COMMISSION IMPLEMENTING DECISION (EU) 2022/483

in such a case, the Commission shall inform the joint controllers of that legal requirement before carrying on the processing activity, unless that law prohibits submitting such information on important grounds of public interest. The processing by the Commission entails the following: | (a) | Authentication of national backend servers, based on national backend server certificates; ---|--- (b) | Reception of the data referred to in Article 5a(3) of the Decision uploaded by national backend servers by providing an application programming interface that allows national backend servers to upload the relevant data; ---|--- (c) | Storage of the data in the EU Digital COVID certificate gateway; ---|--- (d) | Making the data available for download by national backend servers; ---|--- (e) | Deletion of the data at their expiration date or upon instruction of the controller that submitted them; ---|--- (f) | After the end of the provision of service, delete any remaining data unless Union or Member State law requires storage of the personal data. ---|--- (4) | Take all state of the art organisational, physical and logical security measures to maintain the EU Digital COVID Certificate Gateway. To this end, the Commission shall: | (a) | designate a responsible entity for the security management at the level of the EU Digital COVID Certificate Gateway, communicate to the joint controllers its contact information and ensure its availability to react to security threats; ---|--- (b) | assume the responsibility for the security of the EU Digital COVID Certificate Gateway, including regularly carrying out tests, evaluations and assessments of the security measures; ---|--- (c) | ensure that all individuals that are granted access to the EU Digital COVID Certificate Gateway are subject to contractual, professional or statutory obligation of confidentiality. ---|--- (5) | Take all necessary security measures to avoid compromising the smooth operational functioning of the national backend servers. To this end, the Commission shall put in place specific procedures related to the connection from the backend servers to the EU Digital COVID Certificate Gateway. This includes: | (a) | risk assessment procedure, to identify and estimate potential threats to the system; ---|--- (b) | audit and review procedure to: | i. | check the correspondence between the implemented security measures and the applicable security policy; ---|--- ii. | control on a regular basis the integrity of system files, security parameters and granted authorisations; ---|--- iii. | monitor to detect security breaches and intrusions; ---|--- iv. | implement changes to mitigate existing security weaknesses; ---|--- v. | define the conditions under which to authorise, including at the request of controllers, and contribute to, the performance of independent audits, including inspections, and reviews on security measures subject to conditions that respect Protocol (No 7) to the TFEU on the Privileges and Immunities of the European Union; ---|--- (c) | changing the control procedure to document and measure the impact of a change before its implementation and keep the joint controllers informed of any changes that can affect the communication with and/or the security of their infrastructures; ---|--- (d) | laying down a maintenance and repair procedure to specify the rules and conditions to be respected when maintenance and/or repair of equipment should be performed; ---|--- (e) | laying down a security incident procedure to define the reporting and escalation scheme, inform without delay the controllers affected, inform without delay the controllers for them to notify the national data protection supervisory authorities, of any personal data breach and define a disciplinary process to deal with security breaches. ---|--- (6) | Take state of the art physical and/or logical security measures for the facilities hosting the EU Digital COVID Certificate Gateway equipment and for the controls of logical data and security access. To this end, the Commission shall: | (a) | enforce physical security to establish distinct security perimeters and allowing detection of breaches; ---|--- (b) | control access to the facilities and maintain a visitor register for tracing purposes; ---|--- (c) | ensure that external people granted access to the premises are escorted by duly authorised staff; ---|--- (d) | ensure that equipment cannot be added, replaced or removed without prior authorisation of the designated responsible bodies; ---|--- (e) | control access from and to the national backend servers to the trust framework gateway; ---|--- (f) | ensure that individuals who access the EU Digital COVID Certificate Gateway are identified and authenticated; ---|--- (g) | review the authorisation rights related to the access to the EU Digital COVID Certificate Gateway in case of a security breach affecting this infrastructure; ---|--- (h) | keep the integrity of the information transmitted through the EU Digital COVID Certificate Gateway; ---|--- (i) | implement technical and organisational security measures to prevent unauthorised access to personal data; ---|--- (j) | implement, whenever necessary, measures to block unauthorised access to the EU Digital COVID Certificate Gateway from the domain of the issuing authorities (i.e.: block a location/IP address). ---|--- (7) | Take steps to protect its domain, including the severing of connections, in the event of substantial deviation from the principles and concepts for quality or security. ---|--- (8) | Maintain a risk management plan related to its area of responsibility. ---|--- (9) | Monitor – in real time – the performance of all the service components of its trust framework gateway services, produce regular statistics and keep records. ---|--- (10) | Provide support for all trust framework gateway services in English, 24/7 via phone, mail or Web Portal and accept calls from authorised callers: the EU Digital COVID Certificate Gateway’s coordinators and their respective helpdesks, Project Officers and designated persons from the Commission. ---|--- (11) | Assist the joint controllers by appropriate technical and organisational measures, insofar as it is possible in accordance with Article 12 of Regulation (EU) 2018/1725, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III of the General Data Protection Regulation. ---|--- (12) | Support the joint controllers by providing information concerning the EU Digital COVID Certificate Gateway, to implement the obligations pursuant to Articles 32, 33, 34, 35 and 36 of the General Data Protection Regulation. ---|--- (13) | Ensure that data processed within the EU Digital COVID Certificate Gateway is unintelligible to any person who is not authorised to access it. ---|--- (14) | Take all relevant measures to prevent that the EU Digital COVID Certificate Gateway’s operators have unauthorised access to transmitted data. ---|--- (15) | Take measures in order to facilitate the interoperability and the communication between EU Digital COVID Certificate Gateway’s designated controllers. ---|--- (16) | Maintain a record of processing activities carried out on behalf of the joint controllers in accordance with Article 31(2) of Regulation (EU) 2018/1725. ---|--- ’ * * *