Security

1.   The Commission shall ensure that IMI complies with the rules on data security adopted by the Commission pursuant to Article 22 of Regulation (EC) No 45/2001.
2.   The Commission shall put in place the necessary measures to ensure security of personal data processed in IMI, including appropriate data access control and a security plan which shall be kept up-to-date.
3.   The Commission shall ensure that, in the event of a security incident, it is possible to verify what personal data have been processed in IMI, when, by whom and for what purpose.
4.   IMI actors shall take all procedural and organisational measures necessary to ensure the security of personal data processed by them in IMI in accordance with Article 17 of Directive 95/46/EC.