1. This Decision lays down internal rules relating to the conditions under which ESMA in the framework of the activities set out in paragraphs 2 to 5 may restrict the application of the rights enshrined in Articles 14 to 21, and 35, as well as Article 4 thereof, following Article 25 of the Regulation (EU) 2018/1725. These restrictions are without prejudice to the exemptions to data subject rights provided in Regulation (EU) 2018/1725.
2. Within the framework of the administrative functioning of ESMA, the restrictions foreseen in point 1 of this Article apply to the processing of personal data by ESMA for the purpose of:
administrative inquiries and disciplinary proceedings;
processing irregularities in liaison with the European Anti-Fraud Office (OLAF);
processing whistleblowing cases, (formal and informal) harassment cases as well as internal and external complaints;
internal audits, data protection or ethics investigations;
ICT investigations, information security investigations and activities performed in the context of security risks and incidents management, handled internally or with external involvement.
3. Within the exercise of ESMA’s missions, the restrictions foreseen in point 1 of this Article apply to the processing of personal data by ESMA for the purpose of:
investigations relating to ESMA’s direct supervisory and enforcement functions;
investigations of potential breaches of Union law under Article 17 of ESMA Regulation; and
inquiries into a particular type of financial activity or type of product or type of conduct in order to assess potential threats to the integrity of financial markets or the stability of the financial system under Article 22 of the ESMA Regulation.
4. In addition, these restrictions apply to assistance, coordination and/or cooperation provided by ESMA to national securities and markets authorities, including third country authorities, and international organisations in the context of the investigations conducted for the exercise of their statutory missions.
5. The restrictions referred to in paragraph 1 of this Article also apply to processing operations carried out prior to the opening of the investigations or other administrative enquiries referred to in paragraphs 2 to 4 above, during these investigations and during the monitoring of the follow-up to the outcome of these investigations.
6. This Decision applies to any category of personal data processed in the context of the activities set out in paragraphs 2 to 5 above.
7. Subject to the conditions set out in this Decision the restrictions may apply to the following rights: provision of information to data subjects, right of access, rectification, erasure, restriction of processing and communication of a personal data breach to the data subject.