COMMISSION IMPLEMENTING REGULATION (EU) 2021/2248

of 16 December 2021

specifying the details of the electronic interface between national customs systems and the information and communication system for market surveillance, and the data to be transmitted by means of that interface

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2019/1020 of the European Parliament and of the Council of 20 June 2019 on market surveillance and compliance of products and amending Directive 2004/42/EC and Regulations (EC) No 765/2008 and (EU) No 305/2011 (1), and in particular Article 34(8) thereof,

Whereas:

(1) Article 34(7) of Regulation (EU) 2019/1020 requires the Commission to develop an electronic interface (‘the interface’) to enable the transmission of data between national customs systems and the information and communication system referred to in Article 34(1) of that Regulation. That information and communication system is known as the Information and Communication System for Market Surveillance (‘ICSMS’). The interface is intended to facilitate communication between customs authorities and market surveillance authorities for the control of products entering the Union in accordance with Articles 25 to 28 of Regulation (EU) 2019/1020. Its use is to remain voluntary pursuant to Article 26(4) of that Regulation.

(2) In order to facilitate the preparation of the electronic systems and the consistent exchange of information, it is necessary to lay down the standard datasets to be transmitted, in the prescribed form and manner, by means of the interface. Those datasets should reflect the requirements set out in Regulation (EU) 2019/1020 as regards the controls on products entering the Union market. They should nevertheless be flexible enough to allow Member States to deal with all relevant cases, using the data or data fields that are appropriate for each case.

(3) To limit the administrative burden for customs authorities, the data transmitted from national customs systems to ICSMS should, whenever possible, be readily available from these systems. Nevertheless, verification of compliance of a product by the market surveillance authorities requires additional data elements to be entered in national customs systems.

(4) Where Member States make use of the interface, they should be subject to specific procedural requirements in order to ensure the effective functioning of the electronic systems.

(5) Where the application of this Regulation entails the processing of personal data, it should be carried out in accordance with Union law on the protection of personal data, in particular Regulation (EU) 2016/679 (2) and Regulation (EU) 2018/1725 (3) of the European Parliament and of the Council. This Regulation should lay down some specifications as regards the processing of personal data. These specifications should in the future be consistent with those laid down in the EU Single Window Environment for Customs, for which the Commission tabled a proposal on 28 October 2020 (4). The provisions of this Regulation on personal data protection may therefore be reviewed in light of the future legislative framework governing the EU Single Window Environment for Customs.

(6) Data transmitted via the interface should be confidential and should not remain in the interface longer than necessary for its transmission.

(7) In accordance with Article 34(7) of Regulation (EU) 2019/1020, the interface should be in place within four years from the date of adoption of this Regulation. Setting up electronic systems is a complex technical task requiring Member States and the Commission to invest both financially and in terms of time. The development process of the interface is expected to take four years. The date of application of this Regulation should therefore be deferred until the interface is available.

(8) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered an opinion on 22 October 2021.

(9) The measures provided for in this Regulation are in accordance with the opinion of the committee established by Article 43 of Regulation (EU) 2019/1020,

HAS ADOPTED THIS REGULATION:

Article 1 Definitions For the purposes of this Regulation, the following definitions shall apply: (a) ‘Information and Communication System for Market Surveillance’ or ‘ICSMS’ means the information and communication system on market surveillance provided for in Article 34(1) of Regulation (EU) 2019/1020; (b) ‘interface’ means the electronic interface to be developed by the Commission pursuant to Article 34(7) of Regulation (EU) 2019/1020.

Article 2 Data to be transmitted 1. For the purposes of notification to market surveillance authorities of the suspension of release for free circulation of a product pursuant to Article 26(2) of Regulation (EU) 2019/1020, the data to be transmitted shall include: (a) relevant data available from national customs systems, including data from the customs declaration, as listed in Annex I, Section 1, to this Regulation; (b) additional data to be entered in national customs systems, as listed in Annex I, Section 2, to this Regulation. 2. Where market surveillance authorities request customs authorities to maintain the suspension of the release for free circulation of the product, inform customs authorities of their approval for such release or require customs authorities not to release the product for free circulation pursuant to Articles 27 and 28 of Regulation (EU) 2019/1020, the data to be transmitted shall include: (a) the decision of the market surveillance authorities as regards the approval or refusal to release the product for free circulation, or their request to maintain the suspension, in accordance with Annex II to this Regulation; (b) follow-up to the communications referred to in point (a) of this paragraph, both by customs authorities and market surveillance authorities, in accordance with Annex III to this Regulation. 3. For the purposes of a request by market surveillance authorities to suspend the release for free circulation of a product pursuant to Article 26(3) of Regulation (EU) 2019/1020, and of the reply by customs authorities, the data specified in Annex IV to this Regulation shall be transmitted.

