Processing of information and personal data
1. In relation to the processing of personal data in the Union Registry and the EUTL, the national administrators shall be regarded as controllers within the meaning of Article 4(7) of Regulation (EU) 2016/679. In relation to its responsibilities under this Regulation and the processing of personal data involved therein, the Commission shall be regarded as a controller within the meaning of Article 3(8) of Regulation (EU) 2018/1725.
2. In the case of a personal data breach detected by a national administrator, it shall without undue delay inform the central administrator and other national administrators about the nature and possible consequences of the breach and the measures taken and proposed to be taken to address the personal data breach and to mitigate the possible adverse effects.
3. In the case of a personal data breach detected by the central administrator, it shall without undue delay inform the national administrators about the nature and possible consequences of the breach and the measures taken by the central administrator and proposed to be taken by national administrators to address the personal data breach and to mitigate the possible adverse effects.
4. Arrangements on the respective responsibilities of the controllers for compliance with their data protection obligations shall be included in the terms of cooperation drawn up pursuant to Article 7(4).
5. The central administrator and Member States shall ensure that the Union Registry and the EUTL only store and process the information concerning the accounts, account holders and account representatives as set out in Table III-I of Annex III, Tables VI-I and VI-II of Annex VI, Table VII-I of Annex VII, and Table VIII-I of Annex VIII. Any other information to be provided pursuant to this Regulation shall be stored and processed outside the Union Registry or the EUTL.
6. National administrators shall ensure that information required by this Regulation but not stored in the Union Registry or the EUTL are processed in accordance with the relevant provisions of Union and national law.
7. No special categories of data as defined in Article 9 of Regulation (EU) 2016/679 and Article 10 of Regulation (EU) 2018/1725 shall be recorded in the Union Registry or the EUTL.
Records
1. The central administrator shall ensure that the Union Registry stores records concerning all processes, log data and account holders for five years after the closure of an account.
2. Personal data shall be removed from the records after five years of the closure of an account or after five years of the closure of business relationship, as defined in Article 3(13) of Directive (EU) 2015/849, with a natural person.
3. Personal data may be retained, with access restricted to the central administrator, for additional five years only for the purposes of investigation, detection, prosecution, tax administration or enforcement, auditing and financial supervision of activities involving allowances, or of money laundering, terrorism financing, other serious crime or market abuse for which the accounts in the Union Registry may be an instrument, or of breaches of Union or national law ensuring the functioning the EU ETS.
4. For the purposes of investigation, detection, prosecution, tax administration or enforcement, auditing and financial supervision of activities involving allowances, or of money laundering, terrorism financing, other serious crime or market abuse for which the accounts in the Union Registry may be an instrument, or of breaches of Union or national law ensuring the functioning the EU ETS, personal data controlled by national administrators may be retained after the closure of the business relationship until the end of a period corresponding to the maximum prescription period of these offences laid down in the national law of the national administrator.
5. Account information containing personal data, gathered pursuant to the provisions of this Regulation and not stored in the Union Registry or the EUTL shall be retained according to the provisions of this Regulation.
6. The central administrator shall ensure that national administrators are able to access, query and export all records held in the Union Registry in relation to accounts that are or were administered by them.
Reporting and availability of information
1. The central administrator shall make available the information referred to in Annex XIII to the recipients set out in Annex XIII in a transparent and organised manner. The central administrator shall take all reasonable steps to make available the information referred to in Annex XIII at the frequencies set out in Annex XIII. The central administrator shall not release additional information held in the EUTL or in the Union Registry unless this is permitted under Article 80.
2. National administrators may also make available the part of the information referred to in Annex XIII that they have access to in accordance with Article 80 at the frequencies and to the recipients set out in Annex XIII in a transparent and organised manner on a site publicly accessible via the internet. National administrators shall not release additional information held in the Union Registry unless this is permitted under Article 80.
Confidentiality
1. All information, including the holdings of all accounts, all transactions made, the unique unit identification code of the allowances held or affected by a transaction, held in the EUTL and the Union Registry shall be considered confidential except as otherwise required by Union law, or by provisions of national law that pursue a legitimate objective compatible with this Regulation and are proportionate.
The first subparagraph also applies to any information gathered pursuant to this Regulation and held by the central administrator or the national administrator.
2. The central administrator and the national administrators shall ensure that all persons who work or who have worked for them or entities to whom tasks are delegated, as well as experts instructed by them, are bound by the obligation of professional secrecy. They shall not divulge any confidential information which they may receive in the course of their duties, without prejudice to requirements of national criminal or taxation law or the other provisions of this Regulation.
