## I.24 PROCESSING OF PERSONAL DATA UNDER THIS FWC 

I.24.1 Any personal data included in the FWC must be processed in accordance with Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data or any legal statute that may replace it. Such data must be processed by the data controller solely for the purposes of the implementation, management and monitoring of the FWC. This does not affect its possible transmission to bodies entrusted with monitoring or inspection tasks in application of Union law. 

I.24.2  The contractor has the right to access its personal data and the right to rectify any such data. Under certain conditions, a right to erasure, restriction, objection and/or data portability also applies. The contractor should address any queries concerning the processing of its personal data to the data controller. 

I.24.3  The contractor has right of recourse at any time to the European Data Protection Supervisor. 

I.24.4 If the FWC requires the contractor to process any personal data, the contractor may act only under the supervision of the data controller, in particular with regard to the purposes of the processing, the categories of data that may be processed, the recipients of the data, the means by which the data subject may exercise its rights and with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject. 

I.24.5 The contractor must grant personnel access to the data to the extent strictly necessary for the implementation, management and monitoring of the FWC. 

I.24.6 The contractor must adopt appropriate technical and organisational security measures, giving due regard to the risks inherent in the processing and to the nature of the personal data concerned, in order to: 

(a) prevent any unauthorised person from gaining access to computer systems processing personal data, and especially: 

(i) unauthorised reading, copying, alteration or removal of storage media; 

(ii) unauthorised data inputting, as well as any unauthorised disclosure, alteration or erasure of stored personal data; 

(iii) unauthorised use of data processing systems by means of data transmission facilities; 

(b) ensure that authorised users of a data-processing system can access only the personal data to which their access right refers; 

(c) record which personal data have been communicated, when and to whom; 

(d) ensure that personal data being processed on behalf of third parties can be processed only in the manner prescribed by the contracting authority; 

(e) ensure that, during communication of personal data and transport of storage media, the data cannot be read, copied or erased without authorisation; 

(f) design its organisational structure in such a way that it meets data protection requirements. 

I.24.7  The contractor may only store (incl. back-up storage) and treat personal data using datacentres or similar premises, located on the territory of the European Union member states. Every additional data storage and/or treatment location within the European Union member states envisaged during the period of implementation of the contract, must be 

