1. In duly justified cases and under the conditions stipulated in this decision, the right to information may be restricted by the controller in the context of the following processing operations:
the performance of administrative inquiries and disciplinary proceedings;
preliminary activities related to cases of potential irregularities reported to OLAF;
whistleblowing procedures;
(formal and informal) procedures for cases of harassment;
processing internal and external complaints;
internal audits;
the investigations carried out by the DPO in line with Article 45(2) of Regulation (EU) 2018/1725;
(IT) security investigations handled internally or with external involvement (e.g. CERT-EU).
EIOPA shall include in the data protection notices, privacy statements or records in the sense of Article 31 of Regulation (EU) 2018/1725, published on its website and/or on the intranet informing data subjects of their rights in the framework of a given procedure, information relating to the potential restriction of these rights. The information shall cover which rights may be restricted, the reasons and the potential duration.
2. Without prejudice to the provisions of paragraph 3, EIOPA, where proportionate, shall also inform individually all data subjects, which are considered persons concerned in the specific processing operation, of their rights concerning present or future restrictions without undue delay and in a written form.
3. Where EIOPA restricts, wholly or partly, the provision of information to the data subjects referred to in paragraph 2, it shall record the reasons for the restriction, the legal ground in accordance with Article 3 of this Decision, including an assessment of the necessity and proportionality of the restriction.
4. The record and, where applicable, the documents containing underlying factual and legal elements shall be registered. They shall be made available to the EDPS on request.
5. The restriction referred to in paragraph 3 shall continue to apply as long as the reasons justifying it remain applicable.
6. Where the reasons for the restriction no longer apply, EIOPA shall provide information to the data subject on the principal reasons on which the application of a restriction is based. At the same time, EIOPA shall inform the data subject of the right of lodging a complaint with the EDPS at any time or of seeking a judicial remedy in the Court of Justice of the European Union.
7. EIOPA shall review the application of the restriction every six months from its adoption and at the closure of the relevant inquiry, procedure or investigation. Thereafter, the controller shall monitor the need to maintain any restriction every six months.