https://ecdc.europa.eu/sites/portal/files/media/en/aboutus/calls/Procurement%20Relate d%20Documents/ECDC%20-%20Privacy%20Statement.pdf 

## I.9.2 Processing of personal data by the contractor 

##  For the purpose of Article II.9.2, 

(a) the subject matter and purpose of the processing of personal data by the contractor may include pseudomised information on cases with severe respiratory infection, includingdata on age, sex, country/region of infection, clinical underlying conditions, vaccination status, microbiology laboratory results, clinical outcome of the infection, previous infections, treatment. Furthermore, in the context of the study on health care workers personal data may additionally include molecular and serological laboratory results, contacts of the cases, and activities performed by the case that could have posed or pose a risk for transmission of COVID-19, including use of protective equipment. This basic set of data are essential for achieving the objectives of the services included in this contract, which is the estimation of effectiveness of COVID-19 vaccines; 

(b) The localisation of and access to the personal data processed by the contractor shall comply with the following: 

i. the personal data shall preferably only be processed within the territory of the European Union and the European Economic Area or in the case of a need for processing within a third country, the Centre’s permission shall first be obtained prior to any processing and the requirements laid down in Chapter V of Regulation (EU) 2018/1725 7 shall be complied with in full , including compliance with appropriate safeguards as further described in Annex VII additional data protection clauses ; 

ii. the data shall preferably only be stored in data centres located with the territory of the European Union and the European Economic Area or in the case of a need for their location in a third country, the Centre’s permission shall first be obtained prior to any processing, including storage, in the third country and the requirements laid down in Chapter V of Regulation (EU) 2018/1725 shall be complied with in full; 

iii. access to data may be given on a need to know basis only to authorised persons established in a country which has been recognised by the European Commission as providing adequate protection to personal data or where the controller and processor have provided appropriate safeguards and on condition that enforceable data subjects rights and effective legal remedies for data subjects are available. The requirements laid down in Chapter V of Regulation (EU) 2018/1725 shall be complied with in full; 

iv. the contractor may not change the location of data processing without the prior written authorisation of the contracting authority; 

v. any transfer of personal data under the FWC to third countries or international organisations shall fully comply with the requirements laid down in Chapter V of Regulation (EU) 2018/1725. 

