Skip to content
EU Parl WatchResearch
Projects

Text · Plenary report

On the proposal for a regulation of the European Parliament and of the Council amending Council Decision 2009/917/JHA, as regards its alignment with Union rules on the protection of personal data

Report A-9-2023-0361 · COM(2023)0244 – C90170/2023 – 2023/0143(COD)

Kind
Plenary report A-9-2023-0361
Date
15 November 2023
Committee
Committee on Civil Liberties, Justice and Home Affairs
Rapporteur
Cornelia Ernst
Dossier
2023-0143
More facts (3)
Formats
Official page PDF Word
Subject matter
J-AI, PDON
Reference
COM(2023)0244 – C90170/2023 – 2023/0143(COD)
More
Cite this page Official page (opens the official site)
Link to this page

Text

The text as parsed from the official Word file. Every paragraph has a link (¶) and can be saved to a project as a passage.

Jump to an amendment (13)

Draft european parliament legislative resolution

(COM(2023)0244 – C90170/2023 – 2023/0143(COD))

(Ordinary legislative procedure: first reading)

The European Parliament,

–having regard to the Commission proposal to Parliament and the Council (COM(2023)0244),

–having regard to Article 294(2) and Article 16(2) of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90170/2023),

–having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

–having regard to Rule 59 of its Rules of Procedure,

–having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A9-0361/2023),

1.Adopts its position at first reading hereinafter set out;

2.Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

3.Instructs its President to forward its position to the Council, the Commission and the national parliaments.

Amendment 1

Proposal for a regulation

Recital 2

Amendment: Text proposed by the Commission and Amendment
Text proposed by the CommissionAmendment
(2) Council Decision 2009/917/JHA10 on the use of information technology for customs purposes establishes the Customs Information System (CIS) to assist in preventing, investigating and prosecuting serious contraventions of national laws by making information available more rapidly and increase the effectiveness of the customs administrations. In order to ensure a consistent approach to the protection of personal data in the Union, that Decision should be amended to align it with Directive (EU) 2016/680. In particular, the personal data protection rules should respect the principle of purpose specification, be limited to specified categories of data subjects and categories of personal data, respect data security requirements, include additional protection for special categories of personal data and respect the conditions for subsequent processing. Moreover, provision should be made for the coordinated supervision model as introduced by Article 62 of Regulation (EU) 2018/172511 .(2) Council Decision 2009/917/JHA10 on the use of information technology for customs purposes establishes the Customs Information System (CIS) to assist in preventing, investigating and prosecuting serious contraventions of national laws by making information available more rapidly and increase the effectiveness of the customs administrations. In order to ensure a consistent approach to the protection of personal data in the Union, that Decision should be amended to align it with Directive (EU) 2016/680. In particular, the personal data protection rules should respect the principle of purpose limitation, be limited to specified categories of data subjects and categories of personal data, respect data security requirements, include additional protection for special categories of personal data and respect the conditions for subsequent processing. Moreover, provision should be made for the coordinated supervision model as introduced by Article 62 of Regulation (EU) 2018/172511 .
10 Council Decision 2009/917/JHA on the use of information technology for customs purposes (OJ L 323, 10.12.2009, p. 20).10 Council Decision 2009/917/JHA on the use of information technology for customs purposes (OJ L 323, 10.12.2009, p. 20).
11 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).11 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

Amendment 2

Proposal for a regulation

Recital 5

Amendment: Text proposed by the Commission and Amendment
Text proposed by the CommissionAmendment
(5) To ensure the optimal preservation of the data while reducing the administrative burden for the competent authorities, the procedure governing the retention of personal data in the CIS should be simplified by removing the obligation to review data annually and by setting a maximum retention period of five years which can be increased, subject to justification, by an additional period of two years. That retention period is necessary and proportionate in view of the typical length of criminal proceedings and the need for the data for the conduct of joint customs operations and of investigations.(5) To ensure the optimal preservation of the data while reducing the administrative burden for the competent authorities, the procedure governing the retention of personal data in the CIS should be simplified by removing the obligation to review data annually and by setting as a general rule a maximum retention period of three years which can be increased, subject to justification, by an additional period of two years. That retention period is necessary and proportionate in view of the typical length of criminal proceedings and the need for the data for the conduct of joint customs operations and of investigations.

