Circular 2/2013 of the Bank of Spain Creating and Modifying Personal Data Files

VIEWING THE REGULATION

Index

Full Regulation

Regulation as of a Date

Current Regulation

Circular 2/2013, of June 27, of the Bank of Spain, creating and modifying personal data files. (BOE of July 8, 2013)

The descriptions of the automated files containing personal data existing at the Bank of Spain are collected in Circulars 2/2005, of February 25; 4/2005, of December 23; 4/2008, of October 31; 1/2011, of January 26, and 3/2012, of March 28, in compliance with the provisions of Article 20 of Organic Law 15/1999, of December 13, on the protection of personal data, and in Title V of the Regulation of said Organic Law 15/1999, approved by Royal Decree 1720/2007, of December 21, regarding the creation, modification, or suppression of files by Public Administrations.

Changes in the applicable reference legislation for several files, as well as in some management processes, make it necessary to modify five files and create two new ones.

The modifications to files with personal data collected in this circular affect files created or modified by Circulars 2/2005, of February 25; 4/2008, of October 31, and 1/2011, of January 26.

The descriptions of the five files being modified are in the annex of this circular. These descriptions replace the corresponding descriptions included in the circular of creation or last modification of the file, as applicable to each file.

Regardless of the potential data recipients listed in the sections "Transfers of personal data" and "Transfers of personal data to third countries" in the descriptions of the various files, and in accordance with the provisions of Article 6 of Legislative Royal Decree 1298/1986, of June 28, as amended by Law 37/1998, of November 16, the data, documents, and information held by the Bank of Spain by virtue of the functions entrusted to it by laws are confidential; however, they may be transferred to the authorities, bodies, or groups enumerated in paragraph 4 of said provision.

Likewise, and by virtue of the provisions of paragraph 1 of the aforementioned article, the Bank of Spain may communicate information regarding the direction, management, and ownership of credit institutions, as well as that which may facilitate the control of their solvency and any other that favors their supervision or serves to prevent, pursue, or sanction irregular conduct, to those authorities entrusted with similar functions in foreign states.

Furthermore, the "Transfers of personal data" and "Transfers of personal data to third countries" of the "Foreign Operations" file, modified by this circular, will be carried out with the prior and unequivocal consent of the affected parties, in accordance with the scenario contemplated in paragraph e) of Article 34 of Law 15/1999, of December 13.

For all the above, the Bank of Spain, in exercise of the powers conferred by Law 13/1994, of June 1, on the Autonomy of the Bank of Spain, in accordance with the procedure provided therein, has established the following rules:

First Rule.

The file "Return of Withholdings on Interest" is modified in the sections "Reference Legislation," "Purpose of the File and Intended Uses," "Origin of the Data," "Groups or Categories of Interested Parties," "Basic Structure of the File and Types of Personal Data Included in It," and "Transfers of Personal Data." The description appearing in the annex of this circular replaces that of the file of the same name contained in the annex of Circular 4/2008 of the Bank of Spain, of October 31, updating Circular 2/2005, of February 25, on automated files with personal data managed by the Bank of Spain.

Second Rule.

The file "Sanctioning Proceedings" is modified in the sections "Reference Legislation," "Purpose of the File and Intended Uses," "Origin of the Data," "Groups or Categories of Interested Parties," and "Transfers of Personal Data." The description appearing in the annex of this circular replaces that of the file of the same name contained in the annex of Circular 4/2008 of the Bank of Spain, of October 31, updating Circular 2/2005, of February 25, on automated files with personal data managed by the Bank of Spain.

Third Rule.

The file "Contracting Management" is modified in the section "Purpose of the File and Intended Uses." The description appearing in the annex of this circular replaces that of the file of the same name contained in the annex of Circular 1/2011 of the Bank of Spain, of January 26, on the creation, modification, and suppression of files with personal data managed by the Bank of Spain.

Fourth Rule.

