Responsibility of the joint controllers towards data subjects
Article 16
1. In accordance with Articles 13 and 14 of Regulation (EU) 2016/679 and Articles 15 and 16 of Regulation (EU) 2018/1725, the Commission, partner competent authorities and customs authorities shall ensure that data subjects are duly informed of the processing operations carried out within the framework of this Regulation and shall update the data protection statement of their systems accordingly. 2. Customs authorities and partner competent authorities shall ensure that any information and communication to data subjects regarding their rights is provided in a transparent manner. The Commission shall ensure that customs authorities and partner competent authorities have the required information to subsequently provide such information and communication to data subjects. 3. The Commission, customs authorities and partner competent authorities shall facilitate the exercise of the rights of data subjects. 4. The Commission, customs authorities and partner competent authorities shall handle requests from data subjects and shall cooperate without undue delay to handle those requests and provide each other with swift and efficient assistance. 5. Where a joint controller receives a data subject request that does not fall under its responsibility in accordance with Article 12, it shall forward that request to the joint controller responsible promptly and at the latest within 3 calendar days from the receipt of the request. The Commission shall assist in identifying the joint controller responsible. 6. Where a data subject requests access to personal data and that personal data is processed by EU CSW-CERTEX, the joint controller to which the request is addressed shall consult the other joint controllers before dealing with the request. 7. Where a joint controller decides to restrict the rights of data subjects for processing activities falling outside of the scope of the joint controllership and concerning personal data that may be exchanged pursuant to this Regulation, it shall inform the other joint controllers without undue delay. 8. In accordance with Article 34 of Regulation (EU) 2016/679 and Article 35 of Regulation (EU) 2018/1725, the controller responsible for a personal data breach shall notify affected data subjects if the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons. The controller responsible shall inform the other controllers of such notification.