Changes from plenary report to adopted text

Added(h) to produce statistics and other analyses as provided for in Union legislation for which the data in the EU Customs Data Hub is necessary.

Added(ha) to contribute to the enforcement of other relevant Union legislation. [Am. 150]

AddedThe Commission shall only process data to the extent that it is needed and useful to fulfil the purposes referred to in this paragraph. [Am. 151]

Added5. The European Anti-Fraud Office (‘OLAF’) may process data, including personal and commercially sensitive data, stored or otherwise available in the EU Customs Data Hub, exclusively and to the extent necessary for carrying out its activities concerning customs matters pursuant to Article 1 of Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council, and Council Regulation (EC) No 515/97, under the conditions relating to data protection laid down in the aforementioned Regulations.

Added6. The European Public Prosecutor’s Office (‘EPPO’) may, upon request, access and process data, including personal and commercially sensitive data, stored or otherwise available in the EU Customs Data Hub, exclusively and to the extent necessary for carrying out its tasks pursuant to Article 4 of Council Regulation (EU) 2017/1939, insofar as the conduct investigated by EPPO concerns customs and under the conditions determined in an implementing act adopted pursuant to paragraph 14 of this Article. [Am. 152]

Added7. The tax authorities of the Member States may process data, including personal and commercially sensitive data, stored or otherwise available in the EU Customs Data Hub, exclusively and to the extent necessary to determine the liability of any person for duty, fees and taxes that may be due in the Union in connection with the relevant goods and under the conditions determined in an implementing act adopted pursuant to paragraph 14 of this Article. [Am. 153]

Added8. The competent authorities as defined in Article 3, point (3), of Regulation (EU) 2017/625 of the European Parliament and of the Council may access data, including personal and commercially sensitive data, store or otherwise available in the EU Customs Data Hub exclusively and to the extent necessary for enforcing Union legislation governing the placing on the market or the safety of food, feed and plants and for cooperating with customs authorities to minimise the risks that non-compliant products enter the Union and under the conditions determined in an implementing act adopted pursuant to paragraph 14 of this Article. [Am. 154]

Added9. The market surveillance authorities designated by Member States in accordance with Article 10 of Regulation (EU) 2019/1020 may process data, including personal and commercially sensitive data, stored or otherwise available in the EU Customs Data Hub, exclusively and to the extent necessary for enforcing Union legislation governing the placing on the market or the safety of products and for cooperating with customs authorities to minimise the risks that non-compliant goods enter the Union, and under the conditions determined in an implementing act adopted pursuant to paragraph 14 of this Article. [Am. 155]

Added10. The European Union Agency for Law Enforcement Cooperation (Europol) may, upon request, access data, including personal and commercially sensitive data, stored or otherwise available in the EU Customs Data Hub, exclusively and to the extent necessary to perform its tasks in accordance with Article 4 of Regulation (EU) 2016/794 of the European Parliament and of the Council as long as those tasks concern customs-related matters and under the conditions determined in an implementing act adopted pursuant to paragraph 14 of this Article. [Am. 156]

Added11. Other national authorities and Union bodies, including the European Border and Coast Guard Agency (Frontex), may process non-personal data stored or otherwise available in the EU Customs Data Hub under the conditions determined in an implementing act adopted pursuant to paragraph 14 of this Article: [Am. 157]

Added(a) carry out their tasks relevant for the fulfilment of customs formalities;

Added(b) carry out the tasks entrusted to those authorities by Union legislation;

Added(c) carry out their tasks relevant for the performance of the Union-level risk management activities referred to in Article 52.

Added12. Until the date set out in Article 265(3), the Commission, OLAF, EPPO and the EU Customs Authority once it is established shall, exclusively for the purposes stated in paragraphs 4, 5 and 6, be able to process data, including personal data, from the existing electronic systems for the exchange of information developed by the Commission pursuant to Regulation (EU) No 952/2013. [Am. 158]

Added13. The Commission is empowered to adopt delegated acts in accordance with Article 261 to amend paragraphs 2 to 4 to clarify and complement the purposes laid down therein in light of the evolving needs in implementing customs legislation or other legislation.

