EBA欧洲银行-Specific-privacy-noticeEBA-Register-under-PSD2-2800229202800229202800329_3页_154kb

EBA Register Privacy Notice Summary

Core Content

This document outlines the privacy notice for the EBA Register, which is established under Article 15 of the Payment Services Directive 2 (PSD2). It provides individuals with information on how their personal data is processed, who has access to it, the legal basis for processing, retention period, and the rights they hold regarding their data.

Personal Data Processed

The EBA processes personal data of payment institutions and electronic money institutions, including:

• Name
• Address
• National identification number (as specified in the Annex to the ITS on the EBA Register under the PSD2)

This data is included in the central register (EBA Register) and is notified by national competent authorities in accordance with Article 15(2) of the PSD2.

Access to Data

• The EBA Register is publicly accessible on the EBA website.
• The data is available for easy access and search, free of charge.

Purpose of Processing

The primary purpose of the EBA Register is to:

• Enhance transparency of payment institutions and electronic money institutions authorized or registered by national competent authorities.
• Ensure a high level of consumer protection within the European Union.

The EBA is responsible for developing, operating, and maintaining the register, ensuring the accurate presentation of the information provided by national authorities.

Legal Basis for Processing

• The processing of personal data is based on Article 5(1)(a) of the Regulation (EU) 2018/1725.
• It is required by Article 15 of the PSD2, which mandates the creation and maintenance of a central register.

Retention Period

Personal data is retained for as long as it is included in the national public register and notified to the EBA. Additionally, it is kept for 5 years after the EBA has been notified of the withdrawal of authorisation or exemption under Article 32 or 33 of the PSD2.

Rights of Data Subjects

Individuals have the following rights regarding their personal data:

• Right of access: To obtain information about the processing of their data and how it is used.
• Right to rectification: To correct inaccurate personal data.
• Right to erasure (right to be forgotten): To request deletion of their data under certain conditions.
• Right to restrict processing: To limit the processing of their data in specific situations.
• Right to object: To object to the processing of their data on grounds related to their particular situation.

In cases where individuals wish to exercise these rights, they must also contact their national competent authority, as the EBA receives data from these authorities.

Contact Details

For any data protection-related enquiries or complaints, individuals can contact:

• National competent authority: The authority that notified the data to the EBA.
• EBA Directly:
  • Email: info@eba.europa.eu (with subject: "Data Protection enquiry")
  • Postal address: European Banking Authority EBA, One Canada Square (Floor 46), Canary Wharf, London E14 5AA, UK
• DPO of the EBA:
  • Email: dpo@eba.europa.eu
  • Postal address: As above, marked for the attention of the DPO

Individuals can also file a complaint with the European Data Protection Board (EDPS): https://edps.europa.eu/data-protection/our-role-supervisor/complaints_en

Additional Information

• The EBA Register is accessible via: https://eba.europa.eu/risk-analysis-and-data/register-of-payment-and-e-money-institutions-under-psd2
• The EBA is represented by its Executive Director, Adam Farkas.
• The Regulation (EU) 2018/1725 (GDPR) applies to the processing of personal data by the EBA.