Circular 7/2015 of the Bank of Spain on the Creation and Modification of Personal Data Files

Skip to main content.

VIEWING THE REGULATION

Index

Full Regulation

Regulation at a Date

Current Regulation

Circular 7/2015, of November 25, of the Bank of Spain, creating and modifying personal data files. (Official State Bulletin of December 10) (Correction of errors, Official State Bulletin of January 26)

The descriptions of the automated files containing personal data currently existing at the Bank of Spain are collected in seven circulars: Circular 2/2005, of February 25; Circular 4/2005, of December 23; Circular 4/2008, of October 31; Circular 1/2011, of January 26; Circular 3/2012, of March 28; Circular 2/2013, of June 27, and Circular 4/2014, of July 30. These provisions comply with Article 20 of Organic Law 15/1999, of December 13, on the protection of personal data, and Title V of the Regulation of said Organic Law 15/1999, approved by Royal Decree 1720/2007, of December 21, regarding the creation, modification, or suppression of files by Public Administrations.

Changes in the Bank's organizational structure, in the reference regulations, in some management processes, in the data collected for processing, and in the corresponding information systems make it necessary to create a new file and modify thirteen.

The file modifications with personal data collected in this circular affect files created or modified by Circulars 1/2011, of January 26; 3/2012, of March 28, and 4/2014, of July 30.

The descriptions of the thirteen files that are modified and the file created are found in the annex of this circular. These descriptions replace those included in the circular of creation or last modification of the file, as applicable to each file.

Regardless of potential data recipients listed in the sections "Assignments of personal data" and "Transfers of personal data to third countries" in the descriptions of the files managed by the Bank of Spain by virtue of the public functions entrusted to it by Law 13/1994, of June 1, and in accordance with Article 82 of Law 10/2014, of June 26, on the ordering, supervision, and solvency of credit entities, the data, documents, and information held by the Bank of Spain by virtue of the exercise of the supervisory function or any other functions entrusted to it by laws will be used by it exclusively in the exercise of said functions and will have a reserved character, although they may be assigned to the authorities, bodies, or groups enumerated in paragraph 3 of said provision, and even then, only in the cases established.

Likewise, and by virtue of Article 61 of the aforementioned law, the Bank of Spain may or must, depending on the case, communicate to authorities of other countries that have functions similar to the supervision of credit entities information regarding the direction, management, and ownership of these entities, as well as those that may facilitate the control of their solvency and liquidity, the factors that may influence the systemic risk posed by the entity, and any other that may facilitate their supervision or serve to prevent, investigate, or sanction irregular conduct.

For all the foregoing, the Bank of Spain, in exercise of the powers conferred by Law 13/1994, of June 1, on the Autonomy of the Bank of Spain, in accordance with the procedure provided therein, has established the following rules:

First Rule.

The file "Union Affairs and Social Benefits" is modified in the section "Purpose of the file and intended uses thereof," and a new section regarding the "Data Collection Procedure" is included. The description appearing in the annex of this circular replaces that of the file of the same name contained in the annex of Bank of Spain Circular 3/2012, of March 28, updating Circular 1/2011, of January 26, on the creation, modification, and suppression of files with personal data managed by the Bank of Spain.

Second Rule.

The file "Balance Sheet Central. Directory of Non-Financial Corporate Groups" is created, the description of which appears in the annex of this circular, and it is included among the files managed by the Bank of Spain by virtue of the public functions entrusted to it by Law 13/1994, of June 1, and other applicable legislation.

Third Rule.

The file "Archive Inquiries" is modified in the section "Rights of access, rectification, cancellation, and opposition," and a new section regarding the "Data Collection Procedure" is included. The description appearing in the annex of this circular replaces that of the file of the same name contained in the annex of Bank of Spain Circular 1/2011, of January 26, updating Circular 4/2008, of October 31, updating Circular 2/2005, of February 25, on automated files with personal data managed by the Bank of Spain.

Fourth Rule.

The file "Managing Entity of the Annotated Public Debt Market" is modified in the sections "Data Protection Officer of the file" and "Security Measures," and two new sections regarding the "Data Collection Procedure" and "Reference Regulation" are included. The description appearing in the annex of this circular replaces that of the file of the same name contained in the annex of Bank of Spain Circular 4/2014, of July 30, updating Circular 2/2005, of February 25, on automated files with personal data managed by the Bank of Spain.

Fifth Rule.

