Data Protection Policy
BAWAG P.S.K. Bank für Arbeit und Wirtschaft und Österreichische Postsparkasse Aktiengesellschaft, trading as MoCo (“MoCo”), is authorised by the Austrian Financial Markets Authority in Austria and is regulated by the Central Bank of Ireland for conduct of business rules. BAWAG is a stock corporation registered in Austria having its registered office at Wiedner Gürtel 11 1100, Vienna (with registration number 205340X) and having a registered branch in Ireland (with registration number 910053). Directors: A Abuzaakouk (US), E Sirucic (AT), S Shah (US), D O’Leary (US), A Wise (US) and G Jestaedt (GER). MoCo is subject to, and acts in accordance with, EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data, or General Data Protection Regulation (“GDPR”).
GDPR specifies that Personal Data, which may be held on paper, on a computer, or on other media, is subject to certain legal safeguards, and misuse or unlawful processing of Personal Data can result in potential fines of up to €20m or 4% of turnover.
As such, MoCo has established this Data Protection Policy to establish rules for the protection of natural persons with regard to the processing of Personal Data, and rules relating to the free movement of Personal Data.
Scope
This Policy applies to the processing of Personal Data MoCo collects from Data Subjects, or that is provided to MoCo by Data Subjects or collected from other sources.
For the purpose of this Policy, the term ‘Data Subjects’ refers to customers, staff, job applicants, contractors, directors, outsourcers, other third parties, or any living identified or identifiable individual about whom MoCo holds personal data.
This Policy applies to all staff and contractors of MoCo.
MoCo is a Data Controller in relation to the relationship between MoCo and its Data Subjects.
The Head of Risk and Compliance is ultimately responsible for monitoring MoCo’s compliance with GDPR, and for ensuring all Data Users comply with this policy and any relevant Group policies. The Head of Risk and Compliance will ensure that there are appropriate practices, processes, controls and training in place to ensure compliance with the regulations. Any questions about the operation of this policy or any concerns that the policy is not being followed should be forwarded to the Head of Risk and Compliance immediately.
Personal Data MoCo Collects
MoCo collects Personal Data relating to:
Employee Personal Data
Personal details on employees and applicants for employment, including job applications, records of training, employee appraisals, salary information, bank details, social security number, etc.
Customer Personal Data
Identification, proof of address, financial information, financial history, proof of employment, employment history, family and next of kin details, etc.
Suppliers/Service Providers Personal Data
Contact details, personal information (if required for due diligence or KYC purposes), etc.
Reasons the Personal Data is Collected
The following are some of the reasons for which MoCo collects the Personal Data mentioned above:
Employee Personal Data
To administer contracts of employment;
To manage employee benefits and entitlements;
To provide access to MoCo’s IT systems;
To manage MoCo’s hiring process;
Compliance with applicable laws, regulations, and rules; and
Protection of the legitimate interests of MoCo, including investigations of faults or frauds.
Customer Personal Data
Administration and management of customer relationships;
To perform required due diligence on customers;
To allow for fair and appropriate credit risk assessment of customers and fair and appropriate credit decisioning;
To allow for the establishment of an effective efficient method of credit repayment for customers;
Verification of customer identification;
To compile statistical and management information regarding products, services, customers and transactions;
To successfully deal with complaints, enquiries and errors; and
Compliance with applicable laws, regulations and rules (including anti-money laundering obligations).
Suppliers/Service Providers Personal Data
To administer the receipt of goods and services from suppliers;
To manage supplier relationships and payments; and
Compliance with applicable laws, regulations and rules.
In order to fulfil the above objectives and obligations, we may share the Personal Data we collect with corporate affiliates, Parent and Group companies, third parties acting on our behalf, or regulatory authorities. We will only share Personal Data with parties that have a requirement to protect Personal Data in accordance with relevant Data Protection Law. If you are not sure about whether a party meets this standard, do not share Personal Data with the party until receiving confirmation from the Head of Risk and Compliance.
