Article 12 — Data sharing

1. The purpose of data sharing among national statistical institutes and other national authorities included on the list referred to in Article 5(2) of Regulation (EC) No 223/2009, including those of other Member States, and between those institutes and authorities and the Commission (Eurostat) shall be exclusively to develop and produce European statistics that fall within the scope of this Regulation and to improve the quality of such European statistics. 2. For the purpose of ensuring secure data sharing within the ESS, with all necessary safeguards with regard to the physical, technical and logical protection of data, the Commission (Eurostat) shall set up a secure infrastructure to facilitate the data sharing referred to in paragraph 1. National statistical institutes and other national authorities included on the list referred to in Article 5(2) of Regulation (EC) No 223/2009 may use that secure data sharing infrastructure for the purpose set out in paragraph 1. The Commission (Eurostat) and those institutes and authorities that use that secure data sharing infrastructure for the processing of personal data in accordance with paragraph 3 shall be considered as joint controllers for the processing of personal data in the secure data sharing infrastructure. In the event that those institutes and authorities use another data sharing infrastructure, they shall ensure that such infrastructure provides security that is at least equivalent to the security provided by the secure data sharing infrastructure set up by the Commission (Eurostat). 3. Sharing of confidential data within the meaning of Article 3, point (7), of Regulation (EC) No 223/2009 or sharing of personal data pursuant to Regulation (EU) 2016/679 or (EU) 2018/1725 may take place on a voluntary basis provided that such sharing is: (a) based on a request justifying the necessity to share the data in each individual case, in particular with regard to the quality issues to be specifically addressed; (b) based on privacy-enhancing technologies that are specifically designed to implement the principles of Regulations (EU) 2016/679 and (EU) 2018/1725, with particular regard to purpose limitation, data minimisation, storage limitation, integrity and confidentiality; (c) carried out in accordance with Chapter V of Regulation (EC) No 223/2009. 4. For the purpose set out in paragraph 1, non-confidential data shall be shared among national statistical institutes and other national authorities included on the list referred to in Article 5(2) of Regulation (EC) No 223/2009, including those of other Member States, and between those institutes and authorities and the Commission (Eurostat). 5. The Commission (Eurostat) and the Member States shall test and assess, by means of pilot studies, the infrastructure for and fitness of relevant privacy-enhancing technologies for data sharing. 6. Where the pilot studies carried out pursuant to paragraph 5 of this Article identify effective and secure data sharing solutions for the purpose set out in paragraph 1 of this Article, the Commission may adopt implementing acts laying down technical specifications for the data sharing and measures for the confidentiality and security of information. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 17(2).