Initiative of the French Republic with a view to adopting a Council decision on the use of information technology for customs purposes
Date: 2009-02-05
Institutions: France
Subjects: customs, data protection, data recording, disclosure of information, information storage, information system

C 29/6

EN

Official Journal of the European Union

5.2.2009

III

(Preparatory Acts)

COUNCIL

Initiative of the French Republic with a view to adopting a Council decision on the use of
information technology for customs purposes

THE COUNCIL OF THE EUROPEAN UNION,

(5)

(2009/C 29/05)

Having regard to the Treaty on European Union, and in particu-
lar Article 30(1)(a) and Article 34(2)(c) thereof,

Having regard to the initiative of the French Republic,

Having regard to the Opinion of the European Parliament (1),

Whereas:

(1)

(2)

(3)

territory,

At the external frontiers of the Community and within
are
customs
Community
responsible, together with other competent authorities,
for
investigation and suppression of
offences against not only Community rules, but also
against national laws.

the prevention,

administrations

The developing trend towards illicit
kinds constitutes a serious
morality and security.

threat

trafficking of all
to public health,

It is necessary to reinforce cooperation between customs
administrations, by laying down procedures under which
customs administrations may act jointly and exchange
personal and other data concerned with illicit trafficking
activities, using new technology for the management and
transmission of such information, subject to the provi-
sions of the Council of Europe Convention on the Protec-
tion of Individuals with Regard to Automatic Processing
of Personal Data, done at Strasbourg on 28 January
1981, and the principles contained in Recommendation
R (87) 15 of the Committee of Ministers of the Council
of Europe of 17 September 1987, regulating the use of
personal data in the police sector.

(4)

It is also necessary to enhance complementarity with
actions in the context of cooperation with the European
Police Office (Europol) and Eurojust, by granting those
agencies access to the Customs Information System.

customs

to implement
administrations have
Since
both Community and non-Community provisions in
their day-to-day work, it is necessary to ensure that the
provisions on mutual assistance and administrative coop-
eration evolve in parallel. Account should therefore be
the provisions on the Customs Information
taken of
System and the customs files identification database in
Regulation (EC) No 766/2008 of the European Parlia-
ment and of
the Council of 9 July 2008 amending
Council Regulation (EC) No 515/97 on mutual assistance
between the administrative authorities of
the Member
States and cooperation between the latter and the
Commission to ensure the correct application of the law
on customs and agricultural matters (2).

(6)

(7)

(8)

Experience gained since the Convention of 26 July 1995
on the use of
information technology for customs
purposes (hereinafter ‘the CIS convention’) (3) entered
into force has shown that the use of the Customs Infor-
mation System for the sole purposes of sighting and
reporting, discreet surveillance or specific checks does
not make it possible to achieve fully the system's objec-
investigating and
tive, which is to assist in preventing,
prosecuting serious contraventions of national laws.

A strategic analysis should help those responsible at the
highest level to determine projects, objectives and policies
for combating fraud, to plan activities and to deploy the
resources needed to achieve the operational objectives
laid down.

An operational analysis of the activities, resources and
intentions of certain persons or businesses that do not
comply or appear not
laws
should help the customs authorities to take the appro-
priate measures in specific cases to achieve the objectives
laid down as regards the fight against fraud.

to comply with national

(1) Opinion of … (not yet published in the Official Journal).

(2) OJ L 218, 13.8.2008, p. 48.
(3) OJ C 316, 27.11.1995, p. 33.

5.2.2009

EN

Official Journal of the European Union

C 29/7

(9)

The CIS convention should therefore be replaced.

(10)

rights and
the
This Decision respects
observes the principles recognised in particular by the
Charter of Fundamental Rights of the European Union,

fundamental

HAS DECIDED AS FOLLOWS:

CHAPTER I

ESTABLISHMENT OF A CUSTOMS INFORMATION SYSTEM

Article 1

1.
The customs administrations of the Member States shall
set up and maintain a joint automated information system for
customs purposes, hereinafter referred to as the ‘Customs Infor-
mation System’.

