# C_2014219EN.01000801.xml

| 11.7.2014 | EN | Official Journal of the European Union | C 219/8 |
| --------- | -- | -------------------------------------- | ------- |

---

Executive summary of Opinion of the European Data Protection Supervisor on the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 515/97 on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters

(The full text of this Opinion can be found in EN, FR & DE on the EDPS website www.edps.europa.eu)

2014/C 219/11

1.   INTRODUCTION

1.1.   Consultation of the EDPS

| 1. | On 25 November 2013, the Commission adopted a proposal for a Regulation of the European Parliament and of the Council( 1 ) amending Regulation (EC) No 515/97 of 13 March 1997 on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters, as amended by Regulation (EC) No 766/2008 on 9 July 2008( 2 ). The Proposal was sent to the EDPS for consultation on 29 November 2013. |
| -- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 2. | Before the adoption of the Proposal, the EDPS was given the possibility to provide informal comments to the Commission. Some of these comments have been taken into account. As a result, the data protection safeguards in the Proposal have been strengthened. |
| -- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

1.2.   Background and objectives of the Proposal

| 3. | The Proposal amends one of the most important legal instruments for action against breaches of customs legislation. The fight against breaches of Union customs legislation involves extensive exchanges of information - including personal data - in the context of cooperation between competent authorities in the Member States and between the latter and the Commission. |
| -- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 4. | The Proposal's stated aim is to render the enforcement and cooperation in this area of EU law more effective. In relation to the tracking of goods, it introduces new obligations for carriers to supply the Commission with information on container movements (the so-called Container Status Messages - ‘CSM’); it also aims at streamlining the rules organizing the central database for import, export and transit data in order to improve the analysis of the flows of goods. |
| -- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 5. | The Proposal also introduces the possibility for the Commission to obtain directly from private sector operators documents supporting import and export declarations, with the explicit purpose to speed up OLAF’s investigations. |
| -- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 6. | The Proposal also has the stated aim to simplify and harmonise the data protection supervision rules applicable to the different databases set up on the basis of the Regulation. It introduces a maximum retention period for data stored in the Customs Information System (‘CIS’)( 3 ) and in the other databases. |
| -- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 7. | For the sake of clarity, the databases and directories covered by the Regulation are the following:
—
The ‘European Data directory’ - Article 18(a); —
The ‘CSM directory’ - Articles 18(c), 18(d) and 18(e); —
The ‘Import, export and transit directory’ - Article 18(g); —
The CIS database - Articles 23 to 41; —
The FIDE database - Articles 41(a) to 41(d). | — | The ‘European Data directory’ - Article 18(a); | — | The ‘CSM directory’ - Articles 18(c), 18(d) and 18(e); | — | The ‘Import, export and transit directory’ - Article 18(g); | — | The CIS database - Articles 23 to 41; | — | The FIDE database - Articles 41(a) to 41(d). |
| -- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | - | ---------------------------------------------- | - | ------------------------------------------------------ | - | ----------------------------------------------------------- | - | ------------------------------------- | - | -------------------------------------------- |
| — | The ‘European Data directory’ - Article 18(a); | | | | | | | | | | |
| — | The ‘CSM directory’ - Articles 18(c), 18(d) and 18(e); | | | | | | | | | | |
| — | The ‘Import, export and transit directory’ - Article 18(g); | | | | | | | | | | |
| — | The CIS database - Articles 23 to 41; | | | | | | | | | | |
| — | The FIDE database - Articles 41(a) to 41(d). | | | | | | | | | | |

3.   CONCLUSIONS

| 66. | The EDPS welcomes the modifications that the Commission brought to the Proposal in order to enhance its compliance with the relevant data protection legislation. However, it should be noted that the Proposal also contains some rather serious weaknesses that need to be eliminated before its final adoption. |
| --- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

| 67. | The EDPS wishes to highlight that the Commission should have taken a more comprehensive approach to the legislation on mutual assistance in the customs area to bring it in line with the changes brought by the Lisbon Treaty, namely by deciding to eliminate the Regulation/Decision dual basis and to substitute it with a single instrument based exclusively on the TFEU, in order to guarantee legal certainty and a seamless data protection regime. |
| --- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

