ANNEX III
Ongoing supervision of significant supervised entities
1. SUBJECT MATTER, NATURE AND PURPOSE OF PROCESSING
In the context of the prudential supervision of significant supervised entities, personal data are processed for the following purposes:
(a) | ensuring that significant supervised entities comply with relevant Union law, including national transpositions thereof, imposing prudential requirements in the areas of (i) own funds, securitisation, large exposure limits, liquidity, leverage, and reporting and public disclosure of information on those matters; and (ii) governance, including risk management processes, internal control mechanisms, remuneration policies and practices and effective internal capital and liquidity adequacy assessment processes, including internal ratings based models; |
(b) | carrying out supervisory reviews and stress tests to determine whether significant supervised entities comply with the relevant requirements of Union law and, on the basis of that supervisory review, imposing on supervised entities specific requirements and other measures; |
(c) | carrying out supervision over supervised entities’ parents established in one of the participating Member States, including over (mixed) financial holding companies, and participating in supervision on a consolidated basis, including in colleges of supervisors without prejudice to the participation of NCAs in those colleges as observers, in relation to parents not established in one of the participating Member States; |
(d) | participating in supplementary supervision of financial conglomerates in relation to the supervised entities included in them and assuming the tasks of a coordinator where the ECB is appointed as the coordinator for a financial conglomerate in accordance with the criteria set out in relevant Union law; |
(e) | carrying out supervisory tasks in relation to recovery plans and early intervention; |
(f) | carrying out supervisory tasks in relation to the assessment of material holdings that are not qualifying holdings; |
(g) | exercising, vis-à-vis significant supervised entities, supervisory powers granted under national law which fall within the scope of the ECB’s tasks, including the approval of acquisitions by significant supervised entities of holdings in a non-credit institution or a credit institution outside the Union, mergers or demergers of credit institutions, the acquisition or sale of assets or liabilities, amendments to credit institutions’ statutes, the appointment of external auditors, requests for information and specific reports from external auditors, outsourcing projects, operations in third countries, the exercise of powers vis-à-vis shareholders, the granting or limitation of credit to related parties, strategic decisions and the establishment of cooperative banking groups; |
(h) | exercising, vis-à-vis significant supervised entities, supervisory powers granted under Union law, including the options and discretions available to competent authorities under Regulation (EU) No 575/2013 of the European Parliament and of the Council (1) and Directive 2013/36/EU, as transposed into national law; |
2. LEGAL BASIS
Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Article 4(1), points (d), (e), (f), (g), (h) and (i), Article 4(3) and Articles 6 and 9 of Regulation (EU) No 1024/2013.
3. DATA SUBJECTS
Personal data relating to the following categories of data subjects may be processed:
(a) | staff of a significant supervised entity; |
(b) | members of the management body, customers and their guarantors, shareholders and creditors, service providers, consultants and external auditors of a significant supervised entity; |
(c) | staff or representatives of banking associations; |
(d) | staff of Union institutions and bodies, and of national and international authorities; |
(e) | other third parties, such as persons filing complaints or submitting requests for information regarding a significant supervised entity; |
(f) | authorised representatives of an appointee in a fit and proper procedure; |
(g) | authorised representatives of the acquirer of a material holding; |
(h) | staff of the acquirer of a material holding. |
4. CATEGORIES OF PERSONAL DATA PROCESSED
The following categories of personal data may be processed:
(a) | identification data, such as name, ID card/passport number, nationality and signature; |
(b) | contact data, such as postal address, email address and phone number; |
(c) | professional data relating to education, training, employment, other positions held and any other business activities; |
(d) | financial details, such as in the context of a credit file review of a bank customer or in the context of a loan to a member of the management body when a pre-approval is required; |
(e) | details of criminal records; and information on criminal investigations and proceedings, relevant civil and administrative proceedings and disciplinary actions, including disqualification as a company director, bankruptcy, insolvency and similar procedures. |
(1) Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and amending Regulation (EU) No 648/2012 (OJ L 176, 27.6.2013, p. 1, ELI: http://data.europa.eu/eli/reg/2013/575/oj).