Legal provisions of COM(2011)522 - Administrative cooperation through the Internal Market Information System(‘the IMI Regulation’) - Main contents
Please note
This page contains a limited version of this dossier in the EU Monitor.
dossier | COM(2011)522 - Administrative cooperation through the Internal Market Information System(‘the IMI Regulation’). |
---|---|
document | COM(2011)522 |
date | October 25, 2012 |
Contents
- CHAPTER I - GENERAL PROVISIONS
- Article 1 - Subject matter
- Article 2 - Establishment of IMI
- Article 3 - Scope
- Article 4 - Expansion of IMI
- Article 5 - Definitions
- CHAPTER II - FUNCTIONS AND RESPONSIBILITIES IN RELATION TO IMI
- Article 6 - IMI coordinators
- Article 7 - Competent authorities
- Article 8 - Commission
- Article 9 - Access rights of IMI actors and users
- Article 10 - Confidentiality
- Article 11 - Administrative cooperation procedures
- Article 12 - External actors
- CHAPTER III - PROCESSING OF PERSONAL DATA AND SECURITY
- Article 13 - Purpose limitation
- Article 14 - Retention of personal data
- Article 15 - Retention of personal data of IMI users
- Article 16 - Processing of special categories of data
- Article 17 - Security
- CHAPTER IV - RIGHTS OF DATA SUBJECTS AND SUPERVISION
- Article 18 - Information to data subjects and transparency
- Article 19 - Right of access, correction and deletion
- Article 20 - Exceptions and limitations
- Article 21 - Supervision
- CHAPTER V - GEOGRAPHIC SCOPE OF IMI
- Article 22 - National use of IMI
- Article 23 - Information exchange with third countries
- CHAPTER VI - FINAL PROVISIONS
- Article 24 - Committee procedure
- Article 25 - Monitoring and reporting
- Article 26 - Costs
- Article 27 - Repeal
- Article 28 - Effective application
- Article 29 - Exceptions
- Article 30 - Entry into force
CHAPTER I - GENERAL PROVISIONS
Article 1 - Subject matter
Article 2 - Establishment of IMI
Article 3 - Scope
2. Nothing in this Regulation shall have the effect of rendering mandatory the provisions of Union acts which have no binding force.
Article 4 - Expansion of IMI
2. The Commission shall submit an evaluation of the outcome of the pilot project, including data protection issues and effective translation functionalities, to the European Parliament and the Council. Where appropriate, that evaluation may be accompanied by a legislative proposal to amend the Annex to expand the use of IMI to the relevant provisions of Union acts.
Article 5 - Definitions
In addition, the following definitions shall also apply:
(a) | ‘IMI’ means the electronic tool provided by the Commission to facilitate administrative cooperation between competent authorities of the Member States and between competent authorities of the Member States and the Commission; |
(b) | ‘administrative cooperation’ means the working in collaboration of competent authorities of the Member States or competent authorities of the Member States and the Commission, by exchanging and processing information, including through notifications and alerts, or by providing mutual assistance, including for the resolution of problems, for the purpose of better application of Union law; |
(c) | ‘internal market area’ means a legislative or functional field of the internal market, within the meaning of Article 26(2) TFEU, in which IMI is used in accordance with Article 3 of this Regulation; |
(d) | ‘administrative cooperation procedure’ means a pre-defined workflow provided for in IMI allowing IMI actors to communicate and interact with each other in a structured manner; |
(e) | ‘IMI coordinator’ means a body appointed by a Member State to perform support tasks necessary for the efficient functioning of IMI in accordance with this Regulation; |
(f) | ‘competent authority’ means any body established at either national, regional or local level and registered in IMI with specific responsibilities relating to the application of national law or Union acts listed in the Annex in one or more internal market areas; |
(g) | ‘IMI actors’ means the competent authorities, IMI coordinators and the Commission; |
(h) | ‘IMI user’ means a natural person working under the authority of an IMI actor and registered in IMI on behalf of that IMI actor; |
(i) | ‘external actors’ means natural or legal persons other than IMI users that may interact with IMI only through separate technical means and in accordance with a specific pre-defined workflow provided for that purpose; |
(j) | ‘blocking’ means applying technical means by which personal data become inaccessible to IMI users via the normal interface of IMI; |
(k) | ‘formal closure’ means applying the technical facility provided by IMI to close an administrative cooperation procedure. |
CHAPTER II - FUNCTIONS AND RESPONSIBILITIES IN RELATION TO IMI
Article 6 - IMI coordinators
(a) | registering or validating registration of IMI coordinators and competent authorities; |
(b) | acting as the main contact point for IMI actors of the Member States for issues relating to IMI, including providing information on aspects relating to the protection of personal data in accordance with this Regulation; |
(c) | acting as interlocutor of the Commission for issues relating to IMI including providing information on aspects relating to the protection of personal data in accordance with this Regulation; |
(d) | providing knowledge, training and support, including basic technical assistance, to IMI actors of the Member States; |
(e) | ensuring the efficient functioning of IMI as far as it is within their control, including the provision of timely and adequate responses by IMI actors of the Member States to requests for administrative cooperation. |
2. Each Member State may, in addition, appoint one or more IMI coordinators in order to carry out any of the tasks listed in paragraph 1, in accordance with its internal administrative structure.
