Skip to main content
European Union flag
English
European Citizens' Initiative

Privacy policy concerning citizens' initiative organisers' personal data in the ECI Register

Processing operation: Implementing the 'ECI Regulation' and provision of a register of citizens' initiatives

Data Controller: European Commission

Operational Data Controller: Unit SG.A.1 'Policy Priorities & Work Programme'

Record reference: DPR-EC-00068

1. Introduction

This privacy statement explains the reason for the processing of your personal data, the way we collect, handle and ensure protection of all personal data provided, how that information is used and what rights you have in relation to your personal data. It also specifies the contact details of the responsible Operational Data Controller with whom you may exercise your rights, the Data Protection Officer and the European Data Protection Supervisor.

The European Commission (hereafter ‘the Commission’) is committed to protect your personal data and to respect your privacy. The Commission collects and further processes personal data in conformity with Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.

This privacy statement concerns the processing operation 'Implementing the 'ECI Regulation' and provision of a register of citizens' initiatives' undertaken by Unit SG.A.1 'Policy Priorities & Work Programme' of the European Commission.

2. Why and how do we process your personal data?

We collect and use your personal information to implement Regulation (EU) 2019/788 of the European Parliament and of the Council on the European citizens' initiative (hereafter the 'ECI Regulation').

The European Citizens' Initiative was introduced with the Lisbon Treaty and applies since April 2012, date of entry into application of the Regulation (EU) 211/2011 which implemented the Treaty provisions. This first ECI Regulation was replaced as of 1 January 2020 by Regulation (EU) 2019/788.

A European Citizens' Initiative allows one million citizens from at least one quarter of EU Member States to invite the European Commission to propose a legal act in areas where the Commission has the power to do so.

The ECI Regulation provides that the proposed citizens' initiatives shall be registered and made public by the Commission.

In this context we collect and process your personal data, as the ECI Organiser, in particular in order to assess whether you fulfil the requirements to be an organiser of a European citizens' initiative (mandatory or additional member of the group of organisers, additional contact person thereof), whether the legal entity you are connected with has been established in accordance with Article 5(7) of the ECI Regulation, and to allow both the Commission and the citizens to communicate with you as the initiative organiser.

Moreover, the ECI Regulation also entrusts the Commission with some specific obligations as regards the transparency of initiatives' funding.  In the specific cases set out in Article 17(2) and (3) of the ECI Regulation the Commission may be required to process your personal data as initiative sponsor or complainant in the non-public part of the ECI Register. Processing of the organisers', sponsors' and complainants' data and documents is mandatory to meet statutory requirements of the ECI Regulation. However, the Commission will not, as a principle, publish any personal data relating to an individual acting as sponsor in a personal capacity on the ECI website except upon express request from organisers and presentation by them of the evidence of that individual’s explicit consent to the publication.

Processing of personal data of the officials (contact points) from the national authorities involved in the implementation of the ECI Regulation, namely those responsible for certifying individual online collection systems, for coordinating the process of verification of statements of support and for delivering the relevant certificates and the ECI National Contact Points, is required to allow collaboration with these administrations to ensure the proper implementation of the ECI Regulation at the national level and their input through the ECI Expert group and the ECI Comitology Committee. Email addresses of identifiable national officials may be published on the ECI website, only in case Member States concerned chose to provide such email addresses, as part of the contact details of their relevant authorities.

Finally, in the context of the Commission obligations to raise public awareness about the existence, objectives and functioning of the European citizens' initiative through communication activities and information campaigns, set out in Article 18 of the ECI regulation, the operational controller may approach the ECI organisers to invite them to participate on voluntary basis in the communication and consultation activities organised by the Commission.

