# C_2014227EN.01000601.xml

| 17.7.2014 | EN | Official Journal of the European Union | C 227/6 |
| --------- | -- | -------------------------------------- | ------- |

---

Executive summary of the Opinion of the European Data Protection Supervisor on the proposal for a Council Decision on the position to be adopted, on behalf of the European Union, in the EU-China Joint Customs Cooperation Committee regarding mutual recognition of the Authorised Economic Operator Programme in the European Union and the Measures on Classified Management of Enterprises Program in the People's Republic of China

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

2014/C 227/05

I.   Introduction

I.1.   Consultation of the EDPS and aim of the Opinion

| 1. | On 26 February 2014, the Commission published its proposal for a Council Decision on the position to be adopted, on behalf of the European Union, in the EU-China Joint Customs Cooperation Committee regarding mutual recognition of the Authorised Economic Operator Programme (hereinafter: the ‘programmes’) in the European Union and the Measures on Classified Management of Enterprises Program in the People's Republic of China (hereinafter: ‘the proposal’). The proposal contains an attached draft Decision of the Joint Customs Cooperation Committee (‘JCCC’) established under the Agreement between the EU and China on Cooperation and Mutual Administrative Assistance in Customs Matters (hereinafter, ‘the draft decision’). |
| -- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 2. | The EDPS had been previously informally consulted and has had the opportunity to provide comments to the Commission. The aim of this Opinion is to complement these comments in light of the present Proposal and to make the EDPS' views publicly available. |
| -- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 3. | In this opinion, the EDPS will analyse the data protection aspects of the draft decision, mainly on the basis of the relevant provisions of Regulation (EC) No 45/2001, taking into account the interpretation that has been given to the main provisions on the transfer of personal data in the Article 29 Data Protection Working Party's Working Document of 25 November 2005 on a common interpretation of Article 26(1) of Directive 95/46/EC( 1 ) and in its Working Document of 24 July 1998 on Transfers of personal data to third countries( 2 ). |
| -- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

I.2.   Context of the proposal

| 4. | EU legislation on Authorised Economic Operators was introduced by an amendment to the Community Customs Code (Regulation (EC) No 648/2005 adopted in April 2005). This amendment came into force in January 2008. |
| -- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 5. | Customs relations between the EU and China are based on the EU-China Cooperation and Mutual Administrative Assistance Agreement in Customs Matters (hereinafter: ‘CCMAAA’) of 8 December 2004. According to the CCMAAA, the parties' customs authorities undertake to develop customs cooperation covering all matters relating to the application of customs legislation. |
| -- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 6. | According to the proposal, mutual recognition should allow the EU and China to provide facilitative benefits to economic operators who have invested in compliance and supply chain security and have been certified under their respective trade partnership programmes. |
| -- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 7. | In June 2012 the JCCC agreed to launch formal negotiations on mutual recognition of the programmes. Since then, three rounds of negotiations have taken place; the first in January 2013, the second in March 2013 and the third in October 2013 to finalise the draft decision of the JCCC on AEO mutual recognition. |
| -- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 8. | The proposal asks the Council to adopt a Union Position on a draft decision of the JCCC based on Article 207(4) first subparagraph, in conjunction with Article 218(9) of the Treaty on the Functioning of the European Union (‘TFEU’). The legal basis for the draft decision of the JCCC is Article 21 of the CCMAAA. |
| -- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

IV.   Conclusions

| 43. | The EDPS welcomes the fact that a number of data protection safeguards are included in the draft decision. However, such safeguards do not address all the necessary requirements to be considered as ‘adequate safeguard’ in the light of Article 9(7). |
| --- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 44. | In addition, the EDPS is concerned about the actual enforceability of such safeguards and about the absence of an independent data protection supervisory authority in the People's Republic of China. |
| --- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

