation, enforcement and monitoring under Regulation (EU) 2022/2560 requires cooperation between the Member States and the Commission, as well as a seamless exchange of information between the Member States and the Commission.

(2)The tasks under Regulation (EU) 2022/2560 are carried out by the Directorate-General responsible for Competition and by the Directorate-General responsible for Internal Market, Industry, Entrepreneurship and SMEs.

(3)In the context of the investigation, enforcement, and monitoring tasks pursuant to Regulation (EU) 2022/2560, the Commission processes information. That information includes personal data of natural persons, such as informants, staff of the undertakings under investigation, as well as natural persons whose personal data is contained in documents obtained in connection with investigation, enforcement and monitoring activities in accordance with Regulation (EU) 2022/2560.

(4)Personal data processing, within the meaning of Article 3(3) of Regulation (EU) 2018/1725, carried out in the course of investigation, enforcement and monitoring activities under Regulation (EU) 2022/2560, may take place even before the Commission formally initiates the preliminary review, continue throughout the in-depth investigation and may continue even after the formal closure of the investigation, for example, for compliance monitoring or screening activities, assessing the need for initiating new investigative activities or legal proceedings.

(5)In order to fulfil its tasks under Regulation (EU) 2022/2560, the Commission as data controller collects and further processes several categories of personal data, such as identification data, contact details and other case-related information (such as personal data contained in documents, statements, opinions and records). Although unlikely, the categories of personal data processed might also include special categories of personal data as referred to in Article 10(1) of Regulation (EU) 2018/1725, as well as personal data relating to criminal convictions and offences as referred to in Article 11 of Regulation (EU) 2018/1725.

(6)While carrying out its tasks under Regulation (EU) 2022/2560, the Commission is bound to respect the rights of natural persons in relation to the processing of personal data recognised by Article 8(1) of the Charter of Fundamental Rights of the European Union and by Article 16(1) of the Treaty on the Functioning of the European Union, as well as the requirements of Regulation (EU) 2018/1725. At the same time, the Commission, in the context of its activities under Regulation (EU) 2022/2560, is required to comply with strict rules of confidentiality and professional secrecy referred to in Article 43 of that Regulation.

(7)In certain circumstances, it might be necessary to reconcile the rights of data subjects pursuant to Regulation (EU) 2018/1725 with the need to ensure that the Commission can effectively carry out its tasks of investigation, enforcement and monitoring pursuant to Regulation (EU) 2022/2560, including in cooperation with competent authorities of the Member States, or the fundamental rights and freedoms of other data subjects. To that effect, Article 25(1) of Regulation (EU) 2018/1725 provides the Commission with the possibility to restrict, under strict conditions, the application of Articles 14 to 22, 35 and 36 of Regulation (EU) 2018/1725, as well as its Article 4, insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 22 of Regulation (EU) 2018/1725.

(8)In certain circumstances, it is necessary to reconcile the rights of data subjects with the need to safeguard the investigation, enforcement and monitoring conducted by the Commission under Regulation (EU) 2022/2560 in the exercise of its official authority in the public interest of the Union pursuant to Article 25(1), point (g), in conjunction with point (c), of Regulation (EU) 2018/1725. The Commission might apply restrictions, where for instance, exercising those rights would jeopardise an ongoing investigation, for instance where there is a risk of evidence being destroyed or tampered with, or a risk of interference with key actors during an investigation.

(9)In certain circumstances, it is necessary to balance the rights of data subjects against the fundamental rights and freedoms of other persons concerned, such as informants or any other natural person who has reported to the Commission in the context of its investigation, enforcement and monitoring activities pursuant to Regulation (EU) 2022/2560. In such cases, the Commission may need to restrict access to the identity, statements and other personal data of such persons, in order to protect the rights and freedoms of all concerned pursuant to Article 25(1), point (h), of Regulation (EU) 2018/1725. The Commission may decide to do so, in particular to protect those persons against possible retaliation. Only if the reporting person so authorises, the Commission may reveal their identity. If required by law or a judicial authority, the Commission is to reveal their identity.