Amendment 3

Proposal for a regulation

Article 1 – paragraph 1 – point 2

Decision 2009/917/JHA

Article 2 – paragraph 1 – point 2

Amendment: Text proposed by the Commission and Amendment
Text proposed by the CommissionAmendment
(2) Point 2 of Article 2 is hereby deleted.(2) In Article 2 point (2) is replaced by the following:
‘2. “personal data” means personal data as defined in Article 3, point (1), of Directive (EU) 2016/680 of the European Parliament and of the Council1a;’;
1a Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).

Amendment 4

Proposal for a regulation

Article 1 – paragraph 1 – point 3

Decision 2009/917/JHA

Article 3 – paragraph 2

Amendment: Text proposed by the Commission and Amendment
Text proposed by the CommissionAmendment
In relation to the processing of personal data in the Customs Information System, the Commission shall be considered the processor, within the meaning of point (12) of Article 3 of Regulation (EU) 2018/1725, acting on behalf of the national authorities designated by each Member State, which shall be considered the controllers of the personal data.In relation to the processing of personal data in the Customs Information System, the Commission shall be considered the processor, within the meaning of point (12) of Article 3 of Regulation (EU) 2018/1725, acting, in accordance with Article 29 of that Regulation, on behalf of the national authorities designated by each Member State, which shall be considered the controllers of the personal data.

Amendment 5

Proposal for a regulation

Article 1 – paragraph 1 – point 5

Decision 2009/917/JHA

Article 5 – paragraph 2

Amendment: Text proposed by the Commission and Amendment
Text proposed by the CommissionAmendment
2. For the purpose of the actions referred to in paragraph 1, personal data in any of the categories referred to in Article 3(1) may be entered into the Customs Information System only if there are reasonable grounds, in particular on the basis of prior illegal activities, to suggest that the person concerned has committed, is in the act of committing or will commit criminal offences under national laws.2. For the purpose of the actions referred to in paragraph 1, personal data in any of the categories referred to in Article 3(1) may be entered into the Customs Information System only if there are reasonable and objective grounds, in particular on the basis of prior illegal activities, to suggest that the person concerned has committed, is in the act of committing or will commit criminal offences under national laws.

Amendment 6

Proposal for a regulation

Article 1 – paragraph 1 – point 6

Decision 2009/917/JHA

Article 7 – paragraph 3

Amendment: Text proposed by the Commission and Amendment
Text proposed by the CommissionAmendment
(6) Paragraph 3 of Article 7 is replaced by the following:(6) In Article 7 paragraph 3 is deleted;
‘3. Notwithstanding paragraphs 1 and 2, the Council may exceptionally, by a unanimous decision and after consultation of the European Data Protection Board, permit access to the Customs Information System by international or regional organisations, provided that both of the following conditions are met:
(a) the access complies with the general principles for transfers of personal data set out in Article 35 or, where applicable, Article 39 of Directive (EU) 2016/680;
(b) the access is based either on an adequacy decision adopted under Article 36 of that Directive or is subject to appropriate safeguards under Article 37 thereof.’

Amendment 7

Proposal for a regulation

Article 1 – paragraph 1 – point 7

Decision 2009/917/JHA

Article 8 – paragraph 1 – subparagraph 1

Amendment: Text proposed by the Commission and Amendment
Text proposed by the CommissionAmendment
Member States, Europol and Eurojust may process personal data obtained from the Customs Information System only in order to achieve the aim stated in Article 1(2), in accordance with the applicable rules of Union law on the processing of personal data.Member States, Europol and Eurojust may process personal data obtained from the Customs Information System only in order to achieve the aim stated in Article 1(2), in accordance with the applicable rules of Union law on the protection of personal data.

Amendment 8

Proposal for a regulation

Article 1 – paragraph 1 – point 7 a (new)

Decision 2009/917/JHA

Article 8 – paragraph 2

Amendment: Text proposed by the Commission and Amendment
Text proposed by the CommissionAmendment
(7a) In Article 8 paragraph 2 is replaced by the following:
‘2. Without prejudice to paragraphs 1 and 4 of this Article, and Articles 11 and 12, data obtained from the Customs Information System shall only be used by national authorities in each Member State designated by the Member State in question, which are competent, in accordance with the laws, regulations and procedures of that Member State, to act in order to achieve the aim stated in Article 1(2).’;