We collect and further process your personal information in the following way:

Some processing of your data is performed by means of automated operations. In particular:

  • Personal Data and copies of the documents allowing to prove your identity and the fulfilment of requirements of nationality, residence and age are submitted to the Commission by the ECI organisers as part of their registration request using a registration form in the ECI Register public website. They are automatically included in the ECI Register data base and a copy thereof is registered in the Commission document management Ares system.
  • Acknowledgements of receipt of the registration request including personal data of the organisers are automatically sent to the contact persons' email addresses with a copy to the Commission functional mailbox;
  • Automatic messages are sent to the organisers (at the contact persons' email addresses and to additional email addresses of organisers (optionally if requested so)), as confirmation of the different operations performed by the organisers using organiser account and on the occasion of the different milestones reached by the initiative (with a copy sent each time to the Commission functional mailbox);
  • Messages exchanged between the Commission and the organisers using contact forms (between 'administrative interface' of the ECI Register and the 'organiser account') are each time automatically sent in copy to the contact persons' email addresses and to the Commission functional mailbox;
  • Personal data of the initiative contact persons are automatically published in accordance with Article 6(7) of the ECI Regulation insofar as they are part of the decisions on requests for registration or decisions refusing registration;
  • Publication of the organisers' data (names and email addresses) in the public interface of the ECI Register is done automatically following initiative registration.

Other operations concerning your data are performed manually. The following operations are concerned in particular:

  • Manual checks of the information and proofs submitted in accordance with Annex II of the ECI Regulation are performed as part of the registration procedure, to confirm that the organisers fulfil requirements set out in Article 5 thereof;
  • Handling of the changes regarding the composition of the group of organisers under Article 5(4);
  • Outlook messages which can be exchanged with the ECI Organisers and other data subjects;
  • Handling of organisers’ sponsors reporting relating to the transparency of initiatives in accordance with Article 17 of the ECI Regulation;
  • Handling of requests for additional information and of complaints relating to the transparency of initiatives' funding;
  • Handling of data subjects' requests;
  • Exchanges with Member States competent authorities.

Moreover:

  • Organisers' data may be processed manually using electronic means, including exchanged by email;
  • Some documents concerning the initiative and which contain organisers' data may be registered in the Commission document management Ares system;
  • Data contained in the decisions on request for registration and communications in reply to a valid initiative subject to publication in the European Union Official Journal.

Your personal data will not be used for an automated decision-making including profiling.

3. On what legal ground(s) do we process your personal data

  1. In case you are an ECI organiser (a member of the group of organisers or an additional contact person) for an initiative for which registration has been requested to the Commission, your personal data submitted in this context will be processed by the Commission, in line with Articles 5(1) to (4) and Article 6(2) and (3) of the ECI Regulation. Your personal data may be also processed if they have been submitted in the context of Point 7 of Annex II to the ECI Regulation. Moreover in case you are a representative or the substitute of the group of organisers, your name will be published as part of the registration decision or decision refusing registration in line with Article 6(7) of the ECI Regulation.
  2. In case registration of your proposed initiative has been confirmed by the Commission, your name as the ECI organiser (member of the group of organisers) will be made available in the public website of the ECI Register. Also, in case you are a representative or the substitute of the group of organisers of such initiative, your email address will be published equally. Such publication is foreseen by the provisions of footnote (1) in Annexes II and VII of the ECI Regulation.
  3. If you are ECI sponsor (in your personal capacity), or if you submit a complaint concerning the transparency of an initiative funding, your data may be processed based on Article 17 of the ECI Regulation. The Commission will not, as a principle, publish any personal data relating to a natural person acting as sponsor on the ECI website except upon express request from organisers and presentation by them of the evidence of that individual’s explicit consent to the publication; 
  4. If you are official of the national administration involved in the implementation of the ECI Regulation your data may be processed in the context of Articles 4(6), 11(3), 12, 20, 22 and 23 of the ECI Regulation.

In all 4 cases above processing of your personal data is lawful according to Article 5(1 (a) and (b) of Regulation (EU) 2018/1725 because:

(a) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Union institution or body; and

(b) processing is necessary for compliance with a legal obligation to which the controller is subject.

In exceptional cases, the Commission will publish on the ECI website the name of an individual acting as sponsor along with the amount provided upon express request from organisers and presentation by them of the evidence of that individual’s explicit consent to the publication (Article 5(1)(d) of Regulation (EU) 2018/1725 and Article 6(1)(a) of the General Data Protection Regulation).