2.
The aim of the Customs Information System, in accord-
ance with this Decision, shall be to assist in preventing, investi-
gating and prosecuting serious contraventions of national laws
by making
thereby
the cooperation and control
increasing the effectiveness of
the Member
procedures of
States.

the customs administrations of

information available more

rapidly,

CHAPTER II

DEFINITIONS

Article 2

For the purposes of this Decision:

1. the term ‘national
Member State,
administration of
competence, concerning:

laws’ means laws or regulations of a
in the application of which the customs
that Member State has total or partial

(a) the movement of goods subject to measures of prohibi-
tion, restriction or control, in particular those measures
covered by Articles 36 and 223 of the Treaty establishing
the European Community;

(b) the transfer, conversion, concealment, or disguise of
property or proceeds acquired or obtained directly or
indirectly through illicit international drug trafficking or
by infringement of:

transit

(ii) the body of Community provisions and associated
import,
implementing provisions governing the
export,
traded
and presence of goods
between Member States and third countries, and
between Member States in the case of goods that do
not have Community status within the meaning of
Article 9(2) of the Treaty establishing the European
Community or goods subject to additional controls
or investigations for the purposes of establishing
their Community status;

(iii) the body of provisions adopted at Community level
under
the common agricultural policy and the
specific provisions adopted with regard to goods
resulting
agricultural
products; or

from the processing of

(iv) the body of provisions adopted at Community level
for harmonised excise duties and for value-added tax
on importation together with the national provisions
implementing them, or those which have been used
in that context;

2. the term ‘personal data’ means any information relating to

an identified or identifiable individual;

3. the term ‘supplying Member State’ means a State which
includes an item of data in the Customs Information System;

4.

‘operational analysis’ means analysis of operations which
constitute, or appear to constitute, breaches of national laws,
involving the following stages:

(a) the collection of information, including personal data;

(b) evaluation of the reliability of the information source

and the information itself;

(c) research, methodical presentation and interpretation of
information or between

links between these items of
them and other significant data;

(d) the formulation of observations, hypotheses or recom-
mendations directly usable as risk information by the
competent authorities to prevent and detect other opera-
tions in breach of national laws and/or to identify with
precision the person or businesses implicated in such
operations;

(i) the laws, regulations or administrative provisions of
a Member State in the application of which the
customs administration of that Member State has
partial or total competence, concerning the cross-
border movement of goods subject to measures of
in particular
restriction or control,
prohibition,
those measures referred to in Articles 36 and 223 of
the Treaty establishing the European Community,
and non-harmonised excise duties;

5.

trends in breaches of national

‘strategic analysis’ means research and presentation of the
general
laws through an
evaluation of the threat, scale and impact of certain types of
operation in breach of national laws, with a view to setting
priorities, gaining a better picture of the phenomenon or
threat, reorienting action to prevent and detect fraud and
reviewing departmental organisation. Only data from which
identifying factors have been removed may be used for stra-
tegic analysis.

C 29/8

EN

Official Journal of the European Union

5.2.2009

CHAPTER III

(i) suggested action;

OPERATION AND USE OF THE CUSTOMS INFORMATION
SYSTEM

(j) a warning code indicating any history of being armed,

violent or escaping;

Article 3

(k) registration number of the means of transport.

The Customs Information System shall consist of a central
1.
database facility, accessible via terminals in each Member State.
It shall comprise exclusively data necessary to achieve its aim as
stated in Article 1(2), including personal data, in the following
categories:

(a) commodities;

(b) means of transport;

(c) businesses;

(d) persons;

(e) fraud trends;

(f) availability of expertise;

(g) items detained, seized or confiscated.

the infrastructure of

2.
The Commission shall ensure the technical management
the Customs Information System in
of
accordance with the rules provided for by the implementing
measures adopted by the Council.

