Skip to content
EU Parl WatchResearch
Projects

Text · Comparison of two versions

Changes from plenary report to adopted text

A-9-2023-0361 → TA-9-2024-0058

From
A-9-2023-0361 Plenary report of 15 Nov 2023
To
TA-9-2024-0058 Adopted text of 6 Feb 2024
Changes
1 change to the text
Paragraphs
+8 added · −26 removed · 1 changed
More facts (2)
Title (from)
on the proposal for a regulation of the European Parliament and of the Council amending Council Decision 2009/917/JHA, as regards its alignment with Union rules on the protection of personal data
Title (to)
Amending Council Decision 2009/917/JHA, as regards its alignment with Union rules on the protection of personal data
Cite Link to this page

Changes that matter, 1

Changes to the text in document order — the ones the change notes describe. Cover page, renumbering and punctuation-only edits are left out (see “Every difference”); changes to citations and references stay in and are marked as formal in the notes.

Change 1

RemovedRecital 2: (2) Council Decision 2009/917/JHA10 on the use of information technology for customs purposes establishes the Customs Information System (CIS) to assist in preventing, investigating and prosecuting serious contraventions of national laws by making information available more rapidly and increase the effectiveness of the customs administrations. In order to ensure a consistent approach to the protection of personal data in the Union, that Decision should be amended to align it with Directive (EU) 2016/680. In particular, the personal data protection rules should respect the principle of purpose limitation, be limited to specified categories of data subjects and categories of personal data, respect data security requirements, include additional protection for special categories of personal data and respect the conditions for subsequent processing. Moreover, provision should be made for the coordinated supervision model as introduced by Article 62 of Regulation (EU) 2018/172511 .

AddedP9_TC1-COD(2023)0143

RemovedRecital 5: (5) To ensure the optimal preservation of the data while reducing the administrative burden for the competent authorities, the procedure governing the retention of personal data in the CIS should be simplified by removing the obligation to review data annually and by setting as a general rule a maximum retention period of three years which can be increased, subject to justification, by an additional period of two years. That retention period is necessary and proportionate in view of the typical length of criminal proceedings and the need for the data for the conduct of joint customs operations and of investigations.

AddedPosition of the European Parliament adopted at first reading on 6 February 2024 with a view to the adoption of Regulation (EU) 2024/… of the European Parliament and of the Council amending Council Decision 2009/917/JHA as regards its alignment with Union rules on the protection of personal data

RemovedDecision 2009/917/JHA

Added(As an agreement was reached between Parliament and Council, Parliament's position corresponds to the final legislative act, Regulation (EU) 2024/868).

Show 21 more lines

RemovedArticle 1 – paragraph 1 – point 2, Article 2 – paragraph 1 – point 2: (2) In Article 2 point (2) is replaced by the following: / ‘2. “personal data” means personal data as defined in Article 3, point (1), of Directive (EU) 2016/680 of the European Parliament and of the Council1a;’; / 1a Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).

RemovedDecision 2009/917/JHA

RemovedArticle 1 – paragraph 1 – point 3, Article 3 – paragraph 2: In relation to the processing of personal data in the Customs Information System, the Commission shall be considered the processor, within the meaning of point (12) of Article 3 of Regulation (EU) 2018/1725, acting, in accordance with Article 29 of that Regulation, on behalf of the national authorities designated by each Member State, which shall be considered the controllers of the personal data.

RemovedDecision 2009/917/JHA

RemovedArticle 1 – paragraph 1 – point 5, Article 5 – paragraph 2: 2. For the purpose of the actions referred to in paragraph 1, personal data in any of the categories referred to in Article 3(1) may be entered into the Customs Information System only if there are reasonable and objective grounds, in particular on the basis of prior illegal activities, to suggest that the person concerned has committed, is in the act of committing or will commit criminal offences under national laws.

RemovedDecision 2009/917/JHA

RemovedArticle 1 – paragraph 1 – point 6, Article 7 – paragraph 3: (6) In Article 7 paragraph 3 is deleted; / (deleted) / (deleted) / (deleted)

RemovedDecision 2009/917/JHA

RemovedArticle 1 – paragraph 1 – point 7, Article 8 – paragraph 1 – subparagraph 1: Member States, Europol and Eurojust may process personal data obtained from the Customs Information System only in order to achieve the aim stated in Article 1(2), in accordance with the applicable rules of Union law on the protection of personal data.

