Decision of the Management Board of the European Union Agency for Cybersecurity of 21 November 2019 on internal rules concerning restrictions of certain rights of data subjects in relation to processing of personal data in the framework of the functioning of ENISA