1. Data subjects may exercise their rights under Regulation (EU) 2018/1725 or Regulation (EU) 2016/679, whichever is applicable, in respect of and against each of the joint controllers. Each joint controller shall publish its contact point and the contact point of each of the other joint controllers in its data protection notice on its website.
2. The joint controller responsible for handling the data subject request shall be:
for fit and proper procedures for significant supervised entities, the relevant NCA in accordance with Articles 93 and 94 of Regulation (EU) No 468/2014 (ECB/2014/17) until the assessment in the fit and proper procedure is assigned to the ECB, and thereafter the ECB;
for authorisation procedures:(i)in cases of authorisation, the NCA that receives the application for authorisation to take up the business of a credit institution pursuant to Article 14(1) of Regulation (EU) No 1024/2013 until the draft decision prepared by the NCA is notified to the ECB, and thereafter the ECB;(ii)in cases of qualifying holdings, the NCA that receives the notification or any related information pursuant to Article 15(1) of Regulation (EU) No 1024/2013 until the draft NCA proposal for a decision to oppose or not to oppose the acquisition is submitted to the ECB, and thereafter the ECB;(iii)in cases of procedures initiated by an NCA for withdrawal of an authorisation to take up the business of a credit institution, including a withdrawal at the credit institution’s request, pursuant to Article 80 of Regulation (EU) No 468/2014 (ECB/2014/17), the relevant NCA until the draft withdrawal decision prepared by the NCA is submitted to the ECB, and thereafter the ECB;(iv)in cases of procedures initiated by the ECB for withdrawal of an authorisation to take up the business of a credit institution, the ECB;(v)in cases of establishment of a branch by a significant supervised entity, the NCA of the home Member State in accordance with Article 11 of Regulation (EU) No 468/2014 (ECB/2014/17) until the opening of the passporting procedure is notified to the ECB, and thereafter the ECB;(vi)in cases of notification of a change in the provision of services by a significant supervised entity or a less significant supervised entity; notification of a change in branch particulars by a significant supervised entity or a less significant supervised entity; or the establishment of a branch by a less significant supervised entity, the NCA of the home Member State until the opening of the passporting procedure is notified to the ECB, and thereafter the ECB;(vii)in cases of establishment of a branch in a participating Member State by a credit institution established in a non-participating Member State, the NCA of the host Member State until the opening of the passporting procedure is notified to the ECB, and thereafter the ECB;(viii)in cases of the provision of services outside the participating Member States by a significant supervised entity or by a less significant supervised entity, the NCA of the home Member State until the opening of the passporting procedure is notified to the ECB, and thereafter the ECB;(ix)in cases of the provision of services in a participating Member State by a credit institution established in a non-participating Member State, the NCA of the host Member State until the opening of the passporting procedure is notified to the ECB, and thereafter the ECB;(x)in cases of approval or exemption from approval of (mixed) financial holding companies comprising significant supervised entities or significant supervised groups, the ECB;(xi)in cases of approval or exemption from approval of (mixed) financial holding companies comprising less significant supervised entities or less significant supervised groups, the NCA that receives the application in accordance with Article 21a of Directive 2013/36/EU;(xii)in cases of mergers carried out by institutions and by (mixed) financial holding companies where the entities resulting from such proposed operation are significant supervised entities, the ECB;(xiii)in cases of mergers carried out by institutions and by (mixed) financial holding companies where the entities resulting from such proposed operation are less significant supervised entities, the NCA that receives the notification pursuant to Article 27i(1), first subparagraph, of Directive 2013/36/EU;(xiv)in cases of divisions carried out by institutions and by (mixed) financial holding companies that are significant supervised entities, the ECB;(xv)in cases of divisions carried out by institutions and by (mixed) financial holding companies that are less significant supervised entities, the NCA that receives the notification pursuant to Article 27i(1), second subparagraph, of Directive 2013/36/EU;
in cases of authorisation, the NCA that receives the application for authorisation to take up the business of a credit institution pursuant to Article 14(1) of Regulation (EU) No 1024/2013 until the draft decision prepared by the NCA is notified to the ECB, and thereafter the ECB;
in cases of qualifying holdings, the NCA that receives the notification or any related information pursuant to Article 15(1) of Regulation (EU) No 1024/2013 until the draft NCA proposal for a decision to oppose or not to oppose the acquisition is submitted to the ECB, and thereafter the ECB;
in cases of procedures initiated by an NCA for withdrawal of an authorisation to take up the business of a credit institution, including a withdrawal at the credit institution’s request, pursuant to Article 80 of Regulation (EU) No 468/2014 (ECB/2014/17), the relevant NCA until the draft withdrawal decision prepared by the NCA is submitted to the ECB, and thereafter the ECB;
in cases of procedures initiated by the ECB for withdrawal of an authorisation to take up the business of a credit institution, the ECB;