Processing of Criminal Data
For Criminal Data to be processed lawfully, it must be processed on the basis of one of the legal grounds set out in Data Protection Law. These include:
- The Data Subject has given their Explicit Consent;
- Processing is necessary and proportionate for the performance of a contract to which the Data Subject is a party or in order to take steps at the request of the Data Subject prior to entering into a contract;
- Processing is necessary for the purpose of providing or obtaining legal advice or for the purpose of, or in connection with, legal claims, prospective legal claims, legal proceedings or prospective legal proceedings;
- Establishing, exercising or defending legal rights;
- Processing is necessary to prevent injury or other damage to the Data Subject or another person, or loss in respect of, or damage to, property or otherwise to protect the vital interests of the Data Subject or another person;
- Specific legal regulations provide for such processing.
Processing of Special Data
Processing of special categories of data is generally prohibited by the GDPR. These categories include:
GDPR allows for processing of the above categories of data if one of the following circumstances applies:
- The data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where European Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;
- Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;
- Processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;
- Processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;
- Processing relates to personal data which are manifestly made public by the data subject;
- Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;
- Processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;
- Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in the GDPR;
- Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;
- Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
Automated Individual Decision-Making
The Data Subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless the decision:
- Is necessary for entering into, or performance of, a contract between the data subject and MoCo;
- Is authorised by Union or Member State law to which MoCo is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or
- Is based on the Data Subject’s explicit consent.
In the cases referred to in points (1) and (3), MoCo shall implement suitable measures to safeguard the Data Subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of MoCo, to express his or her point of view and to contest the decision.
Any decisions referred to in this section shall not be based on special categories of personal data referred to in the section above, unless point explicit consent is given or the decision is made for reasons of substantial public interest, and suitable measures to safeguard the Data Subject’s rights and freedoms and legitimate interests are in place.
Data Protection Principles
MoCo is responsible for, and must be able to demonstrate, compliance with the principles set out in the GDPR. These provide that Personal Data must be:
- processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
- collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes (‘purpose limitation’);
- adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
- accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
- kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (‘storage limitation’);
- processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
Processing shall be lawful only if and to the extent that at least one of the following applies:
- the Data Subject has given consent to the processing of his or her personal data for one or more specific purposes;
- processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract;
- processing is necessary for compliance with a legal obligation to which the controller is subject;
- processing is necessary in order to protect the vital interests of the Data Subject or of another natural person;
- processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
MoCo will keep, and regularly review, a Record of Processing Activities for all data processing it undertakes detailing the legal basis for processing.
Data Subject Rights and Requests
Under GDPR, Data Subjects have the following rights regarding the processing of their Personal Data:
- Right of Access. Right to request and obtain from MoCo details of any Personal Data held relating to them and details of how it is being processed.
- Right to Rectification. The Data Subject can request any inaccurate Personal Data held by MoCo is amended without undue delay.
- Right to Erasure. The Data Subject has the right to request that Personal Data relating to them is erased without undue delay if the data is no longer necessary to be held, or was obtained illegally.
- Right to Restriction of Processing. The Data Subject has the right to request a restriction of processing on the grounds that the data is inaccurate; the processing is unlawful; or MoCo no longer requires to hold the Personal Data.
- Right to Object. The Data Subject can at any time object, on grounds relating to his or her particular situation, at any time to processing of Personal Data relating to them.
If any employee or director receives a Data Subject request from an individual in writing, verbally, electronically, or via another medium, they must pass it to the Head of Risk and Compliance immediately. All employees must be vigilant in confirming the identification of the individual making the data request.
The Firm will deal with Data Subject requests without undue delay and provide a response within one month, at the latest, of receiving the request. This period may extend to two months where requests are numerous or complex. All requests will be dealt with as per MoCo’s written Data Request Procedures.
Data Sharing
MoCo is not permitted to share Personal Data with third parties unless safeguards and contractual arrangements have been put in place to protect that Personal Data.
MoCo will only share Personal Data with third parties, such as service providers, if:
- The Processor needs to know the information for the purpose of providing the contracted services;
- Sharing the Personal Data complies with the Privacy Notice provided to the Data Subject and, if required, the Data Subject’s consent has been obtained;
- The Processor has agreed to comply with the required data security standards, policies and procedures and put adequate security measures in place;
- The Processor is processing Personal Data on behalf of MoCo; and
- The transfer complies with any applicable cross border transfer restrictions.
