{
  "url": "https://openlegislation.uk/eu-regulation-2017-2226/article-39",
  "json_url": "https://openlegislation.uk/eu-regulation-2017-2226/article-39.json",
  "legislation": "eur/2017/2226",
  "legislation_title": "Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011",
  "legislation_url": "https://openlegislation.uk/eu-regulation-2017-2226",
  "path": "article/39",
  "kind": "article",
  "number": "39",
  "heading": "Responsibility for data processing",
  "text": "1. In relation to the processing of personal data in the EES, each Member State shall designate the authority which is to be considered as controller in accordance with point (7) of Article 4 of Regulation (EU) 2016/679 and which shall have central responsibility for the processing of data by that Member State. Each Member State shall communicate the details of that authority to the Commission.\nEach Member State shall ensure that the data collected and recorded in the EES is processed lawfully and, in particular, that only duly authorised staff have access to the data for the performance of their tasks. The Member State responsible shall ensure, in particular, that the data are:\n(a) collected lawfully and in full respect of the human dignity of the third-country national concerned;\n(b) registered lawfully in the EES;\n(c) accurate and up-to-date when they are transmitted to the EES.\n2. eu-LISA shall ensure that the EES is operated in accordance with this Regulation and the implementing acts referred to in Article 36. In particular, eu-LISA shall:\n(a) take the necessary measures to ensure the security of the EES Central System and the Communication Infrastructure between the EES Central System and the NUI, without prejudice to the responsibilities of the Member States;\n(b) ensure that only duly authorised staff have access to data processed in the EES.\n3. eu-LISA shall inform the European Parliament, the Council and the Commission, as well as the European Data Protection Supervisor, of the measures it takes pursuant to paragraph 2 in view of the start of operations of the EES.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eur/2017/2226/article/39",
    "retrieved_at": "2026-11-01T14:44:24.483532+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}