Personal data processing
Article 22
1. The Commission shall be the controller of the processing of personal data collected for the purpose of conducting joint clinical assessments of medical devices and their updates under this Regulation. 2. The categories of personal data necessary for the purpose referred to in paragraph 1 shall be the following: (a) the identity, email address and affiliation of the representatives appointed to the Coordination Group and the JCA Subgroup; (b) the identity and email address of individual experts in any of the following cases: (1) they are identified as relevant for joint clinical assessment or its update; (2) they are selected to be consulted in a joint clinical assessment or its update; (3) they are consulted in a joint clinical assessment or its update; (c) the identity, email address and affiliation of the representatives of health technology developers of medical devices; (d) the identity, email address and affiliation of the representatives of the members of the stakeholder network established pursuant to Article 29 of Regulation (EU) 2021/2282. 3. The representatives appointed to the Coordination Group and the JCA Subgroup shall have access only to the parts of the secure system of the HTA IT platform relevant for the performance of their tasks. Representatives may collaborate, through the HTA IT platform, with other representatives appointed to the Coordination Group, or the JCA Subgroup to which they belong, for the purposes of conducting joint clinical assessments of medical devices and their updates. 4. The personal data of patients involved in joint clinical assessments and their updates shall not be published. 5. The Commission shall keep the personal data listed in paragraph 2 only for as long as necessary for the purpose referred to in paragraph 1 and no longer than 15 years after the date on which the data subject no longer participates in joint clinical assessment. The Commission shall review the necessity of storing the personal data every 2 years. The Commission shall keep the personal data of individual experts not selected to take part in a joint clinical assessment only for as long as necessary in order to ensure the relevant in-depth specialised expertise in joint clinical assessment and no longer than 3 years after the date on which the Commission received this data.