EN Official Journal of the European Union C 229/12

Opinion of the European Data Protection Supervisor on the Initiative of the French Republic for a Council Decision on the use of information technology for customs purposes (5903/2/09 REV 2)

2009/C 229/03

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (1),

Having regard to Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters (2) (hereinafter ‘Framework Decision 2008/977/JHA’),

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (3), and in particular its Article 41,

HAS ADOPTED THE FOLLOWING OPINION:

I. INTRODUCTION

Consultation of the EDPS

1. The Initiative of the French Republic with a view to adopting a Council Decision on the use of information technology for customs purposes was published in the Official Journal of 5 February 2009 (4). The EDPS was neither asked for advice on this initiative by the Member State which put it forward, nor by the Council. However, the EDPS was requested by the European Parliament's Committee on Civil Liberties, Justice and Home Affairs to comment on the French Initiative, in accordance with Article 41 of Regulation (EC) No 45/2001, in the context of the European Parliament's opinion on the Initiative. Where, in similar cases (5), the EDPS issued an opinion on own initiative, the present opinion must also be seen as a reaction to this request of the European Parliament.

2. According to the EDPS, the present opinion should be mentioned in the preamble of the Council Decision, in the same way as his opinion is mentioned in a number of legal instruments adopted on the basis of a proposal by the Commission.

3. Although there is no legal obligation for a Member State that takes the initiative for a legislative measure under Title VI of the EU Treaty to ask the EDPS for advice, the applicable rules do not preclude the request for such an advice either. The EDPS regrets that neither the French Republic nor the Council had asked for his advice in the present case.

4. The EDPS stresses that due to the ongoing developments regarding the Proposal in the Council, the comments presented in this opinion are based on the version of the Proposal of 24 February 2009 (5903/2/09 REV 2), that is published on the website of the European Parliament (6).

5. The EDPS sees the need for more explanation on the justification of the initiative itself as well as on some specific articles and mechanisms therein. He regrets the absence of an Impact Assessment or an explanatory memorandum accompanying the initiative. This is a necessary element enhancing the transparency and more in general the quality of the legislative process. Explanatory information would also facilitate the assessment of a number of propositions in the Proposal, e.g. regarding the necessity and justification of access to the CIS to be granted to Europol and Eurojust.

6. The EDPS has taken into account the Opinion 09/03 issued by the Customs Joint Supervisory Authority with respect to the draft Council Decision on the use of information technology for customs purposes on 24 March 2009.

The proposal in its context

7. The legal framework of the Customs Information System (hereinafter ‘the CIS’) is currently governed both by First and Third Pillar instruments. The Third Pillar legal framework regulating the system consists mainly of the Convention of 26 July 1995 drawn up on the basis of Article K.3 of the Treaty on European Union on the use of information technology for customs purposes (hereinafter ‘the CIS Convention’ (7) as well as the Protocols of 12 March 1999 and 8 March 2003.

8. Current arrangements on data protection involve the application of the Council of Europe Convention on the Protection of Individuals with Regard to Automatic Processing of Personal Data of 28 January 1981 (hereinafter ‘Council of Europe Convention 108’). Furthermore, the Framework Decision 2008/977/JHA is applicable to the CIS under the Proposal).

9. The First Pillar part of the system is governed by Council Regulation (EC) No 515/97 of 13 March 1997 on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters (8).

10. The purpose of the CIS Convention, in accordance with its Article 2, paragraph 2, was to ‘assist in preventing, investigating and prosecuting serious contraventions of national laws by increasing, through the rapid dissemination of information, the effectiveness of cooperation and control procedures of the customs administrations of the Member States’.

