Information on Data Protection and Data Processing

Since 25 May 2018 onwards, the General Data Protection Regulation, also known as the GDPR, applies throughout the European Union. The GDPR stipulates the way in which personal data are to be processed and how they must be protected. 

What is the GDPR?

The GDPR is a regulation of the European Union. It applies directly in all of the member states including Austria. Every person whose data are processed is able to refer to and invoke the GDPR. 

What is regulated by the GDPR?

The GDPR contains legal provisions regarding the processing of your personal data. Whether it concerns your name, your telephone number, your bank account transactions or even your hobbies – all are protected by the GDPR. The principles which it stipulates regulate the ways in which your personal data are permitted to be saved and processed. 
 

Why does the Austrian Data Protection Act continue to apply (DSG)?

The European Union hasn't just enacted the GDPR, it has also enacted a full “data protection package”. This package also included a new data protection directive. How does a directive differ from a regulation? In contrast to a regulation, it is necessary for a directive to be implemented into national law first. In addition to this, the GDPR provides the member states with the scope to structure certain aspects on a more detailed basis than the GDPR itself.

Both of these have taken place in Austria with the Data Protection Act (Datenschutzgesetz), in short DSG.

Why is the protection of my data so important?

Data protection is a fundamental right. The same as your right to liberty or security, your right to the protection of your data is anchored in the Charter of Fundamental Rights of the European Union. The EU Charter of Fundamental Rights covers your relationship with governmental institutions.

It is legally acknowledged, however, in both the private and commercial spheres, that there must also be a balancing of interests between the Data Processor and what are referred to as the “data subjects” – i.e. between you and your bank, for example. This is stipulated in both the GDPR and the DSG.

Our personal data contains a lot of information about us: it can also refer to our hobbies, our preferences and our aspirations. Such things are naturally worthy of protection. Yet we can only improve our individual service for you if we are aware of your preferences. A key element of data protection is that we work with you to find a way of being able to process your data in your interests and under your supervision. 

Doesn't banking secrecy apply, anyway?

Yes, information of which we become aware due to the business relationship is protected by Austrian banking secrecy - according to Art. 38 of the Austrian Banking Act. The GDPR also applies.

Good to know: The banking confidentiality arrangements can only be dispensed with in writing – refer to Art. 38 para. 2, clause 5, Austrian Banking Act. In this case, “in writing means”:

• the provision of a handwritten signature on “ink and paper” for example, or
• a qualified electronic signature, e.g. in the form of a “mobile phone signature” or
• strong customer authentication in digital banking, for example CardTAN or s Identity in George.

Where can I find out more about the GDPR and the DSG?

(All links are valid as of March 2023)

A consolidated version of the GDPR is available here:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016R0679-20160504

A consolidated version of the DSG is available here:
https://data-protection-authority.gv.at/data-protection-laws/relevant-data-protection-laws.html

The EU Charter of Fundamental Rights:

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A12012P%2FTXT

Further information about your rights is available on the following websites:

Austrian Data Protection Authority https://www.dsb.gv.at/

European Commission:
https://ec.europa.eu/commission/priorities/justice-and-fundamental-rights/data-protection/2018-reform-eu-data-protection-rules_en

(All links are valid as of May 2024)

Before we can discuss the topic of data protection, it is important to clarify some basic terms. We have also included the references for the appropriate Articles of the GDPR so that you can read the definitions for yourself if you are interested. Please note that we only provide a summary, i.e. a shortened description of the legal text. The full legal text of the GDPR and the corresponding Articles is available here:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016R0679-20160504
 

What is personal data?

Personal data means all information that refers to an identified or identifiable natural person, known as the “data subject”. E.g. the name of a person or an identification number such as an IBAN or account number.

For further details refer to Article 4 (1) GDPR.

What does the processing of data entail?

The term “processing” means any operation, with or without the use of automated processes, which is performed on personal data. This includes, for example, the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure (by transmission, dissemination or otherwise making available), the alignment or combination, restriction, erasure or destruction of the data.

For further details refer to Article 4 (2) GDPR.

What is meant by the term “Controller”?

The term “Controller” refers to the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. For example, we, in our role as a bank.

For further details refer to Article 4 (7) GDPR.

What is meant by the term “Processor”?

The term “Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of a Controller.

For further details refer to Article 4 (8) GDPR.

For the categories of data and data processing mentioned above, the other explanations in this information sheet shall also apply (with the exception of the previous item 3., “For which purposes and on what legal basis are my personal data processed?”)
 

Am I obliged to provide my personal data? What will happen if I do not want to do so?

For our business relationship, we require many of your personal data, e.g. for re-order of a debit card that is to be sent to you. If we cannot verify your identity, the law will prohibit us from doing business with you. If we do not know your creditworthiness, we will not be allowed to grant you a loan. So you see we must process your personal data wherever it is required by contract or by law. If you do not want us to do so, we may unfortunately not be allowed to provide certain services. If we process your data only on the basis of your consent, you will not be obliged to give this consent and provide the data.

Is there any automated decision-making, including profiling?

If automated decision-making, including profiling, takes place in the course of a specific processing operation, you will be informed of this in advance.

