Data protection
Article 13
1. In the calls for tender and calls for proposals and, in the absence of calls, before awarding contracts or grants, the institutions and implementing authorities or bodies shall inform third parties of the data concerning them that may be included in the exclusion database and of the entities to whom the data may be communicated. Where third parties are legal entities the institutions and implementing authorities or bodies shall also inform the persons who have powers of representation, decision-making or control over these legal entities. 2. The institution requesting registration of an exclusion warning shall be responsible for relations with the natural or legal person whose data are introduced into the exclusion database (hereinafter ‘the data subject concerned’). The institution shall inform the data subject concerned of the request for activation, updating and removal of any exclusion warning directly concerning it and state the reasons thereof. The institution shall also respond to requests from data subjects concerned to rectify inaccurate or incomplete personal data and to any other requests or questions from those subjects. Requests or questions from data subjects concerned with regard to information provided by implementing authorities or bodies shall be treated by those authorities or bodies. The Commission service responsible shall refer such requests and questions to the liaison point concerned and inform the data subject concerned thereof. 3. Without prejudice to the information requirements set out in paragraph 2, a duly identified natural person may request information on whether data concerning him is registered in the exclusion database. The accounting officer of the Commission shall inform him in writing or by electronic means, whether the person is registered in the exclusion database. If the person is registered, the accounting officer of the Commission shall attach the data stored in the exclusion database concerning that person. He shall inform the institution that requested the warning thereof. 4. Without prejudice to the information requirements set out in paragraph 2, a duly empowered representative of a legal person, may request information on whether that legal person is registered in the exclusion database. The accounting officer of the Commission shall inform him in writing or by electronic means whether the legal person is registered in the exclusion database. If the person is registered, the accounting officer of the Commission shall attach the data stored in the exclusion database concerning that person. He shall inform the institution that requested the warning thereof. 5. Removed warnings shall be accessible for audit and investigation purposes only and shall not be visible for the users of the database. However, personal data contained in exclusion warnings referring to natural persons shall remain accessible to such purposes only for five years after the removal of the warning.