1.   This Decision sets out the general rules implementing Regulation (EU) 2018/1725 as regards the ECB. In particular, it specifies the rules relating to the appointment and role of the data protection officer of the ECB (DPO), including the DPO’s tasks, duties and powers.

2.   This Decision also specifies the roles, tasks and duties of the controllers and of the data protection coordinator and implements the rules pursuant to which data subjects may exercise their rights.

1.   The Executive Board shall:

2.   The Executive Board shall ensure that the DPO is able to carry out the tasks and duties referred to in Article 45 of Regulation (EU) 2018/1725 in an independent manner without receiving any instructions on how to exercise his or her tasks. Without prejudice to such independence:

3.   The Executive Board may appoint a Deputy DPO to whom paragraphs 1 and 2 shall apply. The Deputy DPO shall support the DPO in carrying out the DPO’s tasks and duties, and deputise in the event of the DPO’s absence.

4.   Any ECB staff member providing support to the DPO in relation to data protection issues shall act solely on the DPO’s instructions and shall be bound by professional secrecy and confidentiality in accordance with Article 44(5) of Regulation (EU) 2018/1725 in conjunction with Article 37 of the Statute of the ESCB.

5.   In accordance with Article 43(2) of Regulation (EU) 2018/1725, at the ESRB’s request, the DPO may be authorised to also fulfil in relation to the ESRB the tasks set out in Article 45 of Regulation (EU) 2018/1725.

1.   Any request for an investigation under point (b) of Article 4 shall be addressed to the DPO in writing.

2.   Within seven working days of receiving the request referred to in paragraph 1, the DPO shall send an acknowledgement of receipt to the requester.

3.   The DPO may investigate the matter that is the subject of the request on-site and request a written statement from a controller. The relevant controller shall reply to the DPO within 20 working days of receiving the DPO’s request. The DPO may ask for additional information or assistance from any ECB business area at any time. That business area shall provide such additional information or assistance within 20 working days of the DPO’s request.

4.   The DPO shall consider the issues and facts relating to the investigation impartially and with due regard to the data subjects’ rights. If deemed appropriate and subject to paragraph 5, the DPO shall inform all other parties concerned of the investigation.

5.   The DPO shall ensure that the request remains confidential and is only disclosed to the extent necessary for the purposes of the investigation, unless the data subject concerned gives its consent for the request not to remain confidential.

6.   The DPO shall report back to the requester no later than three calendar months following the receipt of the request.

1.   A controller shall ensure that all processing operations involving personal data that are performed within its area of responsibility comply with the provisions of Regulation (EU) 2018/1725 and any other Union data protection provisions applicable to the ECB.

2.   A controller shall ensure that the DPO is informed, without undue delay, of the following:

3.   A controller, shall, in particular:

4.   When assisting the DPO and the EDPS in performing their duties, a controller shall provide full information to them, grant access to personal data and respond to questions within 20 working days of receiving a request.

1.   The data protection coordinators shall assist the controllers in fulfilling their obligations, either at the controllers’ request or on their own initiative. The data protection coordinators shall liaise with the controllers, who shall provide them with all necessary information.

2.   The data protection coordinators shall assist the DPO in:

3.   A data protection coordinator shall generally be a specialist in information management or have the relevant expertise and/or training.

1.   Controllers shall submit their records of processing activities to the DPO who shall keep the records in a central register.

2.   The central register shall serve as a repository of all personal data processing activities conducted at the ECB. The central register shall constitute a source of information for data subjects and facilitate the exercise of their rights under Articles 17 to 24 of Regulation (EU) 2018/1725. The central register shall be made publicly accessible. The central register shall contain, at least, the information referred to in points (a) to (g) of Article 31(1) of Regulation (EU) 2018/1725.

1.   The respective data protection obligations of any joint controller shall be established in accordance with Article 28 of Regulation (EU) 2018/1725.

2.   In the event that the ECB acts as a joint controller together with one or more controllers, the responsibilities of the joint controllers for compliance with data protection obligations shall be determined by arrangement between them unless and in so far as those responsibilities are determined by Union or Member State law to which the joint controllers are subject.

1.   Data subjects may contact the relevant controller to exercise their rights pursuant to Articles 17 to 24 of Regulation (EU) 2018/1725.

2.   Data subjects’ rights may only be exercised by the data subject or their duly authorised representative. Such persons may exercise any of these rights free of charge.

3.   Requests to exercise data subjects’ rights shall be submitted to the relevant controller in writing or, where appropriate, by electronic means. Upon receiving a request from a data subject, the relevant controller shall send an acknowledgment of receipt to the data subject within five working days, provide them with the contact details of the DPO and inform them of the possibility of lodging a complaint with the EDPS and of seeking judicial redress.

4.   If the relevant controller has reasonable doubts concerning the identity of the data subject, or their authorised representative, the relevant controller may request the provision of additional information necessary to identify the data subject or their authorised representative. If the data subject is represented by an authorised representative, the relevant controller shall also verify the relevant authorisation. The relevant controller may request further information from the data subject in order to clarify the data subject’s request and effectively address it.

5.   In accordance with Article 14(3) and (4) of Regulation (EU) 2018/1725, the relevant controller shall provide information to the data subject on any action taken in relation to a request without undue delay and at the latest within one month of receiving the request. Where necessary, this period may be extended by two further months, taking into account the complexity and number of data subjects’ requests received by the relevant controller. The relevant controller shall inform the data subject of any extension within one month of receiving the request and shall provide the reasons for the delay.

6.   The relevant controller shall respond to the data subject’s request in writing, if appropriate, and if the data subject’s request was submitted by electronic means, the relevant controller shall also provide the requested information by electronic means.

7.   The data subject may at any point contact the DPO, in particular if:

The DPO shall advise the relevant controller on the appropriate course of action.

8.   Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the relevant controller may, having consulted the DPO, refuse to act on the request in accordance with Article 14(5) of Regulation (EU) 2018/1725 and shall inform the data subject accordingly.