1. The safeguards in place to prevent abuse or unlawful access or transfer in the context of the investigations referred to in Article 1 are the following:
paper documents shall be kept in locked cupboards which are only accessible to authorized staff members on a need-to know basis. The security system of the premises, internal record management policies, staff training and audits shall also be in place to ensure proper safeguards;
electronic files shall be managed with the EBA’s approved devices, information systems, applications and storage media resources. The data shall be stored in a secure electronic environment which is designed and maintained to prevent accidental or unlawful destruction, loss, alteration, transfer, unauthorized disclosure of, or access to, personal data to internal and external partners who are not authorized to have access to such data. The EBA’s document management system applications shall be used to organise, find, share, maintain and protect the EBA’s electronic data. Authorised EBA staff shall only be granted access to electronic data based on a need to know basis;
databases and electronic files shall be password-protected under a single sign-on system and connected automatically to the user’s ID and password. Replacing users is strictly prohibited. Electronic records shall be held securely to safeguard the confidentiality and privacy of the data therein;
all persons having access to the data shall be bound by the obligation of confidentiality and shall sign a document acknowledging that obligation and the requirements set out in this paragraph.
2. The Controller of the processing operations is the EBA, represented by its Executive Director. Data subjects shall be informed of the delegated controller by way of the data protection records published on the website of the EBA.
3. The retention period of the personal data processed shall be no longer than necessary and appropriate for the purposes for which the data are processed. The retention period shall be specified in the data protection records and privacy statements referred to in Article 5(1).
4. Where the EBA considers applying a restriction, the risk to the rights and freedoms of the data subject shall be weighed, in particular, against the risk to the rights and freedoms of other data subjects and the risk of cancelling the effect of the EBA’s investigations or procedures for example by destroying evidence. The risks to the rights and freedoms of the data subject concern primarily, but are not limited to, reputational risks and risks to the right of defence and the right to be heard.