JHA, as regards its alignment with Union rules on the protection of personal data - Main contents

Please note

This page contains a limited version of this dossier in the EU Monitor.

dossier	COM(2023)244 - Amendment of Council Decision 2009/917/JHA, as regards its alignment with Union rules on the protection of personal data.
document	COM(2023)244
date	March 13, 2024

Article 1

Council Decision 2009/917/JHA is amended as follows:

1. Paragraph 2 of Article 1 is replaced by the following:

‘2. The objective of the Customs Information System is to assist the competent authorities in the Member States with the prevention, investigation, detection or prosecution of criminal offences under national laws, by making information available more rapidly, thereby increasing the effectiveness of the cooperation and control procedures of the customs administrations of the Member States.’

2. Point 2 of Article 2 is hereby deleted.

3. After the first sentence of paragraph 2 of Article 3, a new sentence is added as follows:

‘In relation to the processing of personal data in the Customs Information System, the Commission shall be considered the processor, within the meaning of point (12) of Article 3 of Regulation (EU) 2018/1725, acting on behalf of the national authorities designated by each Member State, which shall be considered the controllers of the personal data.’

4. Paragraph 5 of Article 4 is replaced by the following:

‘5. In no case shall personal data referred to in Article 10 of Directive (EU) 2016/680 be entered into the Customs Information System.’

5. Paragraph 2 of Article 5 is replaced by the following:

‘2. For the purpose of the actions referred to in paragraph 1, personal data in any of the categories referred to in Article 3(1) may be entered into the Customs Information System only if there are reasonable grounds, in particular on the basis of prior illegal activities, to suggest that the person concerned has committed, is in the act of committing or will commit criminal offences under national laws.’

6. Paragraph 3 of Article 7 is replaced by the following:

‘3. Notwithstanding paragraphs 1 and 2, the Council may exceptionally, by a unanimous decision and after consultation of the European Data Protection Board, permit access to the Customs Information System by international or regional organisations, provided that both of the following conditions are met:

(a) the access complies with the general principles for transfers of personal data set out in Article 35 or, where applicable, Article 39 of Directive (EU) 2016/680;

(b) the access is based either on an adequacy decision adopted under Article 36 of that Directive or is subject to appropriate safeguards under Article 37 thereof.’

7. Paragraph 1 of Article 8 is replaced by the following:

‘1. Member States, Europol and Eurojust may process personal data obtained from the Customs Information System only in order to achieve the aim stated in Article 1(2), in accordance with the applicable rules of Union law on the processing of personal data.

Member States, Europol and Eurojust may process non-personal data obtained from the Customs Information System in order to achieve the aim stated in Article 1(2) or for other purposes, including administrative ones, in compliance with any conditions imposed by the Member State which entered the non-personal data in that system.’

8. Paragraph 4 of Article 8 is replaced by the following:

‘4. Personal data obtained from the Customs Information System may, with the prior authorisation of, and subject to compliance with any conditions imposed by, the Member State which entered that data into that system, be:

(a) transmitted to, and further processed by, national authorities other than those designated under paragraph 2, in accordance with the applicable rules of Union law on the processing of personal data; or

(b) transferred to, and further processed by, the competent authorities of third countries and international or regional organisations, in accordance with Chapter V of Directive (EU) 2016/680 and, where relevant, with Chapter V of Regulation (EU) 2018/1725.

Non-personal data obtained from the Customs Information System may be transferred to, and further processed by national authorities other than those designated under paragraph 2, third countries, and international or regional organisations, in compliance with any conditions imposed by the Member State which entered the non-personal data in that system.’

9. Article 14 is replaced by the following:

‘Personal data entered into the Customs Information System shall be kept only for the time necessary to achieve the aim stated in Article 1(2) and may not be retained for more than five years. However, exceptionally, that data may be kept for an additional period of at most two years, where and insofar as a strict need to do so in order to achieve that aim is established in an individual case.

10. Paragraph 3 of Article 15 is replaced by the following:

‘3. For the purposes of the customs files identification database, each Member State shall send the other Member States, Europol, Eurojust and the Committee referred to in Article 27 a list of criminal offences under its national laws.

This list shall comprise only criminal offences that are punishable:

(a) by deprivation of liberty or a detention order for a maximum period of not less than 12 months; or

(b) by a fine of at least EUR 15 000.’

11. Article 20 is replaced by the following:

‘Directive (EU) 2016/680 shall apply to the processing of personal data under this Decision.’

12. Articles 22, 23, 24 and 25 are hereby deleted.

13. Article 26 is replaced by the following:

'Coordinated supervision among national supervisory authorities and the European Data Protection Supervisor shall be ensured in accordance with Article 62 of Regulation (EU) 2018/1725.’

14. In paragraph 2 of Article 28, the following points are added:

‘(i) to ensure that installed systems may, in the case of interruption, be restored;

(j) to ensure that the functions of the system perform, that the appearance of faults in the functions is reported and that stored personal data cannot be corrupted by means of a malfunctioning of the system.’

15. Paragraph 1 of Article 30 is hereby deleted.

Article 2

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.