| 45. | In particular, he recommends the following:
—
providing confirmation that the draft decision is binding on both Parties and will prevail over Chinese national laws; —
specifying in the draft decision the categories of data to be exchanged; —
specifying who will be the controller on the EU side; —
that the Commission notify the EDPS and the DPO in accordance with Articles 25 and 27 of Regulation (EC) No 45/2001 (prior check); —
submitting the adduced adequate safeguards to the EDPS for authorisation in accordance with Articles 9(7) of Regulation (EC) No 45/2001; —
interpreting Article 17(4) of the CMAAA should therefore be interpreted in the light of Article 20 of Regulation (EC) No 45/2001; —
specifying that the data should be adequate, relevant and not excessive in relation to the purposes for which they are transferred or further processed; —
establishing a maximum retention period; —
specifying that personal data may only be further transferred if the recipient guarantees a level of protection that is equivalent to the one required in the draft decision; —
specifying that data subjects should be informed before the transfer about the purpose of the processing, the identity of the controller in the third country, the possibility of onward transfers, their rights of access, rectification and opposition, and their right to a remedy and reparation; —
including additional safeguards, such as the right for the individual to know the logic involved in the decision, in case of automated decisions; —
including dissuasive sanctions for any failure to comply with the obligations of the draft decision; —
including in the draft decision or at least in letters exchanged between the parties or in documents accompanying the draft decision, practical information on existing remedies; —
specifying the means for ensuring redress for possible damages resulting from the acts and omissions of the Chinese authorities; —
providing that the Parties to the draft decision should jointly review the implementation of the data protection aspects of the draft decision, either in the framework of the JCCC, or as a separate process and providing for involvement of EU national data protection authorities where relevant; —
specifying in particular that oversight and review by the respective relevant authorities of the parties in accordance to Article 6(9) applies to any personal data processing covered by the draft decision; —
specifying the means for ensuring redress for the damages resulting from the acts and omissions of the Chinese authorities; —
specifying that the Chinese authorities competent for the implementation of the draft decision should provide upon request sufficient evidence of compliance and ensure access by the EU review team to relevant documentation, systems and personnel; —
stating that after one year of the entry into force of the draft decision, the Commission should report on the implementation of the data protection principles. | — | providing confirmation that the draft decision is binding on both Parties and will prevail over Chinese national laws; | — | specifying in the draft decision the categories of data to be exchanged; | — | specifying who will be the controller on the EU side; | — | that the Commission notify the EDPS and the DPO in accordance with Articles 25 and 27 of Regulation (EC) No 45/2001 (prior check); | — | submitting the adduced adequate safeguards to the EDPS for authorisation in accordance with Articles 9(7) of Regulation (EC) No 45/2001; | — | interpreting Article 17(4) of the CMAAA should therefore be interpreted in the light of Article 20 of Regulation (EC) No 45/2001; | — | specifying that the data should be adequate, relevant and not excessive in relation to the purposes for which they are transferred or further processed; | — | establishing a maximum retention period; | — | specifying that personal data may only be further transferred if the recipient guarantees a level of protection that is equivalent to the one required in the draft decision; | — | specifying that data subjects should be informed before the transfer about the purpose of the processing, the identity of the controller in the third country, the possibility of onward transfers, their rights of access, rectification and opposition, and their right to a remedy and reparation; | — | including additional safeguards, such as the right for the individual to know the logic involved in the decision, in case of automated decisions; | — | including dissuasive sanctions for any failure to comply with the obligations of the draft decision; | — | including in the draft decision or at least in letters exchanged between the parties or in documents accompanying the draft decision, practical information on existing remedies; | — | specifying the means for ensuring redress for possible damages resulting from the acts and omissions of the Chinese authorities; | — | providing that the Parties to the draft decision should jointly review the implementation of the data protection aspects of the draft decision, either in the framework of the JCCC, or as a separate process and providing for involvement of EU national data protection authorities where relevant; | — | specifying in particular that oversight and review by the respective relevant authorities of the parties in accordance to Article 6(9) applies to any personal data processing covered by the draft decision; | — | specifying the means for ensuring redress for the damages resulting from the acts and omissions of the Chinese authorities; | — | specifying that the Chinese authorities competent for the implementation of the draft decision should provide upon request sufficient evidence of compliance and ensure access by the EU review team to relevant documentation, systems and personnel; | — | stating that after one year of the entry into force of the draft decision, the Commission should report on the implementation of the data protection principles. |
| --- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | - | ---------------------------------------------------------------------------------------------------------------------- | - | ------------------------------------------------------------------------ | - | ----------------------------------------------------- | - | ---------------------------------------------------------------------------------------------------------------------------------- | - | ---------------------------------------------------------------------------------------------------------------------------------------- | - | --------------------------------------------------------------------------------------------------------------------------------- | - | -------------------------------------------------------------------------------------------------------------------------------------------------------- | - | ---------------------------------------- | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | ------------------------------------------------------------------------------------------------------------------------------------------------- | - | ---------------------------------------------------------------------------------------------------- | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | -------------------------------------------------------------------------------------------------------------------------------- | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | --------------------------------------------------------------------------------------------------------------------------- | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| — | providing confirmation that the draft decision is binding on both Parties and will prevail over Chinese national laws; | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | specifying in the draft decision the categories of data to be exchanged; | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | specifying who will be the controller on the EU side; | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | that the Commission notify the EDPS and the DPO in accordance with Articles 25 and 27 of Regulation (EC) No 45/2001 (prior check); | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | submitting the adduced adequate safeguards to the EDPS for authorisation in accordance with Articles 9(7) of Regulation (EC) No 45/2001; | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | interpreting Article 17(4) of the CMAAA should therefore be interpreted in the light of Article 20 of Regulation (EC) No 45/2001; | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | specifying that the data should be adequate, relevant and not excessive in relation to the purposes for which they are transferred or further processed; | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | establishing a maximum retention period; | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | specifying that personal data may only be further transferred if the recipient guarantees a level of protection that is equivalent to the one required in the draft decision; | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | specifying that data subjects should be informed before the transfer about the purpose of the processing, the identity of the controller in the third country, the possibility of onward transfers, their rights of access, rectification and opposition, and their right to a remedy and reparation; | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | including additional safeguards, such as the right for the individual to know the logic involved in the decision, in case of automated decisions; | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | including dissuasive sanctions for any failure to comply with the obligations of the draft decision; | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | including in the draft decision or at least in letters exchanged between the parties or in documents accompanying the draft decision, practical information on existing remedies; | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | specifying the means for ensuring redress for possible damages resulting from the acts and omissions of the Chinese authorities; | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | providing that the Parties to the draft decision should jointly review the implementation of the data protection aspects of the draft decision, either in the framework of the JCCC, or as a separate process and providing for involvement of EU national data protection authorities where relevant; | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | specifying in particular that oversight and review by the respective relevant authorities of the parties in accordance to Article 6(9) applies to any personal data processing covered by the draft decision; | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | specifying the means for ensuring redress for the damages resulting from the acts and omissions of the Chinese authorities; | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | specifying that the Chinese authorities competent for the implementation of the draft decision should provide upon request sufficient evidence of compliance and ensure access by the EU review team to relevant documentation, systems and personnel; | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| — | stating that after one year of the entry into force of the draft decision, the Commission should report on the implementation of the data protection principles. | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

Done at Brussels, 14 March 2014. Peter HUSTINX European Data Protection Supervisor

---

( 1 )  WP 114, available on http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2005/wp114_en.pdf

( 2 )  ‘Applying Articles 25 and 26 of the EU data protection directive’ (WP 12), available on:

http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/1998/wp12_en.pdf

---