Recital 21

(21) To promote data-driven innovation in finance, help integrate capital markets in the Union, channel investments into sustainable activities and bring about efficiencies for consumers and businesses, ESAP should improve access to public information that could contain personal data. ESAP should, however, only improve access to those personal data that are contained in information made public pursuant to a legal obligation or, where the information is made public voluntarily, to those personal data that are processed on lawful grounds pursuant to Regulation (EU) 2016/679. For any processing of personal data in the context of making information accessible on ESAP, ESMA, in its capacity as data controller of ESAP, and the collection bodies should ensure compliance with Regulation (EU) 2016/679 and Regulation (EU) 2018/1725 of the European Parliament and of the Council (8). Submitting entities should be responsible for identifying the presence of any personal data in the information submitted and for the processing of such personal data on the basis of one of the lawful grounds for processing pursuant to Regulation (EU) 2016/679. Information accompanied by metadata specifying that it contains personal data should not be retained by the collection bodies or ESAP for any longer than is necessary and in any event for no longer than five years, unless otherwise provided in the Union legislative acts listed in the Annex to this Regulation.

← Recital 20 · All articles · Recital 22 →

Source: EUR-Lex (Cellar) · retrieved 2026-10-12 · Text as adopted (Official Journal); later amendments are not incorporated in this text.