Go back to the main page of the Data Protection Guidance for the organisers
Data Protection Guidance - Question 9
What information should you give to citizens when collecting their data?
Applies to Case Scenario 2 (the representative acts as sole data controller), except as regards the use of the Commission’s file exchange service
When citizens (signatories) submit a statement of support (and optionally provide their email address), they must be informed of how these personal data are to be processed (for which purpose, how long, by whom, to whom they may be disclosed, how they are protected, what their rights as data subject are and how they can exercise these rights, etc.).
The statement of support established by the Regulation on the European citizens' initiative includes a standard text for a Privacy Statement. This Privacy Statement corresponds to the information, which the signatories should be given when their data are collected.
Privacy statement for the statements of support collected on paper established by the Regulation on the European citizens’ initiative:
In accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation), your personal data provided on this form will only be used for the support of the initiative and made available to the competent national authorities for the purpose of verification and certification. You are entitled to request from the group of organisers of this initiative access to, rectification of, erasure and restriction of processing of your personal data.
Your data will be stored by the group of organisers for a maximum retention period of one month after the submission of the initiative to the European Commission or 21 months after the beginning of the collection period, whichever is the earlier. It might be retained beyond these time limits in the case of administrative or legal proceedings, for a maximum of one month after the date of conclusion of these proceedings.
Without prejudice to any other administrative or judicial remedy, you have the right to lodge at any time a complaint with a data protection authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that your data is unlawfully processed.
The representative of the group of organisers of the initiative or, where appropriate, the legal entity created by it, is the controller within the meaning of the General Data Protection Regulation and can be contacted using the details provided on this form.
The contact details of the data protection officer (if any) are available at the web address of this initiative in the European Commission's register, as provided in point 4 of this form.
The contact details of the national authority which will receive and process your personal data and the contact details of the national data protection authorities can be consulted at: http://ec.citizens-initiative.europa.eu/public/data-protection.
When collecting on paper
When statements of support are collected on paper forms, you should distribute a copy of the privacy statement or a link thereto to signatories in their native language. This privacy statement should be completed with your contact details as data controller, as well as the contact details of the data protection officer, if any, and of the relevant national data protection authorities.
Privacy statement for email addresses
The Regulation on the European citizens’ initiative does not define a similar model for a privacy statement to be used while collecting signatories’ email addresses. As representative, you need to set up such a privacy statement in compliance with the requirements of the GDPR.
The following minimum information should be provided to signatories (see Article 13 GDPR):
- the description and purpose of the processing;
- the data processed;
- the recipients of the data, if any;
- the planned duration of storage;
- the rights of signatories such as withdrawal of consent, right of access, rectification, erasure or objection;
- instructions on the right to lodge a complaint with the authorities.
In case of collection of email addresses, signatories need to separately consent to the processing thereof as described in the privacy statement.
PLEASE NOTE:
In case statements of support and email addresses are collected using the central online collection system, the relevant privacy statements are established by the European Commission. The texts of these privacy statements are published on the Commission ECI website.
References:
- Article 13 of the GDPR
- Annex III of the Regulation on the European citizens' initiative