11. In accordance with the CIS Convention, the Customs Information System consists of a central database facility accessible via terminals in each Member State. Other main features are as follows: — the CIS Convention provides that the CIS can contain only the data, including personal data, necessary to achieve its aim, in the following categories: (a) commodities; (b) means of transport; (c) businesses; (d) persons; (e) fraud trends; (f) availability of expertise (9), — the Member States determine the items to be included in the CIS relating to each of the three last categories to the extent that this is necessary to achieve the aim of the system. No items of personal data are included in the last two categories. Direct access to data included in the Customs Information System is currently reserved exclusively for the national authorities designated by each Member State. These national authorities are customs administrations, but may also include other authorities competent under the laws, regulations and procedures of the Member State in question to act in order to achieve the aim of the Convention, — Member States may only use data from the Customs Information System to achieve the Convention's aim; however, they may use it for administrative or other purposes with the prior authorization of and subject to any conditions imposed by the Member State which entered it in the system. A Joint Supervisory Authority was set up to supervise the Third Pillar part of the CIS.

12. The French initiative, based upon Article 30(1)(a) and Article 34(2) of the Treaty on European Union, intends to replace the CIS Convention as well as the Protocol of 12 March 1999 and the Protocol of 8 March 2003 to align the Third Pillar part of the system with the First Pillar instruments.

13. However, the Proposal goes further than replacing the text of the CIS Convention with a Council Decision. It modifies a significant number of the Convention's provisions and extends the current scope of access to the CIS by granting access to Europol and Eurojust. Moreover, the Proposal incorporates the similar provisions regarding the functioning of the CIS as laid down in the above-mentioned Regulation (EC) No 766/2008, e.g. as far as the creation of a customs files identification database is concerned (Chapter VI).

14. The Proposal also takes account of new legal instruments such as the Framework Decision 2008/977/JHA and the Framework Decision 2006/960/JHA of 13 December 2006 on simplifying the exchange of information and intelligence between law enforcement authorities of the Member States of the European Union (10).

15. The Proposal aims inter alia at: — reinforcing cooperation between customs authorities, by laying down procedures under which customs authorities may act jointly and exchange personal and other data concerned with illicit trafficking activities, using new technology for the management and transmission of such information. These processing operations are subject to the provisions of the Council of Europe Convention 108, the Framework Decision 2008/977/JHA and the principles contained in Recommendation R (87) 15 of the Council of Ministers of the Council of Europe of 17 September 1987, regulating the use of personal data in the police sector, — enhancing complementarities with actions in the context of cooperation with Europol and Eurojust, by granting those bodies access to the Customs Information System.

16. In this context, the aim of the CIS, in accordance with Article 1 of the Proposal, is to ‘assist in preventing, investigating and prosecuting serious contraventions of national laws by making information available more rapidly, thereby increasing the effectiveness of the cooperation and control procedures of the customs administrations of the Member States’. This provision largely reflects Article 2(2) of the CIS Convention.

17. To achieve this objective the Proposal extends the scope of the use of the CIS data and includes searches in the systems and the possibility for strategic or operational analysis. The EDPS notes the broadening of the purpose and of the list of categories of personal data to be collected and processed, and the extension of the list of data subjects who have direct access to the CIS.

Focus of the opinion

18. Given his current role as the supervisory authority for the central part of the First Pillar part of the CIS, the EDPS is particularly interested in the Initiative and the new developments in the Council relating to its content. The EDPS emphasises the need for ensuring a coherent and comprehensive approach to align the First and Third Pillar parts of the system.

19. The EDPS notes that the Proposal involves various aspects relating to fundamental rights, in particular the protection of personal data as well as the right to information and other data subject's rights.

20. Regarding the current data protection regime in the CIS Convention, the EDPS needs to mention that a number of current Convention provisions required modification and refreshing, given that they do not meet any longer the present data protection requirements and standards. The EDPS takes this opportunity to stress that ensuring a high level of the protection of personal data and its more efficient implementation in practice should be considered an essential prerequisite to the improvement of the working of the CIS.

21. After some general remarks, this opinion is to address mainly the following issues relevant from the point of view of the protection of personal data: — data protection safeguards in the system, — customs files identification database, — access of Eurojust and Europol to the system (proportionality and necessity of access to be given to these bodies), — the supervision model for the CIS as a whole, — the list of authorities with access to the CIS.