The Commission shall report on management to the Committee
referred to in Article 23.

The Commission shall communicate to that Committee

3.
the practical arrangements adopted for technical management.

Article 4

1. Member States shall determine the items to be included in
the Customs Information System relating to each of the cate-
gories referred to in Article 3, to the extent that this is necessary
to achieve the aim of the system. No items of personal data
shall be included in any event within category set out
in
point (e) of Article 3.

2. With regard to categories set out in points (a) to (d) of
Article 3,
information included in respect of
the items of
persons shall comprise no more than:

(a) name, maiden name,

forenames,

former surnames and

aliases;

(b) date and place of birth;

(c) nationality;

(d) sex;

(e) number and place and date of issue of the identity papers

(passports, identity cards, driving licences);

(f) address;

3. With regard to category set out in point (f) of Article 3,
the items of information included in respect of persons shall
comprise no more than the experts' surnames and forenames.

4. With regard to category set out in point (g) of Article 3,
the items of information included in respect of persons shall
comprise no more than:

(a) name, maiden name,

forenames,

former surnames and

aliases;

(b) date and place of birth;

(c) nationality;

(d) sex;

(e) address.

5.
In any case personal data listed in Article 6, first sentence,
of the Council of Europe Convention for the Protection of Indi-
viduals with Regard to Automatic Processing of Personal Data,
done at Strasbourg on 28 January 1981, hereinafter referred to
as the ‘1981 Strasbourg Convention’, shall not be included.

Article 5

Data in the categories referred to in Article 3 shall be
1.
included in the Customs Information System only for
the
purpose of sighting and reporting, discreet surveillance, specific
checks, or operational analysis.

2.
For the purpose of the suggested actions referred to in
paragraph 1, namely sighting and reporting, discreet surveil-
lance, specific checks, or operational analysis, personal data
within any of the categories referred to in Article 3 may be
included in the Customs Information System only if, especially
on the basis of prior illegal activities, there are real indications
to suggest that the person concerned has committed, is in the
act of committing, or will commit serious contraventions of
national laws.

Article 6

1.
If the suggested actions referred to in Article 5(1) are
carried out, the following information may in whole or in part
be collected and transmitted to the supplying Member State:

(i) the fact that the commodity, means of transport, business

or person reported has been found;

(ii) the place, time and reason for the check;

(g) any

particular

objective

and

permanent

physical

(iii) the route and destination of the journey;

characteristics;

(h) reason for inclusion of data;

(iv) persons accompanying the person concerned or occupants

of the means of transport;

5.2.2009

EN

Official Journal of the European Union

C 29/9

(v) the means of transport used;

(vi) objects carried;

(vii) the circumstances under which the commodity, means of

transport, business or person was found.

When such information is collected in the course of discreet
surveillance steps must be taken to ensure that the discreet
nature of the surveillance is not jeopardised.

2.
In the context of a specific check referred to in Article 5(1),
persons, means of transport and objects may be searched to the
extent permissible and in accordance with the laws, regulations
and procedures of the Member State in which the search takes
place. If the specific check is not permitted by the law of a
it shall automatically be converted by that
Member State,
Member
and reporting or discreet
into sighting
State
surveillance.

Article 7

1.
Direct access to data included in the Customs Information
System shall be reserved for the national authorities designated
by each Member State. These national authorities shall be
customs administrations, but may also include other authorities
competent, according to the laws, regulations and procedures of
the Member State in question, to act in order to achieve the aim
stated in Article 1(2).

2.
Each Member State shall send the other Member States
and the committee referred to in Article 23 a list of its compe-
tent authorities which have been designated in accordance with
paragraph 1 of this Article to have direct access to the Customs
Information System stating, for each authority, which data it
may have access to and for what purposes.