When granting loans, we check your creditworthiness on the basis of the so-called credit scoring. In the process, the default risk of credit applicants is assessed with the help of statistical benchmark groups.
The calculated score enables us to forecast the probability with which a loan applied for is likely to be redeemed. The following data are used to calculate this score:

• Your master data, e.g. marital status, number of children, length of employment, employer, etc.
• Information on your general financial circumstances, e.g. income, assets, monthly expenses, liabilities, collaterals, etc.
• Data on payment behaviour, e.g. loan repayments, reminders, data from credit information bureaus

If the risk of default is too high, the credit application will be rejected and there may be an entry in the KSV 1870 KKE and an internal warning. If a credit application is rejected, this will be shown in the KSV 1870 KKE for 6 months (according to the Notification of the data protection authority).

To whom will my personal data be disclosed?

Your personal data may be disclosed to:

• Credit institutions, bodies and persons within the network of Sparkasse savings banks, Erste Bank and Erste Group who require the data for contractual, legal or regulatory duties as well as for legitimate interests.  This applies in particular to risk management within Erste Group and to the management of credit risks when credit institutions within Erste Group have identical customers.
• Information bureaus like Kreditschutzverband von 1870 (Credit Protection Association of 1870)
• Public bodies and institutions as well as persons with a sovereign mandate, to the extent that we are legally required to do so or in order to protect our legitimate interests, e.g. the European Bank Supervisors, the European Central Bank, Financial Market Authority, the Austrian National Bank, tax authorities, etc.
• Processors and other service providers (controllers) commissioned by us, e.g. for IT, back office, legal and tax advice, chartered accountants and collection companies, to the extent they require the data for their tasks.
• Bank auditors and auditors of annual financial statements, insofar as this is necessary for the auditing activity
• Third parties, if this is mandatory for the fulfilment of the contract or legal provisions, e.g. the recipients of a bank transfer and their payment service provider.
• Validation services, e.g. Rundfunk und Telekom Regulierungs-GmbH (the radio and telecommunications regulation company), to the extent this is necessary to verify a digital signature or digital seal transmitted by you.
• Trust service providers, e.g. A-Trust, if we provide a document containing your data with our digital signature.

Disclosure to third parties may also take place if you have consented to the disclosure and for the period of your valid consent.

A list containing an overview of potential recipients can be found here.

Will my data be transferred to a third country?

Your personal data may be transferred to a third country in the following cases:

• this is necessary in order to assert, exercise or defend legal claims or there is a legal obligation, e.g. at the request of the authorities under a mutual legal assistance agreement.
• This is necessary for your contract or for pre-contractual measures, for instance, if funds are to be transferred to a third country
• Our processors and sub-processors may be located in third countries. Unless the transfer is based on an adequacy decision of the European Commission, we will transfer the data on the basis of appropriate or suitable safeguards. We will be happy to provide you with these on request.
• You will receive a special notification in other cases of data being transferred to a third country.

A list containing an overview of potential recipients in third countries can be found here.

For how long will my personal data be stored?

(All links are valid as of May 2024)

Your personal data will be stored for as long as is necessary for the respective purpose: this may be the duration of the customer relationship, pending legal proceedings or the existence of a claim, or if required by law. Retention may also be necessary if you have ceased to be our customer.

The essential legal provisions applicable to credit institutions include:

• the Austrian Companies Code, Article 212 (7 years)
• the Federal Tax Code, Article 132 (7 years or for the duration of tax proceedings);
• the Securities Supervision Act 2018, Article 33 (5 or 7 years by order of the Financial Market Authority).
• Financial Market Money Laundering Act, Article 21 (10 years from the end of the business relationship).

An overview of other statutory retention obligations applicable in Austria can be found here, for example:
https://www.wko.at/service/wirtschaftsrecht-gewerberecht/eu-dsgvo-speicher-und-aufbewahrungsfristen.html

The Bank has a legitimate interest in retaining your personal data in the following cases:

• Applications for financing can be kept for up to 18 months after they have been made. This serves our legitimate interest in documenting a customer contact and our ability to process the application quickly when you come back to us.
• If you use George Store and do not complete the purchase, your personal data will be stored for 60 days. During this time, you can use the recovery link and complete the purchase
• When you use the George Store, metadata (e.g., log data, technical log data, date and timestamp) related to the completed purchase is stored for 60 days. We do this to identify potential operational issues arising from the purchase process. We also use this data to defend against potential legal claims and to perform maintenance.
• SWIFT messages are kept for 30 years for the purpose of preventing and combatting fraud and for the prevention of money laundering and terrorist funding.
• Data on receivables sold are kept for 30 years from the date of sale. This serves the Bank's legitimate interest of averting possible objections arising from the sale of receivables.
• Your personal data may also be retained to document past damage cases, as an aid to decision-making about entering into new or extended customer relationships. Specifically:
  • 7 years in a damage case, if
    • the amount of damage at the time the case was closed did not exceed 20,000 euros, or
    • there is otherwise no interest in a business relationship due to special circumstances
  • 12 years in a damage case if
    • the amount of the loss at the time the case was closed was more than 20,000 euros, or
    • insolvency proceedings have been instituted against your assets during our business relationship.
  • 30 years in particularly serious, exceptional cases after detailed examination in each individual case.

The retention period starts when the damage case has been closed, i.e. as soon as a debt/claim no longer exists or insolvency proceedings have been terminated or cancelled. In addition, data on past damage cases must be stored for regulatory purposes, e.g. the data are also used for our model to calculate defaults. However, only a limited group of people will have access to these data. They are no longer visible to account managers. The data will also not affect existing or future business relationships.