Protection of your personal data
Table of Contents
- Why do we process your data?
- How long do we keep your data?
- How do we protect your data?
- Who has access to your data and to whom is it disclosed?
- What are your rights and how can you exercise them?
- Withdrawal of consent
- No profiling
This privacy statement explains the reason for the processing, the way we collect, handle and ensure protection of all personal data provided, how that information is used and what rights you may exercise in relation to your data (the right to access, rectify, block etc.).
The European institutions are committed to protecting and respecting your privacy. As this service/application collects and further processes your personal data, Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, is applicable.
ECC-Net aims to promote consumer confidence by advising citizens on their rights as consumers and providing easy access to redress, in cases where the consumer has purchased something in another country to his/her own (cross-border).
ECCs provide consumers with a wide range of services, from providing information on their rights to giving advice and assistance to their cross-border complaints and informing about the available resolution of disputes.
They also advise on out-of- court-settlement procedures (ADR) for consumers throughout Europe and provide consumers with easy and informed access to such procedures, when an agreement could not be reached directly with the trader and where an applicable ADR is available.
To enable ECC-Net to provide the above mentioned services to the citizens, an IT Tool, "ECC-Net 2", is used to collect and handle complaints and the necessary data including your personal data. The IT tool is operated by the European Commission.
The collection and processing of the above personal data through ECC-Net 2 follows the provisions of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by Community institutions and bodies and on the free movement of such data and more specifically article 5, Paragraph (a and b).
Verein für Konsumenteninformation (VKI)
(Austrian Consumer Association)
Linke Wienzeile 18, 1060 Wien, Tel: 01 588 77
Data protection officer:
Wolfgang Schmitt, LL.M. (WU), MA.
3. Why do we process your data?
Purpose of the processing operation: Head of Unit E.3: Consumer Enforcement and Redress, Directorate-General for Justice and Consumers, European Commission (referred to hereafter as Data Controller) collects and uses your personal information to assist the work of the European Consumer Centres.
The aim of the European Consumer Centres’ Network (ECC-Net) is to provide consumers with information and advice on their rights, and assist them with the handling of their cross-border complaints and disputes within the EU/EEA, so that consumers can take full advantage of the internal market.
The processing of your data is necessary in order to fulfill the contract as well as for enforce, exercise or defend your legal claims.
In order to fulfil their role, "ECC-Net 2" is used by the ECCs to process relevant data, insofar and as long as necessary, for one or more of the following purposes:
- to enable communication between the ECC and the consumer
- to facilitate the assessment of a request
- to attempt resolving complaints or disputes, whether directly with the trader complained about, or through an ADR entity
- to enable consumers to follow up the status of their requests
- to provide anonymised statistics, including on suspected infringements
Further information on ECC-Net can be found on https://ec.europa.eu/info/live-work-travel-eu/consumers/resolve-your-consumer-complaint/european-consumer-centres-network_en
"ECC-Net 2" falls under the following legal basis / lawfulness
- Regulation (EU) No 254/2014 of the European Parliament and of the Council of 26 February 2014 on a multi-annual consumer programme for years 2014-20 and repealing Decision No 1926/2006/EC and, more specifically, articles 2 and 3(1)(c) and (d) of this Regulation
- Directive 2006/123/EC of the European Parliament and of the Council of 12 December 2006 on services in the internal market and, in particular, article 21.
- Directive 2013/11/EU of the European Parliament and of the Council of 21 May 2013 on alternative dispute resolution for consumer disputes and amending Regulation (EC) No 2006/2004 and Directive 2009/22/EC (Directive on consumer ADR) and, more specifically, article 14 of the Directive.
- Regulation (EU) 2017/2394 of the European Parliament and of the Council of 12 December 2017 on cooperation between national authorities responsible for the enforcement of consumer protection laws and repealing Regulation (EC) No 2006/2004 and, in particular, article 27(1).
- Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.
Having regard to article 5 of the aforesaid Regulation (EU) 2018/1725, the data processing is considered lawful because it is necessary to meet the requirements of the legal instruments mentioned above, and to ensure compliance of the Commission with its legal obligations.
4. How long do we keep your data?
The VKI (national host-structure of ECC Austria) reserves the right to keep your personal data for 30 years over the duration of the proceedings, in case of any legal claims.
5. How do we protect your data?
All data in electronic format (e-mails, documents, uploaded batches of data etc.) are stored either on the servers of the European Commission or of its contractors; the operations of which abide by the European Commission’s decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission (C/2016/8998).
The Commission’s contractors are bound by a specific contractual clause for any processing operations of your data on behalf of the Commission, and by the confidentiality obligations deriving from the transposition of Directive 95/46/CE.
6. Who has access to your data and to whom is it disclosed?
To resolve your request it may subsequently be shared, with your express consent, with the ECC where the trader is based or, where appropriate, with relevant bodies such as an ADR entity or a National Enforcement Body (NEB).
Shared requests may result in contact with the trader. When such contact is made, your data may be shared too insofar as necessary to resolve the request.
Access to your data is provided to authorised staff according to the "need to know" principle. Such staff abide by statutory, and when required, additional confidentiality agreements.
The authorised staff are the Case handlers in the European Consumer Centres and the European Commission staff charged with product or business management of "ECC-Net 2".
Norway and Iceland are EEA/EFTA countries and members of the European Consumer Centres Network. Transfer between ECCs in the EU and the ECCs in Norway or Iceland is therefore considered an Article 8 transfer in the meaning of the Regulation No 45/2001.
Furthermore, your data may be forwarded to the following institutions:
- Chamber of labour (Arbeiterkammern)
- Trusted lawyers of the VKI
7. What are your rights and how can you exercise them?
You have the right to get information about all your personal data collected by the VKI as well as the right to have this data corrected, blocked or erased or to withdraw your consent for the processing. Furthermore, you have the right of data portability. If you feel like your rights are being violated, you can lodge a complaint at the national data protection authority.
(Austrian Data Protection Authority)
Telefon: +43 1 52 152-0
8. Withdrawal of consent
In case the processing is based on an agreement given, the person concerned is entitled to withdraw this agreement anytime. The processing until such withdrawal remains valid though.
Whenever collecting data, we inform the person concerned if the provision of his/her personal data is mandatory by law or any contractual clause as well as if the provision is necessary in order to conclude a contract. Moreover, we inform the person concerned if she/he is obliged to make personal data available and which consequences a non-provision might have.
9. No profiling
There is no automatic decision making process including profiling. If any personal data is processed for any other causes than the purpose for which the data was originally collected, the respective information about those other causes will be provided to the person concerned.