Circular 2/2005 of the Bank of Spain on Automated Files with Personal Data Managed by the Bank of Spain

Skip to main content.

VIEWING THE REGULATION

Index

Full Regulation

Regulation at a Date

Current Regulation

Consolidated Text

Circular 2/2005, of February 25, of the Bank of Spain, on automated files with personal data managed by the Bank of Spain. (BOE of March 22)

Article 20, paragraph 1, of Organic Law 15/1999, of December 13, on the Protection of Personal Data, establishes that the creation, modification, or suppression of files belonging to public administrations may only be done through a general provision published in the Official State Bulletin or the corresponding Official Gazette.

With regard to automated files with personal data, this mandate of Organic Law 15/1999 has been satisfied by the Bank of Spain since its adaptation to the provisions of Organic Law 5/1992, of October 29, on the Regulation of the Automated Processing of Personal Data, which in its article 18 contained a similar mandate. The regulatory instrument used for this purpose is Circular 4/1994, of June 22, Files with personal data managed by the Bank of Spain, whose content, which has been updated several times by successive circulars, consists of the descriptions of all automated files with personal data existing in the Bank of Spain.

Recently, a general review of the automated processing of data at the Bank of Spain has been carried out, from the point of view of compliance with the requirements established by Organic Law 15/1999. The review has highlighted a double need: 1) Various modifications must be introduced in all automated files with personal data existing in the Bank of Spain to achieve full adaptation to the provisions of Organic Law 15/1999, and the descriptions of the files must be updated accordingly; 2) six files must be created and two suppressed; the descriptions of the files that are created must be drafted, joining them to those of the other files, and the descriptions of the files that are suppressed must be eliminated.

Given the importance and magnitude of the modifications to be made, it has been considered appropriate to replace Circular 4/1994 with a new one, in which, in addition to the descriptions of all files, the explanatory aspects are also adapted to the new reality defined by Organic Law 15/1999.

The new Circular preserves the distinction that Circular 4/1994 makes between the files that the Bank of Spain manages in attention to the public functions entrusted to it by Law 13/1994, of June 1, on the Autonomy of the Bank of Spain (Annex I), and those that it manages solely to attend to its own internal or operational functioning (Annex II).

In accordance with that distinction, each of the files contained in Annex I includes a reference regulation, indicative of the one that generally regulates the substantive aspects of the information to which the file refers.

For all the above, the Bank of Spain, in exercise of the powers conferred upon it by Law 13/1994, of June 1, on the Autonomy of the Bank of Spain, and in accordance with the procedure provided for therein, has ordered:

First Provision.

In accordance with the provisions of Article 20 of Organic Law 15/1999, of December 13, on the Protection of Personal Data, the automated processing files listed in the corresponding sections of the Supplementary Annex of this Circular are created, modified, or suppressed.

Second Provision.

The descriptions of the files that are created or modified appear in Annexes I, "Files managed by the Bank of Spain by virtue of the public functions entrusted to it by Law 13/1994, of June 1, and other applicable legislation" and II, "Internal or operational files", of this Circular, according to the purpose of each of them.

Third Provision.

Regardless of the potential data recipients listed in the sections "Transfers of personal data" and "Transfers of personal data to third countries", in the descriptions of the various files, and in accordance with the provisions of Article 6 of Legislative Royal Decree 1298/1986, of June 28, as amended by Law 37/1998, of November 16, the data, documents, and information held by the Bank of Spain by virtue of all functions entrusted to it by laws, have a reserved character, although they may be transferred to the authorities, bodies, or groups enumerated in paragraph 4 of the aforementioned provision.

Likewise, and by virtue of the provisions of paragraph 1 of the aforementioned article, the Bank of Spain may communicate information regarding the address, management, and ownership of credit institutions, as well as those that may facilitate the control of their solvency and any other that may facilitate their supervision or serve to prevent, pursue, or sanction irregular conduct, to those authorities that have similar functions entrusted to them in foreign states.

Fourth Provision.

The exercise of the rights of access, rectification, cancellation, and opposition by the affected holders of personal data contained in the files referred to in this Circular may be made effective, if applicable, through a written request addressed to the Bank of Spain, Calle Alcalá, 48, Madrid, DP 28014.

The requests must be signed and contain the first and last name of the applicant, the full address to which the response must be sent, the name of the file or files LOPD, the right whose exercise is sought, and the identification of the data whose rectification or cancellation is sought, if applicable. A complete photocopy of the ID card of the affected holder must be attached to the letter, or, in its absence, any documentation certifying their identity that is considered valid in law. In the case that action is taken through legal representation, a copy of the ID card or equivalent documentation of the representative must also be provided, as well as a document certifying the representation.

