1. Pursuant to Article 33 of Regulation (EU) 2018/1725 and Article 32 of Regulation (EU) 2016/679, respectively, the joint controllers shall implement appropriate technical and organisational measures to ensure the security of the personal data processed. In assessing the appropriate level of security, the joint controllers shall take into account the state of the art; the costs of implementation; the nature, scope, context and purposes of processing; and the risks involved for the data subjects.
2. Each joint controller that maintains and administers an IT system which is used in the processing of personal data shall establish and implement, or ensure that the processor establishes and implements, appropriate technical and organisational measures with regard to such system.
3. The joint controllers shall grant access to personal data processed in the context of this Decision only to natural persons acting under their authority and only to the extent necessary for fulfilling the purposes of the processing laid down in the Annexes.
4. The joint controllers shall ensure that persons authorised to process personal data have committed themselves to respect confidentiality or are under an appropriate statutory obligation of confidentiality.