1. This Decision sets out the allocation of the respective roles and responsibilities between the joint controllers, which are the ECB and the NCAs, for compliance with Regulation (EU) 2018/1725, concerning the ECB, and Regulation (EU) 2016/679, concerning the NCAs, when processing personal data in carrying out the supervisory tasks listed in paragraph 2.
2. This Decision applies to the processing of personal data in carrying out the following supervisory tasks:
fit and proper procedures for significant supervised entities;
authorisation procedures;
ongoing supervision of significant supervised entities;
enforcement and sanctions, with the exclusion of the processing of personal data by NCAs acting pursuant to Article 18(5) of Regulation (EU) No 1024/2013 from the moment the ECB notifies the NCA that it requires the NCA to open proceedings, and procedures under Article 136 of Regulation (EU) No 468/2014 (ECB/2014/17) from the moment the ECB notifies the NCA of its request;
on-site inspections of significant supervised entities;
oversight of the supervision of less significant supervised entities;
supervision of less significant supervised entities.
For each supervisory task, the subject matter, nature and purpose of processing, the legal basis for processing, the data subjects concerned and the categories of personal data processed are set out in the Annexes.
3. This Decision shall not apply to the processing of personal data in relation to reports of breaches of Union or national law relating to the prudential supervision of credit institutions submitted through the ECB’s or an NCA’s whistleblowing mechanism. Nor shall it apply where NCAs process personal data under a legal basis other than Regulation (EU) No 1024/2013.
4. This Decision is without prejudice to other Union legal acts laying down rules on the transmission of supervisory information held by the ECB to Union institutions and bodies, and national and international courts and authorities.