1. The safeguards in place to avoid personal data breaches, leakages or unauthorised disclosure in the context of the investigations referred to in Article 1 are the following:
Paper documents shall be kept in secured cupboards and only accessible to authorized staff;
All electronic data shall be managed with ESMA’s approved devices, information systems, applications and storage media resources. ESMA’s document management system applications shall be used to organise, find, share, maintain and protect ESMA’s electronic data. Authorised ESMA’s staff shall only be granted access to electronic data based on a need to know basis;
All persons having access to the data are bound by the obligation of confidentiality.
2. The Controller of the processing operations is ESMA, represented by its Executive Director, who may delegate the function of the controller. Data subjects shall be informed of the delegated controller by way of the data protection records published on the website of ESMA.
3. The retention period of the personal data processed shall be no longer than necessary and appropriate for the purposes for which the data are processed. The retention period shall be specified in the data protection records and privacy statements referred to in Article 5(1).
4. Where ESMA considers to apply a restriction, the risk to the rights and freedoms of the data subject shall be weighed, in particular, against the risk to the rights and freedoms of other data subjects and the risk of cancelling the effect of ESMA’s investigations or procedures for example by destroying evidence. The risks to the rights and freedoms of the data subject concern primarily, but are not limited to, reputational risks and risks to the right of defence and the right to be heard.