3. The central administrator or national administrator may provide data stored in the Union Registry and the EUTL or gathered pursuant to this Regulation to the following entities:
(a)
the police or another law enforcement or judicial authority and tax authorities of a Member State;
(b)
the European Anti-fraud Office of the European Commission;
(c)
the European Court of Auditors;
(d)
Eurojust;
(e)
the competent authorities referred to in Article 48 of Directive (EU) 2015/849;
(f)
the competent authorities referred to in Article 67 of Directive 2014/65/EU;
(g)
the competent authorities referred to in Article 22 of Regulation (EU) No 596/2014;
(h)
European Securities and Markets Authority, established by Regulation (EU) No 1095/2010 of the European Parliament and of the Council ( 22 ) ;
(i)
Agency for the Cooperation of Energy Regulators established by Regulation (EC) No 713/2009 of the European Parliament and of the Council ( 23 )
(j)
competent national supervisory authorities;
(k)
the national administrators of Member States and the competent authorities referred to in Article 18 of Directive 2003/87/EC;
(l)
the authorities mentioned in Article 6 of Directive 98/26/EC;
(m)
the European Data Protection Supervisor and the competent national data protection authorities.
4. Data may be provided to the entities referred to in paragraph 3 upon their request to the central administrator or to a national administrator if such requests are justified and necessary for the purposes of investigation, detection, prosecution, tax administration or enforcement, auditing and financial supervision of activities involving allowances, or of money laundering, terrorism financing, other serious crime, market abuse for which the accounts in the Union Registry may be an instrument, or of breaches of Union or national law ensuring the functioning the EU ETS.
Without prejudice to requirements of national criminal or taxation law, the central administrator, the national administrators or other authorities, bodies natural or legal persons, which receive confidential information pursuant to this Regulation, may use it only in the performance of their duties and for the exercise of their functions, in the case of the central administrator and the national administrators, within the scope of this Regulation or, in the case of other authorities, bodies or natural or legal persons, for the purpose for which such information was provided to them and/or in the context of administrative or judicial proceedings specifically relating to the exercise of those functions.
Any confidential information received, exchanged or transmitted pursuant to this Regulation shall be subject to the conditions laid down in this Article. Nevertheless, this Article shall not prevent the central administrator and the national administrators from exchanging or transmitting confidential information in accordance with this Regulation.
This Article shall not prevent the central administrator and the national administrators from exchanging or transmitting, in accordance with national law, confidential information that has not been received from the central administrator or a national administrator of another Member State.
5. An entity receiving data in accordance with paragraph 4 shall ensure that the data received is only used for the purposes stated in the request in accordance with paragraph 4 and is not made available deliberately or accidentally to persons not involved in the intended purpose of the data use. This provision shall not preclude these entities to make the data available to other entities listed in paragraph 3, if this is necessary for the purposes stated in the request made in accordance with paragraph 4.
6. Upon their request, the central administrator may provide access to transaction data which do not allow the direct identification of specific persons to the entities referred to in paragraph 3 for the purpose of looking for suspicious transaction patterns. Entities with such access may notify suspicious transaction patterns to other entities listed in paragraph 3.
7. Europol shall obtain permanent read-only access to data stored in the Union Registry and the EUTL for the purposes of Article 18 of Regulation (EU) 2016/794 of the European Parliament and of the Council ( 24 ) . Europol shall keep the Commission informed of the use it makes of the data.
8. National administrators shall make available through secure means to all other national administrators and the central administrator the name, nationality and date and place of birth of persons for whom they refused to open an account in accordance with points (a), (b) and (c) of Article 19(2), or whom they refused to nominate as an authorised representative in accordance with points (a) and (b) of Article 21(5), and the name, nationality and birth date of the account holder and the authorised representatives of accounts to which access has been suspended in accordance with Articles 30(1)(c), 30(2)(a), 30(3)(a) and (b) and Article 30(4) or of accounts that have been closed in accordance with Article 28. National administrators shall ensure that the information is kept up to date and no longer shared when the grounds giving rise to sharing cease to exist. The information shall not be shared for more than five years.
National administrators shall inform the persons concerned about the fact that their identity was shared with other national administrators and about the duration of this information sharing.
The persons concerned may object to the information sharing at the competent authority or the relevant authority under national law within 30 calendar days. The competent authority or the relevant authority shall instruct the national administrator either to stop sharing the information or maintain the sharing of information in a reasoned decision, subject to requirements of national law.
The persons concerned may require the national administrator sharing information pursuant to the first subparagraph to present them the personal data that was shared concerning them. National administrators shall comply with such requests within 20 working days of receiving the request.
9. National administrators may decide to notify to national law enforcement and tax authorities all transactions that involve a number of units above the number determined by the national administrator and to notify any account that is involved in a number of transactions within a period that is above a number determined by the national administrator.
10. The EUTL and the Union Registry shall not require account holders to submit price information concerning allowances.
11. The auction monitor appointed pursuant to Article 24 of Regulation (EU) No 1031/2010 shall have access to all information concerning the auction collateral delivery account held in the Union Registry.
Fees
1. The central administrator shall not charge any fees to account holders in the Union Registry.
2. National administrators may charge reasonable fees to account holders and verifiers administered by them.
3. National administrators shall notify the central administrator of the fees charged and of any changes in the fees within ten working days. The central administrator shall display fees on a public website.
Interruption of operation
The central administrator shall ensure that interruptions to the operation of the Union Registry are kept to a minimum by taking all reasonable steps to ensure the availability and security of the Union Registry and of the EUTL within the meaning of Decision (EU, Euratom) 2017/46 and by providing for robust systems and procedures to safeguard all information.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
