1. Controller
This data protection statement provides information regarding the purpose of the processing carried out by the EIB Group’s Investigations Division (“IG/IN”) hereafter the “EIB” or “we” in the course of the exclusion proceedings conducted under the EIB Exclusion Policy.
In the course of this activity the processing of personal data does not involve the existence of automated decision-making, including profiling.
2. Purpose of the processing
This data protection statement provides information regarding the purpose of the processing carried out by the EIB in the course of Exclusion proceedings or negotiated settlements under the EIB Exclusion Policy. The EIB performs tasks in the exercise of the authority vested to it in accordance with the Provisions of the Treaties and its Statute.
The EIB processes your personal data as reasonably necessary so that it can conduct and manage Exclusion proceedings or negotiated settlements under the EIB Exclusion Policy, in a reasonable and proper manner, in accordance with applicable laws and regulations. Personal data are processed in accordance with Regulation (EC) 2018/1725 of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (hereafter, the EU DPR).
Specifically, the EIB processes the personal data for the below purposes as described in the record:
(i) managing a decision-making process on an exclusion case by the EIB of individuals, organisations, firms, or other entities found to have engaged in Prohibited Conduct as such term is defined in the EIB Group Anti-Fraud Policy. Exclusion means that the data subject is declared ineligible for a stated period to be awarded a contract under any EIB project or to enter into any relationship with the EIB, as per the provisions of the EIB Exclusion Policy; or
(ii) negotiating and implementing a Settlement Agreement between the EIB and an individual or entity to resolve a case which could otherwise give rise to an exclusion proceeding (Article XII of the Exclusion Policy); or
(iii) implementing a decision by the Commission to register any entity or individual in its Early Detection and Exclusion System (EDES).
3. Legal Basis of the processing
The legal basis for the processing of personal data in the course of the Exclusion proceedings is the public interest, and in particular:
(i) EIB Exclusion Policy (European Investment Bank Exclusion Policy (eib.org)
(ii) EIB Group Anti-Fraud Policy (EIB Anti-Fraud Policy)
(iii) EIB Guide to Procurement (Guide to Procurement for projects financed by the EIB)
4. Categories of data subjects
The following categories of individuals (data subjects) are/may be concerned by the processing under 2 above:
- Individuals who have been designated as a party in an EIB exclusion proceeding or negotiated settlement;
- Individuals who manage or control an entity designated as a party in an EIB exclusion proceeding or negotiated settlement;
- Individuals registered in EDES;
- Promoters, borrowers, contractors, suppliers, consultants, financial intermediaries, agents, advisers or other interested parties in an EIB-financed project;
- Applicants for EIB financing or tenderers for EIB projects;
- Candidates, applicants and tenderers for EU funding from the general budget or the European Development Fund, as well as the recipients of those Funds (contractors and subcontractors).
5. What personal data do we process?
The categories of personal data processed comprise:
- Identification data of the subject;
- Case involvement data, such as allegations, summary of facts and evidence related to the Prohibited Conduct involving the subject, statements and records made by or attributed to individuals in the context of an investigation, communications or notes mentioning the data subject in relation to the events under investigation, information concerning personal relationships;
- Professional data such as the positions, functions and organisations of an individual (current and historical);
- Recommendations of the EIB Exclusion Committee;
- Conditions and terms of a settlement agreement in case of negotiation; and
- Decisions of the EIB Management Committee in connection with an exclusion proceeding.
- In the context of an exclusion proceeding pursuant to a registration in EDES, the relevant items of processed data are the following: Name and address of an individual; Ground of exclusion; End date of the active warning; Reference to the authority that requested the warning.
6. Where do we obtain your personal data?
For the purposes of launching an exclusion proceeding concerning an EIB interested party, the data will already have been processed by the Investigations Division of the EIB in the context of its activities.
The data may be collected on the basis of a report by an EIB Group staff member or an external informant, including information from anonymous or confidential sources, national authorities, other Multilateral Development Banks or any other International Financial Institutions, or from the Early Detection and Exclusion System of the European Commission.
7. To whom is your data disclosed?
Duly authorised officers of the EIB, for whom access to the data is indispensable for the proper exercise of their tasks, have access to the data in the course of an exclusion proceeding. This includes the EIB’s Exclusion Committee, which is composed of five members including two external independent members subject to confidentiality agreement.
As per Article XI of the EIB Exclusion Policy, the EIB may, in full respect of the applicable data protection provisions (i) refer the case to the appropriate national and/or EU authorities for further investigation and/or criminal prosecution where criminal conduct is suspected, (ii) make available information to another concerned international or multinational organisation or body, including another development bank who may have an interest in the project, or (iii) an agency of a State.
Furthermore, once a decision has been taken, EIB’s exclusion decisions related to a natural person are made available to EIB staff members who need access to the data for the proper exercise of their tasks until the end of the exclusion period.
8. International Transfers
Your data may be transferred to entities established outside the EU or the European Economic Area as per section 7) above and the below safeguards are in place: Derogations and / or Memoranda of Understanding between EIB and third countries (Regulation (EU) 2018/1725), Articles 47, 48 and 50d), e).
9. How long do we keep your personal data?
We keep your data only for as long as is necessary for the purposes described in this data protection statement and in line with the relevant policies.
Paper and electronic files pertaining to an exclusion proceeding or negotiated settlement will be destroyed 10 years after the close of an exclusion case, which corresponds to: (i) the end of an exclusion period and consequently the compliance of the data subject with the Bank’s conditions, if any; or (ii) the compliance of the individual/entity with the terms and conditions of the agreement in case of negotiated settlement.
10. What are your rights and how can you exercise them?
Your rights are set out in sections 3 to 5 of the EU DPR.
- You have the right to obtain from the controller confirmation as to whether or not your personal data are being processed, and, if so, to access your personal data by contacting the Controller or through the EIB DPO (right of access);
- You have the right to request the controller to rectify any inaccurate data and/or have incomplete personal data completed (right for rectification);
- You have the right to request the controller to erase your personal data as per Article 19 of the EU DPR (right to be forgotten);
- You have the right to request the controller to restrict the processing of your personal data in the following cases (right to restriction of processing):
(i) if you contest the accuracy of your data;
(ii) if the processing of the data is unlawful and you oppose to their erasure;
(iii) if the controller no longer needs the personal data referred to for the purposes of the processing but you require them for the establishment, exercise or defence of legal claims; or
(iv) if you have objected to the processing of your data and EIB seeks to establish whether the controller has legitimate grounds overriding yours right to restriction.
- You have the right to object to the processing of personal data, on grounds relating to your particular situation, unless EIB demonstrates compelling legitimate grounds for the processing or for the establishment, exercise or defence of legal claims;
- You have the right to receive your personal data from the EIB in a structured, commonly used and machine-readable format to allow you to transmit your data to another controller without hindrance from the EIB (right to data portability);
- When the legal basis of the processing is the consent, data subject has the right to withdraw his/her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
- Exceptions and restrictions under Article 25 of Regulation (EU) 2018/1725 and relevant EIB decision may apply to EIB investigations. The relevant EIB decision is available Here;
- You have the right to lodge a complaint with the European Data Protection Supervisor (www.edps.europa.eu) at any time (right to lodge a complaint).
11. Contact us
If you have any questions about our processing of your personal data, or wish to exercise any of the rights described above, please contact us: Investigations@eib.org or the EIB's Data Protection Officer, Mr. Pelopidas Donos by email at p.donos@eib.org or at the following address:
Mr. Pelopidas Donos, European Investment Bank 98-100 Boulevard Konrad Adenauer, L-2950 Luxembourg (Grand Duchy of Luxembourg).