Such requests may generally be submitted, with general character, before the General Registry of the Bank of Spain, at the address indicated above, as well as at the Bank's branches, in the case of being submitted in other locations. They may also be sent by postal mail, to the address indicated above, or by fax, to the number 913385320.

Final Provision.

This Circular shall enter into force on the day of its publication in the Official State Bulletin, with the following circulars being repealed on that same date:

Circular 4/1994, of July 22.

Circular 4/1995, of September 25.

Circular 1/1996, of January 30.

Circular 10/1996, of September 27.

Circular 2/2002, of January 25.

Circular 1/2003, of May 28.

ANNEX I

Files managed by the Bank of Spain by virtue of the public functions entrusted to it by Law 13/1994, of June 1, and other applicable legislation

FILE RETURN OF WITHHOLDINGS ON INTERESTS [1]

File Manager.

Bank of Spain.

Data Protection Officer of the file.

Operations Department.

Rights of access, rectification, cancellation, and opposition.

Operations Department.

C/ Alcalá, 48.

28014 Madrid.

Reference Regulation.

Royal Decree 1145/2011, of July 29.

Type of file.

Managed by the Bank of Spain by virtue of the public functions entrusted to it by Law 13/1994, of June 1.

Purpose of the file and intended uses thereof.

Management of requests for the return of withholdings applied to the interest on public debt annotated in third-party accounts, presented by the managing entities of the Market of Annotated Public Debt.

Type of purpose and intended uses of the file:

– Public Treasury and tax administration management.

– Public economic-financial management.

– Fiscal and administrative accounting management.

Origin of the data.

– Other natural persons.

– Private entity.

Groups or categories of interested parties.

– Legal representatives.

Basic structure of the file and types of personal data included in it

– Specially protected data:

Does not include data of this type.

– Data relating to the commission of offenses:

Does not include data of this type.

– Identifying data:

• NIF/DNI (Tax ID/ID Card).

• Name and surnames.

– Other classified data:

• Economic, financial, and insurance.

Processing System.

Automated.

Security Measures.

Medium level.

Transfers of personal data.

– Public Treasury and Tax Administration.

– Others: Debt issuers.

Transfers of personal data to third countries

No data transfers are planned.

[1]

Drafted according to Circular 2/2013, of June 27, first provision.

FILE MANAGING ENTITY OF THE MARKET OF ANNOTATED PUBLIC DEBT [2]

File Manager: Bank of Spain.

Data Protection Officer of the file:

Payment Systems Department.

Branches of the Bank of Spain.

Vice-Secretariat.

Rights of access, rectification, cancellation, and opposition:

Payment Systems Department.

Calle Alcalá, 48.

28014 Madrid.

Reference Regulation:

– Law 58/2003, of December 17, General Tax Law, and regulations developing it.

– Royal Decree 304/2014, of May 5, approving the Regulation of Law 10/2010, of April 28, on the prevention of money laundering and the financing of terrorism.

– Order of January 22, 1990, on direct accounts at the Bank of Spain for Annotated State Debt.

– Resolution of March 8, 1990, of the General Directorate of Treasury and Financial Policy, making public the agreement between the Bank of Spain and the State for the Direct Accounts of Annotated State Debt.

Type of file: Managed by the Bank of Spain by virtue of the public functions entrusted to it by Law 13/1994, of June 1.

Purpose of the file and intended uses thereof: Keeping the register of the annotated State debt balances of the holders of direct accounts at the Bank of Spain, in its capacity as the managing entity of the Market of Annotated Public Debt.

Type of purpose and intended uses of the file:

– Public Treasury and tax administration management.

– Public economic-financial management.

– Fiscal, accounting, and administrative management.

– Other purposes.

Origin of the data:

– The interested party themselves or their legal representative.

– Private entity.

– Public Administrations.

Groups or categories of interested parties:

– Citizens and residents.

– Legal representatives.

– Other groups: authorized/attorneys-in-fact for the holders of direct accounts, holders of special debt.

Data collection procedure: Data provided by the interested parties themselves or their representatives in connection with their operations in direct accounts, either in person, by postal mail, or by telematic procedures.

Basic structure of the file and types of personal data included in it:

– Specially protected data: Does not include data of this type.

– Data relating to the commission of offenses: Does not include data of this type.

– Identifying data:

• NIF/DNI.

• Name and surnames.

• Address.

• Telephone.

• Signature/fingerprint.

• Other identifying data (residence card, identification of legal representative or attorneys-in-fact/authorized persons).

– Other classified data:

• Economic, financial, and insurance.

• Other types of data (details of authorization/attorney-in-fact or legal representation).

Processing System: Mixed.

Security Measures: High level.

Transfers of personal data:

– Public Treasury and Tax Administration.

– Judicial bodies.

– Other bodies of the State Administration.

– Credit entities.

– Other financial entities.

– Legitimate interested parties.

