ECB/2026/18 · GlobalLawDB

Contents

THE GOVERNING COUNCIL OF THE EUROPEAN CENTRAL BANK,Having regard to the Treaty on the Functioning of the European Union,Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC^note, and in particular Article 28 thereof,Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)^note, and in particular Article 26 thereof,Having regard to Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions^note, and in particular Article 4(3) and Article 6(1) and (7) thereof,Whereas:

(1)The European Central Bank (ECB) and each national competent authority (NCA) together comprise the Single Supervisory Mechanism (SSM). The ECB and the NCAs carry out supervisory tasks relating to the prudential supervision of credit institutions pursuant to Regulation (EU) No 1024/2013. When carrying out those supervisory tasks, the ECB and the NCAs may process personal data.

(2)When processing personal data in carrying out supervisory tasks, the ECB and the NCAs jointly determine the purposes and means of processing. The joint determination of the purposes of processing of personal data occurs as a result of the organisation of work within the SSM which entails cooperation between the ECB and the NCAs.

(3)The ECB and each NCA are therefore to be considered as joint controllers within the meaning of Article 28(1) of Regulation (EU) 2018/1725, concerning the ECB, and Article 26(1) of Regulation (EU) 2016/679, concerning the NCAs, in relation to the personal data processing operations performed in carrying out supervisory tasks.

(4)Article 28(1) of Regulation (EU) 2018/1725 and Article 26(1) of Regulation (EU) 2016/679 provide that the joint controllers must determine, by means of an arrangement between them, their respective responsibilities for compliance with the obligations under Regulation (EU) 2018/1725 and Regulation (EU) 2016/679, respectively. In the interests of the effective and consistent functioning of the SSM for which the ECB is responsible under Article 6(1) of Regulation (EU) No 1024/2013, and transparency and legal certainty, it is appropriate that such an arrangement should be established by means of a decision of the ECB adopted in consultation with the NCAs in accordance with Article 6(1) and (7) of Regulation (EU) No 1024/2013.

(5)The joint controllers should process personal data for the purposes of the following supervisory tasks: (a) fit and proper procedures for significant supervised entities; (b) authorisation procedures; (c) ongoing supervision of significant supervised entities; (d) enforcement and sanctions, with the exclusion of certain specific procedures; (e) on-site inspections of significant supervised entities; (f) oversight of the supervision of less significant supervised entities; and (g) supervision of less significant supervised entities.

(6)Where personal data are processed in the context of procedures under Article 18(5) of Regulation (EU) No 1024/2013 from the moment the ECB notifies the NCA that it requires the NCA to open proceedings; in the context of procedures under Article 136 of Regulation (EU) No 468/2014 of the European Central Bank (ECB/2014/17)^note from the moment the ECB notifies the NCA of its request; and where there is a legal basis for the processing of personal data different from Regulation (EU) No 1024/2013, each NCA should be a sole controller. For any processing of personal data in relation to reports of breaches of Union or national law relating to the prudential supervision of credit institutions submitted through the ECB’s or an NCA’s whistleblowing mechanism, the ECB or the NCA, respectively, should be a sole controller.

(7)In order to comply with Article 28(2) of Regulation (EU) 2018/1725 and Article 26(2) of Regulation (EU) 2016/679, this Decision should set out the respective roles and relationships of the joint controllers vis-à-vis the data subjects and govern how the joint controllers are to make the essence of the arrangement available to the data subjects.

(8)The organisation of work within the SSM implies that typically only two or several joint controllers carry out a supervisory task in relation to a supervised entity and perform the related personal data processing operations. Therefore, it is appropriate that the determination of the respective responsibilities of the joint controllers pursuant to Article 28(1) of Regulation (EU) 2018/1725 or Article 26(1) of Regulation (EU) 2016/679 takes account of which joint controllers carry out the specific supervisory task in relation to a supervised entity. This approach to determining the respective responsibilities of the joint controllers is particularly relevant in the context of providing information to the data subject, handling data subject requests and notifying the supervisory authorities of personal data breaches relating to the personal data processed by that joint controller.

(9)Personal data breaches should be managed by the joint controller responsible. In the unlikely event that the joint controller responsible cannot be determined rapidly, all the joint controllers should be responsible for managing the personal data breach. In such a case, it is appropriate that all the joint controllers coordinate with each other with a view to meeting their respective notification obligations towards the supervisory authority and their communication obligations towards the data subject under Regulation (EU) 2018/1725 or Regulation (EU) 2016/679. Where a personal data breach is communicated to the data subject, it is necessary that this is done in an effective manner in order to avoid multiple or inconsistent communications. The ECB should always notify all personal data breaches to the European Data Protection Supervisor, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.

(10)Each joint controller should remain individually responsible for maintaining a record of the processing activities that fall under its responsibility; determining the periods for which the personal data will be stored; deciding to restrict the application of data subject rights, where necessary and proportionate, or to apply any exceptions under Article 16(5) of Regulation (EU) 2018/1725 or Article 14(5) of Regulation (EU) 2016/679; identifying and assessing the lawfulness, necessity and proportionality of transfers of personal data to a third country or an international organisation; and engaging the processors which process personal data on its behalf.

(11)The joint controllers are liable for damage suffered as a result of an infringement of Regulation (EU) 2018/1725 or Regulation (EU) 2016/679, respectively, in accordance with Article 65 of Regulation (EU) 2018/1725, concerning the ECB, and Article 82 of Regulation (EU) 2016/679, concerning each NCA. Each of the joint controllers is jointly and severally liable vis-à-vis the data subjects, and the distribution of the compensation paid between the joint controllers therefore should be regulated.

(12)This Decision should not affect the applicability of other Union legal acts that lay down rules on the transmission of supervisory information held by the ECB to Union institutions and bodies, and national and international courts and authorities,

HAS ADOPTED THIS DECISION: