Article 16

In the application of this Decision, personal data shall be processed in accordance with Directive 95/46/EC and Regulation (EC) No 45/2001. In particular, appropriate technical and organisational measures shall be taken to protect such personal data against accidental or illegal destruction, accidental loss, or unauthorised access and against any form of illegal processing. The EWRS shall include a selective messaging functionality allowing personal data to be communicated only to national competent authorities involved in contact tracing measures. That selective messaging functionality shall be designed and operated so as to ensure safe and lawful exchange of personal data. Where competent authorities implementing contact tracing measures communicate personal data necessary for contact tracing purposes through the EWRS pursuant to Article 9(3), they shall use the selective messaging functionality referred to in paragraph 2 of this Article and communicate the data only to the other Member States involved in the contact tracing measures. When circulating the information referred to in paragraph 3, the competent authorities shall refer to the alert communicated previously through the EWRS. Messages containing personal data shall automatically be erased from the selective message functionality 12 months after the date of their posting. Where a competent authority establishes that notification of personal data made by it pursuant to Article 9(3) has subsequently proved to be in breach of Directive 95/46/EC because that notification was unnecessary for the implementation of the contact tracing measures at issue, it shall inform immediately the Member States to which that notification was transmitted. In relation to their responsibilities to notify and rectify personal data through the EWRS, the national competent authorities shall be regarded as controllers within the meaning of point (d) of Article 2 of Directive 95/46/EC. In relation to its responsibilities concerning storage of personal data, the Commission shall be regarded as a controller within the meaning of point (d) of Article 2 of Regulation (EC) No 45/2001. The Commission shall adopt: guidelines aimed at ensuring that the day-by-day operation of the EWRS complies with Directive 95/46/EC and Regulation (EC) No 45/2001; a recommendation providing an indicative list of the personal data that may be exchanged for the purpose of the coordination of contact tracing measures.

← art_15__para_3__text_1 · All articles · 1. →

Source: EUR-Lex (Cellar) · retrieved 2026-11-06 · Text as adopted (Official Journal); later amendments are not incorporated in this text.