Contract number: [ complete ]   2019  https://ecdc.europa.eu/sites/portal/files/media/en/aboutus/calls/Procurement%20Relate d%20Documents/ECDC%20-%20Privacy%20Statement.pdf  I.9.2 Processing of personal data by the contractor   For the purpose of Article II.9.2, (a) the subject matter and purpose of the processing of personal data by the contractor may  include pseudomised information on cases with severe respiratory infection, includingdata on age, sex, country/region of infection, clinical underlying conditions,  vaccination status, microbiology laboratory results, clinical outcome of the infection,  previous infections, treatment. Furthermore, in the context of the study on health care  workers personal data may additionally include molecular and serological laboratory  results, contacts of the cases, and activities performed by the case that could have posed  or pose a risk for transmission of COVID-19, including use of protective equipment.  This basic set of data are essential for achieving the objectives of the services included  in this contract, which is the estimation of effectiveness of COVID-19 vaccines;  (b) The localisation of and access to the personal data processed by the contractor shall  comply with the following:  v. any transfer of personal data under the FWC to third countries or international  organisations shall fully comply with the requirements laid down in Chapter V  of Regulation (EU) 2018/1725.  iv. the contractor may not change the location of data processing without the prior  written authorisation of the contracting authority;  iii. access to data may be given on a need to know basis only to authorised persons  established in a country which has been recognised by the European  Commission as providing adequate protection to personal data or where the  controller and processor have provided appropriate safeguards and on condition  that enforceable data subjects rights and effective legal remedies for data  subjects are available. The requirements laid down in Chapter V of Regulation  (EU) 2018/1725 shall be complied with in full;  ii. the data shall preferably only be stored in data centres located with the territory  of the European Union and the European Economic Area or in the case of a need  for their location in a third country, the Centre’s permission shall first be  obtained prior to any processing, including storage, in the third country and the  requirements laid down in Chapter V of Regulation (EU) 2018/1725 shall be  complied with in full;  i. the personal data shall preferably only be processed within the territory of the  European Union and the European Economic Area or in the case of a need for  processing within a third country, the Centre’s permission shall first be obtained  prior to any processing and the requirements laid down in Chapter V of  Regulation (EU) 2018/1725 7 shall be complied with in full , including  compliance with appropriate safeguards as further described in Annex  VII  additional data protection clauses ;  7  Regulation (EU) 2018/1725 of 23 October 2018 on the protection of natural persons with regard to the processing of personal  data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing  Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, OJ L 295/39, 21.11.2018, https://eur-lex.europa.eu/legal- content/EN/TXT/PDF/?uri=CELEX:32018R1725&from=EN  11 