1. This Decision lays down internal rules relating to the conditions under which the EBA in the framework of the activities set out in paragraphs 2 to 5 may restrict the application of the rights enshrined in Articles 14 to 21, and 35, as well as Article 4 thereof, following Article 25 of Regulation (EU) 2018/1725. These restrictions are without prejudice to the exemptions to data subject rights provided in Regulation (EU) 2018/1725.
2. Within the framework of the administrative functioning of the EBA, the restrictions foreseen in paragraph 1 apply to the processing of personal data by the EBA for the purpose of:
administrative inquiries and disciplinary proceedings, in accordance with Article 25(1) point (f) of Regulation (EU) 2018/1725;
processing irregularities in liaison with the European Anti-Fraud Office (OLAF), in accordance with Article 25(1) points (b) or (f) of Regulation (EU) 2018/1725;
processing whistleblowing cases, (formal and informal) harassment cases as well as internal and external complaints, in accordance with Article 25(1) point (f) of Regulation (EU) 2018/1725;
internal audits, ethics investigations, inquiries, proceedings and investigations performed by the Data Protection Officer (‘the DPO’) in line with Article 25(1) points (f) or (g) or Article 45(2) of Regulation (EU) 2018/1725;
ICT investigations, information security investigations and activities performed in the context of security risks and incidents management, handled internally or with external involvement, in accordance with Article 25(1) point (d) of the Regulation (EU) 2018/1725.
3. Within the exercise of the EBA’s missions, the restrictions foreseen in paragraph 1 apply to the processing of personal data by the EBA for the purpose of any of the following:
investigations of potential breaches of Union law pursuant to Article 17 of Regulation (EU) No 1093/2010;
inquiries and proceedings related to consumer protection and financial activities in order to assess potential threats to the integrity of financial markets or the stability of the financial system in the Union pursuant to Articles 9 and 22 of Regulation (EU) No 1093/2010;
proceedings related to the settlement of disagreements between competent authorities pursuant to Article 19 of Regulation (EU) No 1093/2010 and legislative acts referred to in Article 1(2) of that Regulation;
proceedings related to non-binding mediation carried out by the EBA pursuant to Article 31(2)(c) of Regulation (EU) No 1093/2010 and legislative acts referred to in Article 1(2) of that Regulation (EU);
investigations related to the prevention and countering of money laundering and of terrorist financing pursuant to Article 9b of Regulation (EU) No 1093/2010 and legislative acts referred to in Article 1(2) of that Regulation.
4. In addition, these restrictions apply to assistance, coordination and/or cooperation provided by the EBA to competent authorities as defined in Article 4 point (2) of Regulation (EU) No 1093/2010, including third country authorities, and international organisations in the context of the investigations conducted for the exercise of their statutory missions.
5. The restrictions referred to in paragraph 1 also apply to processing operations carried out prior to the opening of the investigations or other administrative enquiries referred to in paragraphs 2 to 4, during these investigations and during the monitoring of the follow-up to the outcome of these investigations.
6. This Decision applies to any category of personal data processed in the context of the activities set out in paragraphs 2 to 5.
7. Subject to the conditions set out in this Decision the restrictions may apply to the following rights: provision of information to data subjects, right of access, rectification, erasure, restriction of processing and communication of a personal data breach to the data subject.