1. Description of the processing operation
This privacy statement provides information regarding the processing of personal data carried out by the European Investment Bank (the Bank) when handling complaints about alleged maladministration by the EIB Group submitted to the EIB Group Complaints Mechanism in line with the relevant Policy and Procedures. This statement also covers the processing of personal data carried out as part of the coordination of the EIB’s responses to the European Ombudsman in cases against the EIB Group lodged with the EO. The processing referred to in this statement is performed by the Complaints Mechanism Division of the Inspectorate General (EIB-CM).
The EIB-CM, in the course of those activities, processes personal data. Such personal data could relate to individuals who share it as complainants, while acting on behalf of entities submitting the complaint or simply because the individuals feel affected by the alleged maladministration. Personal data could also relate to EIB Group’s staff concerned by the complaint, individuals acting on behalf the Promoter, the Borrower, the Final beneficiary or any other international/national/local authority interacting with the EIB Group for the purpose of the inquiry. Finally, personal data could relate to external experts and service providers working on behalf of the EIB or third parties.
2. Legal basis and the controller
Personal data are processed by the EIB (“EIB” or “Controller”) in accordance with Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC.
In accordance with Article 309 of the Treaty on the Functioning of the European Union, the task of the European Investment Bank shall be to contribute, by having recourse to the capital markets and utilising its own resources, to the balanced and steady development of the internal market in the interest of the Union.
All of this processing is necessary so that the EIB can carry out its tasks in the public interest and that the activity and workings of the EIB Group’s Complaints Mechanism are in accordance with the EIB-CM Policy and Procedures. In some cases, processing is also necessary so that the EIB can comply with its legal obligations. Consent is in general not the legal basis justifying our processing of your personal data. If we do propose to rely on your consent, we will make this clear at the time.
3. Why do we process your personal data
The EIB-CM processes your personal data as reasonably necessary so that it can handle complaints, in a reasonable and proper manner, in accordance with applicable regulatory framework. We collect and process personal data in connection with the handling of complaints submitted to the EIB Group Complaints Mechanism. Specifically, we process your personal data for the following purposes:
- Processing correspondence received via the complaints mailbox and via other entry points;
- checking whether complaints are admissible and should be handled by the EIB-CM;
- maintaining a complete and accurate repository (Microsoft Outlook, GED document management system and local hard drives) of all relevant documentation and emails in relation to complaints that have been received by the EIB-CM;
- notifying a range of personal data, which are relevant for the handling of the complaint to
- External experts and service providers working on behalf of the EIB-CM
- EIB Group’s concerned services;
- Promoters/Borrowers/Financial Intermediaries/Final beneficiaries or any other international/national/local authority interacting with the EIB Group;
- European Union Institutions/Bodies or International Organisations (e.g. European Ombudsman)
- notifying dedicated EIB staff dealing with other investigative activities and/or staff of other Independent Accountability Mechanisms in case of project-related complaints where the EIB Group co-finances the operation with other bilateral or multilateral financial institutions
- in the process of having the EIB Group’s response to the complaint endorsed by the relevant EIB’s governing bodies.
4. What personal data do we process?
We collect and process personal data, which may e.g. include the name, address, telephone number, fax number, email address of individuals in connection with the handling of complaints pursuant to the EIB-CM Policy and Procedures. We collect and process personal data communicated only in relation to the complaint such as:
- identification data, e.g. full name, ID;
- position and function in a company/civil society organisation/public entity;
- contact details, e.g. e-mail address, business/mobile telephone number, fax number, postal address, company and department (if relevant), country of residence, internet address;
- (for complaints concerning recruitment procedures), information for the evaluation of selection or eligibility criteria, e.g. expertise, languages, educational background, professional experience including details on current and past employment, test results;
- (for complaints concerning social impacts of EIB Group’s operations or discrimination), information about the racial/ethnic origin of individuals, political affiliations, religious beliefs, data concerning the health, gender or sexual orientation of individuals; ownership certificates.
Reports of the EIB-CM (Initial Assessment Reports, Conclusions Reports, Mediation Reports), which are shared with third parties other than the complainant and published on the EIB website, do not contain personal data.
5. Where do we obtain your personal data?
We may obtain your personal data directly from you (or from a legal entity or an organisation that you represent or with which you are associated), or from one of the external stakeholders interacting with the EIB Group for the purpose of the inquiry (see point 3). While carrying out the inquiry, we may also collect some information about you and the concerns raised in the complaint from publicly available sources (e.g. a blog, a news article).
6. To whom is your data disclosed?
We may disclose personal data about you to:
- service providers who hold and process your personal data on our behalf, under strict conditions of confidentiality and security
- EIB Group relevant services including EIB Group’s legal services and/or EIB Group governing and controlling bodies,
- the legal entity, organisation (if any) with which you are associated,
- other EU institutions (including the European Commission and the European Ombudsman) or International Organisations,
- staff of other Independent Accountability Mechanisms in case of project-related complaints where the EIB Group co-finances the operation with other bilateral or multilateral financial institutions
- Promoters/Borrowers/Financial Intermediaries/Final beneficiary or any other international/national/local authority interacting with the EIB Group and/or with the EIB-CM for the purpose of its inquiry.
7. How long do we keep your personal data?
We keep your data only for as long as is necessary for the purposes described in this privacy statement. For more specific information as to the period for which we will keep your personal data, please contact us (see the section headed "Contact us", below).
8. What are your rights and how can you exercise them?
Your rights are set out in the Regulation (EU) No 2018/1725.
You have the right to ask us to (i) provide you with a copy of your personal data; (ii) correct your personal data; (iii) erase your personal data; or (iv) restrict our processing of your personal data. You can also object to our processing of your personal data.
You can also lodge a complaint about our processing of your personal data with the European Data Protection Supervisor (edps@edps.europa.eu) at any time if you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data by the EIB Group.
9. Contact us
If you have any questions about our processing of your personal data, or wish to exercise any of the rights described above, please contact us: complaints@eib.org or the EIB's Data Protection Officer, Mr. Pelopidas Donos, by email at p.donos@eib.org or at the following address:
Mr. Pelopidas Donos
European Investment Bank
98-100 Boulevard Konrad Adenauer
L-2950 Luxembourg (Grand Duchy of Luxembourg)