Changes from report parliamentary committee draft to plenary report

AddedRegulation (EU) No 904/2010

AddedArticle 1 – paragraph 1 – point 5, Article 49a – paragraph 3: 3. That centralised access shall be an access through a single-entry point, to all the information concerning an investigation, even if that information concerns several Member States. The system concerned shall ensure full traceability and logging of all searches, and shall be supported by secure communication channels and comprehensive records enabling effective ex-post verification mechanisms.

AddedRegulation (EU) No 904/2010

AddedArticle 1 – paragraph 1 – point 5, Article 49a – paragraph 3 a (new): 3a. The EPPO shall publish, on an annual basis, statistics on the use of the centralised access granted pursuant to this Regulation, including on the number of inquiries made, the number of investigations in which such access contributed to advancing the case, and the number of instances in which accessed data was found to be irrelevant and deleted. Those statistics shall be included in the annual reports of the EPPO and submitted to the European Parliament. In compliance with the relevant provisions governing the investigations, such data shall be properly redacted to ensure confidentiality and proper conduct of the investigations.

AddedRegulation (EU) No 904/2010

AddedArticle 1 – paragraph 1 – point 5, Article 49a – paragraph 4 – subparagraph 1 – point a: (a) the technical details concerning the centralised access to the information referred to in paragraph 1 of this Article including the list of data categories, with which the targeted searches can be carried out, and including preventive mechanisms against untargeted searches;

AddedRegulation (EU) No 904/2010

Article 1 – paragraph 1 – point 5, Article 49a – paragraph 5: deleted

Regulation (EU) No 904/2010

Change 7

ChangedArticle 1 – paragraph 1 – point 5, Article 49b49a – paragraph 25 a (new): 2a.5a. TheAll centralisedusers accessshall referredbe tobound inby paragraphthe 1confidentiality shallrules belaid limiteddown toin whatthis isRegulation. strictlyThe necessaryexchange forof theinformation purposeprocedures ofand openingthe oraccess carryingto outdata specificshall investigationsbe pursued in accordancecompliance with OLAF’s tasks asRegulations referred(EU) to2016/679 inand Article(EU) 1(1)2018/1725 of Regulation (EU, Euratom)the NoEuropean 883/2013,Parliament and shallof bethe designedCouncil and used in such a way as to preventrespect untargetedof searchesthe orCharter accessof notFundamental linkedRights toof athe concreteEuropean case.Union.

Regulation (EU) No 904/2010

Change 8

AddedArticle 1 – paragraph 1 – point 5, Article 49a – paragraph 5 b (new): 5b. The systems enabling the centralised access referred to in paragraph 1 shall be designed to ensure full interoperability with the systems used by relevant Union bodies, in order to facilitate efficient and secure information exchanges and to reduce administrative burdens.

AddedRegulation (EU) No 904/2010

AddedArticle 1 – paragraph 1 – point 5, Article 49a – paragraph 5 c (new): 5c. The Commission shall assess, in close cooperation with the EPPO, the need for additional Union funding to support the development of interoperable IT systems, digital tools and specialised staff.

AddedRegulation (EU) No 904/2010

AddedArticle 1 – paragraph 1 – point 5, Article 49a – paragraph 5 d (new): 5d. Where the EPPO receives personal data as a result of a spontaneous transmission by customs authorities under Article 13a, the following rules shall apply: / (a) the data may be processed solely for the purpose of assessing whether to open, or for the conduct of, an investigation within the EPPO’s mandate under Article 4 of Regulation (EU) 2017/1939; / (b) where the EPPO determines within 90 days of receipt that the data is not relevant to any investigation within its mandate, it shall delete the data and notify the transmitting authority; / (c) where an investigation is opened on the basis of the transmitted data, the transmitting customs authority shall be notified and shall be given the opportunity to communicate its assessment to the EPPO and to the EDPS if it considers that the processing exceeds what is necessary; / (d) the data protection rules laid down in Chapter VIII of Regulation (EU) 2017/1939 shall apply.’

AddedRegulation (EU) No 904/2010

AddedArticle 1 – paragraph 1 – point 5, Article 49b – paragraph 1 – introductory part: 1. The competent authorities of the Member States shall grant to OLAF centralised access for targeted searches to the following information, limited to what is necessary for the exercise of its mandate:

AddedRegulation (EU) No 904/2010

AddedArticle 1 – paragraph 1 – point 5, Article 49b – paragraph 1 – point b: (b) From 1 September 2026, the information referred to in Article 17(1), points (e) and (f), of this Regulation, including any additional data elements stored pursuant to Article 17(1), point (f);

AddedRegulation (EU) No 904/2010

AddedArticle 1 – paragraph 1 – point 5, Article 49b – paragraph 2 a (new): 2a. The centralised access referred to in paragraph 1 shall be designed and used in such a way that OLAF has the focused, investigation-specific access it needs, and that it is not possible to perform untargeted searches or get any access other than for the purpose of opening or carrying out investigations in accordance with OLAF’s tasks as referred to in Article 1(1) of Regulation (EU, Euratom) No 883/2013. Such access shall not permit bulk data extraction, generalised monitoring, or automated profiling not linked to a specific administrative investigation.

