European Central Bank - eurosystem
European Central Bank - eurosystem
Search
Suchoptionen
Startseite Medien Wissenswertes Forschung und Publikationen Statistiken Geldpolitik Der Euro Zahlungsverkehr und Märkte Karriere
Vorschläge
Sortieren nach
Nicht auf Deutsch verfügbar.
  • PRIVACY STATEMENT

Privacy statement for issuance of the Union laissez-passer

What is our legal framework?

All personal data are processed in accordance with European Union data protection law, that is to say in line with Regulation (EU) 2018/1725 (“the EUDPR”).

Why do we process personal data?

Personal data are processed for the issuance of the Union laissez-passer for staff members of the European Central Bank (ECB) and special applicants.

The ECB’s Security and Safety Division, within the Directorate Administration of the Directorate General Corporate Services, collects personal data to authorise the issuance of the Union laissez-passer to ECB staff members or special applicants as defined by Council Regulation (EU) No 1417/2013 with a view to facilitating their work when travelling or residing abroad for service.

In accordance with Council Regulation (EU) No 1417/2013, the Union laissez-passer must be accorded and issued solely in the interest of the Union. The Union laissez-passer may be issued to applicants from all eligible institutions (in accordance with Council Regulation No 1417/2013 and Decision (EU) 2021/2321 of the European Central Bank).

The European Commission coordinates the issuance process for applications from all institutions within a single uniform system.

The ECB will process the personal data of eligible staff members or special applicants necessary for the issuance of the Union laissez-passer. Such data are obtained directly from the data subjects when filling in the application form. The ECB will ensure that the application form is approved in accordance with Decision (EU) 2021/2321 of the European Central Bank of 10 December 2021 on the delegation of decisions on the issuing of Union laissez-passer for applicants falling under the authority of the European Central Bank (ECB/2021/55).

The Commission, as the issuing authority, coordinates the implementation of Council Regulation (EU) No 1417/2013 to ensure that personal data are not made available to more persons than necessary.

The rationale for the procedure related to the issuance of the Union laissez-passer is the following:

a) The Union laissez-passer is a travel document granted to a list of officials and other servants of the institutions of the European Union. Council Regulation (EU) No 1417/2013 introduced a new category referred to as “special applicants”, which is defined in Article 1 of Annex II to that regulation.

b) Council Regulation (EU) No 1417/2013 requires that both biographical and biometric personal data (a facial image and two digital fingerprints) be captured to identify the laissez-passer applicant unambiguously. This activity is conducted by the Commission during the enrolment phase of the issuing process.

c) In this context, the Commission acts on behalf of all institutions. For this purpose, the Commission runs two enrolment centres, one in Brussels and one in Luxembourg.

Council Regulation (EU) No 1417/2013 establishes that the Commission must designate an entity to be responsible for designing, producing and personalising the Union laissez-passer, “taking into account the sensitive nature of the documents to be produced”. The entity is selected in accordance with the provisions applicable to the award of contracts. Once personalised, the Union laissez-passer are sent back to the Commission, which checks the quality and readability of the documents and ensures that each of them is delivered via hand-to-hand or remote delivery to the final document holder.

The personal data processed for the purposes of issuing a Union laissez-passer will not be used for automated decision-making, including profiling.

Each laissez-passer shall remain the property of the Union.

What is the legal basis for processing your personal data?

Your personal data are processed by the ECB:

