DAC — Article 25

xtent required in order to safeguard the interests referred to in point (c) of Article 25(1) of that Regulation. 3. Reporting Financial Institutions, intermediaries, Reporting Platform Operators and the competent authorities of Member States shall be considered to be data controllers when, acting alone or jointly, they determine the purposes and means of the processing of personal data within the meaning of Regulation (EU) 2016/679. determine the purposes and means of the processing of personal data within the meaning of Regulation (EU) 2016/679. 4. Notwithstanding paragraph 1, each Member State shall ensure each Reporting Financial Institution or intermediary or Reporting Platform Operator, as the case may be, which is under its jurisdiction: (a) informs each individual concerned that information relating to that individual will be collected and transferred in accordance with this Directive; and (b) provides to each individual concerned all information that the individual is entitled to from the data controller in sufficient time for that individual to exercise his/her data protection rights and, in any case, before the information is reported. Notwithstanding point (b) of the first subparagraph, each Member State shall lay down rules obliging Reporting Platform Operators to inform Reportable Sellers of the reported Consideration. shall lay down rules obliging Reporting Platform Operators to inform Reportable Sellers of the reported Consideration. 5. Information processed in accordance with this Directive shall be retained for no longer than is necessary to achieve the purposes of this Directive, and in any case in accordance with each data controller’s domestic rules on statute of limitations. 6. A Member State where a data breach occurred, shall report the data breach and any subsequent remedial action to the Commission without delay. The Commission shall inform all Member States without delay of the data breach that has been reported to it or of which it is aware and any remedial action. Each Member State may suspend the exchange of information to the Member State(s) where the data breach occurred by giving notice in writing to the Commission and the Member State(s) concerned. where the data breach occurred by giving notice in writing to the Commission and the Member State(s) concerned. Such suspension shall have immediate effect. The Member State(s) where the data breach occurred shall investigate, contain and remedy the data breach and shall, by giving notice in writing to the Commission, request the suspension of the CCN access for the purposes of this Directive, if the data breach cannot be contained immediately and appropriately. Upon such request, the Commission shall suspend the CCN access of such Member State(s) for the purposes of this Directive. Upon reporting by the Member State where the data breach occurred of remedying the data breach, the Commission shall resume the CCN access of the Member State(s) concerned for the purposes of this Directive. breach, the Commission shall resume the CCN access of the Member State(s) concerned for the purposes of this Directive. In case one or more Member States request the Commission to jointly verify whether the remediation of the data breach was successful, the Commission shall resume the CCN access of such Member State(s) for the purposes of this Directive upon such verification. Where a data breach occurs to the central directory or the CCN for the purposes of this Directive and where the exchanges of Member States through the CCN can potentially be affected, the Commission shall inform Member States of the data breach and any remedial actions taken without undue delay. Such remedial actions may include suspending access to the central directory or the CCN for the purposes of this Directive until the data breach is remedied. access to the central directory or the CCN for the purposes of this Directive until the data breach is remedied. 7. Member States, assisted by the Commission, shall agree on the practical arrangements necessary for the implementation of this Article, including data breach management processes which are aligned with internationally recognised good practices and where appropriate a joint data controller agreement, a data processor – data controller agreement, or models thereof.