[F11. For the purpose of implementing the specific control and inspection programmes, each Member State concerned shall ensure the electronic exchange with other Member States concerned and EFCA of data related to fishing activities and fishing related activities covered by the specific control and inspection programmes. The Commission shall have access to the data exchanged pursuant to this subparagraph.]
The exchange of data referred to in the first subparagraph shall be in accordance with Article 111 of Regulation (EC) No 1224/2009 and with Article 118 of and Annex XII to Implementing Regulation (EU) No 404/2011.
[F12. Data exchanged pursuant to paragraph 1 may include personal data. EFCA, the Commission and Member States may process personal data to which they have access pursuant to paragraph 1 for the purposes of complying with their tasks and obligations under the specific control and inspection programmes. EFCA, the Commission and Member States shall take, in accordance with Article 5 of Regulation (EU) 2016/679 and Article 4 of Regulation (EU) 2018/1725, measures to ensure appropriate protection of personal data.]
3.Personal data contained in the information exchanged pursuant to paragraph 1 shall not be stored for a period longer than 10 years, except if such personal data is necessary to allow the follow up of an infringement, an inspection, or judicial or administrative proceedings. In this case, such personal data may be stored for 20 years. If personal data contained in the information exchanged pursuant to paragraph 1 is retained for a longer period of time, the data shall be anonymised.
4.By way of derogation from paragraph 3, personal data contained in the information exchanged pursuant to paragraph 1 may be stored for a period exceeding the periods set in paragraph 3 solely for the purpose of performing scientific research and providing scientific advice in line with Article 89 of Regulation (EU) 2016/679.
5.Member States shall process personal data collected pursuant to this Decision in accordance with Article 4(7) of Regulation (EU) 2016/679.
[F16. EFCA, the Commission and the Member State authorities shall ensure the security of the processing of personal data that takes place pursuant to this Decision. EFCA and the Member State authorities shall cooperate on security-related tasks.]
[F17. EFCA, the Commission and Member States shall take measures to ensure appropriate protection of the confidentiality of the information received pursuant to this Decision in accordance with Article 113 of Regulation (EC) No 1224/2009.]