II. GENERAL REMARKS

Consistency between the First and Third Pillar parts of the system

22. As mentioned in the introductory remarks, the EDPS is particularly interested in the new developments concerning the Third Pillar part of the CIS, given that he already exercises supervisory tasks over the central part of the First Pillar part, in accordance with the new Regulation (EC) No 766/2008 of the European Parliament and of the Council (11) to ensure the correct application of the law on customs and agricultural matters.

23. In this context, the EDPS wishes to draw attention of the legislator to the fact that he has already commented on issues relating to the supervision of the First Pillar part of the CIS in a number of his opinions, in particular in his Opinion of 22 February 2007 (12).

24. In this opinion, the EDPS underlined that the ‘creation and upgrading of the various instruments intended to strengthen Community cooperation, like the CIS, entail an increase in the share of personal information that will be originally collected and further exchanged with Member States’ administrative authorities, and, in some cases, also with third countries. The personal information processed and further shared may include information relating to individuals’ alleged or confirmed involvement in wrongdoing actions in the area of customs or agricultural operations […]. Furthermore, its importance is enhanced if one considers the type of data collected and shared, notably suspicions of individuals being engaged in wrongdoings, and the overall finality and outcome of the processing’.

Need for a strategic approach to the CIS as a whole

25. The EDPS stresses that, unlike the amendments introduced by Regulation (EC) No 766/2008 to the First Pillar instrument governing the CIS, the Proposal provides for a complete overhaul of the CIS Convention, which gives the legislator the opportunity to have a more global vision for the whole system, based on a coherent and comprehensive approach.

26. In the EDPS's views this approach must also be oriented towards the future. New developments such as the adoption of the Framework Decision 2008/977/JHA and the (possible) future entry into force of the Lisbon Treaty should be duly reflected upon and taken into account when deciding on the very content of the Proposal.

27. As far as the entry into force of the Lisbon Treaty is concerned, the EDPS draws the legislator's attention to the need for profound analysis of the possible effects the abolition of the pillar structure of the EU would have on the CIS when the Lisbon Treaty enters into force, given that the system is currently built upon a combination of First and Third Pillar instruments. The EDPS regrets the lack of explanatory information on this important future development, which would significantly affect the legal framework governing the CIS in the future. More generally, the EDPS raises a question of whether it would not be more opportune, if the legislator waited with the revision until the entry into force of the Lisbon Treaty to avoid any possible legal uncertainty.

EDPS calls for consistency with other large scale systems

28. In the EDPS's view the replacement of the CIS Convention as a whole also provides for a good opportunity to ensure consistency of the CIS with other systems and mechanisms which have developed since the Convention was adopted. In this regard, the EDPS calls for coherence, also in terms of the supervision model, with other legal instruments, in particular those establishing the Schengen Information System II and the Visa Information System.

Relationship with the Framework Decision 2008/977/JHA

29. The EDPS welcomes the fact that the Proposal takes account of the Framework Decision on the protection of personal data given the exchange of data between the Member States taking place in the framework of the CIS. Article 20 of the Proposal clearly stipulates that Framework Decision 2008/977/JHA shall apply to the protection of the data exchange in accordance with the present Decision unless otherwise provided in this Decision. The EDPS notes as well that the Proposal refers to the Framework Decision also in other provisions, e.g. in Article 4, paragraph 5, stipulating that data listed in Article 6 of the Framework Decision 2008/977/JHA shall not be included, Article 8 on the use of data obtained from the CIS in order to achieve the aim stated in Article 1(2) of the Decision, Article 22 of the Proposal concerning the rights of persons with regard to personal data in the CIS and Article 29 regarding the responsibilities and liabilities.

30. The EDPS believes that the concepts and principles established in this Framework Decision are appropriate in the context of the CIS, and should therefore be applicable both for the sake of legal certainty as well as consistency between the legal regimes.

31. Having said this, the EDPS stresses however that the legislator should provide for the necessary guarantees that while waiting for full implementation of the Framework Decision 2008/977/JHA, in accordance with its final provisions, there will be no loophole in the data protection system. In other words, the EDPS wishes to underline that he favours the approach whereby necessary and adequate safeguards are in place before new data exchanges take place.

