1. The safeguards in place to avoid data breaches, leakages or unauthorised disclosure are the following:
Paper documents shall be kept in secured cupboards and only accessible to authorized staff;
All electronic data shall be stored in a secure IT application according to EIOPA's security standards, as well as in specific electronic folders accessible only to authorised staff. Appropriate levels of access shall be granted individually;
The database shall be password-protected under a single sign-on system and connected automatically to the user's ID and password. Replacing users is strictly prohibited. E-records shall be held securely to safeguard the confidentiality and privacy of the data therein;
All persons having access to the data are bound by the obligation of confidentiality.
2. The controller of the processing operations is EIOPA, represented by its Executive Director, who may delegate the function of the controller. Data subjects shall be informed of the delegated controller by way of the data protection notices or records published on the website and/or the intranet of EIOPA.
3. The retention period of the personal data referred to in Article 1(3) shall be no longer than necessary and appropriate for the purposes for which the data are processed. It shall in any event not be longer than the retention period specified in the data protection notices, privacy statements or records referred to in Article 5(1).
4. Where EIOPA considers to apply a restriction, the risk to the rights and freedoms of the data subject shall be weighed, in particular, against the risk to the rights and freedoms of other data subjects and the risk of cancelling the effect of EIOPA's investigations or procedures for example by destroying evidence. The risks to the rights and freedoms of the data subject concern primarily, but are not limited to, reputational risks and risks to the right of defence and the right to be heard.