European Banking Authority records processing activity for protection of dignity at work in Paris La Défense, France; confidential counsellors appointed and mandated

European Banking Authority records processing activity for protection of dignity at work in Paris La Défense, France; confidential counsellors appointed and mandated

ROPAp - Protection of dignity at work

RECORD OF PROCESSING ACTIVITY – PROTECTION OF DIGNITY AT WORK

1 Record of processing activity Protection of Dignity at Work Record of EBA activities processing personal data, based on Article 31 of Regulation (EU) 2018/1725 (EUDPR) Part 1 - Article 31 Record (publicly available) 1 Last update of this record 20/07/2026 2 Date of next review 20/07/2028 3 Reference number EBA/DPR/2026/2 4 Name and contact details of controller Controller: European Banking Authority, Tour Europlaza, 20 avenue André Prothin, CS 30154, 92927 Paris La Défense CEDEX, France Responsible Department: HR Contact: Harassment.Prevention.Coordinator@eba.europa.eu 5 Contact details of DPO dpo@eba.europa.eu, or alternatively send a letter to the postal address of the EBA (address above) marked for the attention of the DPO of the EBA. 6 Name and contact details of joint controller (where applicable) Not applicable 7 Name and contact details of processor (where applicable) Not applicable 8 Short description and purpose of the processing activity This processing activity covers the personal data processing carried out by the EBA in relation to: • the appointment, publication and administration of the mandate of Confidential Counsellors; • activity of Confidential Counsellors; • the operation of the informal procedure under the EBA policy on protecting the dignity of the person and preventing psychological harassment and sexual harassment;

RECORD OF PROCESSING ACTIVITY – PROTECTION OF DIGNITY AT WORK 2 Part 1 - Article 31 Record (publicly available) • related support by the Harassment Prevention Coordinator; • where applicable, cooperation in an inter-agency network of confidential counsellors; • requests for assistance submitted under Article 24 of the Staff Regulations, including cases linked to alleged psychological or sexual harassment and other threats, insulting or defamatory acts, or attacks to the person or property of a staff member by reason of his or her position or duties. For the confidential counsellors selection and activity, processing includes in particular: • publication of calls for applications; • receipt and assessment of applications from candidates for confidential counsellor roles; • interviews, shortlisting, appointment, reserve list management, training confirmation and mandate management; • publication on the EBA intranet of the names and professional contact details of appointed confidential counsellors; • administrative support to confidential counsellors by the Harassment Prevention Coordinator; • limited processing necessary to organise contacts, meetings and follow-up under the informal procedure; • where applicable, handling basic administrative exchanges with another EU agency in the context of an inter-agency network. According to the Manual on informal procedures, confidential counsellors listen to, support, inform and accompany persons seeking assistance in situations perceived as psychological or sexual harassment, and may, where requested, act as intermediaries between parties in attempts at conciliation, mediation or amicable resolution. The manual states that confidential counsellors should neither take notes nor record what is being said. The EBA nevertheless processes limited personal data necessary to organise and administer this function, including appointment and contact details, and the handling of related administrative steps. For Article 24 assistance requests, processing includes receipt and handling of a request, assessment by the Executive Director of whether prima facie evidence exists, possible opening of an

RECORD OF PROCESSING ACTIVITY – PROTECTION OF DIGNITY AT WORK 3 Part 1 - Article 31 Record (publicly available) administrative inquiry, and handling of any related complaint or litigation. The purposes of the processing are: • to implement the EBA policy on protecting dignity and preventing psychological and sexual harassment; • to ensure the availability and functioning of the informal support mechanism through confidential counsellors; • to select and appoint suitable confidential counsellors and manage their mandate; • to assist staff members under Article 24 of the Staff Regulations where the legal conditions are met; • to ensure proper administration, follow-up, accountability and legal compliance in harassment prevention and staff assistance matters. The processing is based in particular on: • Article 12a of the Staff Regulations; • Article 24 of the Staff Regulations; • the applicable provisions of the CEOS; • EBA Decision EBA/DC/178 on the policy on protecting the dignity of the person and preventing psychological harassment and sexual harassment; • EBA/DC/2020/362 - the EBA Manual on informal procedures; • EBA decisions on the appointment and renewal of confidential counsellors, including EBA/DC/371 and EBA/DC/573. 9 Description of categories of persons whose data the EBA processes and list of data categories Categories of data subjects Internal to the EBA • Temporary agents • Contract agents • Seconded National Experts • Trainees • Interim staff • Consultants and external contractor staff working at EBA • Members of the Staff Committee • Members of selection panels • Confidential counsellor candidates • Appointed confidential counsellors • Staff members seeking support under the informal procedure • Staff members identified as the other party in an informal procedure