III. SPECIFIC REMARKS

Data protection safeguards

32. The EDPS considers the effective implementation of the right to data protection and the right to information as crucial elements for the proper functioning of the Customs Information System. Data protection safeguards are not only required to ensure the effective protection of individuals subject to the CIS, but they should also serve to facilitate the proper and more efficient functioning of the system.

33. The EDPS draws the legislator's attention to the fact that the need for strong and efficient data protection safeguards is even more evident when one considers that the CIS is a database based rather on ‘suspicions’ than on convictions or other judicial or administrative decisions. This is reflected in Article 5 of the Proposal which stipulates that ‘data in the categories referred to in Article 3 shall be entered into the Customs Information System only for the purpose of sighting and reporting, discrete surveillance, specific checks and strategic or operational analysis. For the purpose of the suggested actions […], personal data […] may be entered into the Customs Information System only if, especially on the basis of prior illegal activities, there are real indications to suggest that the person concerned has committed, is in the act of committing, or will commit serious contraventions of national laws’. Given this characteristic of the CIS, the Proposal requires balanced, efficient and upgraded safeguards in terms of the protection of personal data and control mechanisms.

34. Regarding specific provisions in the Proposal on the protection of personal data, the EDPS notes the efforts taken by the legislator to provide for more safeguards than available in the CIS Convention. However, the EDPS still needs to raise a number of serious concerns with regard to the data protection provisions, and in particular with regard to the application of the purpose limitation principle.

35. It should also be mentioned in this context that the comments on the data protection safeguards in the present opinion are not limited only to the provisions which modify or extend the scope of the CIS Convention, but also concern the parts which are copied from the current text of the Convention. The reason for this, as mentioned in general remarks, is that in the EDPS's view some of the provisions of the Convention do not seem to satisfy any longer the current data protection requirements, and the French initiative is a good opportunity to have a fresh look at the whole system and ensure the adequate level of data protection, equivalent to the one in the First Pillar part of the system.

36. The EDPS notes with satisfaction that only a closed and exhaustive list of personal data may be included in CIS. He also welcomes that the Proposal provides for a more extended definition of the term ‘personal data’, in comparison with the CIS Convention. Under Article 2(2) of the Proposal, the term ‘personal data’ means any information relating to an identified or identifiable natural person (data subject); ‘an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, psychological, mental, economic, cultural or social identity’.

Purpose limitation

37. An example of the provisions which raise serious data protection concerns is Article 8 of the Proposal, stipulating that ‘the Member States may use the data obtained from the CIS only in order to achieve the aim stated in Article 1(2). However, they may use it for administrative or other purposes with the prior authorization of, and subject to any conditions imposed by the Member State which entered the data in the system. Such other use shall be in accordance with the laws, regulations and procedures of the Member State which seeks to use it in accordance with Article 3(2) of the Framework Decision 2008/977/JHA’. This provision concerning the use of the data obtained from the CIS is essential for the structure of the system and therefore needs special attention.

38. Article 8 of the Proposal refers to Article 3(2) of the Framework Decision 2008/977/JHA which addresses ‘Principles of lawfulness, proportionality and purpose’. Article 3 of the Framework Decision stipulates as follows: ‘1. Personal data may be collected by the competent authorities only for specified, explicit and legitimate purposes in the framework of their tasks and may be processed only for the same purpose for which data were collected. Processing of the data shall be lawful and adequate, relevant and not excessive in relation to the purposes for which they are collected. 2. Further processing for another purpose shall be permitted in so far as: (a) it is not incompatible with the purposes for which the data were collected; (b) the competent authorities are authorised to process such data for such other purpose in accordance with the applicable legal provisions; and (c) processing is necessary and proportionate to that other purpose’.

39. Notwithstanding the application of Article 3(2) of the Framework Decision 2008/977/JHA providing for general conditions under which the processing for another purpose can be permitted, the EDPS draws attention to the fact that the provision of Article 8 of the Proposal, by allowing for use of the CIS data for any possible administrative or other purposes, undefined by the Proposal, raises concerns as to compliance with the data protection requirements, in particular the purpose limitation principle. Moreover, the First Pillar instrument does not allow for such general use. The EDPS calls therefore for specifying the purposes for which the data may be used. This is of essential importance from the perspective of data protection as it tackles the core principles of the use of data in the large scale systems: ‘data should only be used for well defined and clearly limited purposes governed by the legal framework’.