Article 3 Procedure 1. Where a Member State uses the interface, customs authorities shall connect the national customs systems with that interface, test the connection and ensure that these systems remain interoperable with that interface. 2. Where the notifications and requests referred to in Article 26(2) and (3) of Regulation (EU) 2019/1020 take place by means of ICSMS and of the interface pursuant to Article 26(4) of that Regulation, the following provisions shall apply: (a) customs authorities shall enter in their national customs systems the data to be transmitted, where such data are not already present, and shall authorise the transmission of these data via the interface to ICSMS; (b) market surveillance authorities shall enter in ICSMS the data to be transmitted and shall authorise the transmission of these data via the interface to the national customs systems of the relevant customs authorities; (c) once the transmission of the data referred to in points (a) and (b) of this paragraph has been authorised, the interface shall transmit these data to the other system; (d) all subsequent data transmissions relating to the notifications and requests shall take place via the interface. 3. Where the market surveillance authorities do not respond to the notification within the time limits set out in Article 27, point (a), of Regulation (EU) 2019/1020, ICSMS shall transmit to national customs systems, via the interface, an automatic message indicating that the product may be released for free circulation where all the other requirements and formalities relating to such a release have been fulfilled.

Article 4 Processing of personal data 1. Processing of personal data may take place in the interface only for the following purposes: (a) enabling information to be exchanged between national customs systems and ICSMS for the control of products entering the Union market in accordance with Articles 25 to 28 of Regulation (EU) 2019/1020; (b) performing the transformation of data, where necessary, to ensure alignment of customs and non-customs terminology and thereby enabling the exchange of information referred to in point (a). 2. The interface may process personal data only for the following categories of data subjects: (a) natural persons whose personal information is contained in the customs declaration; (b) natural persons whose personal information is contained in the supporting documents or in any other additional documentary evidence required for the verification of compliance with Union law of the products subject to the customs declaration; (c) authorised staff of customs authorities and market surveillance authorities or any other relevant authority or authorised body whose personal information is contained in any documents referred to in points (a) and (b); (d) Commission staff and third party providers acting on behalf of the Commission that perform operations and maintenance activities related to the interface. 3. The interface may process only the following categories of personal data: (a) name and contact information (including address, country code, e-mail, telephone) or identification number of the natural persons referred to in paragraph 2, points (a) and (b); (b) name, contact information (including address, country code, e-mail, telephone) and signature of the authorised staff referred to in paragraph 2, points (c) and (d). 4. The transformation of personal data referred to in paragraph 1, point (b), shall be performed using information technology infrastructure located in the Union.

Article 5 Joint controllership of the interface 1. As regards the processing of personal data in the interface, the Commission shall be a joint controller within the meaning of Article 28(1) of Regulation (EU) 2018/1725, and customs authorities and market surveillance authorities shall be joint controllers within the meaning of Article 26(1) of Regulation (EU) 2016/679. 2. The Commission shall enter into a joint controllership arrangement with the other joint controllers, to establish the respective responsibilities of the joint controllers and comply with the obligations under Regulations (EU) 2016/679 and (EU) 2018/1725. 3. The joint controllers shall ensure that they: (a) work together to process the requests made by the data subject in a timely manner; (b) assist each other in matters involving the identification and handling of any data breach related to joint processing; (c) exchange the relevant information necessary to inform data subjects pursuant to Section 2 of Regulation (EU) 2016/679 and Section 2 of Regulation (EU) 2018/1725; (d) ensure and protect the security, integrity, availability and confidentiality of the personal data processed jointly pursuant to Article 32 of Regulation (EU) 2016/679 and Article 33 of Regulation (EU) 2018/1725.

Article 6 Confidentiality of data Data transmitted via the interface pursuant to this Regulation shall not remain in the interface longer than necessary for their transmission and shall be kept confidential by the Commission during the transmission. This data shall be used only for the purpose of implementation of Regulation (EU) 2019/1020.

Article 7 Entry into force and application This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 16 December 2025.

This Regulation shall be binding in its entirety and directly applicable in all Member States. Done at Brussels, 16 December 2021. For the Commission The President Ursula VON DER LEYEN

(1) OJ L 169, 25.6.2019, p. 1.

(2) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1)

(3) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

(4) Proposal for a Regulation of the European Parliament and of the Council establishing the European Union Single Window Environment for Customs and amending Regulation (EU) No 952/2013, COM/2020/673 final.