The file "Foreign Operations" is modified in the sections "Purpose of the File and Intended Uses," "Origin of the Data," "Groups or Categories of Interested Parties," and "Transfers of Personal Data." The description appearing in the annex of this circular replaces that of the file of the same name contained in Annex II of Circular 2/2005 of the Bank of Spain, of February 25, on automated files with personal data managed by the Bank of Spain.

Fifth Rule.

The files "Researcher Portal. Data of Researchers" and "Personnel Budget" are created, whose descriptions are in the annex of this circular. These files are of an internal or operational nature.

Sixth Rule.

The file "Register of Agents of Credit and Payment Institutions" is modified in the sections "Reference Legislation," "Purpose of the File and Intended Uses," "Basic Structure of the File and Types of Personal Data Included in It," and "Transfers of Personal Data to Third Countries." The description appearing in the annex of this circular replaces that of the file of the same name contained in the annex of Circular 1/2011 of the Bank of Spain, of January 26, on the creation, modification, and suppression of files with personal data managed by the Bank of Spain.

Final Rule.

This circular shall enter into force on the day of its publication in the Official State Bulletin.

ANNEX

File: Return of Withholdings on Interest

File Manager.

Bank of Spain.

Data Protection Officer of the File.

Operations Department.

Rights of access, rectification, cancellation, and opposition.

Operations Department.

C/ Alcalá, 48.

28014 Madrid.

Reference Legislation.

Royal Decree 1145/2011, of July 29.

Type of File.

Managed by the Bank of Spain by virtue of the public functions entrusted to it by Law 13/1994, of June 1.

Purpose of the File and Intended Uses.

Management of requests for the return of withholdings applied to the interest on public debt recorded in third-party accounts, presented by the entities managing the Public Debt in Annotations Market.

Type of Purpose and Intended Uses of the File:

– Public Treasury and tax administration management.

– Public economic-financial management.

– Fiscal and administrative accounting management.

Origin of the Data.

– Other natural persons.

– Private entity.

Groups or Categories of Interested Parties.

– Legal representatives.

Basic Structure of the File and Types of Personal Data Included in It

– Specially Protected Data:

Does not include data of this type.

– Data Related to the Commission of Offenses:

Does not include data of this type.

– Identifying Data:

• NIF/DNI (Tax ID/Identity Card).

• Name and Surname.

– Other Classified Data:

• Economic, financial, and insurance data.

Treatment System.

Automated.

Security Measures.

Medium Level.

Transfers of Personal Data.

– Public Treasury and Tax Administration.

– Others: Debt Issuers.

Transfers of Personal Data to Third Countries

No data transfers are planned.

File: Sanctioning Proceedings

File Manager.

Bank of Spain.

Data Protection Officer of the File.

Technical Secretariat Department.

Rights of access, rectification, cancellation, and opposition.

Technical Secretariat Department.

C/ Alcalá, 48.

28014 Madrid.

Reference Legislation.

– Law 26/1988, of July 29 ("BOE" of the 30th).

– Law 30/1992, of November 26 ("BOE" of the 27th).

– Royal Decree 1398/1993, of August 4 ("BOE" of the 9th).

– Royal Decree 2119/1993, of December 3 ("BOE" of the 23rd).

– Law 1/1994, of March 11 ("BOE" of the 12th).

– Law 13/1994, of June 1 ("BOE" of the 2nd).

– Additional and Tenth Provisions of Law 3/1994, of April 14 ("BOE" of the 15th).

– Article 178 of Law 13/1996, of December 30 ("BOE" of the 31st).

– Law 41/2007, of December 7 ("BOE" of the 8th).

– Law 16/2009, of November 13 ("BOE" of the 14th).

Type of File.

Managed by the Bank of Spain by virtue of the public functions entrusted to it by Law 13/1994, of June 1.

Purpose of the File and Intended Uses.

Processing of sanctioning proceedings by the Bank of Spain in the exercise of legally attributed supervisory powers.

Type of Purpose and Intended Uses of the File:

– Sanctioning management.

Origin of the Data.

– The interested party themselves or their legal representative.

– Public registers.