Data transfer to third countries

40. Article 8(4) of the Proposal deals with data to be transferred to third countries or international organisations. This provision stipulates that ‘data obtained from the CIS may, with the prior authorisation of, and subject to any conditions imposed by the Member State which entered them into the system, be transferred for use by […] non-Member States and international or regional organisations wishing to make use of them. Each Member State shall take special measures to ensure the security of such data when they are being transferred to services located outside its territory. Details of such measures must be communicated to the Joint Supervisory Authority referred to in Article 25’.

41. The EDPS notes that Article 11 of the Framework Decision on the protection of personal data applies in this context. It should be underlined however that given the very general nature of the application of the provision of Article 8(4) of the Proposal, which in principle enables the Member States to transfer data obtained from the CIS to non-Member States and international or regional organisations wishing to make use of them, the safeguards envisaged in this provision are far from sufficient from the perspective of the protection of personal data. The EDPS calls that Article 8(4) be reconsidered to ensure a uniform system of the assessment of adequacy through an appropriate mechanism, e.g. the Committee referred to in Article 26 of the Proposal could be involved in such assessment.

Other data protection safeguards

42. The EDPS notes with satisfaction the provisions on Amendment of data (Chapter IV, Article 13), which constitute an important element of the data quality principle. The EDPS welcomes in particular the extended and modified, when compared to the CIS Convention, scope of this provision, which adds now the rectification and erasure of data. For instance Article 13(2) stipulates that a supplying Member State or Europol, if they note, or have drawn to their attention, that the data they included are factually inaccurate or were entered, or are stored contrary to this Decision, shall amend, supplement, rectify or erase the data, as appropriate, and shall advise the other Member States and Europol accordingly.

43. EDPS notes the provisions of the Chapter V concerning Retention of data which is mainly based on the CIS Convention and amongst others provides for time limits to retain data copied from the CIS.

44. Chapter IX (Personal data protection) reflects many of the provisions of the CIS Convention. It however provides for significant change which is the application of the Framework Decision on the protection of personal data to the CIS and the mention in Article 22 of the Proposal that ‘the rights of persons with regard to personal data in the Customs Information System, in particular the right of access, to rectification, erasure or blocking shall be exercised in accordance with the laws, regulations and procedures of the Member States implementing the Framework Decision 2008/977/JHA in which such rights are invoked’. In this context, the EDPS wishes to emphasise in particular the importance of the maintaining of the procedure for data subjects to invoke their rights and be able to ask for access in every Member State. The EDPS will have a close look at the practical implementation of this important right of data subjects.

45. The Proposal also extends the scope of the CIS Convention when it comes to the prohibition of copying data from CIS into other national data files. The CIS Convention explicitly mentions in Article 14(2) that ‘personal data included by other Member States may not be copied from the CIS into other national data files’. The Proposal, in its Article 21(3), allows such copying ‘for those copies held in the systems of risk management used to direct national customs controls or copies held in an operational analysis system to co-ordinate actions’. With respect to this, the EDPS shares the remarks made by the Customs Joint Supervisory Authority in its Opinion 09/03, in particular as regards the term ‘systems of risk management’ as well as the need to stipulate further when and under which circumstances the copying allowed in Article 21(3) would be possible.

46. EDPS welcomes provisions on security, which are essential for the efficient functioning of the CIS (Chapter XII).

Customs files identification database

47. The Proposal adds provisions on customs files identification database (Articles 16-19). This reflects the creation of the customs files identification database in the First Pillar instrument. Although the EDPS does not question the need for such new databases in the framework of the CIS, he draws attention to the need for appropriate data protection safeguards. In this context, the EDPS welcomes the fact that the exception foreseen in Article 21(3) does not apply to customs files identification databases.

