1. The EBA shall publish on its website data protection records that inform all data subjects of its activities involving processing of personal data, including information relating to the potential restriction of data subject rights pursuant to Article 3 of this Decision. The information shall cover which rights may be restricted, the grounds on which restrictions may be applied, and their potential duration.
2. The EBA shall individually notify all data subjects, whom it considers persons concerned by the investigation or inquiry, of the data protection record of the specific processing operations concerned, without undue delay and in a written form.
3. In duly justified cases and under the conditions stipulated in this decision, the EBA may restrict, wholly or partly, the provision of information to the data subjects referred to in paragraph 2. In this case, it shall document in an internal note the reasons for the restriction, the legal ground in accordance with Article 3 of this Decision, including an assessment of the necessity and proportionality of the restriction.
4. The restriction referred to in paragraph 3 shall continue to apply as long as the reasons justifying it remain applicable. Where the reasons for the restriction no longer apply, the EBA shall notify the data subject concerned of the relevant data protection record and the principal reasons for the restriction. This notification can be combined with an invitation to make submission on the findings of the investigation or inquiry underway, as part of the exercise of the rights of defence of the data subject concerned. At the same time, the EBA shall inform the data subject concerned of the right of lodging a complaint with the European Data Protection Supervisor at any time or of seeking a judicial remedy in the Court of Justice of the European Union. The EBA shall review the application of the restriction every six months from its adoption and at the closure of the relevant inquiry or investigation.