---
title: "European Banking Authority records processing activity for protection of dignity at work in Paris La Défense, France; confidential counsellors appointed and mandated"
sdDatePublished: "2026-08-03T21:26:00Z"
source: "https://www.eba.europa.eu/sites/default/files/2026-08/884a18cd-d58f-4b85-aed9-4f0231a46b8c/ROPAp%20-%20Protection%20of%20dignity%20at%20work%20%281%29.pdf"
topics:
  - name: "employment legislation"
    identifier: "medtop:20000521"
  - name: "privacy"
    identifier: "medtop:20001300"
locations:
  - "France"
---


European Banking Authority records processing activity for protection of dignity at work in Paris La Défense, France; confidential counsellors appointed and mandated

ROPAp - Protection of dignity at work

 RECORD OF PROCESSING ACTIVITY – PROTECTION OF DIGNITY AT WORK

1
Record of processing activity
Protection of Dignity at Work
Record of EBA activities processing personal data, based on Article 31 of Regulation (EU)
2018/1725 (EUDPR)
Part 1 - Article 31 Record (publicly available)
1
Last update of this record
20/07/2026
2
Date of next review
20/07/2028
3
Reference number
EBA/DPR/2026/2
4
Name and contact details of
controller
Controller: European Banking Authority, Tour Europlaza, 20
avenue André Prothin, CS 30154, 92927 Paris La Défense CEDEX,
France
Responsible Department: HR
Contact: Harassment.Prevention.Coordinator@eba.europa.eu
5
Contact details of DPO
dpo@eba.europa.eu, or alternatively send a letter to the postal
address of the EBA (address above) marked for the attention of
the DPO of the EBA.
6
Name and contact details of
joint
controller
(where
applicable)
Not applicable
7
Name and contact details of
processor (where applicable)
Not applicable
8
Short
description
and
purpose of the processing
activity
 This processing activity covers the personal data processing carried
out by the EBA in relation to:
•
the appointment, publication and administration of the
mandate of Confidential Counsellors;
•
activity of Confidential Counsellors;
•
the operation of the informal procedure under the EBA
policy on protecting the dignity of the person and
preventing
psychological
harassment
and
sexual
harassment;

RECORD OF PROCESSING ACTIVITY – PROTECTION OF DIGNITY AT WORK
2
Part 1 - Article 31 Record (publicly available)
•
related
support
by
the
Harassment
Prevention
Coordinator;
•
where applicable, cooperation in an inter-agency network
of confidential counsellors;
•
requests for assistance submitted under Article 24 of the
Staff Regulations, including cases linked to alleged
psychological or sexual harassment and other threats,
insulting or defamatory acts, or attacks to the person or
property of a staff member by reason of his or her position
or duties.
For the confidential counsellors selection and activity, processing
includes in particular:
•
publication of calls for applications;
•
receipt and assessment of applications from candidates for
confidential counsellor roles;
•
interviews,
shortlisting,
appointment,
reserve
list
management,
training
confirmation
and
mandate
management;
•
publication on the EBA intranet of the names and
professional contact details of appointed confidential
counsellors;
•
administrative support to confidential counsellors by the
Harassment Prevention Coordinator;
•
limited processing necessary to organise contacts,
meetings and follow-up under the informal procedure;
•
where applicable, handling basic administrative exchanges
with another EU agency in the context of an inter-agency
network.
According to the Manual on informal procedures, confidential
counsellors listen to, support, inform and accompany persons
seeking assistance in situations perceived as psychological or sexual
harassment, and may, where requested, act as intermediaries
between parties in attempts at conciliation, mediation or amicable
resolution. The manual states that confidential counsellors should
neither take notes nor record what is being said. The EBA
nevertheless processes limited personal data necessary to organise
and administer this function, including appointment and contact
details, and the handling of related administrative steps.
For Article 24 assistance requests, processing includes receipt and
handling of a request, assessment by the Executive Director of
whether prima facie evidence exists, possible opening of an

RECORD OF PROCESSING ACTIVITY – PROTECTION OF DIGNITY AT WORK
3
Part 1 - Article 31 Record (publicly available)
administrative inquiry, and handling of any related complaint or
litigation.
The purposes of the processing are:
•
to implement the EBA policy on protecting dignity and
preventing psychological and sexual harassment;
•
to ensure the availability and functioning of the informal
support mechanism through confidential counsellors;
•
to select and appoint suitable confidential counsellors and
manage their mandate;
•
to assist staff members under Article 24 of the Staff
Regulations where the legal conditions are met;
•
to ensure proper administration, follow-up, accountability
and legal compliance in harassment prevention and staff
assistance matters.
The processing is based in particular on:
•
Article 12a of the Staff Regulations;
•
Article 24 of the Staff Regulations;
•
the applicable provisions of the CEOS;
•
EBA Decision EBA/DC/178 on the policy on protecting the
dignity of the person and preventing psychological
harassment and sexual harassment;
•
EBA/DC/2020/362 - the EBA Manual on informal
procedures;
•
EBA decisions on the appointment and renewal of
confidential counsellors, including EBA/DC/371 and
EBA/DC/573.
9
Description of categories of
persons whose data the EBA
processes and list of data
categories
Categories of data subjects
Internal to the EBA
•
Temporary agents
•
Contract agents
•
Seconded National Experts
•
Trainees
•
Interim staff
•
Consultants and external contractor staff working at EBA
•
Members of the Staff Committee
•
Members of selection panels
•
Confidential counsellor candidates
•
Appointed confidential counsellors
•
Staff members seeking support under the informal
procedure
•
Staff members identified as the other party in an informal
procedure

