22.9.2012   

EN

Official Journal of the European Union

C 286/16

(1)

Regulation (EC) No 45/2001 sets out principles and rules applicable to all European Union institutions and bodies and provides for the appointment by each Union institution and body of a data protection officer (DPO).

(2)

Pursuant to Article 24(8) of Regulation (EC) No 45/2001, each Union institution or body must adopt further implementing rules concerning the DPO in accordance with the Annex to that Regulation.

(3)

It is appropriate to include provisions relating to controllers and data protection coordinators, whose tasks and duties relate to those of the DPO, and to the regulation of data subjects’ rights,

(a)

the appointment and status of the European Systemic Risk Board’s (ESRB’s) DPO, as well as to the tasks, duties and powers of the DPO;

(b)

the roles, tasks and duties of controllers and data protection coordinators;

(c)

the exercise of rights by data subjects.

(a)

‘controller’ means a manager responsible for an organisational unit that determines the purposes and means of the processing of personal data;

(b)

‘data protection coordinator’ means a staff member who assists a controller in fulfilling the latter’s data protection obligations. This person shall be a specialist in record management.

(a)

appoint a DPO who is sufficiently senior to meet the requirements of Article 24 of Regulation (EC) No 45/2001;

(b)

set a term of office for the DPO of between two and five years.

(a)

when an issue arises that has, or might have, data protection implications; and

(b)

in respect of all contacts between the ESRB and external parties relating to the application of Regulation (EC) No 45/2001, notably any interaction with the EDPS.

(a)

raise awareness concerning data protection issues and encourage a culture of protection of personal data within the ESRB;

(b)

advise the General Board, the Steering Committee, the Secretariat, the controller and the data protection coordinator on matters concerning the application of data protection provisions at the ESRB. The DPO may be consulted by the General Board, the Steering Committee, the Secretariat, the controller concerned or any individual on any matter concerning the interpretation or application of Regulation (EC) No 45/2001;

(c)

cooperate with the EDPS at the latter’s request or on their own initiative and respond to requests that the EDPS addresses to the ESRB DPO;

(d)

determine whether a processing operation is likely to present specific risks in the sense of Article 27 of Regulation (EC) No 45/2001 and is thus subject to prior checking. The DPO shall consult the controller concerned if necessary. In case of doubt as to the need for prior checking the EDPS shall be consulted, in accordance with Article 27(3) of Regulation (EC) No 45/2001;

(e)

at the request of the General Board, the Steering Committee, the Secretariat or any individual, or on their own initiative, investigate matters and occurrences directly relating to DPO tasks and duties and report back to the requester. The DPO shall consider issues and facts impartially and with due regard to the data subject’s rights. If the DPO deems it appropriate, they shall inform all other parties concerned accordingly. If the requester is an individual or acts on behalf of an individual, the DPO shall, to the extent possible, ensure that the request remains confidential, unless the data subject concerned gives their unambiguous consent to treating the request otherwise;

(f)

cooperate with the DPOs of other Union institutions and bodies, in particular by exchanging experience and sharing know-how and representing the ESRB in all discussions — excluding court cases — relating to data protection issues; and

(g)

submit an annual work programme and an annual report of DPO activities to the General Board and the EDPS.

(a)

request an opinion from the ESRB Secretariat on any matter relating to DPO tasks and duties;

(b)

issue an opinion on the lawfulness of current or proposed processing operations or on any issue concerning the notification of processing operations;

(c)

bring to the attention of the Head of the ESRB Secretariat any failure of staff to comply with the obligations under Regulation (EC) No 45/2001;

(d)

have access at all times to the data forming the subject matter of processing operations on personal data and to all offices, data-processing installations and data carriers;

(e)

be involved whenever the ESRB draws up internal rules related to the protection of personal data;

(f)

keep an anonymous list of the written requests from data subjects relating to the exercise of their rights; and

(g)

carry out the other tasks specified in the Annex to Regulation (EC) No 45/2001.

(a)

the data protection coordinators shall assist the controllers in fulfilling their obligations, either at the controllers’ request or on their own initiative. When doing so, the data protection coordinators shall liaise with the controllers’ staff, who shall provide them with all necessary information. This may, at the relevant controller’s discretion, include accessing personal data processed under that controller’s responsibility;

(b)

the data protection coordinators shall assist the DPO in:

(a)

these rights may only be exercised by the data subject or their duly authorised representative. Such persons may exercise any of these rights free of charge;

(b)

requests to exercise these rights shall be addressed in writing to the relevant controller. The controller shall only grant the request if the requester’s identity and, if relevant, their entitlement to represent the data subject have been appropriately verified. The controller shall without delay inform the data subject in writing of whether or not the request has been accepted. If the request has been rejected, the controller shall include the grounds for the rejection;

(c)

the controller shall, at any time within three calendar months of receipt of the request, grant access pursuant to Article 13 of Regulation (EC) No 45/2001 by enabling the data subject to consult these data on-site or to receive a copy thereof, according to the applicant’s preference;

(d)

data subjects may contact the DPO in the event that the controller does not respect either of the time limits in paragraphs (b) or (c). In the event of obvious abuse by a data subject in exercising their rights, the controller may refer the data subject to the DPO. If the case is referred to the DPO, the DPO shall decide on the merits of the request and the appropriate follow-up. In the event of disagreement between the data subject and the controller, both parties shall have the right to consult the DPO.