RemovedDecision 2009/917/JHA

RemovedArticle 1 – paragraph 1 – point 7 a (new), Article 8 – paragraph 2: (7a) In Article 8 paragraph 2 is replaced by the following: / ‘2. Without prejudice to paragraphs 1 and 4 of this Article, and Articles 11 and 12, data obtained from the Customs Information System shall only be used by national authorities in each Member State designated by the Member State in question, which are competent, in accordance with the laws, regulations and procedures of that Member State, to act in order to achieve the aim stated in Article 1(2).’;

RemovedDecision 2009/917/JHA

RemovedArticle 1 – paragraph 1 – point 8, Article 8 – paragraph 4 – subparagraph 1 – point a: (a) transmitted to, and further processed by, national authorities other than those designated under paragraph 2, in accordance with the applicable rules of Union law on the protection of personal data; or

RemovedDecision 2009/917/JHA

RemovedArticle 1 – paragraph 1 – point 8, Article 8 – paragraph 4 – subparagraph 1 – point b: (b) transferred to, and further processed by, the competent authorities of third countries and international or regional organisations, in accordance with Chapter V of Directive (EU) 2016/680 and, where relevant, with Chapters V and IX of Regulation (EU) 2018/1725.

RemovedDecision 2009/917/JHA

RemovedArticle 1 – paragraph 1 – point 9, Article 14: Personal data entered into the Customs Information System shall be kept only for the time necessary to achieve the aim stated in Article 1(2). The need for their retention shall, as a general rule, be reviewed at least once every three years. However, exceptionally, that data may be kept for an additional period of at most two years, where and insofar as strictly necessary in order to achieve that aim in an individual case.

RemovedDecision 2009/917/JHA

RemovedArticle 1 – paragraph 1 – point 11, Article 20: Directive (EU) 2016/680 and Regulation (EU) 2018/1725 shall apply to the processing of personal data under this Decision.

RemovedDecision 2009/917/JHA

RemovedArticle 1 – paragraph 1 – point 13, Article 26: 1. The European Data Protection Supervisor shall be responsible for monitoring the processing of personal data under this Regulation by the Commission and for ensuring that it is carried out in accordance with this Regulation. The tasks and powers referred to in Articles 57 and 58 of Regulation (EU) 2018/1725 shall apply accordingly. / 2. The European Data Protection Supervisor shall carry out an audit of the processing of personal data by the Commission under this Regulation in accordance with international auditing standards at least every three years. A report on that audit shall be sent to the European Parliament, to the Council, to the Commission and to the national supervisory authorities. / 3. The European Data Protection Supervisor and the national supervisory authorities, each acting within the scope of their respective competences, shall cooperate actively within the framework of their responsibilities to ensure coordinated supervision in accordance with Article 62 of Regulation (EU) 2018/1725.

Sources & citation

Where the facts on this page come from, and how to cite it.

Permalink
https://news.eu-parl.st-solutions.dev/texts/A-9-2023-0361/compare/TA-9-2024-0058
Data source
Licensed CC BY 4.0.
Retrieved
25 September 2026

Cite as

European Parliament (2024). “Changes between A-9-2023-0361 and TA-9-2024-0058”. Text, 6 February 2024. from A-9-2023-0361, to TA-9-2024-0058. EU Parl Watch Research. https://news.eu-parl.st-solutions.dev/texts/A-9-2023-0361/compare/TA-9-2024-0058 (retrieved 25 September 2026). Data: European Parliament Open Data, https://data.europarl.europa.eu/ (CC BY 4.0).
BibTeX 
@misc{epw-text-2024-02-06,
  author = {{European Parliament}},
  title = {{Changes between A-9-2023-0361 and TA-9-2024-0058}},
  year = {2024},
  date = {2024-02-06},
  howpublished = {\url{https://news.eu-parl.st-solutions.dev/texts/A-9-2023-0361/compare/TA-9-2024-0058}},
  url = {https://news.eu-parl.st-solutions.dev/texts/A-9-2023-0361/compare/TA-9-2024-0058},
  urldate = {2026-09-25},
  publisher = {EU Parl Watch Research},
  note = {Text. from A-9-2023-0361, to TA-9-2024-0058. Data: European Parliament Open Data (CC BY 4.0)}
}