| 68. | For the reasons set out above, the EDPS would in any case recommend:
—
the introduction of a new model for the supervision of all databases which involve processing of personal data established on the basis of the Regulation and the Proposal (namely, CIS - including FIDE -, the European Data directory, and the Import, export and transit directory). Such model would be based on coordinated supervision which has a three-layered structure: DPAs at national level, EDPS at central level and coordination between both; —
the designation of the EDPS as secretariat of supervision coordination under both the Decision and the Regulation; —
the introduction of a general provision in the text of the Proposal to clarify that Regulation (EC) No 45/2001 applies to processing of personal data carried out by Union institutions and that national laws implementing Directive 95/46/EC are applicable to the processing carried out by the relevant competent authorities in the various Member States; —
the substitution of various fragmented provisions with uniform provisions specifying for each database (i) the role of the Commission as data controller or possibly joint data controller together with the relevant national competent authorities; (ii) if needed for the sake of clarity, the supervisory role of the EDPS where the Commission is the controller, as opposed to cases where the processing is under the supervision of national data protection authorities; (iii) the technical measures to be adopted by the Commission in order to ensure security of the processing (possibly, the specific measures could be inserted in a delegated act in order to ensure a more flexible updating); and (iv) the need for prior checking by the EDPS pursuant to Article 27 of Regulation (EC) No 45/2001; —
that the newly introduced retention periods are reconsidered on the basis of an evaluation of the necessity of the duration for each specific case; furthermore the provisions on anonymisation of data should be modified in order to require deletion of the data; —
as regards the CSM database, the Proposal should indicate an exhaustive list of data to be inserted. Alternatively, the text of the Proposal should explicitly prohibit that personal data are to be inserted in such database. | — | the introduction of a new model for the supervision of all databases which involve processing of personal data established on the basis of the Regulation and the Proposal (namely, CIS - including FIDE -, the European Data directory, and the Import, export and transit directory). Such model would be based on coordinated supervision which has a three-layered structure: DPAs at national level, EDPS at central level and coordination between both; | — | the designation of the EDPS as secretariat of supervision coordination under both the Decision and the Regulation; | — | the introduction of a general provision in the text of the Proposal to clarify that Regulation (EC) No 45/2001 applies to processing of personal data carried out by Union institutions and that national laws implementing Directive 95/46/EC are applicable to the processing carried out by the relevant competent authorities in the various Member States; | — | the substitution of various fragmented provisions with uniform provisions specifying for each database (i) the role of the Commission as data controller or possibly joint data controller together with the relevant national competent authorities; (ii) if needed for the sake of clarity, the supervisory role of the EDPS where the Commission is the controller, as opposed to cases where the processing is under the supervision of national data protection authorities; (iii) the technical measures to be adopted by the Commission in order to ensure security of the processing (possibly, the specific measures could be inserted in a delegated act in order to ensure a more flexible updating); and (iv) the need for prior checking by the EDPS pursuant to Article 27 of Regulation (EC) No 45/2001; | — | that the newly introduced retention periods are reconsidered on the basis of an evaluation of the necessity of the duration for each specific case; furthermore the provisions on anonymisation of data should be modified in order to require deletion of the data; | — | as regards the CSM database, the Proposal should indicate an exhaustive list of data to be inserted. Alternatively, the text of the Proposal should explicitly prohibit that personal data are to be inserted in such database. |
| --- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | ------------------------------------------------------------------------------------------------------------------ | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| — | the introduction of a new model for the supervision of all databases which involve processing of personal data established on the basis of the Regulation and the Proposal (namely, CIS - including FIDE -, the European Data directory, and the Import, export and transit directory). Such model would be based on coordinated supervision which has a three-layered structure: DPAs at national level, EDPS at central level and coordination between both; | | | | | | | | | | | | |
| — | the designation of the EDPS as secretariat of supervision coordination under both the Decision and the Regulation; | | | | | | | | | | | | |
| — | the introduction of a general provision in the text of the Proposal to clarify that Regulation (EC) No 45/2001 applies to processing of personal data carried out by Union institutions and that national laws implementing Directive 95/46/EC are applicable to the processing carried out by the relevant competent authorities in the various Member States; | | | | | | | | | | | | |
| — | the substitution of various fragmented provisions with uniform provisions specifying for each database (i) the role of the Commission as data controller or possibly joint data controller together with the relevant national competent authorities; (ii) if needed for the sake of clarity, the supervisory role of the EDPS where the Commission is the controller, as opposed to cases where the processing is under the supervision of national data protection authorities; (iii) the technical measures to be adopted by the Commission in order to ensure security of the processing (possibly, the specific measures could be inserted in a delegated act in order to ensure a more flexible updating); and (iv) the need for prior checking by the EDPS pursuant to Article 27 of Regulation (EC) No 45/2001; | | | | | | | | | | | | |
| — | that the newly introduced retention periods are reconsidered on the basis of an evaluation of the necessity of the duration for each specific case; furthermore the provisions on anonymisation of data should be modified in order to require deletion of the data; | | | | | | | | | | | | |
| — | as regards the CSM database, the Proposal should indicate an exhaustive list of data to be inserted. Alternatively, the text of the Proposal should explicitly prohibit that personal data are to be inserted in such database. | | | | | | | | | | | | |

Done at Brussels, 11 March 2014. Peter HUSTINX European Data Protection Supervisor

---

( 1 )  COM(2013)796 final. hereinafter: ‘the Proposal’.

( 2 )  Regulation (EC) No 515/97 of 13 March 1997 on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters, as amended by Regulation (EC) No 766/2008 on 9 July 2008 (OJ L 82, 22.3.1997, p. 1). Hereinafter: ‘the Regulation’.

( 3 )  The purpose of CIS is to assist competent national authorities and the Commission (‘CIS partners’) in preventing, investigating, and prosecuting operations that are in breach of customs and agricultural provisions. To this end, it allows CIS partners to put up alerts in the system requesting other CIS partners to take certain actions, more specifically: sighting and reporting, discreet surveillance, specific checks and operational analysis. These alerts can relate to commodities, means of transport, businesses and persons.

---