  • a) in the performance of a task carried out in the public interest, based on Article 5(1)(a) of the EUDPR, in conjunction with:
    • Article 11.6 of the Statute of the European System of Central Banks and of the European Central Bank (for current ECB business activities);
    • Article 6 of Protocol (No 7) on the Privileges and Immunities of the European Union. The laissez-passer is a requirement of Article 6 of Protocol No 7 on Privileges and Immunities annexed to the Treaty on the Functioning of the European Union. The principle expressed in the Protocol is translated into Article 23 of the Commission’s Staff Regulations and Articles 11 and 81 of the Conditions of Employment of Other Servants of the European Union;
    • Council Regulation (EU) No 1417/2013 laying down the form of the laissez-passer, which constitutes the legal basis for collecting and processing personal data for the issuance of the laissez-passer to ECB staff members and special applicants;
    • in this particular case, Council Regulation (EU) No 1417/2013 indicates that the laissez-passer should comply with the security standards and technical specifications applicable to the national travel documents issued by the Member States pursuant to Union law and maintain compliance with the specifications of the International Civil Aviation Organization. This includes the requirement that common security standards and interoperable biometric identifiers should be integrated into the laissez-passer in addition to the biographical data;
    • Decision (EU) 2021/2321 of the European Central Bank of 10 December 2021 on the delegation of decisions on the issuing of Union laissez-passer to applicants falling under the authority of the European Central Bank (ECB/2021/55).
  • b) because you consented to this processing by providing the personal data requested. You may withdraw your consent at any time by contacting ssc@ecb.europa.eu. All processing of your personal information will stop once you withdraw your consent; however, any processing that has already taken place remains lawful.

Who is responsible for processing your personal data?

The following roles have been contractually agreed between the ECB and the Commission.

ECB as Controller

The organisational unit conducting the processing activity is the ECB’s Security and Safety Division within the Directorate Administration of the Directorate General Corporate Services.

The ECB acts as the controller for all personal data, in particular biographical data, of its own staff members and special applicants for the following processing activities:

  • (pre-) enrolment of ECB staff members / special applicants (biographical data).

Commission as Controller

The Commission acts as the controller for staff members of all institutions, including ECB staff members, for the following processing activities:

  • enrolment of ECB staff members / special applicants (biometric data);
  • delivery by hand to ECB staff members / special applicants (delivery data);
  • remote delivery to ECB staff members / special applicants (delivery data);
  • production and personalisation by the external contractor (data for the Union laissez-passer) (the external contractor acts as processor);
  • verification before delivery (data on the Union laissez-passer).

Processor

The data are processed by an external third party (external contractor) that on behalf of the Commission. It acts as processor of the personal data, whether biographical or biometric, of applicants from all institutions’ applicants and special applicants. In the core of the process, it is considered sub-processor relative to the Commission and sub/sub-processor relative to the other institutions. It only has contractual relations with the Commission and is bound by the general terms of the contract for data protection. See the Commission’s online record of processing activity.

The processor follows any national rules that may apply to it as controller within its own national system.

Who will be the recipients of your personal data?

The recipients of your personal data (including entities who have access to that personal data) are:

- the data subjects themselves;

- the managers of the data subjects;

- designated ECB staff members; *

- other:

  • the ECB Director General Corporate Services; in the case of their unavailability, the ECB Director Administration is given the power to issue the Union laissez-passer to ECB applicants;
  • designated staff members of the Commission** and the external contractors used by the Commission, as identified in the Commission’s online record of processing activity;
  • the data protection officers of all the institutions, services and bodies, as well as agencies, that are part of the system and have signed the Service Level Agreement with the Commission;
  • the national authorities responsible for border control, including those of third countries;
  • the national authorities in charge of security at the border, including at airports and maritime or fluvial ports, including those of third countries;
  • the national authorities responsible for the management of lost and/or stolen documents, including those of third countries;
  • the Court of Justice of the European Union and the national courts, including those of third countries, within the remit of their competences;
  • the disciplinary bodies within the institutions, notably the Investigation and Disciplinary Office of the Commission;
  • the European Anti-Fraud Office (OLAF);
  • the auditors;
  • Europol;
  • Interpol, Schengen Information System II, Supplementary Information Request at the National Entries (SIRENE) bureaux;
  • the European Union Agency for Law Enforcement Training (CEPOL);
  • the Commission’s 24/7 central alert system, within the remit of its competences and on a need-to-know basis.

This list can be extended to hierarchical superiors of staff and of other persons executing tasks under their responsibility.

*All persons with access to the service for the purpose of fulfilling their tasks in the Security and Safety Division of the ECB, in the Union laissez-passer issuance service and in the Commission’s Union laissez-passer central service in Brussels or Luxembourg.

** Access to your personal data is provided to the Commission staff members responsible for carrying out this processing operation and to authorised staff members on a “need-to-know” basis. Further details on how the Commission processes your personal data can be found in the Commission’s Privacy Statement for the issuance of the laissez-passer of the European Union, accessible via the European Commission’s online record of processing activity.

