Roles and responsibilities of the controllers and the processor
Article 7
1. Member States shall jointly be controllers, as defined in Article 4, point (7), of Regulation (EU) 2016/679, of CESOP. The responsibilities of the controllers of CESOP shall be determined in an agreement between the controllers, which shall set out the rules for the exercise of rights of the data subject and their duties in relation to the provision of the information referred to in Article 13 and 14 of Regulation (EU) 2016/679. Member States shall be responsible for the following: (a) drawing up the technical specifications of CESOP, and where necessary adapting them, for the Commission to be able to: (a) establish and maintain CESOP pursuant to Article 1 of this Regulation; (b) technically manage CESOP pursuant to Article 2 of this Regulation; (c) ensure the interoperability of the national electronic systems referred to in Article 24b of Regulation (EU) No 904/2010 and CESOP pursuant to Article 3(3) of this Regulation; (d) take the security measures pursuant to Article 6(2), first subparagraph, of this Regulation; (b) setting out the rules and procedures for the selection of Eurofisc liaison officials who will have access to CESOP; (c) answering requests from data subjects regarding the exercise of the rights laid down in Chapter III of Regulation (EU) 2016/679. 2. The Commission shall be processor, as defined in Article 3, point (12), of Regulation (EU) 2018/1725, of CESOP. The Commission shall: (a) process the personal data on behalf of the Member States on their instructions and keep documentation for those instructions; (b) ensure the confidentiality of personal data when processed under this Regulation; (c) provide the necessary technical infrastructure for Member States to respond to the requests referred to in paragraph 1, point (c); (d) assist the Member States to comply with the obligations laid down in Articles 33 to 41 of Regulation (EU) 2016/679; (e) ensure the deletion of all personal data stored in CESOP in accordance with Article 24c(2), of Regulation (EU) No 904/2010; (f) make available to Member States all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by Member States or another auditor mandated by Member States, in full respect of Protocol (No 7) to the Treaty on the Functioning of the European Union on the Privileges and Immunities of the European Union.