Decision (EU) 2020/655 of the European Central BankShow full title

SECTION 2 U.K. THE DATA PROTECTION OFFICER

Article 3 U.K. Appointment, status and organisational matters

1. The Executive Board shall:

(a) appoint the DPO on the basis of personal and professional qualities and, in particular, expert knowledge of data protection law and practices and ability to fulfil the tasks referred to in Article 45 of Regulation (EU) 2018/1725 and in this Decision;

(b) issue a non-convertible fixed-term contract for the position of DPO for a period of between three to five years, which may be extended up to the overall limit of 10 years, as set out in the Conditions of Employment for Staff of the European Central Bank; and

(c) register the DPO with the European Data Protection Supervisor (EDPS) in accordance with Article 44(9) of Regulation (EU) 2018/1725.

2. The Executive Board shall ensure that the DPO is able to carry out the tasks and duties referred to in Article 45 of Regulation (EU) 2018/1725 in an independent manner without receiving any instructions on how to exercise his or her tasks. Without prejudice to such independence:

(a) the DPO shall be subject to the Conditions of Employment for Staff of the European Central Bank;

(b) for administrative purposes and for the purpose of applying the ECB’s employment framework, the DPO shall be allocated to the ECB’s Directorate-General Legal Services;

(c) the DPO’s appraiser consults the EDPS and may also seek input from other ECB stakeholders, before appraising the DPO’s performance of his or her tasks and duties. The DPO shall not suffer any prejudice on account of due performance of his or her tasks and duties;

(d) the DPO is subject to dismissal by the Executive Board if he or she no longer fulfils the conditions required for the performance of his or her duties and such dismissal has received the prior consent of the EDPS in accordance with Article 44(8) of Regulation (EU) 2018/1725.

3. The Executive Board may appoint a Deputy DPO to whom paragraphs 1 and 2 shall apply. The Deputy DPO shall support the DPO in carrying out the DPO’s tasks and duties, and deputise in the event of the DPO’s absence.

4. Any ECB staff member providing support to the DPO in relation to data protection issues shall act solely on the DPO’s instructions and shall be bound by professional secrecy and confidentiality in accordance with Article 44(5) of Regulation (EU) 2018/1725 in conjunction with Article 37 of the Statute of the ESCB.

5. In accordance with Article 43(2) of Regulation (EU) 2018/1725, at the ESRB’s request, the DPO may be authorised to also fulfil in relation to the ESRB the tasks set out in Article 45 of Regulation (EU) 2018/1725.

Article 4 U.K. Data Protection Officer’s tasks

The DPO shall carry out the tasks specified in Article 45 of Regulation (EU) 2018/1725 and in particular:

(a)

inform and advise the Executive Board, the controllers, the Staff Committee and the data protection coordinators, and respond to consultations from any of them or any data subject on matters concerning the interpretation and application of data protection provisions at the ECB;

(b)

investigate matters and incidents related to data protection either on the DPO’s own initiative or at the request of the Executive Board, a controller, the Staff Committee or any data subject, and report back to the requester of the investigation;

(c)

maintain a central register with the records of processing activities at the ECB pursuant to Article 31 of Regulation (EU) 2018/1725 and Article 9 of this Decision;

(d)

assist a controller, upon request, in drafting data protection impact assessments and submissions for the prior consultation of the EDPS in accordance with Articles 39 and 40 of Regulation (EU) 2018/1725;

(e)

respond to requests from the EDPS and, within the sphere of his or her competence, cooperate with the EDPS;

(f)

cooperate with the data protection officers of other Union institutions and bodies, national central banks and national competent authorities, in particular by: (i) sharing knowledge and know-how based on experience; (ii) representing the ECB in relevant discussions relating to data protection issues, excluding court cases; and (iii) participating in interinstitutional committees and bodies;

(g)

ensure in an independent manner the application of Regulation (EU) 2018/1725 at the ECB by monitoring compliance with Regulation (EU) 2018/1725, with other applicable Union law containing data protection provisions and with the policies of the ECB and its processors in relation to the protection of personal data, including the assignment of responsibilities, the raising of awareness and training of ECB staff members involved in processing operations and any related audits.

Article 5 U.K. Data Protection Officer’s powers

In performing his or her tasks pursuant to Article 4, the DPO:

(a)

may request information from any ECB business area on any matter relating to the DPO’s tasks and duties;

(b)

shall have access to personal data being processed, to all ECB premises, and to all information, data processing operations and databases at any time;

(c)

may issue an opinion on the lawfulness of actual or proposed processing operations, on the measures required to ensure that such operations are lawful, and on the suitability or adequacy of data protection measures or on any issue concerning processing operations;

(d)

may bring to the Executive Board’s attention any data protection related issue, including the failure of an ECB staff member to comply with the provisions of Regulation (EU) 2018/1725 or any other Union data protection provisions applicable to the ECB;

(e)

may request that data protection related items be added to the Executive Board’s agenda and submit relevant documentation to the Executive Board for that purpose;

(f)

may conduct compliance checks of data processing operations carried out by a controller or on behalf of a controller;

(g)

may restrict any data processing that is not in compliance with the provisions of Regulation (EU) 2018/1725 or this Decision or any other Union data protection provisions;

(h)

may inform the EDPS of any issue related to data protection that requires the EDPS’s input or guidance.

Article 6 U.K. Data Protection Officer and investigation procedure

1. Any request for an investigation under point (b) of Article 4 shall be addressed to the DPO in writing.

2. Within seven working days of receiving the request referred to in paragraph 1, the DPO shall send an acknowledgement of receipt to the requester.

3. The DPO may investigate the matter that is the subject of the request on-site and request a written statement from a controller. The relevant controller shall reply to the DPO within 20 working days of receiving the DPO’s request. The DPO may ask for additional information or assistance from any ECB business area at any time. That business area shall provide such additional information or assistance within 20 working days of the DPO’s request.

4. The DPO shall consider the issues and facts relating to the investigation impartially and with due regard to the data subjects’ rights. If deemed appropriate and subject to paragraph 5, the DPO shall inform all other parties concerned of the investigation.

5. The DPO shall ensure that the request remains confidential and is only disclosed to the extent necessary for the purposes of the investigation, unless the data subject concerned gives its consent for the request not to remain confidential.

6. The DPO shall report back to the requester no later than three calendar months following the receipt of the request.