Decision (EU) 2024/901 of the European Central Bank of 12 March 2024 amending Decision (EU) 2022/2359 adopting internal rules concerning restrictions of rights of data subjects in connection with the European Central Bank’s internal functioning (ECB/2022/42)(ECB/2024/9)

‘4 A decision to restrict the rights of a data subject pursuant to paragraph 1 that is to be taken by the controller shall be made at the level of the relevant business area head in whose business area the main processing operation involving the personal data is carried out. If such main processing operation is carried out by a function that is not part of a business area, such a decision shall be made at the level of the holder of the function.’

‘5 For the purposes of paragraph 4, where the relevant business area head is unavailable due to absence, or has an actual or perceived conflict of interest, or has access to relevant confidential information, a decision to restrict the rights of a data subject pursuant to paragraph 1 that is to be taken by the controller shall be made by the deputy head of the business area in which the main processing operation involving the personal data is carried out. Where there is no such deputy head, such a decision shall be made by the line manager competent to do so in the case of absence, conflict of interest or access to relevant confidential information of the relevant business area head.’

This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.