Privacy statement for audit missions

What is our legal framework?

All personal data are processed in accordance with European Union data protection law, that is to say in line with Regulation (EU) 2018/1725 (“EUDPR”).

Why do we process personal data?

Personal data are processed in the context of the internal audit services provided by the Directorate Internal Audit (D/IA), as defined by the Executive Board in the ECB Audit Charter. This processing aims to identify, assess, evaluate and record any relevant information for assurance and advisory engagements. Any personal data that fall within the scope of these activities are collected from the ECB’s business areas. In general, D/IA processes personal data which are relevant for a specific task.^[1]

In particular, D/IA may process personal data to fulfil the following tasks:

• implementing the ECB’s audit plan and the Internal Auditors Committee work
programme by conducting and reporting on assurance and advisory engagements;

• assessing the implementation status of audit recommendations;

• processing incident reports from ECB business areas (not including incident reports related to breaches of professional duties).

Furthermore, D/IA processes data in order to provide audit support (e.g. as the Secretariat to the Internal Auditors Committee) and coordinate external audit services (e.g. external auditors or the European Court of Auditors).

What is the legal basis for processing your personal data?

Your personal data are processed by the ECB in the performance of a task carried out in the public interest, based on Article 5(1)(a) EUDPR, in conjunction with Protocol (No 4) on the Statute of the European System of Central Banks (ESCB) and the European Central Bank (OJ C 202, 7.6.2016, p. 230) and Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 29.10.2013, p. 63), as further detailed in the ECB Audit Charter.

Who is responsible for processing your personal data?

The ECB is the controller for the processing of your personal data. D/IA is responsible for this processing.

Who will be the recipients of your personal data?

The recipients of your personal data (including entities who have access to that personal data) are the following:

• the data subjects;

• designated ECB staff members;

• designated staff members of the national central banks within the ESCB and national competent authorities within the Single Supervisory Mechanism (including secondees), where relevant in the context of Internal Auditors Committee activities;

• externals (consultants, external auditors and trainees) participating in internal audit activities.

Upon request, members of the ECB’s Executive Board, Governing Council and Supervisory Board and the ECB Chief Services Officer may receive personal data.

Where applicable, on a need to know basis and in compliance with the relevant legal framework, bodies charged with monitoring or inspection tasks in accordance with EU law may also receive personal data, e.g. the European Court of Auditors, the European Anti-Fraud Office, the European Public Prosecutor’s Office, national competent authorities, the European Data Protection Supervisor, the Ethics Committee and the Audit Committee.

What categories of personal data are collected?

D/IA has access to all of the personnel, records, information, systems and property deemed necessary to carry out its responsibilities in the context of audit missions and may process any related personal data.

The ECB may process the following personal data in relation to audit missions:

• identification data and contact details (e.g. name, postal address, etc.);
• education and professional training data;
• employment data;
• financial data;
• information on family, lifestyle and social circumstances;
• information on goods or services provided;
• information relating to civil or administrative proceedings or other regulatory investigations;
• information relating to criminal proceedings;
• information relating to sanctions or other administrative penalties;
• any other personal data relevant to a particular audit mission;
• special categories of data within the scope of Article 10 EUDPR, where justified.

Will your personal data (in a clear or encrypted form) be processed (e.g. transferred, accessed or stored) in third countries or by international organisations?

The ECB does not foresee any transfers of your personal data to third countries or international organisations. However, your personal data might exceptionally be processed in third countries/international organisations based on the derogations for specific situations set out in Article 50(1) EUDPR.

How long will the ECB keep personal data?

The retention period for D/IA’s audit files is in line with the ECB Filing and Retention Plan.

Any personal data processed during an audit mission are deleted or anonymised once the ECB’s decision‑making bodies have considered the audit report.

Any data needed for follow‑up and/or evidence may be kept for up to two years, or longer if required, in line with the ECB Filing and Retention Plan. Audit report information is always anonymised.

Please note that personal data may be held by the ECB’s archives in accordance with Decision (EU) 2023/1610 of the European Central Bank of 28 July 2023 establishing the historical archives of the European Central Bank.

What are your rights?

You have the right to access your personal data and correct any data that are inaccurate or incomplete. You also have (with some limitations) the right to delete your personal data and to object to or to restrict the processing of your personal data in line with EUDPR. The ECB may restrict your rights to safeguard the interests and objectives referred to in Article 25(1) EUDPR.

Who can you contact for queries or requests?

You can exercise your rights by contacting D/IA at DL-DIA-DIA_MANAGEMENT@ecb.europa.eu. You can also directly contact the ECB’s Data Protection Officer at dpo@ecb.europa.eu for all queries relating to your personal data.

Addressing the European Data Protection Supervisor

If you consider that your rights under the EUDPR have been infringed as a result of the processing of your personal data, you have the right to lodge a complaint with the European Data Protection Supervisor at any time.