3. Member States shall inform the Commission of the IMI coordinators appointed in accordance with paragraphs 1 and 2 and of the tasks for which they are responsible. The Commission shall share that information with the other Member States.
4. All IMI coordinators may act as competent authorities. In such cases an IMI coordinator shall have the same access rights as a competent authority. Each IMI coordinator shall be a controller with respect to its own data processing activities as an IMI actor.
Article 7 - Competent authorities
2. A competent authority may invoke as evidence any information, document, finding, statement or certified true copy which it has received electronically by means of IMI, on the same basis as similar information obtained in its own country, for purposes compatible with the purposes for which the data were originally collected.
3. Each competent authority shall be a controller with respect to its own data processing activities performed by an IMI user under its authority and shall ensure that data subjects can exercise their rights in accordance with Chapters III and IV, where necessary, in cooperation with the Commission.
Article 8 - Commission
(a) | ensuring the security, availability, maintenance and development of the software and IT infrastructure for IMI; |
(b) | providing a multilingual system, including existing translation functionalities, training in cooperation with the Member States, and a helpdesk to assist Member States in the use of IMI; |
(c) | registering the national IMI coordinators and granting them access to IMI; |
(d) | performing processing operations on personal data in IMI, where provided for in this Regulation, in accordance with the purposes determined by the applicable Union acts listed in the Annex; |
(e) | monitoring the application of this Regulation and reporting back to the European Parliament, the Council and the European Data Protection Supervisor in accordance with Article 25. |
2. For the purposes of performing the tasks listed in paragraph 1 and producing statistical reports, the Commission shall have access to the necessary information relating to the processing operations performed in IMI.
3. The Commission shall not participate in administrative cooperation procedures involving the processing of personal data except where required by a provision of a Union act listed in the Annex.
Article 9 - Access rights of IMI actors and users
2. Member States shall designate the IMI coordinators and competent authorities and the internal market areas in which they have competence. The Commission may play a consultative role in that process.
3. Each IMI actor shall grant and revoke, as necessary, appropriate access rights to its IMI users in the internal market area for which it is competent.
4. Appropriate means shall be put in place by the Commission and the Member States to ensure that IMI users are allowed to access personal data processed in IMI only on a need-to-know basis and within the internal market area or areas for which they were granted access rights in accordance with paragraph 3.
5. The use of personal data processed in IMI for a specific purpose in a way that is incompatible with that original purpose shall be prohibited, unless explicitly provided for by national law in accordance with Union law.
6. Where an administrative cooperation procedure involves the processing of personal data, only the IMI actors participating in that procedure shall have access to such personal data.
Article 10 - Confidentiality
2. IMI actors shall ensure that requests of other IMI actors for confidential treatment of information exchanged by means of IMI are respected by IMI users working under their authority.
Article 11 - Administrative cooperation procedures
Article 12 - External actors
(a) | provided for by a Union act; |
(b) | provided for in an implementing act referred to in Article 11 in order to facilitate administrative cooperation between competent authorities in Member States for the application of the provisions of Union acts listed in the Annex; or |
(c) | necessary for submitting requests in order to exercise their rights as data subjects in accordance with Article 19. |
Any such technical means shall be separate from IMI and shall not enable external actors to access IMI.
CHAPTER III - PROCESSING OF PERSONAL DATA AND SECURITY
Article 13 - Purpose limitation
Data submitted to IMI by data subjects shall only be used for the purposes for which the data were submitted.