The file "Risk Information Central Files" is modified in the sections "Type of purpose and intended uses of the file" and "Reference Regulation," and a new section regarding the "Data Collection Procedure" is included. The description appearing in the annex of this circular replaces that of the file of the same name contained in the annex of Bank of Spain Circular 4/2014, of July 30, updating Circular 4/2005, of December 23, updating Circular 2/2005, of February 25, on automated files with personal data managed by the Bank of Spain.

Sixth Rule.

The file "Sanctioning Proceedings" is modified in the sections "Reference Regulation," "Purpose of the file and intended uses thereof," and "Transfers of personal data to third countries," and a new section regarding the "Data Collection Procedure" is included. The description appearing in the annex of this circular replaces that of the file of the same name contained in the annex of Bank of Spain Circular 4/2014, of July 30, updating Circular 2/2013, of June 27, creating and modifying personal data files.

Seventh Rule.

The file "Management of Supervisory Activity" is modified in the sections "Reference Regulation" and "Transfers of personal data to third countries," and a new section regarding the "Data Collection Procedure" is included. The description appearing in the annex of this circular replaces that of the file of the same name contained in the annex of Bank of Spain Circular 4/2014, of July 30, updating Circular 4/2008, of October 31, updating Circular 2/2005, of February 25, on automated files with personal data managed by the Bank of Spain.

Eighth Rule.

The file "Cash Operations" is modified in the sections "Data Protection Officer of the file," "Reference Regulation," "Security Measures," and "Assignments of personal data," and a new section regarding the "Data Collection Procedure" is included. The description appearing in the annex of this circular replaces that of the file of the same name contained in the annex of Bank of Spain Circular 4/2014, of July 30, updating Circular 3/2012, of March 28, creating, modifying, and suppressing personal data files managed by the Bank of Spain.

Ninth Rule.

The file "Register of Agents of Credit Entities, Electronic Money Entities, and Payment Entities" is modified by changing its name to "Register of Agents, Promoters, and Sellers of Credit, Electronic Money, and Payment Entities," and in the sections "Data Protection Officer of the file," "Rights of access, rectification, cancellation, and opposition," "Reference Regulation," "Purpose of the file and intended uses thereof," "Groups or categories of interested parties," "Basic structure of the file and types of personal data included therein," "Assignments of personal data," and "Transfers of personal data to third countries," and a new section regarding the "Data Collection Procedure" is included. The description appearing in the annex of this circular replaces that of the file named "Register of Agents of Credit Entities, Electronic Money Entities, and Payment Entities," which is contained in the annex of Bank of Spain Circular 4/2014, of July 30, updating Circular 2/2013, of June 27, on the creation, modification, and suppression of files with personal data managed by the Bank of Spain.

Tenth Rule.

The file "Register of Professionals Linked to Valuation Companies Supervised by the Bank of Spain" is modified by changing its name to "Register of Professionals Linked to Valuation Companies," and in the sections "Data Protection Officer of the file," "Rights of access, rectification, cancellation, and opposition," "Reference Regulation," "Groups or categories of interested parties," "Purpose of the file and intended uses thereof," "Basic structure of the file and types of personal data included therein," "Assignments of personal data," and "Transfers of personal data to third countries," and a new section regarding the "Data Collection Procedure" is included. The description appearing in the annex of this circular replaces that of the file named "Register of Professionals Linked to Valuation Companies Supervised by the Bank of Spain," which is contained in the annex of Bank of Spain Circular 4/2014, of July 30, updating Circular 1/2011, of January 26, on the creation, modification, and suppression of files with personal data managed by the Bank of Spain.

Eleventh Rule.

The file "Register of Holders of Establishments Open to the Public for Foreign Currency Exchange" is modified in the sections "Data Protection Officer of the file," "Rights of access, rectification, cancellation, and opposition," "Reference Regulation," "Purpose of the file and intended uses thereof," "Assignments of personal data," and "Transfers of personal data to third countries," and a new section regarding the "Data Collection Procedure" is included. The description appearing in the annex of this circular replaces that of the file of the same name contained in the annex of Bank of Spain Circular 4/2014, of July 30, updating Circular 1/2011, of January 26, on the creation, modification, and suppression of files with personal data managed by the Bank of Spain.

Twelfth Rule.