RECORD OF PROCESSING ACTIVITY – PROTECTION OF DIGNITY AT WORK
4
Part 1 - Article 31 Record (publicly available)
•
Witnesses or persons contacted in the context of Article 24
requests or related inquiry steps
•
HR, Legal, Executive Office and authorised ICT staff
involved on a need-to-know basis
External to the EBA
•
Family members of staff members, where relevant in
Article 24 requests
•
Confidential counsellors from other participating EU
agencies, where an inter-agency network is used
•
External legal consultants appointed by the EBA in specific
cases
•
EU bodies with statutory access rights (e.g. Ombudsman,
Court of Justice, OLAF, EDPS, IAS, Court of Auditors)
Categories of personal data
For confidential counsellor selection and mandate management:
•
Identification data: name, surname, gender, nationality
•
Professional
data:
department/unit,
contract
category/grade, years in service, contract start and end
date, current job title
•
Application data: motivation letter, CV, declaration of
honour, previous experience in similar roles, training
attended, languages spoken fluently
•
Selection data: interview assessment, shortlist/reserve list
status, appointment decision, training completion status
•
Professional contact data of appointed counsellors
published on the intranet
For informal procedure administration:
•
Identification and professional contact data of party 1 and,
where applicable, party 2
•
Limited administrative data necessary to arrange
meetings, follow-up actions and contacts
•
Information communicated by the person seeking
assistance, including allegations and circumstances of the
perceived situation, to the extent such data is processed
by EBA administratively
•
Acknowledgement of receipt of the privacy statement
For Article 24 requests for assistance:
•
Basic identification and professional data of the requestor
and other persons concerned
•
Allegations, declarations, supporting documents and
correspondence

RECORD OF PROCESSING ACTIVITY – PROTECTION OF DIGNITY AT WORK
5
Part 1 - Article 31 Record (publicly available)
•
Witness statements
•
Information relating to the assessment of prima facie
evidence
•
Inquiry-related data where an administrative inquiry is
opened
•
Complaint or litigation-related correspondence and
documents
10
Special categories of personal
data processed (as defined in
Article 10 EUDPR)
This activity does not specifically require processing of special
categories of personal data, but such data may be proactively
provided by data subjects.
For the informal procedure and Article 24 requests, such data may
arise because the subject matter concerns alleged psychological or
sexual harassment or other serious incidents affecting a staff
member.
For the selection of confidential counsellors, special categories of
data are not requested as part of the standard application, but
candidates
may
exceptionally
disclose
such
information
spontaneously in application documents or exchanges.
11
Time limit for keeping the
data
Personal data are retained only for as long as necessary for the
purposes of managing the confidential counsellors activity, handling
informal procedures, processing requests for assistance under
Article 24 of the Staff Regulations, and dealing with any related
complaint, audit, inquiry or litigation.
As a general rule, data relating to selection and appointment
procedures may be retained for up to 5 years, while certain data
relating to non-selected or reserve-list candidates may be kept for
a shorter period in accordance with the applicable EBA retention
arrangements. In the event of an appeal or complaint, relevant data
may be retained until completion of the relevant procedure.
Any limited administrative records necessary to organise and
manage the activity are kept only as long as necessary.
If the request for assistance is rejected by the Executive Director
and no further procedure is opened, the data may be retained for
up to 10 years after rejection in order to ensure legal certainty and
the harmonised application of the Staff Regulations;
Where a matter proceeds to a formal Article 24 procedure or
administrative inquiry, relevant data may be incorporated into the
corresponding case file and retained in accordance with the

RECORD OF PROCESSING ACTIVITY – PROTECTION OF DIGNITY AT WORK
6
Part 1 - Article 31 Record (publicly available)
retention rules applicable to that file. Requests for assistance that
do not lead to further proceedings may be retained for a longer
period where necessary for legal certainty and the harmonised
application of the Staff Regulations, after which data may be
anonymised where appropriate.
12
Recipients of the data
Personal data may be disclosed, on a strict need-to-know basis, to
authorised EBA staff involved in the management of the
confidential counsellors activity, the informal procedure, and
requests for assistance under Article 24 of the Staff Regulations,
including relevant staff in Human Resources, Legal, senior
management, and ICT support where necessary.
Where required, data may also be disclosed to limited external
recipients, such as training providers, external legal advisers,
competent counterparts in other EU agencies in the context of an
inter-agency network, and EU bodies or authorities with statutory
oversight, audit, investigative, complaint-handling or judicial
functions.
All recipients only receive the personal data necessary for the
performance of their duties.
13
Are there any transfers of
personal
data
to
third
countries
or
international
organisations?
The personal data will be processed by the EBA with the EU/EEA.
14
General
description
of
security
measures,
where
possible
Processing is carried out within the EBA information security
framework and under EBA rules on the security of communication
and information systems. General measures include:
•
access restriction on a need-to-know basis;
•
role-based access controls for electronic folders and
systems;
•
restricted physical access to paper files and offices;
•
use of secure corporate systems for storage and
communication;
•
confidentiality obligations for staff involved;
•
specific confidentiality declarations for selection panel
members where applicable;
•
secure handling of emails and documents;
•
logging, backup and ICT security controls unde