Amendment 9

Proposal for a regulation

Article 1 – paragraph 1 – point 8

Decision 2009/917/JHA

Article 8 – paragraph 4 – subparagraph 1 – point a

Amendment: Text proposed by the Commission and Amendment
Text proposed by the CommissionAmendment
(a) transmitted to, and further processed by, national authorities other than those designated under paragraph 2, in accordance with the applicable rules of Union law on the processing of personal data; or(a) transmitted to, and further processed by, national authorities other than those designated under paragraph 2, in accordance with the applicable rules of Union law on the protection of personal data; or

Amendment 10

Proposal for a regulation

Article 1 – paragraph 1 – point 8

Decision 2009/917/JHA

Article 8 – paragraph 4 – subparagraph 1 – point b

Amendment: Text proposed by the Commission and Amendment
Text proposed by the CommissionAmendment
(b) transferred to, and further processed by, the competent authorities of third countries and international or regional organisations, in accordance with Chapter V of Directive (EU) 2016/680 and, where relevant, with Chapter V of Regulation (EU) 2018/1725.(b) transferred to, and further processed by, the competent authorities of third countries and international or regional organisations, in accordance with Chapter V of Directive (EU) 2016/680 and, where relevant, with Chapters V and IX of Regulation (EU) 2018/1725.

Amendment 11

Proposal for a regulation

Article 1 – paragraph 1 – point 9

Decision 2009/917/JHA

Article 14

Amendment: Text proposed by the Commission and Amendment
Text proposed by the CommissionAmendment
Personal data entered into the Customs Information System shall be kept only for the time necessary to achieve the aim stated in Article 1(2) and may not be retained for more than five years. However, exceptionally, that data may be kept for an additional period of at most two years, where and insofar as a strict need to do so in order to achieve that aim is established in an individual case.Personal data entered into the Customs Information System shall be kept only for the time necessary to achieve the aim stated in Article 1(2). The need for their retention shall, as a general rule, be reviewed at least once every three years. However, exceptionally, that data may be kept for an additional period of at most two years, where and insofar as strictly necessary in order to achieve that aim in an individual case.

Amendment 12

Proposal for a regulation

Article 1 – paragraph 1 – point 11

Decision 2009/917/JHA

Article 20

Amendment: Text proposed by the Commission and Amendment
Text proposed by the CommissionAmendment
Directive (EU) 2016/680 shall apply to the processing of personal data under this Decision.Directive (EU) 2016/680 and Regulation (EU) 2018/1725 shall apply to the processing of personal data under this Decision.

Amendment 13

Proposal for a regulation

Article 1 – paragraph 1 – point 13

Decision 2009/917/JHA

Article 26

Amendment: Text proposed by the Commission and Amendment
Text proposed by the CommissionAmendment
Coordinated supervision among national supervisory authorities and the European Data Protection Supervisor shall be ensured in accordance with Article 62 of Regulation (EU) 2018/1725.1. The European Data Protection Supervisor shall be responsible for monitoring the processing of personal data under this Regulation by the Commission and for ensuring that it is carried out in accordance with this Regulation. The tasks and powers referred to in Articles 57 and 58 of Regulation (EU) 2018/1725 shall apply accordingly.
2. The European Data Protection Supervisor shall carry out an audit of the processing of personal data by the Commission under this Regulation in accordance with international auditing standards at least every three years. A report on that audit shall be sent to the European Parliament, to the Council, to the Commission and to the national supervisory authorities.
3. The European Data Protection Supervisor and the national supervisory authorities, each acting within the scope of their respective competences, shall cooperate actively within the framework of their responsibilities to ensure coordinated supervision in accordance with Article 62 of Regulation (EU) 2018/1725.

Back matter, 1

Parts that accompany the text rather than belong to it: explanatory statement, annexes, opinions appended by other committees. Collapsed.

Annex: list of entities or persons from whom the rapporteur has received input 2 blocks

The following list is drawn up under the exclusive responsibility of the rapporteur. The rapporteur has received input from the following entities or persons in the preparation of the report, until the adoption thereof in committee:

Table from the text: Entity and/or person
Entity and/or person
The Rapporteur declares that she did not receive input from any entity or person.

Procedure pages and committee votes

How the committees handled the text and how their members voted on it. Collapsed.