3.
Notwithstanding the provisions of paragraphs 1 and 2,
Member State may, by unanimous agreement, permit access to
the Customs Information System by international or regional
organisations. Such agreement shall take the form of a Council
decision. In reaching this decision the Member States shall take
account of any reciprocal arrangements and any opinion of the
Joint Supervisory Authority referred to in Article 25 on the
adequacy of data protection measures.

the Council of Europe of 17 September 1987, regulating the
use of personal data in the police sector, hereinafter referred to
as ‘Recommendation R (87) 15’.

2. Without prejudice to paragraphs 1 and 4 of this Article,
Article 7(3) and Articles 11 and 12, data obtained from the
Customs Information System shall only be used by national
authorities in each Member State designated by the Member
State in question, which are competent, in accordance with the
laws, regulations and procedures of that Member State, to act in
order to achieve the aim stated in Article 1(2).

3.
Each Member State shall send the other Member States
and the Committee referred to in Article 23 a list of the compe-
tent authorities it has designated in accordance with paragraph 2
of this Article.

4.
Data obtained from the Customs Information System may,
with the prior authorisation of, and subject to any conditions
imposed by, the Member State which included it in the system,
be communicated for use by national authorities other than
those designated under paragraph 2, non-Member States, and
international or regional organisations wishing to make use of
them. Each Member State shall take special measures to ensure
the security of such data when they are being transmitted or
supplied to services located outside its territory. Details of such
measures must be communicated to the Joint Supervisory
Authority referred to in Article 25.

Article 9

1.
The inclusion of data in the Customs Information System
shall be governed by the laws, regulations and procedures of the
supplying Member State unless this Decision lays down more
stringent provisions.

2.
The use of data obtained from the Customs Information
System, including performance of any action under Article 5(1)
suggested by the supplying Member State, shall be governed by
the laws, regulations and procedures of the Member State using
such data, unless this Decision lays down more stringent
provisions.

Article 10

Article 8

1.
Each of the Member States shall designate a competent
customs administration which shall have national responsibility
for the Customs Information System.

1. Member States may use data obtained from the Customs
Information System only in order to achieve the aim stated in
Article 1(2). However, they may use it for administrative or
other purposes with the prior authorisation of, and subject to
any conditions imposed by, the Member State which included it
in the system. Such other use shall be in accordance with the
laws, regulations and procedures of the Member State which
seeks to use it and should take into account Principle 5.5 of
Recommendation R (87) 15 of the Committee of Ministers of

2.
The administration referred to in paragraph 1 shall be
responsible for the correct operation of the Customs Informa-
tion System within the Member State and shall
take the
measures necessary to ensure compliance with this Decision.

3. Member States shall inform one another of the administra-
tion referred to in paragraph 1.

C 29/10

EN

Official Journal of the European Union

5.2.2009

Article 11

Subject to Chapter IX of this Decision, the European Police
1.
Office (Europol) shall, within its mandate, have the right to have
access to the data entered into the Customs Information System
in accordance with Articles 2, 3, 4, 5 and 6, to search those
data directly, and to enter data into the system.

2. Where a search by Europol reveals the existence of an
alert in the Customs Information System, Europol shall, via the
channels defined in Council Decision […] establishing a
European Police Office
inform the
Member State which issued the alert.

(Europol Decision) (1),

3.
Use of information obtained from a search in the Customs
Information System is subject to the consent of the Member
State which entered the data into the system. If this Member
State allows the use of such information, the handling thereof
shall be governed by the Europol Decision. Europol may
communicate such information to third countries and third
the Member State which
bodies only with the consent of
entered the data into the system.

3.
Nothing in this Article shall be interpreted as affecting the
provisions of Council Decision 2002/187/JHA of 28 February
2002 setting up Eurojust with a view to reinforcing the fight
against serious crime (2) which concern data protection and the
liability for any unauthorised or incorrect processing of such
data by national members of Eurojust or their assistants, or as
affecting the powers of
the Joint Supervisory Body set up
pursuant to that Decision.

No parts of the Customs Information System to which the
4.
national members or
their assistants have access shall be
connected to any computer system for data collection and
processing in operation by or at Eurojust, nor shall any data
contained in the former be transferred to the latter, nor shall
any part of the Customs Information System be downloaded.

5.
Access to data entered in the Customs Information System
shall be limited to the national members and their assistants and
not be extended to Eurojust staff.

Europol may request

4.
information from the
Member States concerned, in accordance with the provisions of
the Europol Decision.

further

5. Without prejudice to paragraphs 3 and 4, Europol shall
not connect the parts of the Customs Information System to
which it has access to any computer system for data collection
and processing operated by or at Europol, nor transfer the data
contained therein to any such system, nor download or other-
wise copy any part of the Customs Information System.

Europol shall
Information System to duly authorised staff of Europol.

limit access to data entered into the Schengen

Europol shall allow the Joint Supervisory Body, set up under
Article 34 of the Europol Decision, to review the activities of
Europol in the exercise of its right to accede to and to search
data entered into the Customs Information System.

Article 12

1.
Subject to Chapter IX, the national members of Eurojust
and their assistants shall, within their mandate, have the right to
have access to the data entered into the Customs Information
System in accordance with Articles 2, 3, 4, 5 and 6, and to
search those data.

2. Where a search by a national member of Eurojust reveals
the existence of an alert in the Customs Information System, he
or she shall inform the Member State having issued the alert
thereof. Any communication of information obtained from such
a search may be communicated to third countries and third
bodies only with the consent of the Member State which issued
the alert.

CHAPTER IV

AMENDMENT OF DATA

Article 13

1.
Only the supplying Member State or Europol shall have
the right to amend, supplement, correct or delete data which it
has entered in the Customs Information System.

2.
Should a supplying Member State or Europol note, or
have drawn to its attention, that the data it included are factually
inaccurate or were included, or are stored contrary to this Deci-
sion, it shall amend, supplement, correct or delete the data, as
appropriate, and shall advise the other Member States and
Europol accordingly.

3.
If one of the Member States or Europol has evidence to
suggest that an item of data is factually inaccurate, or was
included or is stored on the Customs Information System,
contrary to this Decision, it shall advise the supplying Member
State or Europol as soon as possible. The latter shall check the
data concerned and,
if necessary, correct or delete the item
without delay. The supplying Member State or Europol shall
advise the other Member States and Europol of any correction
or deletion effected.

4.
If, when entering data in the Customs Information System,
a Member State or Europol notes that its report conflicts with a
previous report as to content or suggested action, it shall imme-
diately advise the Member State or Europol which made the
previous report. The two Member States or the Member State
and Europol shall then attempt to resolve the matter. In the
event of disagreement, the first report shall stand, but those
parts of the new report which do not conflict shall be included
in the System.

(1) OJ …

(2) OJ L 63, 6.3.2002, p. 1.

5.2.2009

EN

Official Journal of the European Union

C 29/11

5.
Subject to the provisions of this Decision, where in any
Member State a court, or other competent authority within that
Member State, makes a final decision as to amendment, supple-
mentation, correction or deletion of data in the Customs Infor-
mation System,
the Member States and Europol undertake
mutually to enforce such a decision. In the event of conflict
between such decisions of courts or other competent authorities
in different Member States,
including those referred to in
Article 22(4) concerning correction or deletion, the Member
State which included the data in question or Europol shall delete
them from the System.

CHAPTER V

RETENTION OF DATA

Article 14

1.
Data included in the Customs Information System shall be
kept only for the time necessary to achieve the purpose for
which it was included. The need for their retention shall be
reviewed at least annually by the supplying Member State, or by
Europol if the latter entered the data.

if

The supplying Member State, or Europol

2.
the latter
entered the data, may, within the review period, decide to retain
data until the next review if their retention is necessary for the
purposes for which they were included. Without prejudice to
Article 22, if there is no decision to retain data, they shall auto-
matically be transferred to that part of the Customs Information
System to which access shall be limited in accordance with para-
graph 4 of this Article.