AddedRegulation (EU) No 904/2010

Article 1 – paragraph 1 – point 5, Article 49b – paragraph 2 b (new): 2b. The centralised access referred to in paragraph 1 shall be subject to appropriate technical and organisational measures ensuring that each access is attributable to a specific investigation and to an identified authorised user. Such access shall be logged in a manner allowing effective ex-post verification.

Regulation (EU) No 904/2010

Change 9

AddedArticle 1 – paragraph 1 – point 5, Article 49b – paragraph 3: 3. That centralised access shall be an access through a single-entry point, to all the information concerning an investigation, even if that information concerns several Member States. The system concerned shall ensure full traceability and logging of all searches, and shall be supported by comprehensive records enabling effective ex-post verification mechanisms.

AddedRegulation (EU) No 904/2010

AddedArticle 1 – paragraph 1 – point 5, Article 49b – paragraph 3 a (new): 3a. OLAF shall publish, on an annual basis, statistics on the use of the centralised access granted pursuant to this Regulation, including on the number of inquiries made, the number of investigations in which such access contributed to advancing the case, and the number of instances in which accessed data was found to be irrelevant and deleted. Those statistics shall be included in the annual reports of the OLAF and submitted to the European Parliament. In compliance with the relevant provisions governing the investigations, such data shall be properly redacted to ensure confidentiality and proper conduct of the investigations.

AddedRegulation (EU) No 904/2010

AddedArticle 1 – paragraph 1 – point 5, Article 49b – paragraph 4 – subparagraph 1 – point a: (a) the technical details concerning the centralised access to the information referred to in paragraph 1 of this Article including the list of data categories, with which the targeted searches can be carried out, and including preventive mechanism against untargeted searches;

AddedRegulation (EU) No 904/2010

Article 1 – paragraph 1 – point 5, Article 49b – paragraph 5: deleted

Change 10

AddedRegulation (EU) No 904/2010

AddedArticle 1 – paragraph 1 – point 5, Article 49b – paragraph 5 a (new): 5a. All users shall be bound by the confidentiality rules laid down in this Regulation. The exchange of information procedures and the access to data shall be pursued in compliance with Regulations (EU) 2016/679 and (EU) 2018/1725 of the European Parliament and of the Council and in respect of the Charter of Fundamental Rights of the European Union.

AddedRegulation (EU) No 904/2010

AddedArticle 1 – paragraph 1 – point 5, Article 49b – paragraph 5 b (new): 5b. The systems enabling the centralised access referred to in paragraph 1 shall be designed to ensure full interoperability with the systems used by relevant Union bodies, in order to facilitate efficient and secure information exchanges and to reduce administrative burdens.

AddedRegulation (EU) No 904/2010

AddedArticle 1 – paragraph 1 – point 5, Article 49b – paragraph 5 c (new): 5c. The Commission shall assess, in close cooperation with OLAF, the need for additional Union funding to support the development of interoperable IT systems, digital tools and specialised staff.

AddedRegulation (EU) No 904/2010

AddedArticle 1 – paragraph 1 – point 5, Article 49b – paragraph 5 d (new): 5d. Where OLAF receives personal data as a result of a spontaneous transmission by customs authorities under Article 13a, the following rules shall apply: / (a) the data may be processed solely for the purpose of assessing whether to open, or for the conduct of, an investigation within OLAF’s mandate under Article 1(1) of Regulation (EU, Euratom) No 883/2013; / (b) where OLAF determines within 60 days of receipt that the data is not relevant to any investigation within its mandate, it shall delete the data and notify the transmitting authority; / (c) where an investigation is opened on the basis of the transmitted data, the transmitting customs authority shall be notified and shall be given the opportunity to communicate its assessment to OLAF and to the EDPS if it considers that the processing exceeds what is necessary; / (d) the data protection rules laid down in Regulation (EU) 2018/1725 shall apply; OLAF shall apply the internal authorisation requirements under Article 5 of Regulation (EU, Euratom) No 883/2013 to access granted pursuant to this paragraph.’

AddedRegulation (EU) No 904/2010

AddedArticle 1 – paragraph 1 – point 5 a (new), Article 59 – paragraph 1: (5a) in Article 59, paragraph 1 is replaced by the following: / ‘1. Every three years starting from … [entry into force of this amending Regulation], the Commission shall, on the basis of reports provided by EPPO, OLAF and Eurofisc, submit a report to the European Parliament, the Council and the European Court of Auditors on the application of this Regulation. The report shall assess in particular: / (a) the operational effectiveness of direct EPPO and OLAF access to VIES, the SURVEILLANCE system and CESOP, including average time-to-access, the number of investigations materially advanced, and the outcomes of prosecutions or administrative actions; / (b) the coherence of the access and transmission framework with other instruments adopted as part of the revised anti-fraud architecture, including measures relating to Eurofisc’s capacity, CESOP governance, fiscal representative harmonisation and penalty convergence; / (c) the functioning and timeliness of the spontaneous transmission mechanism under Article 13a, including national coordination arrangements between customs and VAT authorities; / (d) the enforcement outcomes achieved in Member States not participating in the EPPO and whether equivalent mechanisms have been established pursuant to the anti-fraud architecture revision; / (e) the estimated amounts of Union VAT and related customs revenue recovered or preserved as a direct result of the data exchanges and access rights established by this Regulation, and; / (f) the c…