1. Pursuant to Article 25(1) of Regulation (EU) 2018/1725, any restriction shall only be applied by the EBA to safeguard:
the prevention, investigation, detection and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, in particular in relation to the processing operations under Article 1(2) point (b) of this Decision;
other important objectives of general public interest of the Union or of a Member State, in particular the objectives of the common foreign and security policy of the Union or an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters, public health and social security in particular in relation to the processing operations under Article 1(3) of this Decision;
the internal security of Union institutions and bodies, including of their electronic communications networks, in particular in relation to the processing operation under Article 1(2) point (c) of this Decision;
the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions, in particular in relation to the processing operations under Article 1(2) points (a) and (c) of this Decision;
a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) and (b), in particular in relation to the processing operations under Article 1(2) point (d) of this Decision;
the protection of the data subject or the rights and freedoms of others.
2. As a specific application of the purposes described in paragraph 1 above, the EBA may apply restrictions in relation to personal data exchanged with Commission services or other Union institutions, bodies, agencies and offices, competent authorities of Member States or third countries or international organisations, if one or more of the following circumstances occurs:
where the exercise of those rights and obligations could be restricted by Commission services or other Union institutions, bodies, agencies and offices on the basis of other acts provided for in Article 25 of Regulation (EU) 2018/1725 or in accordance with Chapter IX of that Regulation or with the founding acts of other Union institutions, bodies, agencies and offices;
where the exercise of those rights and obligations could be restricted by competent authorities of Member States on the basis of acts referred to in Article 23 of Regulation (EU) 2016/679 of the European Parliament and of the Council, or under national measures transposing Articles 13(3), 15(3) or 16(3) of Directive (EU) 2016/680 of the European Parliament and of the Council;
where the exercise of those rights and obligations would jeopardise the EBA’s cooperation with third country or international organisations in the conduct of its tasks or of the tasks of the third country or international organisations.
Before applying restrictions in the circumstances referred to in points (a) and (b) of the first subparagraph, the EBA shall consult the relevant Commission services, Union institutions, bodies, agencies, offices or the competent authorities of Member States unless it is clear to the EBA that the application of a restriction is provided for by one of the acts referred to in those points.
3. Any restriction shall be necessary and proportionate taking into account the risks to the rights and freedoms of data subjects and respect the essence of the fundamental rights and freedoms in a democratic society.
4. If the application of restriction is considered, a necessity and proportionality test shall be carried out based on the present rules. It shall be documented through an internal assessment note for accountability purposes on a case by case basis.
5. Restrictions shall be lifted as soon as the circumstances that justify them no longer apply. In particular, where it is considered that the exercise of the restricted right would no longer cancel the effect of the restriction imposed or adversely affect the rights or freedoms of other data subjects.