Privacy statement for issuance of the Union laissez-passer

What is our legal framework?

All personal data are processed in accordance with European Union data protection law, that is to say in line with Regulation (EU) 2018/1725 (‘EUDPR’).

Why do we process personal data?

Personal data are processed for the issuance of the Union laissez-passer for staff members of the European Central Bank (ECB), staff members of institutions and special applicants.

For the purposes of this privacy statement, ‘institutions’ means the institutions, agencies, and other bodies of the European Union, as well as to the European External Action Service.

The ECB’s Security and Safety Division, within the Directorate Administration of the Directorate General Corporate Services collects and uses personal data to issue Union laissez-passer to institutions’ staff members or special applicants as defined by Council Regulation (EU) No 1417/2013 with a view of facilitating their work when travelling or residing abroad for service.

According to Council Regulation (EU) No 1417/2013, the Union laissez-passer must be accorded and issued solely in the interest of the Union. The Union laissez-passer may be issued to all eligible institutions’ applicants (according to Council Regulation No 1417/2013 and to Decision (EU) 2021/2321 of the European Central Bank).

The European Commission coordinates the issuance process for all the institutions’ applications within a single uniform system.

The ECB, as the issuing authority, will process the personal data of eligible staff members or special applicants necessary for the issuance of the Union laissez-passer.

The Commission coordinates the implementation of Council Regulation (EU) No 1417/2013 to ensure that personal data are not made available to more persons than necessary. The ECB, however, has decided to host a dedicated enrolment centre for its staff members and if needed, externals from other institutions

The rationale for the procedure related to the issuance of the Union laissez-passer is the following.

The Union laissez-passer is a travel document granted to a list of officials and other servants of the institutions. Council Regulation (EU) No 1417/2013 introduced a new category of so-called special applicants, as defined in Article 1 of Annex II to Council Regulation (EU) No 1417/2013.

Council Regulation (EU) No 1417/2013 foresees capturing both biographical and biometric personal data (facial image and two digital fingerprints) to identify unambiguously the laissez-passer applicant. This activity is conducted in the enrolment phase of the issuing process.

In this context, it has been contractually agreed between the ECB and the European Commission, that the Commission would act on behalf of all other institutions. However, the ECB has decided to host a dedicated enrolment and delivery centre. The Commission runs two enrolment centres, one in Brussels and one in Luxembourg, and supports the ECB centre in Frankfurt am Main.

For the two other steps of the issuance process, the design and production of the Union laissez-passer and its personalisation, Council Regulation (EU) No 1417/2013 establishes that the Commission must designate an entity to be responsible ‘taking into account the sensitive nature of the documents to be produced’ and in accordance with the provisions applicable to the award of contracts. Finally, once personalised, the Union laissez-passer are sent back to the Commission to check the quality and readability and ensure the delivery of each of them hand by hand or through remote delivery to the final holder.

The personal data for the Union laissez-passer will not be used for automated decision-making including profiling.

Each Union laissez-passer remains property of the Union.

What is the legal basis for processing your personal data?

Your personal data are processed by the ECB:

• a) in the performance of a task carried out in the public interest, based on Article 5(1)(a) of EUDPR, in conjunction with:
  • Article 11.6 of the Statute of the European System of Central Banks and of the European Central Bank (for current ECB business activities);
  • Article 6 of Protocol (No 7) on the Privileges and Immunities of the Union. The laissez-passer is a requirement of the Article 6 of the Protocol N°7 on Privileges and Immunities annexed to the Treaty. The principle expressed in the Protocol is translated in the Article 23 of the Commission’ Staff Regulations and Articles 11 and 81 of the Conditions of Employment of the Other Servants of the European Union;
  • Council Regulation (EU) No 1417/2013 laying down the form of the laissez-passer, as the legal basis for collecting and processing personal data for the issuance of the Union laissez-passer for ECB staff members and special applicants;
  • In this particular case, Council Regulation (EU) No 1417/2013 indicates that the laissez-passer should comply with the security standards and technical specifications applicable to the national travel documents issued by the Member States pursuant to Union law and maintain compliance with the specifications of the International Civil Aviation Organisation. This includes that common security standards and interoperable biometric identifiers should be integrated into the laissez-passer in addition to the biographical data.
  • Decision (EU) 2021/2321 of the European Central Bank of 10 December 2021 on the delegation of decisions on the issuing of Union laissez-passer for applicants falling under the authority of the European Central Bank (ECB/2021/55).
• b) because you consented to this processing by providing the personal data requested. You may withdraw your consent at any time by contacting ssc@ecb.europa.eu. All processing of your personal information will stop once you withdraw your consent; however, any processing that has already taken place remains lawful.
• c) legal basis for processing of special categories of personal data, as specified in Article 10(2) of EUDPR:
  • The consent is explicitly collected from the applicant when filling the application form for one or more specified purposes and is sent to the ECB;
  • Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security;
  • Processing is necessary for reasons of substantial public interest, on the basis of Union law which shall be proportionate to the aim pursued.

