Commission Implementing Decision 2019/1765Show full title

[F1 ANNEX I] U.K. Responsibilities of the Commission as data processor for the eHealth Digital Service Infrastructure for Cross-Border eHealth Information Services

Textual Amendments

F1 Substituted by Commission Implementing Decision (EU) 2020/1023 of 15 July 2020 amending Implementing Decision (EU) 2019/1765 as regards the cross-border exchange of data between national contact tracing and warning mobile applications with regard to combatting the COVID-19 pandemic (Text with EEA relevance).

The Commission shall:

1.

Set up and ensure a secure and reliable communication infrastructure that interconnects networks of the Members of the eHealth Network involved in eHealth Digital Service Infrastructure for Cross-Border eHealth Information Services (‘Central Secure Communication Infrastructure’). To fulfil its obligations, the Commission may engage third parties. The Commissions shall ensure that the same data protection obligations as set out in this Decision apply to these third parties.

2.

Configure part of the Central Secure Communication Infrastructure so that the National Contact Points for eHealth may exchange information securely, reliably and efficiently.

3.

The Commission shall process the personal data on documented instructions from the Controllers.

4.

Take all organisational, physical and logical security measures to maintain the Central Secure Communication Infrastructure. To this end, the Commission shall:

(a)

designate a responsible entity for the security management at the level of Central Secure Communication Infrastructure, communicate to the data controllers its contact information and ensure its availability to react to security threats;

(b)

assume the responsibility for the security of the Central Secure Communication Infrastructure;

(c)

ensure that all individuals that are granted access to Central Secure Communication Infrastructure are subject to contractual, professional or statutory obligation of confidentiality;

(d)

ensure that the personnel having access to classified information fulfil the corresponding criteria of clearance and confidentiality.

5.

Take all necessary security measures to avoid compromising the smooth operational functioning of the other’s domain. To this end, the Commission shall put in place the specific procedures related to the connection to the Central Secure Communication Infrastructure. This information includes:

(a)

risk assessment procedure, to identify and estimate potential threats to the system;

(b)

audit and review procedure to:

(i)

check the correspondence between the implemented security measures and the security policy in application;

(ii)

control on a regular basis the integrity of system files, security parameters and granted authorisations;

(iii)

monitor to detect security breaches and intrusions;

(iv)

implement changes to avoid existing security weaknesses and

(v)

define the conditions under which to authorise, including at the request of controllers, and contribute to the performance of independent audits, including inspections, and reviews on security measures.

(c)

change control procedure to document and measure the impact of a change before its implementation and keep the National Contact Points for eHealth informed of any changes that can affect the communication with and/or the security of the other national infrastructures;

(d)

maintenance and repair procedure to specify the rules and conditions to follow when maintenance and/or repair of equipment should be performed;

(e)

security incident procedure to define the reporting and escalation scheme, inform without delay the responsible national administration, as well as the European Data Protection Supervisor of any security breach and define a disciplinary process to deal with security breaches.

6.

Take physical and/or logical security measures for the facilities hosting the Central Secure Communication Infrastructure equipment and for the controls of logical data and security access. To this end, the Commission shall:

(a)

enforce physical security to establish distinctive security perimeters and allowing detection of breaches;

(b)

control access to the facilities and maintain a visitor register for tracing purposes;

(c)

Ensure that external people granted access to premises are escorted by duly authorised staff of its respective organisation;

(d)

ensure that equipment cannot be added, replaced or removed without prior authorisation of the designated responsible bodies;

(e)

control access from and to other network(s) interconnected to the Central Secure Communication Infrastructure;

(f)

ensure that individuals who access the Central Secure Communication

Infrastructure are identified and authenticated;

(g)

review the authorisation rights related to the access to the Central Secure Communication Infrastructure in case a security breach affecting this infrastructure;

(h)

keep the integrity of the transmitted information through the Central Secure Communication Infrastructure;

(i)

implement technical and organisational security measures to prevent unauthorized access to personal data;

(j)

implement, whenever necessary, measures to block unauthorised access to the Central Secure Communication Infrastructure from the domain of National Contact Points for eHealth (i.e.: Block a location/IP address).

7.

Take steps to protect its domain, including the severing of connections, in the event of substantial deviation from the principles and concepts for quality or security.

8.

Maintain a risk management plan related to its area of responsibility.

9.

Monitor — in real time — the performance of all the service components of its Central Secure Communication Infrastructure services, produce regular statistics and keep records.

10.

Provide support for all Central Secure Communication Infrastructure services in English 24/7 via phone, mail or Web Portal and accept calls from authorised callers: Central Secure Communication Infrastructure’s coordinators and their respective helpdesks, Project Officers and designated people from the Commission.

11.

Support the controllers by providing information concerning the Central Secure Communication Infrastructure of the eHealth Digital Service Infrastructure for Cross-Border eHealth Information Services, in order to implement the obligations in Articles 35 and 36 of the Regulation (EU) 2016/679.

12.

Ensure that data transported within the Central Secure Communication Infrastructure are encrypted.

13.

Take all relevant measures to prevent that the Central Secure Communication Infrastructure’s operators have unauthorised access to transported data.

14.

Take measures in order to facilitate the interoperability and the communication between the Central Secure Communication Infrastructure’s designated national competent administrations.