Taken alone, your processed data do not fall in any of the special categories of sensitive personal data listed under Article 10 of Regulation (EU) 2018/1725. However, the fact of organising or financing a specific initiative may reveal political opinions of the organisers and sponsors. Sensitivity of your data may thus stem from the political sensitivity of the initiative concerned. Depending on the sensitivity of your proposed initiative your processed personal data may be thus considered as data revealing political opinions.

In this case the processing is not prohibited, as it is necessary for reasons of substantial public interest, on the basis of Union law (ECI Regulation) which is proportionate to the aim pursued, respects the essence of the right to data protection and provides for suitable and specific measures to safeguard your fundamental rights and interests in line with Article 10(2)(g). You are entitled to object to the publication of your personal data on compelling legitimate grounds relating to your particular situation as foreseen in footnote (1) of Annex II and VII of the ECI Regulation.

4. Which personal data do we collect and further process?

In order to implement the ECI Regulation we collect and process the following categories of personal data:

In case you are one of the mandatory members of the group of organisers or one of the additional contact persons of the group of organisers, designated under 2nd subparagraph of Article 5(3) of the ECI Regulation:

  • full name,
  • postal address,
  • date of birth,
  • nationality.
  • Moreover, copies of appropriate documents are collected and processed to prove your identity and the fulfilment of requirements of nationality, residence and age.

In case you are one of the contact persons (representative or substitute) of the group of organisers, we additionally collect and process your e-mail address and telephone number.

In case you are one of the additional members of the group of organiser we collect and process your full name.

In case your personal details appear as part of the documentation the group of organisers have submitted in the context of Point 7 of Annex II to the ECI Regulation, the type of data being processed depends on the applicable national law.

If you are initiative sponsor (in your personal capacity), or if you submit a complaint concerning the transparency of an initiative funding, in cases referred to in Article 17(2) and (3) of the ECI Regulation:

  • full name and amount provided as a sponsor of the initiative,
  • contact details you have provided as a complainant (in preference email address).

If you are official (contact point) of the national authorities involved in the implementation of the ECI Regulation, we may collect and process your name, function and email address.

5. How long do we keep your personal data?

Personal data that are not published, including personal data related to non-registered initiatives, will be kept in the ECI Register for a maximum period of 5 years.

This period is normally to be counted from the last action undertaken with regard to the initiative concerned in the ECI Register. However, in case the initiative concerned is subject to judicial proceedings the 5 years period is counted as of the end of such proceedings. In case of successful initiatives for which the Commission has undertaken follow-up actions, the 5 years period is counted as of the last action undertaken with regard to the initiative at issue.

Published data are kept on the website for an indefinite period of time for transparency and historical purposes. Email addresses of contact persons of registered initiatives may be deleted when the Commission becomes aware that such email addresses are no longer in use.

6. How do we protect and safeguard your personal data?

All personal data in electronic format (e-mails, documents, databases, uploaded batches of data, etc.) are stored on the servers of the European Commission. All processing operations are carried out pursuant to the Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission.

In order to protect your personal data, the Commission has put in place a number of technical and organisational measures. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of this processing operation.

7. Who has access to your personal data and to whom is it disclosed?

All data concerned are available within the Commission to the authorised staff members in charge of managing the ECI register as well as those involved in the follow-up of initiatives, and to other authorised Commission staff according to the 'need to know' principle. Such staff abide by statutory, and when required, additional confidentiality agreements.

Some personal data are available to the general public via publication in the individual webpage of the corresponding initiative in the ECI Register and in the European Union Official Journal. This concerns:

  • The names of the members of the group of organisers for all the registered initiatives as well as the e-mail addresses of the contact persons (representative and substitute),
  • The names of the representative and of the substitute, which are included in the decisions on initiative registration (including decisions refusing registration),
  • Email addresses of identifiable national officials may be published on the ECI website, only in case Member States concerned chose to provide such email addresses, as part of the contact details of their relevant authorities,
  • Only upon express request from organisers and presentation by them of the evidence of the individual’s explicit consent to the publication, names of the sponsors, in case they are natural persons.

