Article 19 Protection of personal data

1. The representative of the group of organisers shall be the data controller within the meaning of Regulation (EU) 2016/679 in relation to the processing of personal data when collecting statements of support, email addresses and data on the sponsors of the initiatives. Where the legal entity referred to in Article 5(7) of this Regulation is created, that entity shall be the data controller.


2. The competent authorities designated in accordance with Article 20(2) of this Regulation shall be the data controllers within the meaning of Regulation (EU) 2016/679 in relation to the processing of personal data for the purposes of verification and certification of statements of support.


3. The Commission shall be the data controller within the meaning of Regulation (EU) 2018/1725 in relation to the processing of personal data in the register, the online collaborative platform, the central online collection system referred to in Article 10 of this Regulation, and the collection of email addresses.


4. The personal data provided in the statements of support forms shall be collected for the purpose of the operations required for the secure collection and storage in accordance with Articles 9 to 11, for the submission to the Member States, the verification and certification in accordance with Article 12, and for the necessary quality checks and statistical analysis.


5. The group of organisers and the Commission, as appropriate, shall destroy all statements of support signed for an initiative and any copies thereof not later than one month after the submission of the initiative to the Commission in accordance with Article 13 or not later than 21 months after the beginning of the collection period, whichever is the earlier. However, where an initiative is withdrawn after the beginning of the collection period, the statements of support and any copies thereof shall be destroyed no later than one month after the withdrawal referred to in Article 7.


6. The competent authority shall destroy all statements of support and copies thereof not later than three months after issuing the certificate referred to in Article 12(5).


7. Statements of support for a given initiative and copies thereof may be retained beyond the time limits laid down in paragraphs 5 and 6 if necessary for the purpose of legal or administrative proceedings relating to the initiative concerned. They shall be destroyed not later than one month after the date of conclusion of the said proceedings by a final decision.


8. The Commission and the group of organisers shall destroy records of the email addresses collected in accordance with Article 18(2), not later than one month after the withdrawal of an initiative or 12 months after the end of the collection period or the submission of the initiative to the Commission, respectively. However, where the Commission sets out, by means of a communication, the actions it intends to take in accordance with Article 15(2), records of the email addresses shall be destroyed at the latest three years after the publication of the communication.


9. Without prejudice to their rights under Regulation (EU) 2018/1725, the members of the group of organisers have the right to request the removal of their personal data from the register after two years from the date of registration of the initiative concerned.



Regulation on the European citizens’ initiative(pdf).
#tagcoding hashtag: #euci19