Annex I

‘ANNEX III

ALLOCATION OF RESPONSIBILITIES AMONG JOINT CONTROLLERS

1.

The Commission shall be responsible for:

1. (i)

   the setting up, operation and administration of the CPMS;

2. (ii)

   providing, where necessary, the technical means to the healthcare providers to enable patients to exercise their rights through the CPMS in accordance with Regulation (EU) 2018/1725 and responding and attending to the requests of data subjects where so required by applicable legislation;

3. (iii)

   ensuring that the CPMS complies with the requirements applicable to Commission's communication and information systems^f1;

4. (iv)

   defining and implementing the technical means to enable patients to exercise their rights in accordance with Regulation (EU) 2018/1725;

5. (v)

   communicating any personal data breaches within the CPMS to the healthcare providers;

6. (vi)

   exporting personal data sets from the CPMS in the event of a change of personal data processor;

7. (vii)

   identifying the categories of staff and other individuals to whom access to the CPMS may be granted, affiliated to the healthcare providers authorised to access CPMS;

8. (viii)

   ensuring that the patients' name and place of birth (unless necessary for diagnosis and treatment), and the exact date of birth are encrypted and pseudonymised and that other personal data necessary for the purpose of diagnosis and treatment are pseudonymised in CPMS;

9. (ix)

   putting adequate safeguards in place to ensure the security and confidentiality of patients' personal data processed through the CPMS.

2.

Each healthcare provider authorised to access CPMS shall be responsible for:

1. (i)

   selecting the patients whose personal data are processed through the CPMS;

2. (ii)

   collecting and maintaining explicit, informed, freely-given and specific consent(s) of the patients whose data are processed through the CPMS in compliance with the mandatory minimum requirements for the consent form specified in Annex IV;

3. (iii)

   acting as the contact point for its patients, including when they exercise their rights, responding to the requests of patients or their representatives and ensuring that patients whose data are processed through the CPMS are enabled to exercise their rights in compliance with data protection legislation, using, where necessary, the technical means provided by the Commission in line with point 1(ii);

4. (iv)

   reviewing, at least every 15 years, the necessity of processing specific patients' personal data through the CPMS;

5. (v)

   ensuring the security and confidentiality of any processing of patients' personal data outside the CPMS done by that healthcare provider, where such data is processed for the purposes of or in connection to processing patients' personal data through the CPMS;

6. (vi)

   communicating any personal data breaches with regard to patient data processed through the CPMS to the Commission, to the competent supervisory authorities and, where so required, to patients, in accordance with Articles 33 and 34 of Regulation (EU) 2016/679 or if requested by the Commission;

7. (vii)

   identifying, in compliance with access criteria referred to in point 1(vii) of this Annex, staff and other individuals affiliated to them, whom shall be granted access to patients' personal data within the CPMS and communicating it to the Commission;

8. (viii)

   ensuring that their staff and other individuals affiliated to them, who have access to patients' personal data within the CPMS, are adequately trained to ensure that they perform their tasks in compliance with the rules applicable to the protection of personal data, and are subject to the obligation of professional secrecy in accordance with Article 9(3) of the Regulation (EU) 2016/679.’