Data protection information on the processing of your personal data pursuant to Art. 13, 14 GDPR
The European Biodiesel Board (“EBB“) has commissioned the law firm Redeker Sellner Dahs, Partnerschaft von Rechtsanwältinnen und Rechtsanwälten mbB, (“Redeker“) to set up a whistleblower tool to enable confidential and simple reporting of allegations of fraud or violations of the Renewable Energy Directive (“RED”). All information contained in the reports will be reviewed upon receipt by authorised employees of the EBB Secretariat and, in cases selected by the designated EBB employees, also by Redeker. The aim is to inform the competent audit bodies, national authorities, the European Commission and political decision-makers (e.g. members of parliament and their staff) so that violations can be detected and penalised.
The web based whistleblower tool is provided by Redeker so that the EBB Secretariat can use it to receive reports. After an initial review of the reported allegations and potential violations, the EBB Secretariat decides whether a report should be further processed and reviewed by Redeker. Only these selected reports are reviewed by Redeker for fraud and possible violations of the RED.
As part of the provision of the whistleblower tool, personal data is processed, both of persons who submit a report and of persons who have a connection to the reported facts, and therefore also information that relates to you. The following explains how your personal data is processed by EBB on the one hand and Redeker on the other as well as your rights in this regard.
1. Who is responsible for processing my data?
The EBB, represented by its secretariat, is responsible for the operation of the whistleblower tool and related processing of your data within the meaning of the EU General Data Protection Regulation (“GDPR“). The whistleblower tool is operated by Redeker on behalf of the EBB.
Redeker is only responsible for the further independent and autonomous review of the notifications selected by EBB and the related processing of your data. In this respect, Redeker is independent and autonomous as legal advisor to EBB.
This results in the following distribution of responsibilities:
| EBB | Redeker |
| Whistleblower tool: | Independent review of the reports: |
| Collection and further processing, in particular storage, of data in the reports in the whistleblower tool | |
| Transmission of data for selected reports to Redeker | Collection, evaluation and further processing of the transmitted data |
| Collection and further processing of additional data as part of the clarification of the facts | |
| Transmission of the additional data for clarification of the facts and the result of the review to the EBB | |
| Processing of the above-mentioned data as well as the data transmitted by Redeker in the course of the further review for the purpose of follow up measures | Processing of the above-mentioned data for the purpose of legal advice on follow up measures |
You can contact EBB and Redeker, as well as the respective data protection officers of the data controllers, at any time using the contact details provided at the end of this document.
2. Which of my personal data is processed?
Personal data is all information that relates to an identified or identifiable natural person. This includes, for example, name, position in the company, personnel master data and other data, e.g. identifiers in portals or databases. The personal data collected from you also includes, for example, information about your activities in connection with RED and in connection with contractual relationships.
As part of the independent examination or clarification of the facts, personal data from other documents may be processed.
Redeker summarises the results of the review, including other personal data collected in this context, in a memorandum.
3. For what purposes is my data processed and on what legal basis?
The personal data transmitted as part of the whistleblower tool and collected during the further review shall be processed by Redeker for the purpose of clarifying the facts and review. If necessary, Redeker will further process personal data of third parties on behalf of the EBB in the context of complaints and other follow-up measures. The processing of personal data by the EBB is carried out for the purposes of reporting allegations of fraud or violations of the RED and/or is used for related administrative and judicial proceedings, including proceedings of institutions or bodies of the European Union.
Redeker processes your personal data to protect the overriding legitimate interests of EBB in the examination and clarification of the reported facts, its own interests in the fulfilment of its contract as legal advisor to EBB and to fulfil legal obligations (e.g. with regard to professional retention obligations). The legal basis for processing by Redeker is Art. 6 para. 1 lit. f) and lit. c) GDPR.
The EBB processes your personal data to protect the overriding legitimate interests in accordance with Art. 6 para. 1 lit. f) GDPR (Offer and documentation of the whistleblower tool; decision on and implementation of further measures, in particular by external legal advisors such as Redeker, avoidance or averting of potential risks and further incidents; prosecution of relevant allegations, assertion, exercise and defence of legal claims, ensuring and documenting compliance with legal obligations). If applicable, the processing is also carried out to fulfil legal obligations in accordance with Art. 6 para. 1 c) GDPR (e.g. with regard to legal documentation and retention obligations).
4. How is my data protected, to whom is my data passed on and what are the sources of my data if it is not collected from me?
All personal data collected and further processed as part of the report and, in particular, the review will be treated confidentially, i.e. protected against unauthorised access, and stored on secure media. The same applies to personal data processed by Redeker as part of the further review.