– Others: Iberclear.

Transfers of personal data to third countries: No data transfers are planned.

[2]

Drafted according to Circular 7/2015, of November 25, fourth provision.

FILE CENTRAL RISK INFORMATION CENTER [3]

File Manager:

Bank of Spain.

Data Protection Officer of the file:

Financial Information and Risk Central Department.

Rights of access, rectification, cancellation, and opposition:

Financial Information and Risk Central Department.

C/ Alcalá, 48.

28014 Madrid.

Reference Regulation:

Law 44/2002, of November 22, on measures to reform the financial system, Chapter VI (BOE of November 23).

Order ECO/697/2004, of March 11, on the Central Risk Information Center, modified by Order ECO/747/2013, of April 25 (BOE of May 6).

Order ECO/708/2004, of March 11, determining the status of declaring entity to the CIR of the Bank of Spain for the State Joint-Stock Company of Agricultural Surety.

Circular 3/1995, of September 25, of the Bank of Spain, to credit entities, on the Central Risk Information Center, and subsequent modifications.

Type of file:

Managed by the Bank of Spain by virtue of the public functions entrusted to it by Law 13/1994, of June 1, and other applicable legislation.

Purpose of the file and intended uses thereof:

Generation of risk reports, registration and control of the rights of rectification and cancellation that applicants exercise on the data appearing in the Central Risk Information Center.

Facilitating to the declaring entities the data necessary for the exercise of their activities.

Facilitating to the Bank of Spain the prudential supervision of credit entities and other functions entrusted to said institution by Law.

Type of purpose and intended uses of the file:

Public economic-financial management.

Statistical, historical, or scientific purposes.

Other purposes.

Origin of the data:

Private entity.

The interested party themselves or their legal representative.

Groups or categories of interested parties:

Citizens and residents.

Legal representatives.

Applicants.

Other groups.

Basic structure of the file and types of personal data included in it:

Specially protected data:

Does not include data of this type.

Data relating to the commission of offenses:

Does not include data of this type.

Identifying data:

NIF/DNI.

Name and surnames.

Address.

Signature/fingerprint.

Image/voice.

Electronic signature.

Other identifying data: location.

Other classified data:

Personal characteristics.

Processing System:

Mixed.

Security Measures:

Medium level.

Transfers of personal data:

Credit entities.

Other financial entities.

Legitimate interested parties.

Judicial bodies.

Court of Accounts or equivalent autonomous bodies.

Other bodies of the State Administration.

European Union bodies.

Transfers of personal data to third countries:

No data transfers are planned.

[3]

Drafted according to Circular 4/2014, of July 30, second provision.

FILE

PROCEEDINGS OF THE CENTRAL RISK INFORMATION CENTER [4]

File Manager: Bank of Spain.

Data Protection Officer of the file: Financial Information and Risk Central Department.

Rights of access, rectification, cancellation, and opposition:

Financial Information and Risk Central Department.

Calle Alcalá, 48.

28014 Madrid.

Reference Regulation:

– Law 44/2002, of November 22, on measures to reform the financial system, Chapter VI.

– Order ECO/697/2004, of March 11, on the Central Risk Information Center, modified by Order ECO/747/2013, of April 25.

– Order ECO/708/2004, of March 11, determining the status of declaring entity to the CIR of the Bank of Spain for the State Joint-Stock Company of Agricultural Surety.

– Circular 3/1995, of September 25, of the Bank of Spain, to credit entities, on the Central Risk Information Center, and subsequent modifications.

– Circular 1/2013, of May 24, of the Bank of Spain, on the Central Risk Information Center and modifying Circular 4/2004, of December 22, to credit entities, on rules of public and reserved financial information, and models of financial statements.

Type of file: Managed by the Bank of Spain by virtue of the public functions entrusted to it by Law 13/1994, of June 1, and other applicable legislation.

Purpose of the file and intended uses thereof:

Registration and control of the rights of access that applicants exercise on the data appearing in the Central Risk Information Center (CIR).

Sending and notification of data to those exercising the rights of access to their data in the CIR.

Type of purpose and intended uses of the file:

– Fiscal, accounting, and administrative management.

Origin of the data: The interested applicant themselves or their legal representative.

Groups or categories of interested parties: Applicants.

Data collection procedure: Data may be provided and/or collected in person, by postal mail, or via the Internet.

Basic structure of the file and types of personal data included in it:

– Specially protected data: Does not include data of this type.

– Data relating to the commission of offenses: Does not include data of this type.

– Identifying data:

• NIF/DNI.

• Name and surnames.

• Address.

• Telephone.

• Signature/fingerprint.

– Other types of data.

• Personal characteristics.

Processing System: Mixed.

Security Measures: Basic level.

Transfers of personal data: Legitimate interested parties.

