Responsibilities of the national contact points for digital health as joint controllers
Article 15
1. In their capacity as joint controllers, the national contact points for digital health shall have the responsibilities listed below. (a) They shall set up a contact point with a functional mailbox for communication between the joint controllers and between the joint controllers and the processor. (b) They shall coordinate among each other in the steering group to provide coordinated instructions to the Commission as a processor. (c) They shall send any necessary instructions to the Commission, as the processor, through the steering group, as agreed with the other joint controllers in the group. (d) They shall be responsible for informing data subjects about the processing of personal data in MyHealth@EU in accordance with Articles 13 and 14 of Regulation (EU) 2016/679. (e) They shall address data subject requests for exercise of data subject rights as provided for by Regulation (EU) 2016/679. Where a joint controller receives a request that falls outside its responsibilities for MyHealth@EU, it shall forward the request to the relevant joint controller and inform the data subject. (f) They shall take all appropriate organisational, physical and logical security measures to ensure that each national contact point for digital health operates securely and document these measures. These measures shall ensure that: (i) persons authorised to process personal data exchanged through MyHealth@EU are under an appropriate statutory obligation of confidentiality or have committed themselves to confidentiality; (ii) exchanges of personal data through MyHealth@EU are logged systematically in order to keep a record of personal data exchanges, including the identity of actors involved, the categories of personal data and the purposes for which they were exchanged. (g) They shall assist each other in identifying and handling any incidents, including personal data breaches, linked to processing in MyHealth@EU. In particular, the joint controllers shall notify each other and the Commission of: (i) any risks to the security of the personal data processed in MyHealth@EU; (ii) any security incidents linked to personal data processing operations in MyHealth@EU; (iii) any personal data breach, the likely consequences of the breach and the assessment of the risk to the rights and freedoms of natural persons, and any measures taken to address the breach and mitigate the risk to those rights and freedoms; (iv) any breach of technical or organisational safeguards of the processing operations in MyHealth@EU. (h) They shall communicate any personal data breaches with regard to processing operations in MyHealth@EU to the competent data protection supervisory authorities and, where required, to data subjects, in accordance with Articles 33 and 34 of Regulation (EU) 2016/679. (i) They shall cooperate in carrying out assessments of the impact of the envisaged processing operations, in accordance with Article 35 of Regulation (EU) 2016/679, where necessary. 2. Where a joint controller, in order to comply with its obligations laid down in Articles 33 and 34 of Regulation (EU) 2016/679, needs information from another joint controller, it shall send a specific request to the relevant functional mailbox referred to in paragraph (1), point (a). The other joint controller shall make best efforts to provide such information.