Article 9 Rules on privacy, security of information and processing of personal data

Member States shall take the necessary technical and organisational measures in accordance with applicable Union and national law in order to protect RIS information and records against untoward events or misuse, including improper access, alteration or loss, and to ensure the confidentiality of commercial and other sensitive information exchanged pursuant to this Directive.

Data that constitute personal data as defined in Article 4, point (1), of Regulation (EU) 2016/679 of the European Parliament and of the Council ( 4 ) may be processed on the basis of this Directive only insofar as such processing is necessary for the operation of RIS applications, with a view to ensuring harmonised, interoperable and accessible RIS on inland waterways in the Union and to facilitating standardised interfaces with traffic management services of other transport modes.