Commission Implementing Regulation (EU) No 463/2014Show full title

Article 3 U.K. Operation of SFC2014

1. The Commission, the authorities designated by the Member State pursuant to Article 59(3) of Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council(1) and Article 31 of Regulation (EU) No 223/2014 as well as the bodies to which tasks of those authorities have been delegated shall enter into SFC2014 the information for the transmission of which they are responsible and any updates thereto.

2. Any transmission of information to the Commission shall be verified and submitted by a person other than the person who entered the data for that transmission. This separation of tasks shall be supported by SFC2014 or by Member State's management and control information systems connected automatically with SFC2014.

3. Member States shall appoint, at national level, a person or persons responsible for managing access rights to SFC2014 who shall fulfil the following tasks:

(a) identifying users requesting access, making sure those users are employed by the organisation;

(b) informing users about their obligations to preserve the security of the system;

(c) verifying the entitlement of users to the required privilege level in relation to their tasks and their hierarchical position;

(d) requesting the termination of access rights when those access rights are no longer needed or justified;

(e) promptly reporting suspicious events that may bring prejudice to the security of the system;

(f) ensuring the continued accuracy of user identification data by reporting any changes;

(g) taking the necessary data protection and commercial confidentiality precautions in accordance with Union and national rules;

(h) informing the Commission of any changes affecting the capacity of the Member State authorities or users of SFC2014 to carry out the responsibilities referred to in paragraph 1 or their personal capacity to carry out responsibilities referred to in points (a)-(g).

4. Exchanges of data and transactions shall bear a compulsory electronic signature within the meaning of Directive 1999/93/EC of the European Parliament and of the Council(2). The Member States and the Commission shall recognise the legal effectiveness and admissibility of the electronic signature used in SFC2014 as evidence in legal proceedings.

Information processed through SFC2014 shall respect the protection of privacy and personal data for individuals and commercial confidentiality for legal entities in accordance with Directive 2002/58/EC of the European Parliament and of the Council(3), Directive 2009/136/EC of the European Parliament and of the Council(4), Directive 1995/46/EC and Regulation (EC) No 45/2001.

(1)

Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council of 25 October 2012 on the financial rules applicable to the general budget of the Union and repealing Council Regulation (EC, Euratom) No 1605/2002 (OJ L 298, 26.10.2012, p. 1).

(2)

Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures (OJ L 13, 19.1.2000, p. 12).

(3)

Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ L 201, 31.7.2002, p. 37).

(4)

Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 amending Directive 2002/22/EC on universal service and users' rights relating to electronic communications networks and services, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws (OJ L 337, 18.12.2009, p. 11).