EBB and Redeker take appropriate technical and organisational measures to ensure that your data is adequately protected, in particular against unauthorised access, unauthorised disclosure, use or access, as well as accidental or unlawful destruction, loss, alteration or erasure.
Redeker transmits additional reports and, if applicable, minutes of the review to EBB.
When exchanging your personal data between EBB and Redeker, the data will only be passed on to the respective employees of the EBB secretariat and Redeker who, for the purposes of the whistleblower tool and the further review, must have knowledge of the content due to their position and area of responsibility (“need-to-know principle”).
As far as necessary, EBB or Redeker may subsequently transfer the personal data to companies that are members of EBB or their legal advisors, which process the personal data for the purpose of asserting, exercising and defending legal claims, in particular in subsequent official and judicial proceedings, including proceedings by institutions or bodies of the European Union, in accordance with the legal bases described in section 3.
As far as necessary, the personal data will be transmitted to the competent audit bodies, national authorities, the European Commission and, if applicable, political decision-makers (e.g. members of parliament and their staff).
If Redeker does not collect your personal data from you, the sources of the data can be found in the above descriptions. The same applies if EBB collects your personal data.
5. Will my data be stored and processed outside the EU/EEA?
There are currently no plans to transfer data to recipients outside the EU/EEA.
6. Are automated decisions made based on the processing of my data?
Decisions that produce legal effects concerning you or significantly affect you in a similar way (automated individual decision-making) do not take place.
7. Am I obliged to provide my personal data?
The participation and transmission of personal data as part of the whistleblower tool and the further review is voluntary. You are not obliged to provide information.
8. How long will my data be stored?
The personal data processed by the EBB as part of the whistleblower tool shall only be stored by the EBB for no longer than is necessary for the aforementioned purposes of the EBB. However, this data will be stored at least until the conclusion of the further examination and for six months after the legally binding conclusion of all official and judicial proceedings conducted in this context, including proceedings by institutions or bodies of the European Union. Thereafter, the data shall be deleted or anonymised immediately, unless longer storage is necessary in a specific case to safeguard the legitimate interests of EBB (assertion, exercise or defence of legal claims) or to comply with statutory retention obligations.
The personal data processed by Redeker in the course of its activities will be processed by Redeker until the respective mandate has ended. After termination of the mandate, Redeker stores the data until the expiry of the statutory retention obligation for lawyers (6 years after the end of the calendar year in which the mandate was terminated), provided that there are no other retention obligations to the contrary.
9. What rights do I have with regard to the processing of my data and how can I exercise them?
You have the right, if applicable and in accordance with the statutory provisions:
- to obtain information about the personal data processed concerning you and a copy of this data (right of access),
- to obtain the rectification of any inaccurate data and, taking into account the purposes of the processing, the completion of incomplete data (Right to rectification),
- to obtain the erasure of your data if there are legitimate reasons (right to erasure),
- to obtain the restriction of the processing of your data (Right to restriction of processing),
- to receive the data provided by you in a structured, commonly used and machine-readable format and to transmit this data to another controller or, where technically feasible, to have it transmitted by the controller (Right to data portability).
You also have the right to object to the processing of your data for the purposes of the legitimate interests pursued by the controller in accordance with the statutory provisions (Right to object).
To exercise your rights, please contact the respective controller using the contact details below. Please note, however, that your rights with regard to Redeker may be further restricted due to professional secrecy and attorney-client privilege under criminal law. In this case, the controller concerned will inform you accordingly in the event of an enquiry.
In addition, you have the right to lodge a complaint with a supervisory authority (such as the Belgian data protection authority, L’Autorité de protection des données, APD).[1]
10. How can I contact the respective controller and the data protection officers?
You can contact the individual data controllers and the respective data protection officers (if any) at any time using the contact details below:
| EBB European Biodiesel Board Rue Belliard 12 1040 Brussels, Belgium secretariat@ebb-eu.org | You can reach the data protection officer at: Xavier Noyon (EBB Secretary General) Rue Belliard 12 1040 Brussels, Belgium secretariat@ebb-eu.org |
| Redeker Sellner Dahs PartG mbB 172, Av. De Cortenbergh 1000 Brussels T +32 2 74003-20 F +32 2 74003-29 bruessel@redeker.de | You can reach the data protection officer at: Redeker Sellner Dahs PartG mbB Willy-Brandt-Allee 11 53113 Bonn For the attention of the data protection officer or datenschutz@redeker.de |
[1] Available at https://www. dataprotectionauthority.be/.