The Customs

Information System shall automatically
3.
inform the supplying Member State, or Europol
if the latter
entered the data, of a scheduled transfer of data from the
Customs Information System under paragraph 2, giving one
month's notice.

Data transferred under paragraph 2 shall continue to be
4.
retained for one year within the Customs Information System,
but, without prejudice to Article 22, shall be accessible only to
a representative of the Committee referred to in Article 23 or to
referred to in Articles 24(1)
the
and 25(1). During that period they may consult the data only
for the purposes of checking their accuracy and lawfulness, after
which they must be deleted.

supervisory authorities

CHAPTER VI

CREATION OF A CUSTOMS FILES IDENTIFICATION DATABASE

Article 15

1.
The Customs Information System shall contain data in
accordance with this Chapter, in addition to data in accordance
with Article 3, in a special database, hereinafter referred to as

‘the customs files identification database’. Without prejudice to
the provisions of this Chapter and of Chapters VII and VIII, all
the provisions of this Decision shall also apply to the customs
files identification database.

2.
The aim of the customs files identification database shall
be to enable the national authorities responsible for carrying
out customs investigations designated pursuant to Article 7,
when opening a file on or investigating one or more persons or
businesses, to identify competent authorities of other Member
States which are investigating or have investigated those persons
or businesses, in order, through information on the existence of
investigation files, to achieve the aim referred to in Article 1(2).

3.
For the purposes of the customs files identification data-
base, each Member State shall send the other Member States
and the committee mentioned in Article 23 a list of serious
infringements of its national laws.

This list shall comprise only infringements that are punishable:

(a) by deprivation of

liberty or a detention order

for a

maximum period of not less than 12 months; or

(b) by a fine of at least EUR 15 000.

4.
If the Member State retrieving data from the customs files
identification database requires
information on the
it shall
stored investigation file on a person or a business,
request the assistance of the supplying Member State on the
basis of the instruments in force relating to mutual assistance.

further

CHAPTER VII

OPERATION AND USE OF THE CUSTOMS FILES IDENTIFICA-
TION DATABASE

Article 16

1.
The competent authorities shall enter data from investiga-
tion files in the customs files identification database for the
purposes set out in Article 15(2). The data shall cover only the
following categories:

(a) a person or a business which is or has been the subject of
an investigation file opened by a competent authority of a
Member State, and which:

(i) in accordance with the national

law of the Member
State concerned, is suspected of committing or having
committed, or participating or having participated in
the commission of, a serious infringement of national
laws;

(ii) has been the subject of a report establishing that such

an infringement has taken place; or

(iii) has been the subject of an administrative or legal sanc-

tion for such an infringement;

C 29/12

EN

Official Journal of the European Union

5.2.2009

(b) the field covered by the investigation file;

(c) the name, nationality and contact

the
Member State's authority handling the case, together with
the file number.

information of

Data referred to in points (a) to (c) shall be entered in a data
record separately for each person or business. Links between
data records shall not be permitted.

The personal data referred to in paragraph 1(a) shall

2.
consist only of the following:

(a) for persons: the name, maiden name, forenames, former
surnames and aliases, date and place of birth, nationality
and sex, address;

(b) for businesses: business name, name under which trade is
conducted, registered office and VAT identifier, excise duties
identification number, address.

Data shall be entered for a limited period in accordance

3.
with Article 19.

Article 17

A Member State shall not be obliged to make entries pursuant
to Article 16 in any particular case if and for such time as this
would harm public policy or other essential interests, in particu-
lar with regard to data protection, of
the Member State
concerned.

the date on which the data were entered in the file, shall on no
account be exceeded:

(a) data relating to current

investigation files shall not be
retained beyond a period of three years if it has not been
established that an infringement has taken place within that
time. The data shall be deleted before then if one year has
passed since the last investigative act;

(b) data relating to investigation files which have established
that an infringement has taken place but which have not yet
led to a conviction or to imposition of a fine shall not be
retained beyond a period of six years;

(c) data relating to investigation files which have led to a
conviction or a fine shall not be retained beyond a period of
10 years.

2.
At all stages of an investigation as referred to in points (a)
to (c) of paragraph 1, as soon as a person or business within the
scope of Article 16 is eliminated from an investigation pursuant
to the laws and administrative regulations of
the supplying
Member State, all data relating to that person or business shall
be deleted immediately.

3.
Data shall automatically be deleted from the customs files
identification database as from the date on which the data reten-
tion periods laid down in paragraph 1 are exceeded.

Article 18

PERSONAL DATA PROTECTION

CHAPTER IX

1.
Entry of data in the customs files identification database
and consultation thereof shall be reserved for the authorities
referred to in Article 15(2).

Any consultation concerning the customs files identifica-

2.
tion database shall cover the following personal data:

(a) for persons:

the forename and/or name and/or maiden
name and/or former surnames and/or alias and/or date of
birth and/or address;

(b) for businesses: business name and/or name under which
trade is conducted and/or VAT identifier and/or excise duties
identification number and/or address.

CHAPTER VIII

PERIOD OF RETENTION OF DATA IN THE CUSTOMS FILES
IDENTIFICATION DATABASE

Article 19

1.
Storage periods shall be determined in accordance with
the laws, regulations and procedures of the Member State intro-
ducing the data. However, the following time-limits, starting on

Article 20

1.
Each Member State intending to receive personal data
from, or include them in, the Customs Information System
shall, no later than … (*), adopt national measures sufficient to
achieve a level of protection of personal data at lea equal to that
resulting
the 1981 Strasbourg
Convention.

from the principles of

2.
A Member State shall receive personal data from, or
include them in, the Customs Information System only where
the arrangements for the protection of such data provided for in
paragraph 1 have entered into force in the territory of that
Member State. The Member State shall also have previously
designated a national supervisory authority or authorities in
accordance with Article 24.

In order to ensure the proper application of

3.
the data
protection provisions in this Decision, the Customs Information
System shall be regarded in every Member State as a national
data file subject to the national provisions referred to in para-
graph 1 and any more stringent provisions contained in this
Decision.

(*) Date of application of this Decision.

5.2.2009

EN

Official Journal of the European Union

C 29/13

Article 21

Subject to Article 8(1), each Member State shall ensure
1.
that it shall be unlawful under its laws, regulations and proce-
dures for personal data from the Customs Information System
to be used other than for the purposes set out in Article 1(2).

Data may be duplicated only for

2.
technical purposes,
provided that such duplication is necessary for direct searching
by the authorities referred to in Article 7.

3.
Subject to Article 8(1), personal data included by other
Member States may not be copied from the Customs Informa-
tion System into other national data files, except those copies
held in systems of risk management used to direct national
customs controls or copies held in an operational analysis
system used to coordinate actions.

In the two exceptional cases provided for in paragraph 3,
4.
only the analysts designated by the national authorities of each
Member State shall be empowered to process personal data
obtained from the Customs Information System within the
framework of a risk management system used to direct customs
controls by national authorities or of an operational analysis
system used to coordinate actions.

5.
Each Member States shall send each other Member State
and the Committee referred to in Article 23 a list of the risk-
management departments whose analysts are authorised to
copy and process personal data entered in the Customs Informa-
tion System.

A Member State which has not supplied the data concerned
may communicate data only if it has first given the supplying
Member State an opportunity to adopt its position.

2.
A Member State, to which an application for access to
personal data is made, shall refuse access if access may under-
mine the performance of the legal task specified in the report
pursuant to Article 5(1), or in order to protect the rights and
freedoms of others. Access shall be refused in any event during
the period of discreet surveillance or sighting and reporting, and
during the period in which the operational analysis of the data
or administrative enquiry or criminal investigation is ongoing.

regulations

and procedures of

In each Member State, a person may, according to the
3.
laws,
the Member State
concerned, have personal data relating to himself corrected or
deleted if those data are factually inaccurate, or were included or
are stored in the Customs Information System contrary to the
aim stated in Article 1(2) of this Decision or to the provisions
of Article 5 of the 1981 Strasbourg Convention.