What categories of personal data are collected?

The ECB processes the following personal data:

  • General personal data
    • personal details (name, surname, date of birth, place of birth, nationality and gender, as established in Annex I to Council Regulation (EU) No 1417/2013);
    • employment details (staff type, job information including assignment, job type/s, position, job title/s, statutory link, external transfers or mobility, posting/address);
    • family, lifestyle and social circumstances (family position includes the information –surname, name, date of birth, nationality, gender, address, link with the original holder – for each family member applying for a Union laissez-passer in connection with an application for or the holding of a Union laissez-passer by the original holder);
    • other: Detailed data included in each personalised Union laissez-passer may differ following the specific requirements inherent to each application, in particular the position of the holder in the diplomatic list of mentions.

Will your personal data (in a clear or encrypted form) be processed (e.g. transferred, accessed or stored) in third countries or by international organisations?

The ECB does not foresee any transfers of your personal data to third countries or international organisations. However, your personal data might exceptionally be processed in third countries/international organisations based on the derogations for specific situations set out in Article 50(1) of the EUDPR.

How long will the ECB keep personal data?

Retention of personal data necessary to fulfil the purpose of collection or further processing of the Union laissez-passer corresponds to the principle of proportionality and is accepted by the holder.

The Commission:

- Fingerprints and the digital signature are not stored for a period longer than the time necessary for the effective and successful delivery of the Union laissez-passer. They are deleted at that time (a few days depending on the day the future holder takes to come and collect the personalised document with a maximum of three months). Nevertheless, they remain stored on the Union laissez-passer’s chip under the holder’s responsibility, including for their submission to the controls operated at the borders.

- The Commission stores the original application form for the corresponding period of validity of the Union laissez-passer.

- The Commission stores the biographical data and the facial image of all applicants/special applicants, including those belonging to the ECB, for a period equivalent to the period of validity of the Union laissez-passer (maximum six years) for both paper and electronic versions.

- Biographical data are deleted upon expiration of the validity period (maximum six years), starting from the date of issuance of the Union laissez-passer. This retention period is without prejudice to a longer storage time of the same data for other purposes, for instance in cases of audit or control activities in other systems of the institution of origin. At the end of those retention periods, the biographical data will be erased from the Commission’s Union laissez-passer central service databases.

- The storage includes a period of three months maximum of storage extending from the period between the validation of the personalised Union laissez-passer by the competent staff of the Commission service and the moment of its concrete delivery to the future holder, after which the Union laissez-passer is destroyed if not delivered. This period of three months also corresponds to the maximum period of retention for fingerprints, the precise end of which depends on the day the future holder accepts the personalised Union laissez-passer and enters into possession of it (in the meaning of “receives it” as he or she is not the owner of it).

The ECB:

A copy of the application form of ECB staff members is stored during the validity period of the Union laissez-passer. The original form is sent to the Commission’s laissez-passer central service in Brussels. The data are deleted when the Union laissez-passer is returned.

The contractor:

For biographical data and for biometric data (facial image, fingerprints and digital signature), the retention period is limited to the time needed to issue the Union laissez-passer after successful validation and fulfilment of the acceptance process (normally a few days and up to a maximum of three months).

Please note that personal data may be held in the ECB’s archives in accordance with Decision (EU) 2023/1610 of the European Central Bank of 28 July 2023 establishing the historical archives of the European Central Bank.

What are your rights?

You have the right to access your personal data and correct any data that is inaccurate or incomplete. You also have (with some limitations) the right to delete your personal data and to object to or to restrict the processing of your personal data in line with the EUDPR. The ECB may restrict your rights to safeguard the interests and objectives referred to in Article 25(1) of the EUDPR.

Who can you contact for queries or requests?

You can exercise your rights by contacting ssc@ecb.europa.eu. You can also directly contact the ECB’s Data Protection Officer at dpo@ecb.europa.eu for all queries relating to your personal data.

Addressing the European Data Protection Supervisor

If you consider that your rights under the EUDPR have been infringed as a result of the processing of your personal data, you have the right to lodge a complaint with the European Data Protection Supervisor at any time.