The file "Official Registers of Senior Management of Entities Registered at the Bank of Spain" is modified in the sections "Data Protection Officer of the file," "Rights of access, rectification, cancellation, and opposition," "Reference Regulation," "Origin of the data," "Groups or categories of interested parties," "Basic structure of the file and types of personal data included therein," "Assignments of personal data," and "Transfers of personal data to third countries," and a new section regarding the "Data Collection Procedure" is included. The description appearing in the annex of this circular replaces that of the file of the same name contained in the annex of Bank of Spain Circular 4/2014, of July 30, updating Circular 1/2011, of January 26, on the creation, modification, and suppression of files with personal data managed by the Bank of Spain.

Thirteenth Rule.

The file "Commercial Companies: Shareholders, Claimants, and Affected Parties" is modified in the section "Reference Regulation," and a new section regarding the "Data Collection Procedure" is included. The description appearing in the annex of this circular replaces that of the file of the same name contained in the annex of Bank of Spain Circular 4/2014, of July 30, updating Circular 4/2008, of October 31, updating Circular 2/2005, of February 25, on automated files with personal data managed by the Bank of Spain.

Fourteenth Rule.

The file "Surveillance, Access Control, and Stay in Bank of Spain Buildings" is modified in the section "Reference Regulation," and a new section is included in "Purpose of the file and intended uses thereof" and in "Data Collection Procedure." The description appearing in the annex of this circular replaces that of the file of the same name contained in the annex of Bank of Spain Circular 1/2011, of January 26, updating Circular 2/2005, of February 25, on automated files with personal data managed by the Bank of Spain.

Final Rule.

This circular shall enter into force on the day of its publication in the "Official State Bulletin."

File: UNION AFFAIRS AND SOCIAL BENEFITS

File Manager: Bank of Spain.

Data Protection Officer of the file: Division of Labor Relations and Employee Attention.

Rights of access, rectification, cancellation, and opposition:

Division of Labor Relations and Employee Attention.

Calle Alcalá, 48.

28014 Madrid.

Type of file: Internal or operational.

Purpose of the file and intended uses thereof: Management of union permissions, hours, and appointments, union affiliation, hearing process for union affiliates and electoral processes (union and for staff representative on the Board of Governors), and management of social benefits (loans, advances, and welfare works).

Type of purpose and intended uses of the file:

– Human resources.
– Other purposes: social benefits management, union management.

Origin of the data

– The interested party themselves or their legal representative.

Groups or categories of interested parties:

– Employees.
– Beneficiaries.
– Other groups: collaborators of the Bank of Spain.

Data Collection Procedure: Data provided by the interested parties themselves or their legal representative, either in person or via telematic procedures.

Basic structure of the file and types of personal data included therein:

– Specially protected data:

• Union affiliation.
  – Data relating to the commission of offenses: Does not include data of this type.
  – Identifying data:
• NIF/DNI (Tax ID/ID Card).
• Social Security/Mutual Number.
• Personnel registration number.
• Name and Surname.
• Address.
• Phone.
• Electronic Signature.
  – Other classified data:
• Personal circumstances.
• Social circumstances.
• Employment details.
• Economic, financial, and insurance data.
• Transactions of goods and services.
  – Other types of data: union option represented, union position.

Treatment System: Mixed.

Security Measures: High Level.

Assignments of personal data:

– Public Registers.
– Judicial Bodies.
– Other bodies of the State Administration.
– Unions and staff boards.
– Professional Colleges.
– Public Treasury and Tax Administration.
– Notaries, lawyers, and solicitors.
– Sports clubs and federations.
– Credit Entities.
– Legitimate Interested Parties.
– Insurance Entities.
– Others: presidents of polling stations and other members of the boards, mutual funds and pension funds, valuation entities, companies concessionaires for the management of residences and self-service areas, companies managing meal vouchers, travel agencies, and companies organizing leisure activities.

Transfers of personal data to third countries: No data transfers are planned.

File: BALANCE SHEET CENTRAL. DIRECTORY OF NON-FINANCIAL CORPORATE GROUPS

File Manager: Bank of Spain.

Data Protection Officer of the file: Statistics Department.

Rights of access, rectification, cancellation, and opposition:

Statistics Department.

Calle Alcalá, 48.

28014 Madrid.

Type of file: Managed by the Bank of Spain by virtue of the public functions entrusted to it by Law 13/1994, of June 1.

Purpose of the file and intended uses thereof: Use of public data and other data voluntarily provided by companies to complete corporate group structures, i.e., business control structures, particularly those affecting natural persons, in order to clean up certain intra-group operations reflected in the annual accounts of non-financial companies and create significant economic aggregates, net of this type of operation. Additionally, corporate structures are used in the delimitation of company size through the application of Recommendation 2003/361/EC, and also in the differentiation of holding companies through the application of the SEC 2010 national accounts system.