in cases of establishment of a branch by a significant supervised entity, the NCA of the home Member State in accordance with Article 11 of Regulation (EU) No 468/2014 (ECB/2014/17) until the opening of the passporting procedure is notified to the ECB, and thereafter the ECB;
in cases of notification of a change in the provision of services by a significant supervised entity or a less significant supervised entity; notification of a change in branch particulars by a significant supervised entity or a less significant supervised entity; or the establishment of a branch by a less significant supervised entity, the NCA of the home Member State until the opening of the passporting procedure is notified to the ECB, and thereafter the ECB;
in cases of establishment of a branch in a participating Member State by a credit institution established in a non-participating Member State, the NCA of the host Member State until the opening of the passporting procedure is notified to the ECB, and thereafter the ECB;
in cases of the provision of services outside the participating Member States by a significant supervised entity or by a less significant supervised entity, the NCA of the home Member State until the opening of the passporting procedure is notified to the ECB, and thereafter the ECB;
in cases of the provision of services in a participating Member State by a credit institution established in a non-participating Member State, the NCA of the host Member State until the opening of the passporting procedure is notified to the ECB, and thereafter the ECB;
in cases of approval or exemption from approval of (mixed) financial holding companies comprising significant supervised entities or significant supervised groups, the ECB;
in cases of approval or exemption from approval of (mixed) financial holding companies comprising less significant supervised entities or less significant supervised groups, the NCA that receives the application in accordance with Article 21a of Directive 2013/36/EU;
in cases of mergers carried out by institutions and by (mixed) financial holding companies where the entities resulting from such proposed operation are significant supervised entities, the ECB;
in cases of mergers carried out by institutions and by (mixed) financial holding companies where the entities resulting from such proposed operation are less significant supervised entities, the NCA that receives the notification pursuant to Article 27i(1), first subparagraph, of Directive 2013/36/EU;
in cases of divisions carried out by institutions and by (mixed) financial holding companies that are significant supervised entities, the ECB;
in cases of divisions carried out by institutions and by (mixed) financial holding companies that are less significant supervised entities, the NCA that receives the notification pursuant to Article 27i(1), second subparagraph, of Directive 2013/36/EU;
for ongoing supervision of significant supervised entities, the ECB;
for enforcement and sanctions, the ECB;
for on-site inspections of significant supervised entities, the ECB;
for oversight of the supervision of less significant supervised entities, the ECB;
for supervision of less significant supervised entities:(i)the NCA of the home Member State; or(ii)where the ECB exercises directly itself all the relevant powers for a less significant supervised entity pursuant to Article 6(5), point (b), of Regulation (EU) No 1024/2013, the ECB.
the NCA of the home Member State; or
where the ECB exercises directly itself all the relevant powers for a less significant supervised entity pursuant to Article 6(5), point (b), of Regulation (EU) No 1024/2013, the ECB.
3. A joint controller shall, when requested to do so by the joint controller responsible under paragraph 2, provide swift and efficient assistance to the latter in handling any data subject requests, in accordance with the procedure set out in paragraph 4.
4. The following rules shall apply to the handling of data subject requests:
The joint controller that receives the data subject request shall send an acknowledgment of receipt to the data subject without undue delay. If the data subject request does not fall under its responsibility as determined in accordance with paragraph 2, the joint controller that receives the data subject request shall forward it to the joint controller actually responsible for handling that request under paragraph 2.
If the joint controller to whom the data subject request has been forwarded confirms that it is the joint controller responsible for handling that request under paragraph 2, the joint controller that received the data subject request shall inform the data subject of the transmission of the data subject request to that joint controller.
Any disagreement as to which joint controller is responsible under paragraph 2 shall be resolved in a meeting between the joint controller that received the data subject request, the joint controller to whom the data subject request has been forwarded and any other joint controller that the latter considers to be responsible under paragraph 2. Following that meeting, the joint controller that received the data subject request shall inform the data subject of the transmission of the data subject request to the joint controller that has confirmed it is responsible under paragraph 2. If the joint controller that receives the data subject request is the joint controller responsible under paragraph 2 but the data subject request also pertains to other supervisory tasks referred to in paragraph 2, points (a) to (g), that joint controller shall request the assistance of another joint controller or joint controllers in accordance with paragraph 3.
The joint controller responsible under paragraph 2 shall send the final reply to the data subject, having incorporated the input provided by any other joint controllers under point (c), if relevant.