Data protection at the Agency for the Cooperation of Energy Regulators
The Agency for the Cooperation of Energy Regulators ('the Agency') is highly committed to processing personal data in a lawful way.
The Agency processes personal data collected according to the provisions of Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.
The Agency only processes personal data for the performance of tasks carried out in the public interest in accordance with European Union law or whilst legitimately exercising the official authority vested to the Agency. Furthermore, the processing of personal data is lawful as a part of a legal or contractual obligation or when the data subject concerned has given his or her unambiguous consent.
In any case, the Agency will not process personal data for marketing or commercial purposes.
The Agency's supervisory authority, in terms of processing personal data, is the European Data Protection Supervisor (EDPS). The EDPS is responsible for the monitoring of European Union institutions, agencies and bodies and their compliance with data protection rules, ensuring that the rights to privacy and data protection are respected.
For more information about the EDPS, please refer to this website.
Data Protection Officer
In order to ensure the compliance with Article 43 of the Regulation (EU) 2018/1725, the Agency appointed a Data Protection Officer (DPO).
The main task of the DPO is to ensure, in an independent manner, the internal application of data protection requirements imposed by Regulation (EC) 1725/2018 within the Agency.
The DPO's main functions are to:
- inform data controllers and individuals regarding their obligations and rights pursuant to Regulation (EU) 2018/1725;
- cooperate and consult with the EDPS;
- ensure the transparency of Agency's processing operations. In this regard, the DPO keeps a register of all personal data processing operations performed at the Agency;
- advise on lawful processing of personal data, ensuring that data controllers respect the rights to privacy and data protection in the course of their work.
- provide recommendations, develop guidelines to enhance good practice, organise training and awareness session for Agency' staff;
- support the data subjects on the exercise of their rights;
- provide advice with regards to data protection related breaches;
- ensure in an independent manner the internal application of the Regulation (EU) 2018/1725.
In order to have further information regarding processing operations at the Agency, you may contact the DPO (dpo@acer.europa.eu).
Register
According to Article 31 of Regulation (EU) 2018/1725, the Agency has a legal obligation to keep a register of all personal data processing operations which have been notified to the Data Protection Officer (DPO). The register aims at ensuring transparency to the public and it is accessible to any interested person. It contains, among else, the following information:
- The Agency's department processing personal data;
- Name of the processing operation;
- Purpose of the processing operation.
The register is available 
here.
In order to have further information regarding processing operations at the Agency, contact the DPO (dpo@acer.europa.eu ).
Privacy notices
The processing of an individual's personal data carried out by the Agency is performed in compliance with Regulation (EC) No 1725/2018.
The privacy notices describe Agency's policies and practices regarding collection and use of personal data.
You may find a collection of privacy notices for each specific processing operation carried out by the Agency listed below:
- DPN Staff Administration, available
here: intended to cover processing activities that the Agency may carry out regarding data related to staff members, trainees, SNEs and interim staff. - DPN Interactions with Stakeholders, available here: intended to cover processing of data on contact persons within NRAs, energy market participants, organised marketplaces and other stakeholders that the Agency may engage in the context of meetings, questionnaires, requests for feedback, roundtables, working groups etc.
- DPN ARIS and CMT, available here: intended to cover processing activities undergone on the REMIT Portal, including applications and platforms made available on the REMIT Portal.
- DPN Financial Management, available here: intended to cover processing related to data of anyone entering into financial relationships / transactions with the Agency as well as other activities needed for the Agency's financial and budgetary management.
- DPN ACER Website, available here: intended to act as the Privacy Policy for the Agency's website, covering the processing activities carried out within.
- DPN Agency Events, available here: intended to cover processing activities related to the organisation of events by the Agency.
- DPN Meetings with the Director of the Agency, available here: intended to cover the disclosure of information on individuals (self-employed or representing organisations) meeting with the Director.
- DPN Recruitment and Selection, available here: intended to cover the processing of data on applicants and candidates to traineeship programmes, staff positions or assignments.
- DPN Procurement and Contract Management, available here: intended to cover the processing of data on tenderers and contractors concerning procurement procedures.
- DPN Agency Offices, available here: intended to cover processing operations regarding persons physically present at the Agency's premises (access control, CCTV and Wi-Fi).
- DPN AEGIS, available here: intended to cover processing activities undergone on the AEGIS Portal, including applications and platforms made available therein.
- DPN Board of Appeal, available here: intended to cover processing activities carried out in the context of proceedings before the Agency's Board of Appeal.
