1. Further to a data subject request, the EBA may restrict, wholly or partly, the right of this data subject to obtain confirmation as to whether or not personal data concerning him or her are being processed by the EBA in the context of an investigation or inquiry referred to in Article 1 of this Decision, and where that is the case, the right of access to this data and other information referred to in Article 17 of Regulation (EU) 2018/1725.
2. Where the EBA restricts the right of access, it shall inform the data subject concerned, in its reply to the request, of the restriction applied and of the principal reasons thereof, and of the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking a judicial remedy in the Court of Justice of the European Union.
3. The provision of information referred to in paragraph 2 may be deferred, omitted or denied if it would cancel the effect of the restriction imposed in accordance with Article 25(8) of Regulation (EU) 2018/1725. Where this is the case, the EBA shall document in an internal assessment note the reasons for the restriction, including an assessment of the necessity, proportionality of the restriction and its duration.
4. The EBA shall review the application of the restriction every six months from its adoption and at the closure of the relevant inquiry or investigation.