(1)

The European Central Bank (ECB) carries out its tasks in accordance with the Treaties and Council Regulation (EU) No 1024/2013 (2).

(2)

In accordance with Article 45(3) of Regulation (EU) 2018/1725, Decision (EU) 2020/655 of the European Central Bank (ECB/2020/28) (3) sets out the general rules implementing Regulation (EU) 2018/1725 as regards the ECB. In particular, it specifies the rules relating to the appointment and role of the data protection officer of the ECB (DPO), including the DPO’s tasks, duties and powers.

(3)

In exercising the tasks conferred on the ECB, the ECB and in particular the organisational unit concerned acts as data controller in so far as it determines, alone or jointly with others, the purposes and means of the processing of personal data.

(4)

Pursuant to Article 4(1) of Regulation (EU) No 1024/2013, the ECB is exclusively competent to carry out, for supervisory purposes, and with a view to ensuring the safety and soundness of credit institutions and the stability of the financial system, specific tasks in relation to all credit institutions established in the Member States participating in the Single Supervisory Mechanism (SSM).

(5)

In carrying out these specific tasks, the ECB processes several categories of information that may be related to an identified or identifiable natural person such as identification data, contact data, professional data, financial or administrative details, data received from specific sources, data on electronic communication and electronic traffic data, criminal records, a description of financial and non-financial interests, details of relationships of an individual or their close relatives to supervised entities or to members of the management body of supervised entities, and data relating to the position for which an individual has been or may be appointed. Personal data could also form part of an assessment including an assessment conducted: for the purposes of the authorisation of a credit institution, the withdrawal of the authorisation of a credit institution and a qualifying holding procedure; in relation to the right of establishment for a significant supervised entity; to determine whether fit and proper requirements are met; in relation to a significant supervised entity’s remuneration policies and regarding credits by such an entity to its own senior officials and persons related to these officials; and in relation to allegations related to potential breaches of the legal acts referred to in Article 4(3) of Regulation (EU) No 1024/2013.

(6)

The aim of the ECB in performing these specific tasks is to pursue important objectives of general public interest of the Union. For this reason, the performance of such tasks should be safeguarded as contemplated by Regulation (EU) 2018/1725, in particular by Article 25(1)(c) and (g) thereof. In particular in performing such tasks, the ECB acts in the general public interest of the Union as a public authority entrusted with carrying out, for supervisory purposes, specific tasks in relation to all credit institutions established in the Member States participating in the SSM. Such tasks include monitoring, inspection or regulatory functions connected with the exercise of official authority related to the prudential supervision of credit institutions.

(7)

In this context, it is appropriate to specify the grounds on which the ECB may restrict the rights of data subjects in relation to data obtained in the performance of its supervisory tasks pursuant to Regulation (EU) No 1024/2013.

(8)

In accordance with Article 25(1) of Regulation (EU) 2018/1725, restrictions of the application of Articles 14 to 22, 35 and 36 and, in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 22, Article 4 of that Regulation should be set out in internal rules or legal acts adopted on the basis of the Treaties. Accordingly, the ECB should set out the rules under which it may restrict the rights of data subjects in the performance of its supervisory tasks.

(9)

Whilst this Decision sets out the rules under which the ECB may restrict the rights of data subjects in the performance of its supervisory tasks, the Executive Board intends to adopt a separate decision adopting internal rules concerning the restriction of those rights when the ECB processes personal data in connection with its internal functioning.

(10)

The ECB may be able to apply an exception in accordance with Regulation (EU) 2018/1725 which makes the need to consider a restriction unnecessary including in particular those set out in Articles 15(4), 16(5), 19(3) and 35(3) of that Regulation. For processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, the ECB may be able to apply an exception set out in point (b) of Article 16(5) or point (d) of Article 19(3) of Regulation (EU) 2018/1725.

(11)

The exercise of the rights of data subjects referred to in Articles 17, 18, 20, 21, 22 and 23 of Regulation (EU) 2018/1725 may render impossible or seriously impair the achievement of certain purposes including, as applicable, archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. Therefore this Decision should provide for a derogation from those rights in accordance with Article 25(3) or (4) of Regulation (EU) 2018/1725, subject to appropriate safeguards.

(12)

The ECB should justify why such restrictions of data subjects’ rights are strictly necessary and proportionate in a democratic society to safeguard the objectives pursued in the exercise of its official authority and the functions connected to it, and how the ECB respects the essence of fundamental rights and freedoms whilst imposing any such restriction.

(13)

Within this framework the ECB is bound to respect, to the maximum extent possible, the fundamental rights of data subjects, in particular those relating to the right of provision of information, access and rectification, right to erasure, restriction of processing, right of communication of a personal data breach to the data subject or confidentiality of communication as provided for in Regulation (EU) 2018/1725.

(14)

However, the ECB may be obliged to restrict the information provided to data subjects and the rights of data subjects to protect the performance of its supervisory tasks, in particular its own investigations and procedures, the investigations and procedures of other public authorities and the fundamental rights and freedoms of other persons related to its investigations or other procedures.

(15)

The ECB should lift a restriction which has already been applied to the extent it is no longer needed.

(16)

The ECB’s DPO should review the application of restrictions with a view to ensuring compliance with this Decision and with Regulation (EU) 2018/1725.

(17)

The European Data Protection Supervisor was consulted in accordance with Article 41(2) of Regulation (EU) 2018/1725 and delivered an opinion on 12 March 2021,

(1)

‘processing’ means processing as defined in point (3) of Article 3 of Regulation (EU) 2018/1725;

(2)

‘personal data’ means personal data as defined in point (1) of Article 3 of Regulation (EU) 2018/1725;

(3)

‘data subject’ means an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

(4)

‘central register’ means the publicly available repository of all personal data processing activities conducted at the ECB which is kept by the ECB’s DPO and referred to in Article 9 of Decision (EU) 2020/655 (ECB/2020/28);

(5)

‘controller’ means the ECB, and in particular the competent organisational unit within the ECB which, alone or jointly with others, determines the purposes and means of the processing of personal data and which is responsible for the processing operation.

(6)

‘Union institutions and bodies’ means Union institutions and bodies as defined in point (10) of Article 3 of Regulation (EU) 2018/1725.

(a)

the controller shall specify the rights which may be restricted, the reasons for restriction and the potential duration;

(b)

the controller shall include the information referred to in point (a) in its data protection notices, privacy statements and records of processing activities as referred to in Article 31 of Regulation (EU) 2018/1725.