(10)In cases where data subjects submit a request to access their personal data, they should be given access to such personal data including that provided by a reporting person. To protect the reporting persons’ confidentiality and ensure that their rights are not adversely affected, the Commission should be allowed not to provide the data subject with the name of the reporting person, as well as any other information that would allow their direct or indirect identification.

(11)In addition, in order to carry out its tasks to ensure the effective application of Regulation (EU) 2022/2560, in particular in the context of cooperation between the Commission and competent authorities in the Member States, the Commission may restrict the application of data subjects’ rights to safeguard the exercise of its official authority in the public interest, as referred to in Article 25(1), point (g), in conjunction with point (c), of Regulation (EU) 2018/1725. The Commission may do so in a situation where the purpose of a restriction imposed by a Member State authority would be jeopardised were the Commission not to apply an equivalent restriction in respect of the same personal data. In the application of such a restriction the Commission should consult the Member State concerned on the relevant potential grounds for imposing restrictions and the necessity and proportionality of those restrictions, unless that would jeopardise the activities of the Commission.

(12)When restricting data subjects’ rights, the Commission should make sure that such restrictions respect the essence of fundamental rights and freedoms, are strictly necessary and are a proportionate measure in a democratic society. The Commission should provide a justification for the applicable restrictions.

(13)Article 25(6) of Regulation (EU) 2018/1725 requires the controller to inform data subjects of the principal reasons on which the application of the restriction is based and of their right to submit a complaint to the European Data Protection Supervisor.

(14)Pursuant to Article 25(8) of Regulation (EU) 2018/1725, the Commission may defer, omit, or deny informing the data subject about the principal reasons for the application of a restriction if providing that information would in any way cancel the effect of the restriction. The Commission should assess on a case-by-case basis whether the communication of the restriction and its reasons would cancel its effect.

(15)The Commission should lift the restriction as soon as the conditions that justify the restriction no longer apply and assess those conditions on a regular basis.

(16)In order to comply with Articles 14, 15 and 16 of Regulation (EU) 2018/1725, the Commission should inform all data subjects of its activities involving the processing of their personal data and of their rights, in a transparent and coherent manner, by means of a data protection notice published on the Commission’s website. The Commission should individually inform, by appropriate means, legal representatives and staff members of undertakings under investigation, informants and other natural persons providing information to the Commission about the processing of their personal data.

(17)Article 16(5) of Regulation (EU) 2018/1725 provides for exceptions to data subjects’ right to information where personal data is not obtained from the data subjects. If those exceptions apply, the Commission does not need to apply a restriction to the right to information under this Decision. Exceptions under Article 16(5), point (b), of Regulation (EU) 2018/1725 are to be applicable where the provision of information referred to in Article 16(1) to (4) of that Regulation would prove impossible, would involve a disproportionate effort or would be likely to render impossible or seriously impair the achievement of the objectives of that processing, such as in cases of data subjects not relevant to the investigation, whose personal information is contained in documents collected as part of the investigation, enforcement and monitoring pursuant to Regulation (EU) 2022/2560.

(18)In accordance with the principles of transparency, fairness and accountability, the Commission should handle all exceptions and restrictions in a transparent manner and keep a record of its application of those exceptions and restrictions.

(19)In order to guarantee the protection of the rights and freedoms of data subjects and in accordance with Article 44(1) of Regulation (EU) 2018/1725, the Commission should involve the Data Protection Coordinator of the Directorate-General responsible for Competition or of the Directorate-General responsible for Internal Market, Industry, Entrepreneurship and SMEs throughout the process of applying restrictions and document that consultation. In particular, the responsible Data Protection Coordinator should be consulted in due time on any restrictions that may be applied and verify their compliance with this Decision.

(20)The Data Protection Officer of the Commission should carry out an independent review of the application of restrictions, with a view to ensuring compliance with this Decision.

(21)The European Data Protection Supervisor was consulted in accordance with Article 41(2) of Regulation (EU) 2018/1725 and delivered an opinion on 16 April 2026,

HAS ADOPTED THIS DECISION: