1. Further to a data subject request, ESMA may restricts, wholly or partly, the right of this data subject to obtain confirmation as to whether or not personal data concerning him or her are being processed by ESMA in the context of an investigation or inquiry referred to in Article 1 of this Decision, and where that is the case, the right of access to this data and other information referred to in Article 17 of Regulation (EU) 2018/1725.
2. Where ESMA restricts the right of access, it shall inform the data subject concerned, in its reply to the request, of the restriction applied and of the principal reasons thereof, and of the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking a judicial remedy in the Court of Justice of the European Union.
3. The provision of information referred to in paragraph 2 may be deferred, omitted or denied if it would cancel the effect of the restriction in accordance with Article 25(8) of Regulation (EU) 2018/1725. Where this is the case, ESMA shall document in an internal assessment note the reasons for the restriction, including an assessment of the necessity, proportionality of the restriction and its duration.
4. ESMA shall review the application of the restriction every six months from its adoption and at the closure of the relevant inquiry or investigation.