Recital 22

(22)Information submitted to the competent authorities should contain information on the identity of the members of the management body of a DRSP and on their suitability. Such information includes personal data. In compliance with the principle of data minimisation enshrined in Article 5(1), point (c), of Regulation (EU) 2016/679 of the European Parliament and of the Council ⁷ , only personal data that is necessary to enable the competent authority to assess the ability of the members of the management body of a DRSP to comply with the requirements laid down in Regulation (EU) No 600/2014 should be requested. The processing of personal data for the purposes of this Regulation should be carried out in accordance with Union law on the protection of personal data. In that regard, any processing of personal data performed by national competent authorities in application of this Regulation should be carried out in accordance with Regulation (EU) 2016/679 and national requirements on the protection of natural persons with regard to the processing of personal data. Any processing of personal data performed by ESMA in application of this Regulation should be carried out in accordance with Regulation (EU) 2018/1725 of the European Parliament and of the Council ⁸ . To enable competent authorities to conduct the assessment for the purposes of the initial authorisation and the ongoing supervision, while ensuring appropriate safeguards, personal data relating to the good repute of a member of the management body should be kept by DRSPs and competent authorities for no longer than five years after that member has ceased to perform its function.