The GDPR restricts data transfers to third countries. MoCo will only transfer Personal Data to third countries, if the following conditions apply:
- The European Commission has deemed the country ensures an adequate level of protection. The European Commission maintain an updated list of approved third countries on their dedicated GDPR website; or
- MoCo has ensured that the Processor in the third country has appropriate safeguards in place, and that enforceable data subject rights and effective legal remedies for Data Subjects are available.
No Processor is permitted to transfer Personal Data to a third country without express, prior written consent from MoCo.
Data Processors
Third parties that MoCo engage with to process Personal Data on behalf of MoCo are designated as Data Processors.
MoCo will only engage with Data Processors who provide sufficient guarantees to comply with GDPR and protect the rights of the Data Subject.
MoCo, or its Parent company, will enter into a written contract with all Data Processors which will set out the subject-matter, duration, nature and purpose of the processing, including the types of Personal Data to be processed.
MoCo will only allow for the processing of Personal Data on documented instruction from MoCo. Sub-contracting of Personal Data processing can only happen with prior written consent of MoCo.
All Data Processors will be required to inform MoCo immediately of any breach or potential breach of Data Protection regulations or contract terms relating to Data Protection.
Accountability
MoCo is responsible for, and must be able to demonstrate, compliance with the GDPR and data protection principles.
MoCo will provide relevant Data Protection information and Data Privacy Notices to all Data Subjects.
MoCo will ensure that Data Protection clauses are inserted in all relevant third party or supplier contracts.
MoCo will integrate Data Protection into all relevant internal policies and procedures.
MoCo will provide regular training to employees on GDPR and the applicable policies and procedures including Data Subject rights, consent and Data Subject requests. MoCo will keep a record of all completed trainings.
Regular testing of policies, procedures and systems related to Data Protection will be undertaken by MoCo.
Data Protection Impact Assessment
Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, MoCo shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (“DPIA”). A single assessment may address a set of similar processing operations that present similar high risks.
The DPIA shall be conducted in conjunction with the Head of Risk and Compliance and the relevant business areas of MoCo.
A DPIA will in particular be required in the following cases:
- A systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;
- Processing on a large scale of special categories of data, or of personal data relating to criminal convictions and offences; or
- A systematic monitoring of a publicly accessible area on a large scale.
The DPIA shall contain at minimum:
- A systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller;
- An assessment of the necessity and proportionality of the processing operations in relation to the purposes;
- An assessment of the risks to the rights and freedoms of Data Subjects; and
- The measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of Personal Data and to demonstrate compliance with the GDPR taking into account the rights and legitimate interests of Data Subjects and other persons concerned.
Reporting a Personal Data Breach
The GDPR requires notification of any Personal Data Breach to the applicable regulator. The applicable regulator in Ireland is the Data Protection Commission.
The Head of Risk and Compliance will be responsible for reporting any necessary information or breaches to the Data Protection Commission, and to relevant individuals in Parent or Group companies.
Appendix
Glossary
‘Personal Data’ means any information relating to an identified or identifiable natural person (‘Data Subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
‘Processing’ means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
‘Restriction of Processing’ means the marking of stored Personal Data with the aim of limiting their processing in the future;
‘Profiling’ means any form of automated processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data; where the purposes and means of such processing are determined by Union or Member State law, the Controller or the specific criteria for its nomination may be provided for by European Union or Member State law;
‘Processor’ means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller;
‘Third Party’ means a natural or legal person, public authority, agency or body other than the Data Subject, Controller, Processor and persons who, under the direct authority of the Controller or Processor, are authorised to process Personal Data;
‘Consent’ of the Data Subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of Personal Data relating to him or her;
‘Personal Data Breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed;
‘Genetic Data’ means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question;
‘Biometric Data’ means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data;
‘Data concerning health’ means Personal Data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;
‘Cross-Border Processing’ means either:
- processing of Personal Data which takes place in the context of the activities of establishments in more than one Member State of a Controller or Processor in the Union where the Controller or Processor is established in more than one Member State; or
- processing of Personal Data which takes place in the context of the activities of a single establishment of a Controller or Processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.
‘Relevant and Reasoned Objection’ means an objection to a draft decision as to whether there is an infringement of this Regulation, or whether envisaged action in relation to the Controller or Processor complies with this Regulation, which clearly demonstrates the significance of the risks posed by the draft decision as regards the fundamental rights and freedoms of data subjects and, where applicable, the free flow of personal data within the Union;