Access to the CIS for Europol and Eurojust

48. The Proposal grants access to the system to the European Police Office (Europol) and the European Union's Judicial Cooperation Unit (Eurojust).

49. First of all, the EDPS stresses the need for clearly defining the purpose for access and assessing the proportionality and necessity of the extension of access. The information on why it is necessary to extend the access to the system to Europol and Eurojust is missing. The EDPS also stresses that when access to databases, functionalities and the processing of personal information are at stake, there is a clear need to evaluate in advance not just the usefulness of such access, but also the real and documented necessity of such a proposal. The EDPS underlines that no justification of the reasons has been provided.

50. The EDPS also calls for a clear definition in the text of the precise missions for which Europol and Eurojust can be granted access to the data.

51. According to Article 11, ‘Europol shall, within its mandate and for the fulfilment of its tasks, have the right to access the data entered in the CIS, to search data directly, to enter data into the system’.

52. The EDPS welcomes the limitations introduced in the Proposal, such as in particular: — subjecting the use of information from the CIS to the consent of the Member State which entered the data into the system, — limitations of Europol's communication of data to third countries (again only with the consent of the Member State which entered the data into the system), — limited access to the CIS (authorised staff), — Europol Joint Supervisory Body reviewing the activities of Europol.

53. The EDPS would also like to mention that whenever the Proposal refers to the Europol Convention, account should be taken of the Council Decision on the basis of which, with effect of 1 January 2010, Europol will become an EU agency.

54. Article 12 of the Proposal deals with Eurojust's access to the CIS. It stipulates that ‘Subject to Chapter IX, the national members and their assistants shall, within their mandate and for the fulfillment of its tasks, have the right to have access to the data entered into the CIS in accordance with Articles 1, 3, 4, 5 and 6, and to search those data’. The Proposal provides for similar mechanisms concerning the consent of the Member State which entered the data to the ones envisaged for Europol. The above comments regarding the need for justification of the necessity to provide for access as well as for adequate and necessary limitations if such access is given, are also applicable to Eurojust.

55. EDPS welcomes the limitation of the access to CIS only to the national member, their deputies, and their assistants. The EDPS notes however that Article 12(1) only speaks of national member and assistants, whereas other paragraphs of Article 12 cover also deputies to national members. The legislators should ensure clarity and consistency in this context.

Supervision — Towards a coherent, consistent and comprehensive model

56. With regard to the proposed supervision of the Third Pillar part of the CIS, the EDPS draws attention of the legislator to the need for ensuring a consistent and comprehensive supervision of the whole system. The complex legal framework governing the CIS, based on two legal bases, should be taken into account and two different supervision models should be avoided both for the sake of legal clarity and for practical reasons.

57. As mentioned earlier in the opinion, the EDPS currently acts as a supervisor of the central part of the First Pillar part of the system. This is in accordance with Article 37 of Regulation (EC) No 515/97 which stipulates ‘the European Data Protection Supervisor shall supervise compliance of the CIS with Regulation (EC) No 45/2001’. The EDPS notes that the supervision model, as proposed in the French Proposal, does not take into account this role. The supervision model is based on the role of the CIS Joint Supervisory Authority.

58. Although the EDPS appreciates the work done by the CIS Joint Supervisory Authority, he stresses two reasons for which a coordinated supervision model, consistent with his current supervisory tasks in other large scale systems, should be applied. First, such model would ensure the internal consistency between the First and Third pillar parts of the system. Secondly, it would also provide for consistency with the models established in other large scale systems. Therefore, the EDPS advises that a similar model as the one used in the SIS II (‘coordinated supervision’ or ‘layered model’) is applied to the CIS as a whole. As mentioned in the EDPS opinion on the First Pillar part of CIS, ‘in the framework of the SIS II, the European legislator has opted for a rationalisation of the supervision model, by applying the same layered model as described in both the First and Third Pillar environments of the system’).