RECORD OF PROCESSING ACTIVITY – PROTECTION OF DIGNITY AT WORK 4 Part 1 - Article 31 Record (publicly available) • Witnesses or persons contacted in the context of Article 24 requests or related inquiry steps • HR, Legal, Executive Office and authorised ICT staff involved on a need-to-know basis External to the EBA • Family members of staff members, where relevant in Article 24 requests • Confidential counsellors from other participating EU agencies, where an inter-agency network is used • External legal consultants appointed by the EBA in specific cases • EU bodies with statutory access rights (e.g. Ombudsman, Court of Justice, OLAF, EDPS, IAS, Court of Auditors) Categories of personal data For confidential counsellor selection and mandate management: • Identification data: name, surname, gender, nationality • Professional data: department/unit, contract category/grade, years in service, contract start and end date, current job title • Application data: motivation letter, CV, declaration of honour, previous experience in similar roles, training attended, languages spoken fluently • Selection data: interview assessment, shortlist/reserve list status, appointment decision, training completion status • Professional contact data of appointed counsellors published on the intranet For informal procedure administration: • Identification and professional contact data of party 1 and, where applicable, party 2 • Limited administrative data necessary to arrange meetings, follow-up actions and contacts • Information communicated by the person seeking assistance, including allegations and circumstances of the perceived situation, to the extent such data is processed by EBA administratively • Acknowledgement of receipt of the privacy statement For Article 24 requests for assistance: • Basic identification and professional data of the requestor and other persons concerned • Allegations, declarations, supporting documents and correspondence

RECORD OF PROCESSING ACTIVITY – PROTECTION OF DIGNITY AT WORK 5 Part 1 - Article 31 Record (publicly available) • Witness statements • Information relating to the assessment of prima facie evidence • Inquiry-related data where an administrative inquiry is opened • Complaint or litigation-related correspondence and documents 10 Special categories of personal data processed (as defined in Article 10 EUDPR) This activity does not specifically require processing of special categories of personal data, but such data may be proactively provided by data subjects. For the informal procedure and Article 24 requests, such data may arise because the subject matter concerns alleged psychological or sexual harassment or other serious incidents affecting a staff member. For the selection of confidential counsellors, special categories of data are not requested as part of the standard application, but candidates may exceptionally disclose such information spontaneously in application documents or exchanges. 11 Time limit for keeping the data Personal data are retained only for as long as necessary for the purposes of managing the confidential counsellors activity, handling informal procedures, processing requests for assistance under Article 24 of the Staff Regulations, and dealing with any related complaint, audit, inquiry or litigation. As a general rule, data relating to selection and appointment procedures may be retained for up to 5 years, while certain data relating to non-selected or reserve-list candidates may be kept for a shorter period in accordance with the applicable EBA retention arrangements. In the event of an appeal or complaint, relevant data may be retained until completion of the relevant procedure. Any limited administrative records necessary to organise and manage the activity are kept only as long as necessary. If the request for assistance is rejected by the Executive Director and no further procedure is opened, the data may be retained for up to 10 years after rejection in order to ensure legal certainty and the harmonised application of the Staff Regulations; Where a matter proceeds to a formal Article 24 procedure or administrative inquiry, relevant data may be incorporated into the corresponding case file and retained in accordance with the

RECORD OF PROCESSING ACTIVITY – PROTECTION OF DIGNITY AT WORK 6 Part 1 - Article 31 Record (publicly available) retention rules applicable to that file. Requests for assistance that do not lead to further proceedings may be retained for a longer period where necessary for legal certainty and the harmonised application of the Staff Regulations, after which data may be anonymised where appropriate. 12 Recipients of the data Personal data may be disclosed, on a strict need-to-know basis, to authorised EBA staff involved in the management of the confidential counsellors activity, the informal procedure, and requests for assistance under Article 24 of the Staff Regulations, including relevant staff in Human Resources, Legal, senior management, and ICT support where necessary. Where required, data may also be disclosed to limited external recipients, such as training providers, external legal advisers, competent counterparts in other EU agencies in the context of an inter-agency network, and EU bodies or authorities with statutory oversight, audit, investigative, complaint-handling or judicial functions. All recipients only receive the personal data necessary for the performance of their duties. 13 Are there any transfers of personal data to third countries or international organisations? The personal data will be processed by the EBA with the EU/EEA. 14 General description of security measures, where possible Processing is carried out within the EBA information security framework and under EBA rules on the security of communication and information systems. General measures include: • access restriction on a need-to-know basis; • role-based access controls for electronic folders and systems; • restricted physical access to paper files and offices; • use of secure corporate systems for storage and communication; • confidentiality obligations for staff involved; • specific confidentiality declarations for selection panel members where applicable; • secure handling of emails and documents; • logging, backup and ICT security controls unde