8. What are your rights and how can you exercise them?

The ECI Regulation grants you the following rights:

  • You are entitled to object to the publication of your name and email address as the organisers of an initiative based on compelling legitimate grounds relating to your particular situation.
  • You are entitled to request the removal of your data from the Commission’s online register after the expiry of a period of two years from the date of registration of the proposed citizens’ initiative.

Moreover, you have specific rights as a ‘data subject’ under Chapter III (Articles 14-25) of Regulation (EU) 2018/1725, in particular:

  • You have the right to access your personal data and to rectify them in case your personal data is inaccurate or incomplete. In some cases, you have the right to erase your personal data, to restrict the processing of your personal data, to object to the processing and the right to data portability.
  • Insofar you are acting as sponsor in a personal capacity who consented to the publication of your personal data in the public website of the ECI Register, you can withdraw your consent at any time by notifying the Data Controller. The withdrawal will not affect the lawfulness of the processing carried out before you have withdrawn the consent.

You can exercise your rights by contacting the Operational Data Controller, or in case of conflict the Data Protection Officer. If necessary, you can also address the European Data Protection Supervisor. Their contact information is given under Heading 9 below.

Where you wish to exercise your rights in the context of one or several specific processing operations, please provide their description (i.e. their Record reference(s) as specified under Heading 10 below) in your request.

Any request for access to personal data will be handled within one month upon receipt of the request. Any other request mentioned above will be addressed within 15 working days.

9. Contact information

The Data Controller

If you would like to exercise your rights under Regulation (EU) 2018/1725, or if you have comments, questions or concerns, or if you would like to submit a complaint regarding the collection and use of your personal data, please contact the Operational Data Controller, using the following contact information:

European Commission

Secretariat General

Directorate A 'Strategy, Better Regulation & Corporate Governance'

Unit A.1 'Policy Priorities & Work Programme'

B – 1049 Brussels

Tel. +32 2 29 92165

E-mail: SG-ECI-INFO@ec.europa.eu

The Data Protection Officer (DPO) of the Commission

You may contact the Data Protection Officer (DATA-PROTECTION-OFFICER@ec.europa.eu) with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725.

The European Data Protection Supervisor (EDPS)

You have the right to have recourse (i.e. you can lodge a complaint) to the European Data Protection Supervisor (edps@edps.europa.eu). If you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data by the Data Controller.

10. Where to find more detailed information?

The Commission Data Protection Officer (DPO) publishes the register of all processing operations on personal data by the Commission, which have been documented and notified to him. You may access the register via the following link: http://ec.europa.eu/dpo-register.

This specific processing operation has been included in the DPO’s public register with the following Record reference: DPR-EC-00068

General information on personal data protection in the context of the ECI implementation can be found at:

https://citizens-initiative.europa.eu/how-it-works/data-protection_en

11. Additional information

Processing of the sponsors' personal data in the ECI Register 

In accordance with Article 17(1) of the ECI Regulation, the group of organisers is required to provide via the ECI Register (and systematically update) the information on the sources of funding and support for their initiative in excess of 500 Euros per sponsor and information on the organisations assisting it on voluntary basis where such support is not economically quantifiable. In case the initiative is sponsored by natural persons, this information includes names of data subjects concerned. 

As far as natural persons acting as sponsors (data subjects) are concerned, the Commission will not, as a principle, publish any personal data, and will only publish on the ECI website aggregated information under a generic category ‘natural persons acting as sponsors’ together with the amounts gathered from them. The Commission will publish the name of an individual sponsor along the amount provided only upon express request from organisers and presentation by them of the evidence of that individual’s explicit consent to the publication. In such cases, the data subjects have the right to withdraw their consent at any time, as specified under Heading 8 above.

Additional information – previous privacy statement

This privacy statement does not cover aspects specific to the processing of personal data under the first ECI Regulation (Regulation (EU) No211/2011), which may differ from the current ones. Such data may be still processed and or published in the ECI Register. The previous privacy statement applying to these data processing operations can be found at: 

https://europa.eu/citizens-initiative/privacy-policy  

 

Want to learn and collaborate?
Join the Forum