Type of purpose and intended uses of the file:

– Historical, statistical, or scientific purposes.

Origin of the data:

– Private Entity.
– Public Registers.

Groups or categories of interested parties:

– Other groups: natural persons holding stakes in dominant companies of non-financial business groups.

Data Collection Procedure: Collection from information provided in public sources (Commercial Registers) and through voluntary submission by companies directly collaborating with the Balance Sheet Central, via manual and/or automatic upload, as appropriate.

Basic structure of the file and types of personal data included therein:

– Specially protected data: Data of this type is not included.
– Data relating to the commission of offenses: Data of this type is not included.
– Identifying data:

• Name and Surname.
• NIF/DNI (Tax ID/ID Card).
  – Other data:
• NIF of the companies in which the agent holds a direct or indirect participation.
• Percentage of participation in the company.

Treatment System: Mixed.

Security Measures: Basic Level.

Assignments of personal data: No data assignments are planned.

Transfers of personal data to third countries: No data transfers are planned.

File: ARCHIVE INQUIRIES

File Manager: Bank of Spain.

Rights of access, rectification, cancellation, and opposition:

Vice-Secretariat.

Calle Alcalá, 48.

28014 Madrid.

Purpose of the file and intended uses thereof: Management of inquiries to the Bank of Spain Archive.

Type of purpose and intended uses of the file:

– Statistical, historical, or scientific purposes.
– Administrative procedure.

Origin of the data: The interested party themselves or their legal representative.

Groups or categories of interested parties:

Employees.

Citizens and residents.

Data Collection Procedure: Data provided by the interested parties themselves or their representatives, either in person or via telematic procedures.

Basic structure of the file and types of personal data included therein:

– Specially protected data: Does not include data of this type.
– Data relating to the commission of offenses: Does not include data of this type.
– Identifying data:

• NIF/DNI (Tax ID/ID Card).
• Personnel registration number.
• Name and Surname.
• Address.
• Phone.
• Signature/fingerprint.
• Image/voice.
  – Other identifying data: email address, library user number.
  – Other classified data:
• Personal characteristics.
• Academic and professional.

Treatment System: Automated.

Security Measures: Basic Level.

Assignments of personal data: No data assignments are planned.

Transfers of personal data to third countries: No data transfers are planned.

File: MANAGING ENTITY OF THE ANNOTATED PUBLIC DEBT MARKET

File Manager: Bank of Spain.

Data Protection Officer of the file:

Payment Systems Department.

Bank of Spain Branches.

Vice-Secretariat.

Rights of access, rectification, cancellation, and opposition:

Payment Systems Department.

Calle Alcalá, 48.

28014 Madrid.

Reference Regulation:

– Law 58/2003, of December 17, General Tax Law, and regulations developing it.
– Royal Decree 304/2014, of May 5, approving the Regulation of Law 10/2010, of April 28, on the prevention of money laundering and terrorist financing.
– Order of January 22, 1990, on direct accounts at the Bank of Spain for Annotated State Debt.
– Resolution of March 8, 1990, of the General Directorate of Treasury and Financial Policy, making public the agreement between the Bank of Spain and the State for the Direct Accounts of Annotated State Debt.

Type of file: Managed by the Bank of Spain by virtue of the public functions entrusted to it by Law 13/1994, of June 1.

Purpose of the file and intended uses thereof: Keeping the register of annotated State debt balances of holders of direct accounts at the Bank of Spain, in its capacity as the managing entity of the Annotated Public Debt Market.

Type of purpose and intended uses of the file:

– Public Treasury and Tax Administration management.
– Public economic-financial management.
– Accounting, tax, and administrative management.
– Other purposes.

Origin of the data:

– The interested party themselves or their legal representative.
– Private Entity.
– Public Administrations.

Groups or categories of interested parties:

– Citizens and residents.
– Legal representatives.
– Other groups: authorized/attorneys-in-fact for holders of direct accounts, holders of special debt.

Data Collection Procedure: Data provided by the interested parties themselves or their representatives due to their operations in direct accounts, either in person, by postal mail, or via telematic procedures.

Basic structure of the file and types of personal data included therein:

– Specially protected data: Does not include data of this type.
– Data relating to the commission of offenses: Does not include data of this type.
– Identifying data:

• NIF/DNI (Tax ID/ID Card).
• Name and Surname.
• Address.
• Phone.
• Signature/fingerprint.
  – Other identifying data (residence card, identification of legal representative or authorized agents).
  – Other data classi