1. The EBA shall communicate a personal data breach to the data subject concerned without undue delay when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons as provided for in Article 35 of Regulation (EU) 2018/1725.
2. In duly justified cases and under the conditions stipulated in this decision, the EBA may restrict, wholly or partly, the provision of information to the data subjects referred to in paragraph 1 of this Article. In this case, it shall document in an internal note the reasons for the restriction, the legal ground in accordance with Article 3 of this Decision, including an assessment of the necessity and proportionality of the restriction.
3. The restriction referred to in paragraph 2 shall continue to apply as long as the reasons justifying it remain applicable. Where the reasons for the restriction no longer apply, the EBA shall communicate the personal data breach to the data subject concerned and inform the data subject of the principal reasons for the restriction. At the same time, the EBA shall inform the data subject concerned of the right of lodging a complaint with the European Data Protection Supervisor at any time or of seeking a judicial remedy in the Court of Justice of the European Union. The EBA shall review the application of the restriction every six months from its adoption and at the closure of the relevant inquiry or investigation.