Responsibilities of the Commission and the Member States relating to SFC2021
ANNEX IISupplementary provisions
ANNEX II Responsibilities of the Commission and the Member States relating to SFC2021 1. Responsibilities of the Commission 1.1. Ensuring the operation of an electronic system for the official and secure exchange of information between the Member State and the Commission, hereinafter referred to as ‘SFC2021’. SFC2021 shall contain at least the information specified in the templates established pursuant to Regulation (EU) 2021/2115. 1.2. Ensuring the following characteristics of SFC2021: (a) interactive forms or forms pre-filled by the system on the basis of the data already recorded in the system previously; (b) automatic calculations, where they reduce the encoding effort of users; (c) automatic embedded controls to verify internal consistency of transmitted data and consistency of this data with applicable rules; (d) system generated alerts warning SFC2021 users that certain actions can or cannot be performed; (e) online status tracking of the treatment of information entered into the system; (f) availability of historical data in respect of all information entered for a programme; (g) availability of a compulsory electronic signature within the meaning of Regulation (EU) No 910/2014 of the European Parliament and of the Council ( 1 ) which will be recognised as evidence in legal proceedings. 1.3. Ensuring an information technology security policy for SFC2021 applicable to the personnel using the system in accordance with relevant Union rules, in particular Commission Decision (EU, Euratom) 2017/46 ( 2 ) . 1.4. Designating a person or persons responsible for defining, maintaining and ensuring the correct application of the security policy to SFC2021. 2. Responsibilities of Member States 2.1. Ensuring that the programme authorities of the Member State identified in accordance with Title VI of Regulation (EU) 2021/2115 as well as the bodies identified to carry out certain tasks under the responsibility of the managing authority enter into SFC2021 the information for the transmission of which they are responsible and any updates thereto. 2.2. Ensuring the verification of information submitted by a person other than the person who entered the data for that transmission. 2.3. Providing arrangements for the separation of the tasks referred to in points 2.1 and 2.2 through the Member State’s management and control information systems connected automatically with SFC2021. 2.4. Appointing a person or persons responsible for managing access rights to fulfil the following tasks: (a) identifying users requesting access, making sure those users are employed by the organisation; (b) informing users about their obligations to preserve the security of the system; (c) verifying the entitlement of users to the required privilege level in relation to their tasks and their hierarchical position; (d) requesting the termination of access rights when those access rights are no longer needed or justified; (e) promptly reporting suspicious events that may bring prejudice to the security of the system; (f) ensuring the continued accuracy of user identification data by reporting any changes; (g) taking the necessary data protection and commercial confidentiality precautions in accordance with Union and national rules; (h) informing the Commission of any changes affecting the capacity of the Member State authorities or users of SFC2021 to carry out the responsibilities referred to in point 2.1 or their personal capacity to carry out responsibilities referred to in points (a) to (g). 2.5. Providing arrangements for the respect of the protection of privacy and of personal data for individuals, and of commercial confidentiality for legal entities in accordance with Directive 2002/58/EC ( 3 ) , and Regulations (EU) 2016/679 ( 4 ) and (EU) 2018/1725 ( 5 ) of the European Parliament and of the Council. 2.6. Adopting national, regional or local information security policies on access to SFC2021 based on a risk assessment applicable to all authorities using SFC2021 and addressing the following aspects: (a) the IT security aspects of the work performed by the person or persons responsible for managing the access rights referred to in point 2.4 in case direct use is applied; (b) for national, regional or local computer systems connected to SFC2021, through a technical interface as part of the Member State’s management and control information systems as referred to in point 2.3, the security measures for those systems allowing to be aligned with SFC2021 security requirements and covering: (i) physical security; (ii) data media and access control; (iii) storage control; (iv) access and password control; (v) monitoring; (vi) interconnection with SFC2021; (vii) communication infrastructure; (viii) human resources management prior to employment, during employment and after employment; (ix) incident management. 2.7. Making the document(s) containing the policies referred to in point 2.6 available to the Commission upon request. 2.8. Appointing a person or persons responsible for maintaining and ensuring the application of the national, regional or local IT security policies and acting as a contact point with the person or persons designated by the Commission and referred to in point 1.4. 3. Joint responsibilities of the Commission and the Member States 3.1. Ensuring accessibility either directly through an interactive user-interface (i.e. a web-application) or via a technical interface using pre-defined protocols (i.e. web-services) that allows for automatic synchronisation and transmission of data between Member States information systems and SFC2021. 3.2. Providing for the date of electronic transmission of the information by the Member State to the Commission and vice-versa in electronic data exchange, which constitutes the date of submission of the document concerned. 3.3. Ensuring that official data is exchanged through SFC2021, except where force majeure occurs, and that information provided in the electronic forms embedded in SFC2021 (‘structured data’) is not replaced by non-structured data and, in the event of inconsistency, that structured data prevails over non-structured data. In the event of force majeure , a malfunctioning of SFC2021 or a lack of a connection with SFC2021, the Member State may, with the prior approval of the Commission, send the documents in another form, under the conditions laid down by the Commission. When the cause of the force majeure ceases, the party concerned enters in SFC2021 without delay the information already provided in paper form. 3.4. Ensuring compliance with the IT security terms and conditions published in the SFC2021 portal and the measures that are implemented in SFC2021 by the Commission to secure the transmission of data, in particular in relation to the use of the technical interface as part of the Member State’s management and control information systems as referred to in point 2.3. 3.5. Implementing and ensuring the effectiveness of the security measures adopted to protect the data stored and transmitted through SFC2021. 3.6. Updating and reviewing annually the SFC2021 IT security policy and the relevant national, regional and local IT security policies in the event of technological changes, the identification of new threats or other relevant developments. ( 1 ) Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC ( OJ L 257, 28.8.2014, p. 73 ). ( 2 ) Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission ( OJ L 6, 11.1.2017, p. 40 ). ( 3 ) Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) ( OJ L 201, 31.7.2002, p. 37 ). ( 4 ) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ( OJ L 119, 4.5.2016, p. 1 ). ( 5 ) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC ( OJ L 295, 21.11.2018, p. 39 ).