Privacy statement for the participation in the work of the European Systemic Risk Board (ESRB)

What is our legal framework?

All personal data are processed in accordance with European Union data protection law, that is to say in line with Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

Why do we process personal data?

Personal data are processed by the ESRB for the purpose of managing the work activities of the ESRB. This includes the processing of personal data for the purpose of organising meetings, sharing documents, sending emails etc.

What is the legal basis for processing your personal data?

Your personal data will be processed by the ESRB:

• in the performance of a task in the public interest, based on Article 5(1)(a) of Regulation (EU) 2018/1725 in conjunction with Regulation (EU) No 1092/2010 of the European Parliament and of the Council of 24 November 2010 on European Union macro-prudential oversight of the financial system and establishing a European Systemic Risk Board (OJ L 331, 15.12.2010, p. 1).
• By answering the call for expressions to participate in the work of the ESRB you consent to the processing of the personal data requested. You may withdraw your consent at any time by contacting info@esrb.europa.eu. All processing of your personal information will stop once you have withdrawn your consent, but any prior processing will remain lawful.

Who is responsible for processing your personal data?

The ESRB is the controller for the processing of the personal data. The ESRB Secretariat is the organisational unit responsible for the processing.

Who will receive your personal data?

The recipients of the data are ESRB Secretariat staff members, members of the ESRB General Board, members of the ESRB Steering Committee, members of the ESRB Advisory Technical Committee, members of the ESRB Advisory Scientific Committee and other members of ESRB substructures.

What type of personal data are collected?

The ESRB processes the following personal data:

• name;
• contact details (e.g. email address, postal address, business/mobile telephone number, fax number);
• employment details (e.g. institution, organisational unit, your position/function).

How long will the ESRB keep personal data?

The personal data in organisational and information items are stored for a maximum of 15 years before being deleted. The personal data in documents regarding meetings and written procedures are stored permanently.

What are your rights?

You have the right to access your personal data and correct any data that is inaccurate or incomplete. You also have (with some limitations) the right to delete your personal data and to object to or to restrict the processing of your personal data in line with Regulation (EU) 2018/1725.

Who can you contact in case of queries or requests?

You can exercise your rights by contacting info@esrb.europa.eu. You can also directly contact the European Central Banks’s Data Protection Officer at dpo@ecb.europa.eu regarding all queries relating to personal data.

Addressing the European Data Protection Supervisor

If you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data, you have the right to lodge a complaint with the European Data Protection Supervisor at any time.