Commission Delegated Regulation (EU) 2021/1783 of 2 July 2021 supplementing Regulation (EU) No 596/2014 of the European Parliament and of the Council with regard to regulatory technical standards containing a template document for cooperation arrangements with third countries (Text with EEA relevance)
Commission Delegated Regulation (EU) 2021/1783of 2 July 2021supplementing Regulation (EU) No 596/2014 of the European Parliament and of the Council with regard to regulatory technical standards containing a template document for cooperation arrangements with third countries(Text with EEA relevance)THE EUROPEAN COMMISSION,Having regard to the Treaty on the Functioning of the European Union,Having regard to Regulation (EU) No 596/2014 of the European Parliament and of the Council of 16 April 2014 on market abuse (market abuse regulation) and repealing Directive 2003/6/EC of the European Parliament and of the Council and Commission Directives 2003/124/EC, 2003/125/EC and 2004/72/ECOJ L 173, 12.6.2014, p. 1., and in particular the fourth subparagraph of Article 26(2) thereof,Whereas:(1)Article 26(1) of Regulation (EU) No 596/2014 requires the competent authorities of Member States where necessary to conclude cooperation arrangements with supervisory authorities of third countries concerning the exchange of information and the enforcement of obligations arising under that Regulation in third countries. Cooperation arrangements on exchange of information can only be concluded if the information to be disclosed under them is subject to guarantees of professional secrecy at least equivalent to those set out in Article 27 of that Regulation, and such exchanges must be intended for the performance of the tasks of the competent authorities in question.(2)The third subparagraph of Article 25(8) of Regulation (EU) No 596/2014 requires competent authorities where possible to conclude cooperation arrangements with third-country regulatory authorities responsible for related spot markets in accordance with Article 26 of that Regulation.(3)In concluding new cooperation arrangements and updating existing cooperation arrangements with third-country authorities, the competent authorities where possible are to use the template document adopted pursuant to Article 26 of Regulation (EU) No 2014/596.(4)In order to ensure a level of protection of personal data that is in line with Regulation (EU) 2016/679 of the European Parliament and of the CouncilRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ L 119, 4.5.2016, p. 1)., any transfer of personal data to third countries should be undertaken in full compliance with that regulation. One such way to exchange personal data between competent authorities and supervisory authorities of third countries is through administrative arrangements ensuring appropriate safeguards pursuant to Article 46(3) of by Regulation (EU) 2016/679, which include enforceable and effective rights that natural persons have over their personal data. For the transfer of personal data between European Economic Area ("EEA") financial supervisory authorities and non-EEA financial supervisory authorities, such an administrative arrangement has been drafted by the International Organization of Securities Commissions (IOSCO) and the European Securities and Markets Authority (ESMA)Administrative arrangement for the transfer of personal data between Each of the European Economic Area ("EEA") Authorities set out in Appendix A and Each of the non-EEA Authorities set out in Appendix B, available at https://www.esma.europa.eu/sites/default/files/administrative_arrangement_aa_for_the_transfer_of_personal_data_between_eea_and_non-eea_authorities.pdf, and received the positive opinion of the European Data Protection Board (EDPB)Opinion 4/2019 on the draft Administrative Arrangement for the transfer of personal data between European Economic Area ("EEA") Financial Supervisory Authorities and non-EEA Financial Supervisory Authorities, available at https://edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-42019-draft-aa-between-eea-and-non-eea_en. All EEA financial supervisory authorities and a number of non-EEA financial supervisory authorities have signed the ESMA-IOSCO administrative arrangement. In light of the broad institutional consensus around personal data safeguards provided in the ESMA-IOSCO administrative arrangement, it provides a model for future similar arrangements framing the transfer of personal data between competent authorities and supervisory authorities of third countries which are not parties to the ESMA-IOSCO Administrative Arrangement. However, authorities of Member States using the model ESMA-IOSCO Administrative Arrangement would still need to obtain authorisation by the data protection authority pursuant to Article 46(3) of Regulation (EU) 2016/679.(5)This Regulation is based on the draft regulatory technical standards submitted by ESMA to the Commission.(6)ESMA did not conduct open public consultations on the draft regulatory technical standards on which this Regulation is based, nor did it analyse the potential related costs and benefits of introducing such standards, as to have done so would have been disproportionate in relation to the scope and impact of those standards, taking into account the fact that the addressees of the standards would only be the competent authorities of the Member States and not market participants.(7)ESMA has requested the opinion of the Securities and Markets Stakeholder Group established by Article 37 of Regulation (EU) No 1095/2010 of the European Parliament and of the CouncilRegulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84).,HAS ADOPTED THIS REGULATION: