ANNEX IV
Enforcement and sanctions
1. SUBJECT MATTER, NATURE AND PURPOSE OF PROCESSING
In the context of enforcement and sanctions procedures, personal data are processed for the following purposes:
(a) | investigating alleged breaches of requirements under relevant directly applicable acts of Union law committed by supervised entities in relation to which administrative pecuniary penalties may be imposed pursuant to Article 18(1) of Regulation (EU) No 1024/2013 and preparing proposals for the imposition of such penalties; |
(b) | investigating alleged breaches by supervised entities of ECB regulations or decisions in relation to which sanctions may be imposed pursuant to Article 18(7) of Regulation (EU) No 1024/2013; |
(c) | assessing, in the context of cases under Article 18(5) of Regulation (EU) No 1024/2013, whether an NCA should be required to open proceedings and notifying the NCA of such request; |
(d) | requesting information pursuant to Article 10 of Regulation (EU) No 1024/2013 and Article 139 of Regulation (EU) No 468/2014 (ECB/2014/17) and carrying out tasks pursuant to Articles 125 to 138 of Regulation (EU) No 468/2014 (ECB/2014/17) in the context of investigating alleged breaches as referred to in Article 18(1) and (7) of Regulation (EU) No 1024/2013; |
(e) | assessing whether an NCA should be requested pursuant to Article 136 of Regulation (EU) No 468/2014 (ECB/2014/17) to refer a suspected criminal offence to the appropriate authorities for investigation and possible criminal prosecution and notifying the NCA of such request. |
2. LEGAL BASIS
(a) | Article 5(1), points (a) and (b), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Articles 9, 10, 11 and 18 of Regulation (EU) No 1024/2013; |
(b) | Article 5(1), points (a) and (b), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Article 113(3) and Articles 120 to 129, 134, 136 and 139 of Regulation (EU) No 468/2014 (ECB/2014/17). |
3. DATA SUBJECTS
Personal data relating to the following categories of data subjects may be processed:
(a) | staff of the supervised entity subject to the procedure; |
(b) | members of the management body of the supervised entity subject to the procedure; |
(c) | members of the management body of entities seeking to acquire a qualifying holding in the supervised entity; |
(d) | proposed acquirers of a qualifying holding; |
(e) | authorised representatives of the supervised entity subject to the procedure. |
4. CATEGORIES OF PERSONAL DATA PROCESSED
The following categories of personal data may be processed:
(a) | identification data, such as name, nationality and signature; |
(b) | contact data, such as postal address, email address and phone number; |
(c) | professional data relating to education, training and employment; |
(d) | financial details; |
(e) | details of (suspected) offences and criminal convictions. |