Privacy statement for the processing of personal data by the Mediation Function

What is our legal framework?

All personal data are processed in accordance with European Union data protection law, that is to say in line with the EU Data Protection Regulation (EUDPR) (EU) 2018/1725.

The Mediation Function operates in accordance with the EUDPR and Decision NP21/2022. It aims to align its data protection practices with the latest developments and best international practices followed by ombuds and mediation offices of a similar mandate. These practices are regularly updated. The Mediation Function adopts international good practices, in line with the International Ombuds Association (IOA) Standards of Practice.

Why do we process personal data?

In order to provide confidential conflict prevention and resolution services, the Mediation Function does not collect data on or process party names, names of business areas or any other information that could reveal the identity of the parties involved.

When receiving support from the Mediator/Ombuds, involved parties may exchange emails and/or texts or provide information that could include personal data. Therefore, the Mediator/Ombuds also keeps succinct handwritten notes as part of their mediation services. These notes do not include the names of the involved parties or business areas but may include sensitive data or other useful information relating to a workplace situation.

All involved parties will receive an anonymous survey form, completion of which is optional. However, the involved parties may wish to share certain personal data for the extraction of anonymised aggregated data on workplace trends, which are to be included in the Mediator/Ombuds’ annual report. This data is kept electronically by the Mediation Function.

What is the legal basis for processing your personal data?

Your personal data are processed by the ECB:

• in the performance of a task carried out in the public interest, based on Article 5(1)(a) of the EUDPR, in conjunction with Decision NP21/2022;

• because you consented to this processing by providing the personal data requested in the Mediation Function survey form. You may withdraw your consent at any time by contacting us as indicated below. All processing of your personal information will stop once you withdraw your consent. However, any processing that has already taken place remains lawful.

Who is responsible for processing your personal data?

The ECB is the controller for the processing of your personal data. The ECB Mediator/Ombuds is responsible for this processing.

Who will receive your personal data?

The recipient of your personal data (including entities who have access to that personal data) is the ECB Mediator/Ombuds.

What type of personal data is collected?

The ECB may process the following personal data:

• Name (title, first name, surname - solely for scheduling meetings)
• Contact details (email address - solely for scheduling meetings)
• Gender
• Age group
• Salary band or Group of Salary bands
• Type of workplace issues raised

Will your personal data (in a clear or encrypted form) be processed (e.g. transferred, accessed or stored) in third countries or by international organisations?

The ECB does not foresee any transfers of your personal data to third countries or international organisations. However, your personal data might exceptionally be processed in third countries or international organisations based on the derogations for specific situations set out in Article 50(1) of the EUDPR.

How long will the ECB keep personal data?

The limited email and text exchanges, as well as handwritten notes, are destroyed on a regular basis (along with the personal data they might contain), either at the end of a case or interaction with the Mediation Function. At the latest, once the case is closed, the parties involved are duly informed of the destruction of their emails and/or texts or any other information received and are directed to delete their own copies of such personal data as well.

Any personal data that could be shared by the parties involved in the optional survey form is used for the extraction of anonymised aggregated data on workplace trends, which are to be included in the Mediator’s annual report. Such data is kept by the Mediation Function electronically.

What are your rights?

You have the right to access your personal data and correct any data that is inaccurate or incomplete. You also have (with some limitations) the right to delete your personal data and to object to or to restrict the processing of your personal data in line with the EUDPR. The ECB may restrict your rights to safeguard the interests and objectives referred to in Article 25(1) of the EUDPR.

Who can you contact for queries or requests?

You can exercise your rights by contacting the ECB Mediator/Ombuds at mediator@ecb.europa.eu. You can also directly contact the ECB’s Data Protection Officer at dpo@ecb.europa.eu for all queries relating to your personal data.

Addressing the European Data Protection Supervisor

If you consider that your rights under the EUDPR have been infringed as a result of the processing of your personal data, you have the right to lodge a complaint with the European Data Protection Supervisor at any time.