– Public Administrations.

Groups or Categories of Interested Parties.

– Other groups: administrators and executives of entities subject to the Bank of Spain's supervision, as well as other natural persons subject to the Bank of Spain's disciplinary or sanctioning power.

Basic Structure of the File and Types of Personal Data Included in It.

– Specially Protected Data:

Does not include data of this type.

– Data Related to the Commission of Offenses:

• Data related to administrative offenses.

– Identifying Data:

• NIF/DNI.

• Name and Surname.

• Address.

• Telephone.

• Other identifying data: email address, foreigner personal identification number.

Treatment System.

Automated.

Security Measures.

Medium Level.

Transfers of Personal Data

Types of Recipient:

– Public Treasury and Tax Administration.

– Public registers.

– Judicial bodies.

– Other bodies of the State Administration.

– Other bodies of the Autonomous Community.

Transfers of Personal Data to Third Countries.

No data transfers are planned.

File: Contracting Management

File Manager.

Bank of Spain.

Data Protection Officer of the File.

Acquisitions and General Services Department.

Rights of access, rectification, cancellation, and opposition.

Acquisitions and General Services Department.

C/ Alcalá, 48.

28014 Madrid.

Type of File.

Of an internal or operational nature.

Purpose of the File and Intended Uses.

Management of the processing of contracting files and control of expenditure via payments to suppliers; control of income from non-financial goods and services clients; and control of expenses and investments with the necessary treatments to comply with tax obligations for Value Added Tax (VAT), Canary Islands General Indirect Tax (IGIC), Tax on Production, Services and Import in the cities of Ceuta and Melilla (IPSI), Personal Income Tax (IRPF), and the annual declaration of operations with third parties.

Type of Purpose and Intended Uses of the File:

– Fiscal and administrative accounting management.

– Administrative procedure.

Origin of the Data.

– The interested party themselves or their legal representative.

– Sources accessible to the public.

– Public Administrations.

Groups or Categories of Interested Parties.

– Suppliers.

– Legal representatives.

– Contact persons.

– Applicants.

– Other groups (non-financial goods and services clients, bidders).

Basic Structure of the File and Types of Personal Data Included in It.

– Specially Protected Data:

Does not include data of this type.

– Data Related to the Commission of Offenses:

Does not include data of this type.

– Identifying Data:

• NIF/DNI.

• Name and Surname.

• Address.

• Telephone.

• Signature.

• Other identifying data: email address, fax number.

– Other Classified Data:

• Commercial information.

• Economic, financial, and insurance data.

• Social circumstances.

• Academic and professional data.

Treatment System.

Automated.

Security Measures.

Basic Level.

Transfers of Personal Data.

– Public Treasury and Tax Administration.

– Court of Accounts or equivalent autonomous bodies.

Transfers of Personal Data to Third Countries.

No data transfers are planned.

File: Foreign Operations

File Manager.

Bank of Spain.

Data Protection Officer of the File.

Payment Systems Department.

Rights of access, rectification, cancellation, and opposition.

Payment Systems Department.

C/ Alcalá, 48.

28014 Madrid.

Type of File.

Of an internal or operational nature.

Purpose of the File and Intended Uses.

Processing of collection and payment orders in foreign currency and maintenance of foreign currency deposits of public bodies.

Type of Purpose and Intended Uses of the File:

– Other purposes.

Origin of the Data.

– The interested party themselves or their legal representative.

– Other natural persons.

– Private entity.

– Public Administrations.

Groups or Categories of Interested Parties.

– Employees.

– Taxpayers and obligated subjects.

– Legal representatives.

– Beneficiaries.

Basic Structure of the File and Types of Personal Data Included in It

– Specially Protected Data:

Does not include data of this type.

– Data Related to the Commission of Offenses:

• Data related to administrative offenses.

– Identifying Data:

• NIF/DNI.

• Name and Surname.

• Address.

• Telephone.

• Signature/fingerprint.

– Other Classified Data:

• Economic, financial, and insurance data.