Procedure – committee responsible 1 block
Table from the text: Title
TitleAmending Council Decision 2009/917/JHA, as regards its alignment with Union rules on the protection of personal data
ReferencesCOM(2023)0244 – C9-0170/2023 – 2023/0143(COD)
Date submitted to Parliament11.5.2023
Committee responsible Date announced in plenaryLIBE 11.5.2023
Rapporteurs Date appointedCornelia Ernst 6.7.2023
Discussed in committee25.10.2023
Date adopted13.11.2023
Result of final vote+: –: 0:41 0 1
Members present for the final voteAbir Al-Sahlani, Malik Azmani, Pietro Bartolo, Vasile Blaga, Karolin Braunsberger-Reinhold, Patrick Breyer, Saskia Bricmont, Damien Carême, Lucia Ďuriš Nicholsonová, Cornelia Ernst, Maria Grapini, Sylvie Guillaume, Evin Incir, Sophia in ‘t Veld, Jeroen Lenaers, Juan Fernando López Aguilar, Erik Marquardt, Birgit Sippel, Sara Skyttedal, Annalisa Tardino, Milan Uhrík, Tom Vandendriessche, Elena Yoncheva
Substitutes present for the final voteCyrus Engerer, Nathalie Loiseau, Jan-Christoph Oetjen, Anne-Sophie Pelletier, Dragoş Tudorache, Maria Walsh
Substitutes under Rule 209(7) present for the final votePetras Auštrevičius, Katalin Cseh, Ciarán Cuffe, Marie Dauchy, Estrella Durá Ferrandis, Malte Gallée, Niclas Herbst, Martin Hojsík, France Jamet, Bernd Lange, Jutta Paulus, Laurence Sailliet, Ivan Štefanec
Date tabled15.11.2023
Final vote by roll call in committee responsible 3 blocks

41 · For

ID
Marie Dauchy, France Jamet, Annalisa Tardino, Tom Vandendriessche
EPP
Vasile Blaga, Karolin Braunsberger-Reinhold, Niclas Herbst, Jeroen Lenaers, Laurence Sailliet, Sara Skyttedal, Ivan Štefanec, Maria Walsh
Renew
Abir Al-Sahlani, Petras Auštrevičius, Malik Azmani, Katalin Cseh, Lucia Ďuriš Nicholsonová, Martin Hojsík, Sophia in 't Veld, Nathalie Loiseau, Jan-Christoph Oetjen, Dragoş Tudorache
S&D
Pietro Bartolo, Estrella Durá Ferrandis, Cyrus Engerer, Maria Grapini, Sylvie Guillaume, Evin Incir, Bernd Lange, Juan Fernando López Aguilar, Birgit Sippel, Elena Yoncheva
The Left
Cornelia Ernst, Anne-Sophie Pelletier
Greens
Patrick Breyer, Saskia Bricmont, Damien Carême, Ciarán Cuffe, Malte Gallée, Erik Marquardt, Jutta Paulus

0 · Against

1 · Abstained

No group
Milan Uhrík

Connections

The dossier, the decisions on this text and its other versions.

No connections found for this item.

Sources & citation

Where the facts on this page come from, and how to cite it.

Permalink
https://news.eu-parl.st-solutions.dev/texts/A-9-2023-0361
Official source
Data source
Licensed CC BY 4.0.
Retrieved
25 September 2026

Cite as

European Parliament (2023). “REPORT on the proposal for a regulation of the European Parliament and of the Council amending Council Decision 2009/917/JHA, as regards its alignment with Union rules on the protection of personal data”. Text, 15 November 2023. docId A-9-2023-0361, reference A9-0361/2023. EU Parl Watch Research. https://news.eu-parl.st-solutions.dev/texts/A-9-2023-0361 (retrieved 25 September 2026). Official source: The text on the European Parliament’s website, https://www.europarl.europa.eu/doceo/document/A-9-2023-0361_EN.html. Data: EP Open Data API: document record, https://data.europarl.europa.eu/api/v2/documents/A-9-2023-0361 (CC BY 4.0).
BibTeX 
@misc{epw-text-a-9-2023-0361,
  author = {{European Parliament}},
  title = {{REPORT on the proposal for a regulation of the European Parliament and of the Council amending Council Decision 2009/917/JHA, as regards its alignment with Union rules on the protection of personal data}},
  year = {2023},
  date = {2023-11-15},
  howpublished = {\url{https://news.eu-parl.st-solutions.dev/texts/A-9-2023-0361}},
  url = {https://news.eu-parl.st-solutions.dev/texts/A-9-2023-0361},
  urldate = {2026-09-25},
  publisher = {EU Parl Watch Research},
  note = {Text. docId A-9-2023-0361, reference A9-0361/2023. Official source: https://www.europarl.europa.eu/doceo/document/A-9-2023-0361\_EN.html. Data: EP Open Data API: document record (CC BY 4.0)}
}