Notice

COVID-19 loan schemes: data reporting to the European Commission and the UK government

Updated 3 July 2023

Data reporting: borrower questions and answers

1. What changes have been made to the British Business Bank (BBB) and Department for Business and Trade (DBT) privacy notices in relation to data reporting to the European Commission and the UK government?

The privacy notices have been updated to include further details about how we may use and share information about the facilities granted under the ‘COVID-19 loan schemes’:

• the Coronavirus Business Loan Scheme (CBILS)
• the Coronavirus Large Business Loan Scheme (CLBILS)
• the Bounce Back Loan Scheme (BBLS)

This may involve, where required, sharing details of individual loans and facilities with the European Commission and publishing such details on the European Commission’s State aid transparency website.

2. Why are you sharing information with the European Commission? The UK has left the EU. Why is this still relevant?

The financial assistance provided through the COVID-19 loan schemes, like many government-backed business support activities, is regarded as state aid and is governed by the European Commission’s Temporary Framework for state aid measures to support the economy in the current COVID-19 outbreak (the ‘Temporary Framework’). Aid granted under the Temporary Framework to UK businesses prior to 1 January 2021 is still governed by European Union state aid law.

Under the Temporary Framework, DBT as the granting authority has a legal requirement to report information about the aid granted under the COVID-19 loan schemes.

3. What is the Temporary Framework for state aid measures?

The Temporary Framework for state aid measures was introduced by the European Commission in March 2020 to support the economy in the current COVID-19 outbreak. It sets the parameters and requirements for aid by member states. The COVID-19 loan schemes operate under this framework.

4. What information will you be sharing? Will it include personal data?

The information provided to the European Commission is a subset of the information you provided in your loan application:

• the identity of the borrower, for example, the name of your business, or potentially your name if you are a sole trader or partnership
• type / size of business
• region where the business is located
• sector in which the business operates
• date the aid was granted
• the amount of aid granted
• the currency of the aid granted
• the granting authority and any financial intermediary
• that the aid was granted under the Temporary Framework

The information reported is related to the business but may include personal data if you are a sole trader or a limited partnership or your business name includes reference to a natural person. Further details of the specific information required will be published here shortly.

5. Who is in scope of these requirements?

For each of the COVID-19 loan schemes there is a requirement to report and publish information about individual aid exceeding €100,000, and above €10,000 if the borrower operates in the agriculture or fisheries sectors.

The reporting requirements apply to all facility types under the COVID-19 loan schemes (term loans, asset finance facilities, invoice finance facilities and revolving credit facilities).

From 1 January 2021, only facilities provided to businesses in scope of Article 10 of the Northern Ireland Protocol are included in these requirements. In addition, from 1 January, information about facilities provided to UK businesses may be made public by the UK government on a new UK transparency database. Details of the UK reporting requirements are currently subject to open consultation, and further information will be available in due course.

6. Am I in scope if I have repaid my facility?

If you have received a facility under the COVID-19 loan schemes, but have since repaid your facility, you will still be in scope of these requirements.

7. Am I in scope if I was offered a facility but did not draw it down?

If you were offered a facility under a COVID-19 loan scheme but did not draw down or utilise the facility during the draw down period and you have never received the loan or facility, your data will not be within the scope of these reporting requirements.

8. When will details be published?

A rolling programme of reporting will commence imminently, publishing details of aid granted within the preceding 12 months.

9. Where will the data be reported?

For loans granted up to 31 December 2020, the data will be published on the European Commission’s state aid transparency website.

From 1 January 2021, only facilities provided to businesses in scope of Article 10 of the Northern Ireland Protocol will be reported on the European Commission’s state aid transparency website.

In addition, the UK government is developing its own domestic subsidy control regime. As part of this, and to enable compliance with the UK’s international subsidy reporting requirements, certain information on subsidies will be required to be reported to the UK government. Where required, information may be made publicly available on a new UK transparency database. Further information on the UK transparency database will be published by DBT in due course.

10. What does this mean for my loan if my details are to be included on a transparency database?

The purpose of the database is to promote accountability and help to ensure aid is proportionate and justified, so that it is not distorting the market or creating unfair advantages.

11. What rights do I have in relation to my data?

For information about your general rights in relation to personal data please see Your data matters (ICO).

12. Where was I told at the time of borrowing that my data may be published?

Businesses who were offered a facility under the COVID-19 Loan Schemes were required to sign a data protection and disclosure declaration prior to their facility being offered. The declaration confirmed that information processed would be used for analytical and administrative purposes and the online privacy notice confirms that information is processed to meet legal obligations.

Because of the nature of this disclosure, we are taking the additional step of specifically bringing your attention to this obligation in advance of reporting the data to the European Commission and the UK government.

13. Where can I find more information about how DBT and BBB may use my personal data?

Further information is available in:

• the DBT privacy notice
• the BBB privacy notice.

These privacy notices set out the types of information that DBT and the BBB hold about you, and the basis for how personal data is collected, safeguarded, processed and shared.