Treatment System.

Automated.

Security Measures.

Medium Level.

Transfers of Personal Data.

– Other bodies of the State Administration.

– Judicial bodies.

– Credit entities.

– Other financial entities.

Transfers of Personal Data to Third Countries

– Financial entities.

File: Researcher Portal. Data of Researchers

File Manager.

Bank of Spain.

Data Protection Officer of the File.

Research Division.

Rights of access, rectification, cancellation, and opposition.

Research Division.

C/ Alcalá, 48.

28014 Madrid.

Type of File.

Of an internal or operational nature.

Purpose of the File and Intended Uses.

Publication on the Researcher Portal (Economic Research Portal), located within the Bank of Spain website, of the data voluntarily provided by researchers working at the Bank of Spain, in order to disseminate the content of their research.

Type of Purpose and Intended Uses of the File:

– Publications.

– Other purposes.

Origin of the Data.

– The interested party themselves or their legal representative.

Groups or Categories of Interested Parties.

– Employees.

– Other groups: contracted collaborators.

Basic Structure of the File and Types of Personal Data Included in It.

– Specially Protected Data:

Does not include data of this type.

– Data Related to the Commission of Offenses:

Does not include data of this type.

– Identifying Data:

• Name and Surname.

• Address.

• Image/voice.

• Other identifying data: email address, job position.

– Other Classified Data:

• Academic and professional data.

Treatment System.

Mixed.

Security Measures.

Basic Level.

Transfers of Personal Data.

No data transfers are planned.

Transfers of Personal Data to Third Countries.

No data transfers are planned.

File: Personnel Budget

File Manager.

Bank of Spain.

Data Protection Officer of the File.

Organization and Development Division.

Rights of access, rectification, cancellation, and opposition.

Organization and Development Division.

C/ Alcalá, 48.

28014 Madrid.

Type of File.

Of an internal or operational nature.

Purpose of the File and Intended Uses.

Preparation, monitoring, and analysis of the Bank of Spain's personnel expense budget.

Type of Purpose and Intended Uses of the File:

– Human resources.

– Public economic-financial management.

Origin of the Data.

– Public Administrations.

Groups or Categories of Interested Parties.

– Employees.

Basic Structure of the File and Types of Personal Data Included in It.

– Specially Protected Data:

Does not include data of this type.

– Data Related to the Commission of Offenses:

Does not include data of this type.

– Identifying Data:

• Personnel registration number.

• Name and Surname.

• Other identifying data: date of birth.

– Other Classified Data:

• Personal characteristics.

• Academic and professional data.

• Employment details.

• Economic, financial, and insurance data.

Treatment System.

Automated.

Security Measures.

Basic Level.

Transfers of Personal Data.

No data transfers are planned.

Transfers of Personal Data to Third Countries.

No data transfers are planned.

File: Register of Agents of Credit and Payment Institutions

File Manager.

Bank of Spain.

Data Protection Officer of the File.

Financial Institutions Department.

Rights of access, rectification, cancellation, and opposition.

Financial Institutions Department.

C/ Alcalá, 48.

28014 Madrid.

Reference Legislation.

– Article 22 of Royal Decree 1245/1995, of July 14.

– Bank of Spain Circular 4/2010.

– Royal Decree 712/2010, of May 28.

Type of File.

Managed by the Bank of Spain by virtue of the public functions entrusted to it by Law 13/1994, of June 1.

Purpose of the File and Intended Uses.

List of agents with powers to act habitually on behalf of clients, in the name and on behalf of credit institutions and payment institutions, including those from the EU providing services in Spain.

Type of Purpose and Intended Uses of the File:

– Administrative procedure.

Origin of the Data.

– Private entity.

Groups or Categories of Interested Parties.

– Applicants.

– Other groups: agents of supervised entities.

Basic Structure of the File and Types of Personal Data Included in It.

– Specially Protected Data:

Does not include data of this type.

– Data Related to the Commission of Offenses:

Does not include data of this type.

– Identifying Data:

• NIF/D