59. The EDPS believes that the most opportune solution to provide for this is to introduce a more uniform system of supervision, the already experimented model based on a three-layered structure: DPAs at national level, EDPS at central level and coordination between both. The EDPS is convinced that the replacement of the CIS Convention gives this unique opportunity to provide for simplification and more consistency in the supervision, completely in line with other large scale systems (VIS, SIS II, Eurodac).

60. Finally, the coordinated supervision model also takes better into account, the changes that will be brought by the entry into force of the Lisbon Treaty and the abolition of the pillar structure of the EU.

61. The EDPS does not take a position on whether the insertion of the coordinated model of supervision would require amendments to the First Pillar instrument governing the CIS, namely Regulation (EC) No 766/2008, but he draws the legislator's attention to the need to analyze this aspect as well from the perspective of legal consistency.

List of authorities with access to the CIS

62. Article 7, paragraph 2 provides for an obligation on each Member State to send to the other Member States and the Committee referred to in Article 26 a list of the competent authorities it has designed to have access to the CIS, for each authority specifying which data it may have access to and for what purposes.

63. The EDPS draws attention to the fact that the Proposal only provides that information on the authorities having access to CIS should be exchanged between the Member States and that they should inform the Committee mentioned in Article 26, but no publication of such list of authorities has been envisaged. This is regrettable as such publication would help to achieve better transparency and create a practical tool for an effective supervision of the system, e.g. by the competent Data Protection Authorities.

IV. CONCLUSIONS

64. The EDPS supports the Proposal for a Council Decision on the use of information technology for customs purposes. He stresses that due to the ongoing legislative work in the Council, his comments are not based on the final text of the Proposal.

65. He regrets the lack of explanatory documents which could provide for some necessary clarification and information on the objectives and specificity of some of the provisions of the Proposal.

66. The EDPS calls for more attention to be devoted in the Proposal to the need for specific data protection safeguards. He sees a number of issues where the practical implementation of data protection safeguards should be ensured better, in particular as to the application of the purpose limitation with regard to the use of data entered in the CIS. The EDPS considers this as an essential prerequisite for the improvement of the functioning of the Customs Information System.

67. The EDPS calls for a coordinated model of supervision to be inserted in the Proposal. It should be noted that the EDPS has currently supervisory tasks over the First Pillar part of the system. He underlines that for the sake of coherence and consistency the best approach is to apply the coordinated supervision model also to the Third Pillar part of the system. This model would also ensure, where necessary and adequate, consistency with other legal instruments governing the establishment and/or use of other large-scale IT systems.

68. The EDPS calls for more explanation on the necessity and proportionality of giving access to Eurojust and Europol. He stresses the lack of explanatory information on this issue in the Proposal.

69. The EDPS also insists on reinforcing the provision of Article 8(4) of the Proposal regarding the transfer of data to non-Member States or international organisations. This includes the need to ensure a uniform system of adequacy assessment.

70. The EDPS calls for insertion of a provision on the publication of the list of the authorities having access to the CIS, in order to increase transparency and facilitate the supervision of the system.

Done at Brussels, 20 April 2009. Peter HUSTINX European Data Protection Supervisor

(1) OJ L 281, 23.11.1995, p. 31.

(2) OJ L 350, 30.12.2008, p. 60.

(3) OJ L 8, 12.1.2001, p. 1.

(4) OJ C 29, 5.2.2009, p. 6.

(5) See, most recently, Opinion of the European Data Protection Supervisor on the Initiative of 15 Member States with a view to adopting a Council Decision concerning the strengthening of Eurojust and amending Decision 2002/187/JHA, OJ C 310, 5.12.2008, p. 1.

(6) http://www.europarl.europa.eu/meetdocs/2004_2009/organes/libe/libe_20090330_1500.htm

(7) OJ C 316, 27.11.1995, p. 33.

(8) OJ L 82, 22.3.1997, p. 1.

(9) The Proposal adds a new category: (g) items detained, seized or confiscated.

(10) OJ L 386, 29.12.2006, p. 89.

(11) OJ L 218, 13.8.2008, p. 48.

(12) Opinion of 22 February 2007 on the proposal for a Regulation (COM(2006) 866 final) (OJ C 94, 28.4.2007, p. 3).