ANNEX I
Fit and proper assessments
1. SUBJECT MATTER, NATURE AND PURPOSE OF PROCESSING
The ECB, in cooperation with the NCAs, conducts assessments and reassessments of the suitability of appointees to positions of responsibility for the management and oversight of significant supervised entities, such as members of the management body and key function holders, as well as holders of other positions indicated by national law transposing Directive 2013/36/EU, branch managers, and certain other persons responsible for the management of significant supervised entities or their branches (hereinafter the ‘fit and proper procedure’).
In the context of fit and proper procedures, personal data are processed for the following purposes:
(a) | assessing whether the appointees meet the fit and proper criteria; |
(b) | conducting reassessments to ensure that fit and proper requirements are met on a continuing basis and, if the requirements are not met, remove the members concerned from the management body of the significant supervised entity; |
(c) | assessing applications to authorise additional non-executive directorships of members of the management body, as well as applications to hold simultaneously in the significant supervised entity the position of Chair of the management body in its supervisory function and the position of Chief Executive Officer; |
(d) | conducting quantitative research, analysis and statistical reporting on an aggregated level. |
2. LEGAL BASIS
(a) | Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Article 4(1), point (e), and Articles 6, 7, 8, 9 and 10 of Regulation (EU) No 1024/2013; |
(b) | Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Directive 2013/36/EU, as transposed into national law. |
3. DATA SUBJECTS
Personal data relating to the following categories of data subjects may be processed:
(a) | appointees who are subject to an assessment pursuant to a fit and proper procedure; |
(b) | close relatives of an appointee, such as spouse, registered partner, cohabitee, child, parent or other relation with whom the appointee shares living accommodation; |
(c) | associates of an appointee whose personal data are relevant for the assessment of the appointee, such as persons who hold management positions in, or who are beneficial owners of, the supervised entity in which the appointment is made; |
(d) | authorised representatives of an appointee in the fit and proper procedure. |
4. CATEGORIES OF PERSONAL DATA PROCESSED
The following categories of personal data may be processed:
(a) | identification data, such as name, ID card/passport number, nationality and signature of the appointee; |
(b) | contact data, such as the postal address, email address and phone number of the appointee; |
(c) | professional data relating to the education, training, employment and other positions held by the appointee and the members of the management body of the supervised entity in which the appointment is made; |
(d) | professional data relating to any other business activities of the appointee; |
(e) | details of criminal records; and information on criminal investigations and proceedings, relevant civil and administrative proceedings and disciplinary actions, including disqualification as a company director, bankruptcy, insolvency and similar procedures; |
(f) | financial details of the appointee; |
(g) | description of the personal relationships of close relatives of the appointee with other members of the management body and/or key function holders of the supervised entity in which the appointment is made, its parent undertaking or its subsidiaries; and their professional and financial relationships with the supervised entity in which the appointment is made, its parent undertaking or its subsidiaries; |
(h) | information as to whether a fit and proper assessment has already been conducted by another competent authority and information about the outcome of this assessment; |
(i) | comments by ECB or NCA staff regarding the performance of the appointee in their current or any previous role that may have an impact on the current fit and proper procedure; |
(j) | information on the conduct of the appointee in their current role that may be relevant in the context of reassessments; |
(k) | sound recording of the appointee’s voice. |