Added13a. As regards the processing of personal data by EU CSW-CERTEX, the Commission shall be a joint controller within the meaning of Article 28(1) of Regulation (EU) 2018/1725, and customs authorities and Member States’ partner competent authorities responsible for the Union non-customs formalities listed in the Annex Ia shall be joint controllers within the meaning of Article 26(1) of Regulation (EU) 2016/679. [Am. 159]

Added14. The Commission shall lay down, by means of implementing acts, rules and modalities for accessing or processing data, including personal and commercially sensitive data, stored or otherwise available in the EU Customs Data Hub by the authorities referred to in paragraphs 6 to 11. In determining those rules and modalities, the Commission shall, for each authority or category of authorities:

Added(a) assess the existing safeguards applied by the authority concerned to ensure that the data is processed in accordance to the purpose;

Added(b) ensure the proportionality and the necessity of the processing in relation to the purpose;

Added(c) determine the specific categories of data, which the authority may have access to or process;

Added(d) consider the need for the authority concerned to designate a specific contact point, person or persons or to provide additional safeguards;

Added(e) assess the need to restrict the subsequent sharing of the data;

Added(f) determine the conditions and modalities for requests for access to data, including personal or commercially sensitive data and which of the joint controllers will grant the access to the EU Customs Data Hub. [Am. 160]

AddedThose implementing acts shall be adopted in accordance with the examination procedure referred to in Article 262(4). [Am. 161]

AddedArticle 32 Personal data in the EU Customs Data Hub

Added1. The personal data of the following categories of data subjects may be processed in the EU Customs Data Hub exclusively and to the extent necessary for the purposes laid down in Article 31:

Added(a) data subjects registered or applying for registration as economic operators in accordance with Article 19;

Added(b) data subjects who are economic operators which are occasionally involved in activities covered by the customs legislation or by other legislation applied by the customs authorities; [Am. 162]

Added(c) data subjects who are economic operators and whose personal information is contained in the supporting documents referred to in Article 40, or in any additional evidence required for the fulfilment of the obligations imposed by customs legislation and other legislation applied by the customs authorities; [Am. 163]

Added(d) data subjects who are economic operators and whose personal data is contained in the data collected for risk management purposes pursuant to Article 50(3), point (a); [Am. 164]

Added(e) authorised staff of customs authorities, of authorities other than customs or any other relevant authority or authorised body, whose personal information is necessary to ensure appropriate control and supervision of the access to the information in the EU Customs Data Hub;

Added(f) staff or authorised third parties working on behalf of the Commission, the EU Customs Authority or other Union bodies authorised to access the EU Customs Data Hub.

Added2. The following categories of personal data may be processed in the EU Customs Data Hub in accordance with Article 31:

Added(a) personal data in the EU Customs Data model referred to in Article 36;

Added(b) personal data included in the data collected for risk management purposes pursuant to Article 50(3), point (a);

Added(c) personal data required to ensure a proper identification of the staff authorised to process data in the EU Customs Data Hub referred to in paragraph 1, points (e) and (f);

Added3. The Commission is empowered to adopt delegated acts in accordance with Article 261 to amend or supplement the categories of data subjects and the categories of personal data referred to in paragraphs 1 and 2 of this Article to take account of developments in information technology and in the light of the state of progress in the information society.

AddedArticle 33 Retention period of personal data in the EU Customs Data Hub

Added1. Personal data in the EU Customs Data Hub may be stored by means of a specific service for a maximum period of 10 years, starting from the date on which that data is recorded in the service. The cases provided for in Article 48 and investigations launched by OLAF, EPPO or by Member States’ authorities, infringement procedures launched by the Commission and administrative and judicial proceedings involving personal data shall have a suspensive effect on the retention period with regard to that data.

Added2. After the period of time provided for in paragraph 1, personal data shall be erased or anonymised, according to the circumstances.

Added3. The Commission shall lay down, by means of implementing acts, the rules for anonymising the personal data after the expiry of the retention period. [Am. 165]

AddedArticle 34 Roles and responsibilities for personal data processed in the EU Customs Data Hub

Added1. The customs authorities of the Member States, the Commission and the EU Customs Authority shall be considered joint controllers for the personal data processing in the EU Customs Data Hub for the purposes of risk management and cooperation, as referred to in Article 31(2), points (b) and (c), Article 31(3), points (a) and (c), and Article 31(4), points (a) and (e).