Who is responsible for processing your personal data?

The roles have been contractually agreed between the ECB and the Commission.

ECB as Controller

The organisational unit conducting the processing activity is the ECB’s Security and Safety Division within the Directorate Administration of the Directorate General Corporate Services.

The ECB acts as the controller for all personal data, in particular biographical and biometric, of its own staff members and special applicants for the following processing activities:

• (pre-) enrolment of ECB staff members / special applicants (Biographical data);
• enrolment of ECB staff members / special applicants (Biometric data);
• delivery by hand for ECB staff members / special applicants (Delivery data);
• remote delivery for ECB staff members / special applicants (Delivery data);
• collection of expired Union laissez-passer travel documents and return to the Commission for ECB staff members / special applicants (Delivery data);

ECB as Processor

The ECB acts as the processor for all personal data for the following processing activities, in which the Commission is the controller (including for ECB staff members after receipt of the encrypted set of data):

• enrolment of all other institutions’ staff members and special applicants (Biometric data);

The Commission acts as the controller for all other institutions’ staff members, including ECB staff members for the following processing activities:

• production, personalisation of the external contractor (Data for the Union laissez-passer) (the external contractor acts as processor);
• verification before delivery (Data on the Union laissez-passer).

The data is processed by a third party (external contractor) or the processing activity is conducted together with an external third party. The external contractor acts as processor on behalf of the Commission and, following the national rules he applies also (or not) as controller in the national system. The external contractor is hired by the Commission – European Commission’s online record of processing activity.

Who will be the recipients of your personal data?

The recipients of your personal data (including entities who have access to that personal data) are:

- data subject themselves;

- managers of the data subjects;

- designated institutions’ staff members *

- other:

• the ECB Director General Corporate Services and in the case of their unavailability, the ECB Director Administration is given the power to issue the Union laissez-passer to ECB applicants;
• designated staff members of the Commission** and the external contractors used by the Commission, as identified in the Commission’s online record of processing activity.
• the data protection officers of all the institutions, services and bodies as well as agencies that are part to the system and have signed the Service Level Agreement with the Commission;
• the national authorities including those of third countries, responsible for border control;
• the national authorities in charge of security at the border, including at airports, maritime or fluvial ports, including those of third countries;
• the national authority responsible for the management of lost and/or stolen documents including those of third countries;
• the Court of Justice of the European Union and the national courts, including those of third countries, within the remit of their competences;
• the disciplinary bodies in the institutions, notably the Investigation and Disciplinary Office of the Commission;
• the European Anti-Fraud Office (OLAF);
• the Auditors;
• Europol;
• Interpol, Schengen Information System II, supplementary information request at the national entries (SIRENE);
• the European Union Agency for Law Enforcement Training (CEPOL);
• the Commission’s central alert system 24/7 within the remit of its competences and on a need-to-know basis.

This list can be extended to hierarchical superiors of staff and of other persons executing tasks under their responsibility.

*All the persons with access to the service for the purpose of fulfilling their tasks in the Security and Safety Division of the ECB and in the Union laissez-passer issuance service and the Commission’s Union laissez-passer central service in Brussels.

** Access to your personal data is provided to the Commission staff members responsible for carrying out this processing operation and to authorised staff members according to the ‘need-to-know’ principle. Further details on how the Commission processes your personal data can be found the Commission’s Privacy Statement for the issuance of the laissez-passer of the European Union, accessible via the European Commission’s online record of processing activity.

What categories of personal data are collected?

The ECB processes the following personal data:

• General personal data
  • personal details (name, surname, date of birth, place of birth, nationality, gender, as established in Annex I of the Council Regulation (EU) No 1417/2013);
  • employment details (staff type, job information including assignment, job types, position, job titles, statutory link, external transfers or mobility, posting/address);
  • family, lifestyle and social circumstances (family position includes the information (surname, name, date of birth, nationality, gender, address, link with the original holder) for each family member applying for a Union laissez-passer in connection with an application for or the holding of a Union laissez-passer by the original holder);
  • Union laissez-passer number. Detailed data included in each personalised Union laissez-passer may differ following the specific requirements inherent to each demand, in particular the position in the diplomatic list of mentions;
• Special categories of personal data (Article 10 of EUDPR)
  • Biometric data:
  • The following biometric data are collected in all cases except for children below 12 years old who do not provide their fingerprints:
    • facial image (photo);
    • fingerprints;
    • electronic signature of the holder.
    • Note: All previous applicable information must be provided by the persons concerned following Council Regulation (EU) No 1417/2013 that indicates the Union laissez-passer should comply with the security standards and technical specifications applicable to the national travel documents issued by the Member States pursuant to Union law and maintaining compliance with the specifications of the International Civil Aviation Organisation. Failure to do so may cause the application to be refused.

