Judgment of the General Court Eighth Chamber, Extended Composition, 26 April 2023, SRB v EDPS, T-557/20

• Date: 26 April 2023
• Year: 2023

2

I. PROTECTION OF PERSONAL DATA

Judgment of the General Court (Eighth Chamber, Extended Composition), 26 April 2023,

SRB v EDPS, T-557/20

Link to the full text of the judgment

Protection of personal data – Procedure for granting compensation to shareholders and creditors

following the resolution of a bank – Decision of the EDPS in which it found that the SRB failed to fulfil its

obligations concerning the processing of personal data – Article 15(1)(d) of Regulation (EU) 2018/1725 –

Concept of personal data – Article 3(1) of Regulation 2018/1725 – Right of access to the file

In June 2017, the Single Resolution Board (SRB) adopted a resolution scheme in respect of Banco

Popular Español SA, a bank, on the basis of Regulation No 806/2014.

1

In order to determine whether

the shareholders and creditors affected by the resolution action would have received better

treatment if that bank had entered into normal insolvency proceedings, that regulation requires the

involvement of an independent third party who draws up a valuation of difference in treatment.

2

The

SRB asked the firm Deloitte to carry out the valuation.

Once that valuation was drawn up, the SRB adopted a preliminary decision on whether compensation

needed to be granted to the shareholders and creditors and launched a right to be heard process in

order to allow it to adopt a final decision.

3

During that process, which was divided into two phases,

the affected shareholders and creditors were first invited to express their interest in exercising their

right to be heard, using an online registration form, and to provide supporting documentation

proving their rights (‘the registration phase’). Second, the affected shareholders and creditors whose

status had been verified by the SRB were able to submit their written comments on the SRB’s

preliminary decision and the valuation (‘the consultation phase’). On the first day of the registration

phase, the SRB published, on the web page for registering for the right to be heard process, a privacy

statement concerning the processing of personal data in the context of that process.

The data collected during the registration phase were accessible to a limited number of SRB staff

tasked with processing those data in order to determine the participants’ eligibility. Those data were

not visible to the SRB staff tasked with processing the comments received in the consultation phase,

during which those staff members only received comments identified by reference to an

alphanumeric code allocated to each individual comment submitted using the form.

After aggregation, automatic filtering and categorisation of the comments, the SRB transmitted to

Deloitte, for assessment, the comments on the valuation carried out. The comments transferred to

Deloitte were solely those that were received during the consultation phase and that bore an

alphanumeric code. On account of that code, only the SRB could link the comments to the data

received in the registration phase. Deloitte had, and still has, no access to the database of data

collected during the registration phase.

In that context, given that the privacy statement concerning the processing of personal data

published by the SRB did not contain any mention of the transmission to third parties of the data

1

Regulation (EU) No 806/2014 of the European Parliament and of the Council of 15 July 2014 establishing uniform rules and a uniform

procedure for the resolution of credit institutions and certain investment firms in the framework of a Single Resolution Mechanism and a

Single Resolution Fund and amending Regulation (EU) No 1093/2010 (OJ 2014 L 225, p. 1).

2

Article 20(16) to (18) of Regulation No 806/2014.

3

Under of Article 76(1)(e) of Regulation No 806/2014.