Added2. Each customs authority alone shall be considered controller in relation to the personal data it processes for the purposes referred to in Article 31(2),point (a).

Added3. The Commission shall be considered sole controller in relation to the personal data it processes for the purposes referred to in Article 31(4), points (c), (d) and (f) to (g).

Added4. Until the date set out in Article 265(3), the Commission, OLAF, EPPO and the EU Customs Authority shall be considered sole controllers in relation to the data processing referred to in Article 31(12).

Added5. The joint controllers referred to in paragraph 1 shall:

Added(a) work together to process the request(s) made by the data subject(s) in a timely manner and to facilitate the exercise of the rights of data subjects;

Added(b) assist each other in matters involving the identification and handling of any data breach related to the joint processing;

Added(c) exchange the relevant information necessary to inform data subjects pursuant to Chapter III, Section 2 of Regulation (EU) 2016/679, Chapter III, Section 2 of Regulation (EU) 2018/1725, and Chapter III of Directive (EU) 2016/680, where applicable;

Added(d) ensure and protect the security, integrity, availability and confidentiality of the personal data processed jointly pursuant to Article 32 of Regulation (EU) 2016/679, Article 33 of Regulation (EU) 2018/1725, and Article 25 of Directive (EU) 2016/680, where applicable.

Added6. The Commission shall lay down, by means of implementing acts, the respective roles and relationships of the joint controllers vis-à-vis the data subjects, in compliance with Article 26 of Regulation (EU) 2016/679 and Article 28 of Regulation (EU) 2018/1725. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 262(4).

AddedArticle 35 Restriction of data subject’s rights

Added1. Where the exercise by a data subject of the right of access and right to restriction of processing referred to in Articles 15 and 18 of Regulation (EU) 2016/679 and Articles 17 and 20 of Regulation (EU) 2018/1725, or the communication of a data breach referred to in Article 34(1) of Regulation (EU) 2016/679 and Article 35(1) of Regulation (EU) 2018/1725, would jeopardise an ongoing investigation concerning a natural person in the field of customs, the performance of customs controls or the management of a specific risk identified in relation to a natural person in the field of customs, the customs authorities, the EU Customs Authority and the Commission may, in accordance with Article 23(1), points (c), (e), (f) and (h), of Regulation (EU) 2016/679, and the Commission and the EU Customs Authority may, in accordance with Article 25(1), points (a), (c), (e), and (g), of Regulation (EU) 2018/1725, restrict wholly or partly those rights as long as the restriction is necessary and proportionate.

Added2. The customs authorities, the Commission and the EU Customs Authority shall assess the necessity and proportionality of the restrictions referred to in paragraph 1 on a case-by-case basis before they are applied, considering the potential risks to the rights and freedoms of the data subject.

Added3. When processing personal data received from other organisations in the context of its tasks, the customs authorities, the EU Customs Authority or the Commission, when acting as a controller or a joint controller, shall consult those organisations on potential grounds for imposing the restrictions as referred to in paragraph 1, and the necessity and proportionality of such restrictions before applying a restriction referred to in paragraph 1.

Added4. Where the customs authorities, the Commission or the EU Customs Authority restrict, wholly or partly, the rights referred to in paragraph 1, they shall take the following steps:

Added(a) inform the data subject concerned, in its reply to the request, of the restriction applied and of the principal reasons therefore, and of the possibility of lodging a complaint with the national data protection authorities or the European Data Protection Supervisor or of seeking a judicial remedy in a national court or the Court of Justice of the European Union; and

Added(b) record the reasons for the restriction, including an assessment of the necessity for and proportionality of the restriction, and the reasons why providing access would jeopardise risk management and customs controls.

AddedThe provision of information referred to in point (a) of the first subparagraph may be deferred, omitted or denied in accordance with Article 25(8) of Regulation (EU) 2018/1725, or where the provision of that information would be prejudicial to the purposes of the restriction.