Article 14 - Retention of personal data
However, if a longer period is provided for in an applicable Union act listed in the Annex, personal data processed in IMI may be retained for a maximum of 18 months after the formal closure of an administrative cooperation procedure.
2. Where a repository of information for future reference by IMI actors is required pursuant to a binding Union act listed in the Annex, the personal data included in such a repository may be processed for as long as they are needed for this purpose either with the data subject’s consent or where this is provided for in that Union act.
3. Personal data blocked pursuant to this Article shall, with the exception of their storage, only be processed for purposes of proof of an information exchange by means of IMI with the data subject’s consent, unless processing is requested for overriding reasons in the public interest.
4. The blocked data shall be automatically deleted in IMI three years after the formal closure of the administrative cooperation procedure.
5. At the express request of a competent authority in a specific case and with the data subject’s consent, personal data may be deleted before the expiry of the applicable retention period.
6. The Commission shall ensure by technical means the blocking and deletion of personal data and their retrieval in accordance with paragraph 3.
7. Technical means shall be put in place to encourage IMI actors to formally close administrative cooperation procedures as soon as possible after the exchange of information has been completed and to enable IMI actors to involve IMI coordinators responsible in any procedure which has been inactive without justification for longer than two months.
Article 15 - Retention of personal data of IMI users
2. Personal data relating to IMI users shall be stored in IMI as long as they continue to be users of IMI and may be processed for purposes compatible with the objectives of this Regulation.
3. When a natural person ceases to be an IMI user, the personal data relating to that person shall be blocked by technical means for a period of three years. Those data shall, with the exception of their storage, only be processed for purposes of proof of an information exchange by means of IMI and shall be deleted at the end of the three-year period.
Article 16 - Processing of special categories of data
2. IMI may be used for the processing of data relating to offences, criminal convictions or security measures referred to in Article 8(5) of Directive 95/46/EC and Article 10(5) of Regulation (EC) No 45/2001, subject to safeguards provided for in those Articles, including information on disciplinary, administrative or criminal sanctions or other information necessary to establish the good repute of an individual or a legal person, where the processing of such data is provided for in a Union act constituting the basis for the processing or with the explicit consent of the data subject, subject to specific safeguards referred to in Article 8(5) of Directive 95/46/EC.
Article 17 - Security
2. The Commission shall put in place the necessary measures to ensure security of personal data processed in IMI, including appropriate data access control and a security plan which shall be kept up-to-date.
3. The Commission shall ensure that, in the event of a security incident, it is possible to verify what personal data have been processed in IMI, when, by whom and for what purpose.
4. IMI actors shall take all procedural and organisational measures necessary to ensure the security of personal data processed by them in IMI in accordance with Article 17 of Directive 95/46/EC.
CHAPTER IV - RIGHTS OF DATA SUBJECTS AND SUPERVISION
Article 18 - Information to data subjects and transparency
2. The Commission shall make publicly available in a way which is easily accessible:
(a) | information concerning IMI in accordance with Articles 11 and 12 of Regulation (EC) No 45/2001, in a clear and understandable form; |
(b) | information on the data protection aspects of administrative cooperation procedures in IMI as referred to in Article 11 of this Regulation; |
(c) | information on exceptions to or limitations of the rights of data subjects as referred to in Article 20 of this Regulation; |
(d) | types of administrative cooperation procedures, essential IMI functionalities and categories of data that may be processed in IMI; |
(e) | a comprehensive list of all implementing or delegated acts regarding IMI, adopted pursuant to this Regulation or to another Union act, and a consolidated version of the Annex to this Regulation and its subsequent amendments by other Union acts. |
Article 19 - Right of access, correction and deletion
2. Where the accuracy or lawfulness of data blocked pursuant to Article 14(1) is contested by the data subject, this fact shall be recorded, as well as the accurate, corrected information.
Article 20 - Exceptions and limitations
Article 21 - Supervision
2. The European Data Protection Supervisor shall monitor and seek to ensure that the personal data processing activities of the Commission, in its role as an IMI actor, are carried out in accordance with this Regulation. The duties and powers referred to in Articles 46 and 47 of Regulation (EC) No 45/2001 shall apply accordingly.
3. The National Supervisory Authorities and the European Data Protection Supervisor, each acting within the scope of their respective competencies, shall ensure coordinated supervision of IMI and its use by IMI actors.
