PRIVACY STATEMENT
The European Commission is committed to protect your personal data and privacy.The Commission may collect and further process your personal data if you give your explicit consent, under Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies.
Why and how do we process personal data? What personal data do we collect? To whom is personal data disclosed?
EPREL visitors can report product models for possible or suspected non-compliance. Once you have confirmed your intention to submit a report by replying to the email sent by the EPREL system, the email content is sent to the product supplier or market surveillance authority as an ‘anonymous report’. No personal data are stored.
Only if you give your explicit consent, by checking the box to enable possible feedback, your email address is stored and made available to the product supplier or market surveillance authorities and Commission departments that have access to EPREL.
On what legal grounds do we process this personal data?
EPREL only processes your email address with the objective to report products to market surveillance authorities. This will support these authorities in carrying out their tasks including enforcement under article 12 .2 of Regulation (EU) 2017/1369.
How long is your personal email address kept?
Email addresses that have been collected with explicit consent are automatically deleted within 6 months. There is no further processing outside the scope of the specific context described above.
How do we protect your data?
Email addresses are stored on the Commission’s EPREL server. All processing operations are carried out under Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission. To protect personal data, the Commission has put in place a number of technical and organisational measures.
What are your rights and how can you exercise them?
If you have agreed to share your address with the product supplier or market surveillance authorities to report a possible case of non-compliance, you can withdraw your consent, at any time, by notifying the Data Controller. This will not affect the lawfulness of the processing carried out before you withdrew your consent (which will become anonymous).
The Data Controller
To exercise your rights under Regulation (EU) 2018/1725 or for questions, concerns, or complaints about the collection and use of personal email addresses, please contact the Data Controller:
European Commission – Directorate-General for Energy, Unit B3 Buildings and products
Email: EPREL-DATA-CONTROLLER-ENER@ec.europa.eu.
The Commission Data Protection Officer
The Data Protection Officer (DATA-PROTECTION-OFFICER@ec.europa.eu) can be contacted about issues related to processing a personal email address under Regulation (EU) 2018/1725.
The European Data Protection Supervisor
If you consider that your rights under Regulation (EU) 2018/1725 have not been respected as a result of the processing of the personal email address by the Data Controller you can lodge a complaint with the European Data Protection Supervisor (edps@edps.europa.eu) .
Where to find more information?
The Commission Data Protection Officer maintains the register of all processing operations on personal data by the Commission, which have been documented and notified to the office.
This specific processing operation has been included in the Data Protection Officer’s public register with the following record reference: DPR-EC- 12369.
