Division 3 The Commission shall be responsible for:

ensuring that the Union database complies with the requirements applicable to Commission’s communication and information systems, including those concerning the protection of personal data and the application of data protection rules on security of the processing^f1. The Commission shall carry out an information security risk assessment and ensure an appropriate level of security;

responding to the requests of data subjects addressed directly to it in relation to the Union database and publishing a data protection information notice to fulfil information requirements. Where appropriate and in particular when the request concerns rectification and erasure of personal data, the Commission shall foward the request of the data subject to the relevant single contact point(s) that shall address it. In cases where a request is addressed directly to the Commission, it shall inform the data subject on the follow-up given to the request;

communicating any personal data breaches within the Union database to the single contact points referred to in Section 8.1 of Annex I, to the European Data Protection Supervisor and to the relevant individuals where there is a high risk in accordance with Articles 34 and 35 of Regulation (EU) 2018/1725;

identifying the categories of staff and other individuals to whom access to the Union database may be granted and ensuring that access by all those concerned is compliant with applicable data protection rules;

ensuring that Commission staff who have access to crew members’ personal data within the Union database, are adequately trained to ensure that they perform their tasks in compliance with the rules applicable to the protection of personal data, and are subject to the obligation of professional secrecy under Union law.