Transfers of personal data to third countries: No data transfers are planned.

[4]

Drafted according to Circular 7/2015, of November 25, first provision.

FILE CAPITAL STRUCTURE OF ENTITIES SUPERVISED BY THE BANK OF SPAIN [5] [6]

File Manager.–Bank of Spain.

Rights of access, rectification, cancellation, and opposition.–Financial Information and Risk Central Department. Calle Alcalá, 48, 28014 Madrid.

Reference Regulation:

Article 61 of Law 26/1988, of July 29.

Article 19 of Royal Decree 1245/1995, of July 14.

Article 16 of Royal Decree 322/2008, of February 29.

Bank of Spain Circular 1/2009, of December 18.

Royal Decree 775/1997, of May 30.

Circular 3/1998, of January 27.

Royal Decree 2660/1998, of December 14.

Circular 6/2001, of October 29.

Legislative Royal Decree 1298/1986, of June 28.

Purpose of the file and intended uses thereof.–To have updated information on the capital structure of entities supervised by the Bank of Spain.

Type of purpose and intended uses of the file: Other purposes.

Origin of the data.–Private entity.

Groups or categories of interested parties.–Owners or lessees.

Basic structure of the file and types of personal data included in it:

Specially protected data: Does not include data of this type.

Relating to the commission of offenses: Does not include data of this type.

Identifying data:

NIF/DNI.

Name and surnames.

Address.

Other identifying data: passport, residence card.

Other classified data:

Academic and professional.

Economic, financial, and insurance.

Transactions of goods and services.

Processing System.–Mixed.

Security Measures.–Basic.

Transfers of personal data.–No data transfers are planned.

Transfers of personal data to third countries.–No data transfers are planned.

[5]

Previous name: Data corresponding to the capital structure of credit entities.

[6]

Drafted according to Circular 1/2011, of January 26, third provision.

FILE MAIN AGENTS BY VOLUME OF TRANSFERS OF CERTAIN CURRENCY EXCHANGE ESTABLISHMENTS

Reference Regulation:

• Royal Decree 2660/1998, of December 14 (BOE of December 15).

• Circular 6/2001, of October 29 (BOE of November 15).

Purpose of the file and intended uses thereof:

• To have updated information on the main agents by volume of transfers with the exterior of currency exchange establishments.

Affected natural persons:

• The main agents by volume of transfers received or ordered to the exterior of holders of establishments that carry out operations of buying and selling foreign banknotes or traveler's checks and/or transfers with the exterior, according to the requirements of annex 3.5 of Circular 6/2001.

Provenance and procedure for the collection of personal data:

• The data come from establishments that carry out operations of buying and selling foreign banknotes or traveler's checks and/or transfers with the exterior.

• The medium used for its obtaining is:

• Files sent via electronic medium by telematic means.

• Paper medium.

Basic structure of the file and types of personal data included in it:

• NIF or residence card number.

• Name and surnames.

• Number of premises.

• Percentage of the volume of transfers received or issued by the agent on the total of the entity.

Transfers of personal data:

• Those provided for in art. 6 of Legislative Royal Decree 1298/1986, of June 28, drafted according to Law 37/1998, of November 16.

Transfers of personal data to third countries:

• No transfers are planned.

File Manager:

• Bank of Spain.

Service or unit before which the rights of access, rectification, cancellation, and opposition can be exercised:

• Financial Information and Risk Central Department.

Security Measures:

• Level: BASIC.

FILE MOST ACTIVE APPRAISERS AND MAIN CLIENTS OF APPRAISAL COMPANIES AND SERVICES [7]

Reference Regulation:

Order ECO/805/2003, of March 27 (BOE of April 9).

Circular 3/1998, of January 27 (BOE of February 13).

Circular 5/2003, of December 19 (BOE of January 8).

Purpose of the file and intended uses thereof:

To have updated information on the most active appraisers by appraisal value of appraisal companies and services and of the main clients of said appraisal companies and services.

Affected natural persons:

The most active appraisers by appraisal value of appraisal companies and services, according to the requirements of the annex (state VII) of Circular 5/2003.

The main clients of appraisal companies and services, according to the requirements of the annex (state VIII) of Circular 5/2003.

Provenance and procedure for the collection of personal data:

The data come from appraisal companies and services.

The medium used for its obtaining is:

Files sent via electronic medium by telematic means.

Basic structure of the file and types of personal data included in it:

Most active appraisers by appraisal value:

NIF, NIE, or non-resident code.

Number of appraisals.

Appraisal value.

Main clients:

NIF, NIE, or non-resident code.

Name and surnames.

Billed amount.

Transfers of personal data:

Those provided for in art. 6 of Legislative Royal Decree 1298/1986, of June 28, drafted according to Law 37/1998, of November 16.

Transfers of personal data to third countries: