Guideline (EU) 2016/256 of the European Central Bank of 5 February 2016 concerning the extension of common rules and minimum standards to protect the confidentiality of the statistical information collected by the European Central Bank assisted by the national central banks to national competent authorities of participating Member States and to the European Central Bank in its supervisory functions (ECB/2016/1)

For the purposes of this Guideline, the following definitions shall apply: (1) ‘confidential statistical information’ means statistical information which is defined as confidential in accordance with Article 1(12) of Regulation (EC) No 2533/98 and which has been collected in accordance with the provisions and for the purposes outlined in that Regulation; (2) ‘protection measures’ means procedures appropriate for the protection, both logical and physical, of confidential statistical information; (3) ‘logical protection measures’ means measures that prevent unauthorised access to confidential statistical information itself; (4) ‘physical protection measures’ means measures that prevent unauthorised access to a physical area and physical media; (5) ‘physical area’ means any part of a building in which are located the physical media on which confidential statistical information is stored or over which it is transmitted; (6) ‘physical media’ means hard copies (paper) and computer equipment (including peripherals and storage devices) on which confidential statistical information is stored or processed; (7) ‘national competent authority’ has the meaning given in Article 2(2) of Regulation (EU) No 1024/2013; (8) ‘reporting agent’ has the meaning given in Article 1(2) of Regulation (EC) No 2533/98.

1 The ECB and the NCAs shall each define and implement authorisation rules and logical protection measures governing their staff's access to confidential statistical information.

2 Without prejudice to the continuity of the system administration function, the minimum protection measure to be implemented shall be a unique user identifier and personalised password.

3 All appropriate measures shall be taken to ensure that confidential statistical information is arranged in such a way that any published data covers at least three economic agents. Where one or two economic agents make up a sufficiently large proportion of any observation to make them indirectly identifiable, published data shall be arranged in such a way as to prevent their indirect identification. These rules shall not apply if the reporting agents or the other legal persons, natural persons, entities or branches that can be identified have explicitly given their consent to disclosure.

The ECB and the NCAs shall each define and implement authorisation rules and physical protection measures governing their staff's access to any physical area, without prejudice to Article 4 of this Guideline.

In the event of any third party having access to confidential statistical information in line with Article 8(4a) of Regulation (EC) No 2533/98, the ECB and the NCAs shall ensure through appropriate means, where possible by way of a contract, that the confidentiality requirements as prescribed in Regulation (EC) No 2533/98 and in this Guideline are complied with by the third party.

1 Where allowed by Article 8 of Regulation (EC) No 2533/98, confidential statistical information shall be transmitted extra muros electronically, following encryption.

2 The ECB and the NCAs shall each define authorisation rules for such transmission of confidential statistical information.

3 For internal networks, appropriate protection measures shall be taken to prevent unauthorised access.

4 Interactive access to confidential statistical information from unsecured networks shall be prohibited.

The ECB and the NCAs shall ensure that all their rules and procedures relating to the protection of confidential statistical information are documented, and that this documentation is kept up to date. The staff involved shall be informed about the importance of the protection of confidential statistical information and kept up to date about all rules and procedures that affect their work.

1 The NCAs shall inform the ECB at least once a year of any problems experienced since the last report, actions taken in response to these problems and planned improvements with regard to the protection of confidential statistical information. The ECB shall also draw up a report covering the same issues at least once a year.

2 The Governing Council shall assess the implementation of this Guideline at least once a year. In preparation for that assessment, the ECB shall be informed of the authorisation rules and types of protection measures applied by the NCAs as referred to in Articles 2, 3 and 5 of this Guideline. The ECB shall report to the Governing Council on the application of those rules and protection measures by both the NCAs and the ECB.

1 This Guideline shall take effect on the twentieth day following that of its publication in the Official Journal of the European Union.

2 The NCAs and the ECB shall ensure that the provisions of this Guideline also apply to members of their decision making bodies.

3 The ECB and the NCAs shall aim, to the extent legally feasible, to extend the obligations defined in implementation of the provisions of this Guideline to persons involved in the performance of supervisory tasks who are not staff members.

This Guideline is addressed to the NCAs, and to the ECB in the performance of its tasks under Regulation (EU) No 1024/2013, in each case insofar as they receive confidential statistical information from the ESCB.