Commission Implementing Regulation (EU) No 802/2014Show full title

Article 4 Operation of SFC2014

1. The Commission and the competent authorities referred to in Article 25 of Regulation (EU) No 514/2014 shall enter into SFC2014 the information for the transmission of which they are responsible, and any updates thereto.

2. Any transmission of information to the Commission shall be verified and submitted by a person other than the person who entered the data for that transmission. This separation of tasks shall be supported by SFC2014 or by the Member State's management and control information systems connected automatically with SFC2014.

3. Member States shall appoint, at national or regional level or at both national and regional levels, one or more persons responsible for managing access rights to SFC2014. Those persons shall fulfil the following tasks:

(a) identifying users requesting access, making sure those users are employed by the organisation;

(b) informing users about their obligations to preserve the security of the system;

(c) verifying the entitlement of users to the required privilege level in relation to their tasks and their hierarchical position;

(d) requesting the termination of access rights when those access rights are no longer needed or justified;

(e) promptly reporting suspicious events that may undermine the security of the system;

(f) ensuring the continued accuracy of user identification data by reporting any changes;

(g) taking the necessary data protection and commercial confidentiality precautions in accordance with applicable Union and national rules; and

(h) informing the Commission of any changes affecting the capacity of the Member State authorities or users of SFC2014 to carry out the responsibilities referred to in paragraph 1 or their personal capacity to carry out the responsibilities referred to in points (a) to (g).

4. Exchanges of data and transactions shall bear a compulsory electronic signature within the meaning of Directive 1999/93/EC of the European Parliament and of the Council(1). Member States and the Commission shall recognise the legal effectiveness and admissibility of the electronic signature used in SFC2014 as evidence in legal proceedings.

5. Information processed through SFC2014 shall respect the protection of privacy of personal data for individuals and commercial confidentiality for legal entities in accordance with Directive 2002/58/EC of the European Parliament and of the Council(2), Directive 2009/136/EC of the European Parliament and of the Council(3), Directive 95/46/EC and Regulation (EC) No 45/2001.

(1)

Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures (OJ L 13, 19.1.2000, p. 12).

(2)

Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ L 201, 31.7.2002, p. 37).

(3)

Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 amending Directive 2002/22/EC on universal service and users' rights relating to electronic communications networks and services, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws (OJ L 337, 18.12.2009, p. 11).