1.Any request for an investigation under point (b) of Article 4 shall be addressed to the DPO in writing.
2.Within seven working days of receiving the request referred to in paragraph 1, the DPO shall send an acknowledgement of receipt to the requester.
3.The DPO may investigate the matter that is the subject of the request on-site and request a written statement from a controller. The relevant controller shall reply to the DPO within 20 working days of receiving the DPO’s request. The DPO may ask for additional information or assistance from any ECB business area at any time. That business area shall provide such additional information or assistance within 20 working days of the DPO’s request.
4.The DPO shall consider the issues and facts relating to the investigation impartially and with due regard to the data subjects’ rights. If deemed appropriate and subject to paragraph 5, the DPO shall inform all other parties concerned of the investigation.
5.The DPO shall ensure that the request remains confidential and is only disclosed to the extent necessary for the purposes of the investigation, unless the data subject concerned gives its consent for the request not to remain confidential.
6.The DPO shall report back to the requester no later than three calendar months following the receipt of the request.