Contents
- (1) the following Articles 5a, 5b and 5c are inserted: ‘Articl…
- (2) Annex I is amended in accordance with Annex I to this Deci…
- (3) Annex V is amended in accordance with Annex II to this Dec…
- (4) the text in Annex III to this Decision is added as Annex VI;
- (5) the text in Annex IV to this Decision is added as Annex VII.
(1)the following Articles 5a, 5b and 5c are inserted:‘Article 5aExchange of certificate revocation lists1.The EU Digital COVID Certificate trust framework shall enable the exchange of certificate revocation lists via the central EU Digital COVID Certificate gateway (the ‘gateway’) in accordance with the technical specifications in Annex I.2.Where Member States revoke EU Digital COVID Certificates they may submit certificate revocation lists to the gateway.3.Where Member States submit certificate revocation lists, the issuing authorities shall keep a list of revoked certificates.4.Where personal data is exchanged via the gateway, the processing shall be limited to the purpose of supporting the exchange of revocation information. Such personal data shall only be used for the purpose of verifying the revocation status of EU Digital COVID Certificates issued within the scope of Regulation (EU) 2021/953.5.The information submitted to the gateway shall comprise the following data in accordance with the technical specifications in Annex I:
(a)the pseudonymised unique certificate identifiers of revoked certificates,
(b)an expiry date for the submitted certificate revocation list;
6.Where an issuing authority revokes EU Digital COVID Certificates it has issued pursuant to Regulation (EU) 2021/953 or Regulation (EU) 2021/954 and intends to exchange relevant information through the gateway, it shall transmit the information referred to in paragraph 5 in the form of certificate revocation lists to the gateway in a secure format in accordance with the technical specifications in Annex I.7.Issuing authorities shall, to the extent possible, provide a solution to inform the holders of revoked certificates about the revocation status of their certificates and the reason for the revocation at the time of revocation.8.The gateway shall collect the certificate revocation lists received It shall provide tools for distributing the lists to the Member States. It shall automatically delete lists in accordance with the expiry dates indicated for each submitted list by the submitting authority.9.The designated national authorities or official bodies of the Member States processing personal data in the gateway shall be joint controllers of the data processed. The respective responsibilities of the joint controllers shall be allocated in accordance with Annex VI.10.The Commission shall be the processor of personal data processed within the gateway. In its capacity as processor on behalf of the Member States, the Commission shall ensure the security of the transmission and of the hosting of personal data within the gateway and shall comply with the obligations of the processor laid down in Annex VII.11.The effectiveness of the technical and organisational measures for ensuring the security of processing of personal data within the gateway shall be regularly tested, assessed and evaluated by the Commission and by the joint controllers.Article 5bSubmission of certificate revocation lists by third countriesThird countries issuing COVID-19 certificates in respect of which the Commission has adopted an implementing act pursuant to Article 3(10) or Article 8(2) of Regulation (EU) 2021/953 may submit lists of revoked COVID-19 certificates covered by such an implementing act to be processed by the Commission on behalf of the joint controllers in the gateway referred to in Article 5a, in accordance with the technical specifications set out in Annex I.Article 5cGovernance of the processing of personal data in the central EU Digital COVID Certificate gateway1.The decision-making process of the joint controllers shall be governed by a working group established under the Committee referred to in Article 14 of Regulation (EU) 2021/953.2.The designated national authorities or official bodies of the Member States processing personal data in the gateway as joint controllers shall designate representatives to that group.’;
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.