Since, in the exercise of the functions attributed to it, the ECB acts as data controller and to the extent that it individually or collectively determines the purposes and means of processing personal data (referring to identified or identifiable natural persons), it must establish the rules that allow it to limit the rights of the interested parties in the performance of their functions as and when as dictated on November 22, 2022.
Now, the ECB must justify that the limitation of rights of the interested parties is strictly necessary and proportionate in a democratic society to safeguard the objectives pursued with the exercise of its public authority and the functions related to it and that, by imposing said limitation, fundamentally respects fundamental rights and freedoms.
Thus, the aforementioned decision regulates the limitation of the rights of interested parties by the ECB when it carries out security activities. processing of personal data, registered in the central registry, in relation to its internal functioning.
Rights of interested parties
The rights of the interested parties that may be limited are specified in the following articles of Regulation (EU) 2018/1725, the content of which deals with the following matters:
to) Transparency of information, communication and methods of exercising the rights of the interested party.
b) Information that must be provided when personal data is obtained from the interested party.
c) Information that must be provided when the personal data has not been obtained from the interested party.
d) Right of access of the interested party.
and) Right to rectification.
F) Right to erasure (“right to be forgotten”).
g) Right to limitation of treatment.
h) Obligation to notify regarding the rectification or deletion of personal data or the limitation of processing.
Yo) Right to data portability.
j) Communication of a violation of the security of personal data to the interested party.
k) Confidentiality of electronic communications.
The total or partial limitation of the rights of access, rectification, deletion or limitation of processing, must inform the interested party in writing, within the established period, with details of the limitation applied, its main reasons and the possibility of submitting a claim to the European Data Protection Supervisor or resort to Court of Justice of the European Union.
The person responsible for data processing will lift the applied limitation as soon as the circumstances that justified it no longer exist, informing the interested party and granting them the right that is the object of the lifted limitation.
You can access the full text of the ECB Decision here.
Find out all the details in the Master in Compliance & Data Protection Management.