Will your personal data (in a clear or encrypted form) be processed (e.g. transferred, accessed or stored) in third countries or by international organisations?

No.

How long will the ECB and the Commission keep personal data?

Retaining personal data necessary to fulfil the purpose of collection or further processing of the Union laissez-passer, responds to the principle of proportionality and is accepted by the holder.

The Commission:

- Fingerprints and the digital signature are not stored for a period longer than the time necessary for the effective and successful delivery of the Union laissez-passer. They are deleted at that time (a few days depending on the day the future holder takes to come and collect the personalised document with a maximum of three months). Nevertheless, they remain stored on the laissez-passer’s chip, under the holder’s responsibility including for their submission to the controls operated at the borders.

- The Commission stores the original application form for the corresponding period of validity of the Union laissez-passer.

- The Commission stores the biographical data and the facial image of all applicants/special applicants, including those belonging to the ECB for a period equivalent to the period of validity of the Union laissez-passer (maximum six years) for both paper and electronic versions.

- Biographical data are deleted upon expiration of the validity period (maximum six years), starting from the date of issuance of the Union laissez-passer. This retention period is without prejudice to a longer storage time of the same data for other purposes, for instance of cases of audit or control activities, in other systems of the institution of origin. At the end of those retention periods, the biographical data will be erased from the Commission Union laissez-passer central service databases.

- The storage includes a period of three months maximum of storage extending from the period between the validation of the personalised laissez-passer by the competent staff of the Commission service and the moment of its concrete delivery to the future holder, after which the laissez-passer is destroyed if not delivered. This period of three months corresponds also to the maximum period of retention for the fingerprints, the precise end of which depends on the day the future holder accepts the personalised Union laissez-passer and enters in possession (in the meaning of “receives it” as he is not the owner of it).

The ECB:

a) For hardcopies of biographical data:

- of ECB staff members: the retention period follows the general retention period of the personnel file, i.e. ten years after all rights of the staff member or dependent are extinguished.

- of other institutions’ staff members: the data is only stored until the delivery of the Union laissez-passer to the applicant.

- of special applicants, including members of the family, and of ad hoc holders: the retention period should be limited to the period of validity of the Union laissez-passer (maximum six years). Biographical data that are not stored for other processes are deleted upon expiration of the validity period starting from the date of issuance of the Union laissez-passer.

At the end of those retention periods, the biographical data are erased.

b) For biometric data

The retention should be limited to the need as defined by the state of the art, for all holders.:

The ECB deletes all digital’ biographical and biometric data at the Frankfurt am Main enrolment centre from the moment of the successful reception of the enrolment data by the Commission’s laissez-passer central service in Brussels. This means a few days after the encrypted sending to Brussels but no longer than three months.

At the expiration of the validity period of the Union laissez-passer, it must be returned to the Commission to be cancelled and/or partially or completely destroyed. After this process, where the Union laissez-passer is cancelled but not completely destroyed, it may be kept by the holder. In this case, the data (both biographical and biometric) continue to be accessible on the invalid Union laissez-passer under the sole responsibility of the holder. Access to biometric data would nevertheless continue to depend on the use of specific technical devices not commercially easily accessible.

c) Application form:

A copy of the application form of ECB staff members is stored during the validity period of the Union laissez-passer. The original form is sent to the Commission’s laissez-passer central service in Brussels. The data is deleted when the Union laissez-passer is returned

The contractor:

For biographical data and for biometric data (facial image, fingerprints and digital signature), the retention period is limited to the time needed to issue the Union laissez-passer after successful validation and fulfilment of the acceptance process (normally a few days and up to a maximum of three months).

What are your rights?

You have the right to access your personal data and correct any data that is inaccurate or incomplete. You also have (with some limitations) the right to delete your personal data and to object to or to restrict the processing of your personal data in line with EUDPR. The ECB may restrict your rights to safeguard the interests and objectives referred to in Article 25(1) EUDPR.

Who can you contact for queries or requests?

You can exercise your rights by contacting the Security Service Centre at ssc@ecb.europa.eu. You can also directly contact the ECB’s Data Protection Officer at dpo@ecb.europa.eu for all queries relating to your personal data.

Addressing the European Data Protection Supervisor

If you consider that your rights under the EUDPR have been infringed as a result of the processing of your personal data, you have the right to lodge a complaint with the European Data Protection Supervisor at any time.