a.

Credit institutions may not know the clients entitled to repayments of deposits held in the client accounts, or be able to check and record individual data of those clients (7). Therefore, a new Article 8b introduced by the Proposal would enable credit institutions to assess whether client funds deposits are covered by the DGSs by allowing them to collect certain personal data about their clients. The categories of personal data to be processed for this purpose would be specified in draft regulatory technical standards developed by the European Banking Authority (EBA) outlining the technical details related to the identification of clients for the repayment in accordance with Article 8 of the DSGD.

b.

When reimbursing depositors, DGSs may encounter situations that give rise to money laundering concerns and thus the European Commission proposes that DGSs should withhold the payout to a depositor when notified that a financial intelligence unit (FIU) has suspended a transaction, a bank or payment account in accordance with the applicable anti-money laundering (AML) rules (8). A new Article 8c(1) under the Proposal would oblige authorities designated at Member State level as administrators of a DGS to inform the DGS about strictly necessary information received from financial supervisors about the outcome of customer due diligence measures carried out in accordance with the AML regime. Additionally, according to paragraph 3 of the same Article, FIUs would notify DGSs about their decision to act against a depositor pursuant to AML rules as amended by the Proposal for a new AML Directive (‘AMLD 6 Proposal’) (9). In case DGSs receive such a communication, Article 8c(3) of the Proposal would require them to suspend the repayment to the depositor for the same duration of the measure imposed by the FIU.

c.

The new Article 16a advanced by the Proposal would replace current Articles 4(8) and 14(4) of the DSGD, that currently entitle DSGs to receive from their member credit institutions upon request and share with DSGs in other Member States all information necessary to prepare for a repayment of depositors, including so-called ‘markings’ (10).

(1)

including a reference to the fact that the entities covered by the Proposal should comply with the GDPR - and, if applicable, with the EUDPR and the LED - when implementing their obligations under the Proposal in an appropriate recital;

(2)

including a recital mentioning the consultation of the EDPS pursuant to Article 42(1) of EUDPR and to this Opinion;

(3)

consulting the EDPS before the adoption of the delegated act that would validate EBA’s draft regulatory technical standards defining the categories of personal data that DGSs are legally entitled to process in the context of client identification for the purposes of deposit repayment, as per Article 8b of the Proposal;

(4)

assessing whether the reference to compliance with Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases (11) (the ‘Database Directive’) in Article 8c(1) is correct;

(5)

amending Article 8c(1) of the Proposal to further ensure that the sharing of personal data between financial supervisors and designated authorities, and subsequently between the latter and DGSs is limited to what is strictly necessary to enable DGSs to decide about whether they should suspend the repayment of deposits in case of concerns about money laundering or terrorist financing;

(6)

including in Article 8c(2) of the Proposal appropriate safeguards for the rights and freedoms of data subjects, including the definition of the categories of personal data to be shared with or obtained by DGSs, the sources where such personal data should be obtained, appropriate purpose limitation obligations, and an appropriate data storage period;

(7)

specifying the categories of personal data and the data subjects concerned in the notifications from FIUs to DGSs under Article 8c(3) of the Proposal, and that such notifications would only take place in case of the failure of the client’s or beneficial owner’s credit institution, which should would only cover measures taken against depositors to the extent that the involved personal data sharing is necessary and proportionate to the envisaged aim of preventing repayments of depositors that FIUs acted against under the AMLD 6 Proposal;

(8)

the Commission to consult the EDPS before the adoption of the delegated act that would validate EBA’s technical standards defining such the categories of personal data that credit institutions would be required to share with DGSs for the purposes listed under Article 16a of the Proposal.