4. The European Data Protection Supervisor may invite the National Supervisory Authorities to meet, where necessary, for the purposes of ensuring coordinated supervision of IMI and its use by IMI actors, as referred to in paragraph 3. The cost of such meetings shall be borne by the European Data Protection Supervisor. Further working methods for this purpose, including rules of procedure, may be developed jointly as necessary. A joint report of activities shall be sent to the European Parliament, the Council and the Commission at least every three years.
CHAPTER V - GEOGRAPHIC SCOPE OF IMI
Article 22 - National use of IMI
(a) | no substantial changes to the existing administrative cooperation procedures are required; |
(b) | a notification of the envisaged use of IMI has been submitted to the National Supervisory Authority where required under national law; and |
(c) | it does not have a negative impact on the efficient functioning of IMI for IMI users. |
2. Where a Member State intends to make systematic use of IMI for national purposes, it shall notify its intention to the Commission and seek its prior approval. The Commission shall examine whether the conditions set out in paragraph 1 are met. Where necessary, and in accordance with this Regulation, an agreement setting out, inter alia, the technical, financial and organisational arrangements for national use, including the responsibilities of the IMI actors, shall be concluded between the Member State and the Commission.
Article 23 - Information exchange with third countries
(a) | the information is processed pursuant to a provision of a Union act listed in the Annex and an equivalent provision in the law of the third country; |
(b) | the information is exchanged or made available in accordance with an international agreement providing for:
|
(c) | the third country in question ensures adequate protection of personal data in accordance with Article 25(2) of Directive 95/46/EC, including adequate safeguards that the data processed in IMI shall only be used for the purpose for which they were initially exchanged, and the Commission has adopted a decision in accordance with Article 25(6) of Directive 95/46/EC. |
2. Where the Commission is an IMI actor, Article 9(1) and (7) of Regulation (EC) No 45/2001 shall apply to any exchange of personal data processed in IMI with its counterparts in a third country.
3. The Commission shall publish in the Official Journal of the European Union and keep up-to-date a list of third countries authorised to exchange information, including personal data, in accordance with paragraph 1.
CHAPTER VI - FINAL PROVISIONS
Article 24 - Committee procedure
2. Where reference is made to this paragraph, Article 4 of Regulation (EU) No 182/2011 shall apply.
3. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.
Article 25 - Monitoring and reporting
2. By 5 December 2017 and every five years thereafter, the Commission shall report to the European Data Protection Supervisor on aspects relating to the protection of personal data in IMI, including data security.
3. For the purpose of producing the reports referred to in paragraphs 1 and 2, Member States shall provide the Commission with any information relevant to the application of this Regulation, including on the application in practice of the data protection requirements laid down in this Regulation.
Article 26 - Costs
2. Unless otherwise stipulated in a Union act, the costs for the IMI operations at Member State level, including the human resources needed for training, promotion and technical assistance (helpdesk) activities, as well as for the administration of IMI at national level, shall be borne by each Member State.
Article 27 - Repeal
Article 28 - Effective application
Article 29 - Exceptions
2. Notwithstanding Article 8(3) and points (a) and (b) of the first paragraph of Article 12 of this Regulation, for the implementation of the administrative cooperation provisions of the SOLVIT Recommendation through IMI, the involvement of the Commission in administrative cooperation procedures and the existing facility for external actors may continue on the basis of the arrangements that were made prior to the entry into force of this Regulation. The period as referred to in Article 14(1) of this Regulation shall be 18 months for personal data processed in IMI for the purposes of the SOLVIT Recommendation.
3. Notwithstanding Article 4(1) of this Regulation, the Commission may launch a pilot project to assess whether IMI is an efficient, cost-effective and user-friendly tool to implement Article 3(4), (5) and (6) of Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (Directive on electronic commerce) (13). No later than two years after the launch of that pilot project, the Commission shall submit to the European Parliament and the Council the evaluation referred to in Article 4(2) of this Regulation, which shall also cover the interaction between administrative cooperation within the consumer protection cooperation system established in accordance with Regulation (EC) No 2006/2004 of the European Parliament and of the Council of 27 October 2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws (the Regulation on consumer protection cooperation) (14) and within IMI.
4. Notwithstanding Article 14(1) of this Regulation, any periods up to a maximum of 18 months decided on the basis of Article 36 of Directive 2006/123/EC with regard to administrative cooperation pursuant to Chapter VI thereof shall continue to apply in that area.
Article 30 - Entry into force
This Regulation shall be binding in its entirety and directly applicable in all Member States.