ANNEX V
On-site inspections of significant supervised entities
1. SUBJECT MATTER, NATURE AND PURPOSE OF PROCESSING
In the context of on-site inspections of significant supervised entities, personal data are processed for the following purposes:
(a) | carrying out on-site inspections to perform in-depth investigations of the supervised entities’ risks, risk controls and governance; |
(b) | assessing internal models used for the calculation of own funds requirements, in particular with regard to methodologies, economic appropriateness, risks, risk controls and governance; |
(c) | carrying out asset quality reviews to enhance transparency regarding the supervised entities’ exposures, including as regards the adequacy of asset and collateral valuations and related provisions. |
2. LEGAL BASIS
(a) | Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Article 4(1), point (f), Article 6(4) and Articles 10, 11 and 12 of Regulation (EU) No 1024/2013; |
(b) | Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Articles 143 to 146 of Regulation (EU) No 468/2014 (ECB/2014/17). |
3. DATA SUBJECTS
Personal data relating to the following categories of data subjects may be processed:
(a) | staff members of the supervised entity; |
(b) | shareholders of the supervised entity; |
(c) | members of the management body of the supervised entity; |
(d) | customers of the supervised entity, their guarantors and connected parties; |
(e) | external auditors of the supervised entity; |
(f) | service providers and consultants to the supervised entity; |
(g) | staff of Union institutions and bodies, and of national and international authorities. |
4. CATEGORIES OF PERSONAL DATA PROCESSED
The following categories of personal data may be processed:
(a) | details of the customers of the supervised entity, such as: identification data, such as name, ID card/passport number, nationality and signature; contact data, such as postal address, email address and phone number; financial status and activities, such as information related to income level, expenditures, assets, debts, derivatives, financial commitments, credit score, payment history, disputes and litigation with the supervised entity, as well as overall financial health indicators; household composition, characteristics of housing, education, and employment-related information and prospects; |
(b) | details of the staff members, shareholders and members of the management body of the supervised entity, such as: identification data, such as name, ID card/passport number, nationality and signature; contact data, such as postal address, email address and phone number; financial activities in relation to the supervised entity, such as information related to remuneration, assets, debts, derivatives and financial commitments; work experience, qualifications, academic background; |
(c) | details of external auditors, service providers and consultants to the supervised entity and details of staff of Union institutions and bodies, and of national and international authorities, such as: identification data, such as name, ID card/passport number, nationality and signature; contact data, such as postal address, email address and phone number; description of the personal relationships of close relatives of the data subject with members of the management body and/or key function holders of the supervised entity, its parent undertaking or its subsidiaries, and a description of the data subject’s professional and financial relationships with the supervised entity, its parent undertaking or its subsidiaries. |