4.
In the territory of each Member State, any person may, in
accordance with the laws, regulations and procedures of the
Member State in question, bring an action or, if appropriate, a
complaint before the courts or the authority competent under
the laws, regulations and procedures of
that Member State
concerning personal data relating to himself on the Customs
Information System, in order to:

(a) correct or delete factually inaccurate personal data;

(b) correct or delete personal data entered or stored in the
Customs Information System contrary to this Decision;

6.
The list of national authorities referred to in paragraph 4
shall be published for information in the Official Journal of the
European Union.

(c) obtain access to personal data;

(d) obtain compensation pursuant to Article 28(2).

Personal data copied from the Customs

7.
Information
System shall be kept only for the time necessary to achieve the
purpose for which they were copied. The need for their reten-
tion shall be reviewed at least annually by the partner in the
Customs Information System which carried out the copying.
The storage period shall not exceed ten years. Personal data
which are not necessary for the continuation of the analysis
shall be deleted immediately or have any identifying factors
removed.

The Member States concerned undertake mutually to enforce
the final decisions taken by a court, or other competent
authority, pursuant to points (a) to (c).

The references in this Article and in Article 13(5) to a
5.
‘final decision’ do not indicate any obligation on the part of any
Member State to appeal against a decision taken by a court or
other competent authority.

Article 22

1.
The rights of persons with regard to personal data in the
Customs Information System, in particular their right of access,
shall be put into effect in accordance with the laws, regulations
and procedures of the Member State in which such rights are
invoked.

laid down in the laws, regulations and procedures of the
If
Member State concerned,
the national supervisory authority
provided for in Article 23 shall decide whether information is
to be communicated and the procedures for so doing.

CHAPTER X

INSTITUTIONAL FRAMEWORK

Article 23

representatives

A Committee consisting of

1.
from the
customs administrations of the Member States shall be set up.
The Committee shall take its decisions unanimously where the
provisions of point (a) of paragraph 2 are concerned and by a
two-thirds majority where the provisions of point (b) of para-
graph 2 are concerned. It shall adopt its rules of procedure by
unanimity.

C 29/14

EN

Official Journal of the European Union

5.2.2009

2.

The Committee shall be responsible:

(a) for the implementation and correct application of the provi-
sions of this Decision, without prejudice to the powers of
the authorities referred to in Articles 24(1) and 25(1);

(b) for the proper functioning of

the Customs Information
System with regard to technical and operational aspects. The
Committee shall take all necessary steps to ensure that the
measures set out in Articles 14 and 26 are properly imple-
mented with regard to the Customs Information System. For
the purpose of applying this paragraph, the Committee may
have direct access to, and use of, data from the Customs
Information System.

3.
in
The Committee shall report annually to the Council,
accordance with Title VI of the Treaty on European Union,
regarding the efficiency and effectiveness of the Customs Infor-
mation System, making recommendations as necessary.

the Customs Information System,

The Joint Supervisory Authority shall be competent to
3.
supervise operation of
to
examine any difficulties of application or interpretation which
may arise during its operation, to study problems which may
arise with regard to the exercise of independent supervision by
the national supervisory authorities of the Member States, or in
the exercise of rights of access by individuals to the System, and
to draw up proposals for the purpose of finding joint solutions
to problems.

4.
For the purpose of fulfilling its responsibilities, the Joint
Supervisory Authority shall have access to the Customs Infor-
mation System.

5.
Reports drawn up by the Joint Supervisory Authority shall
be forwarded to the authorities to which the national supervi-
sory authorities submit their reports.

The Commission shall be party to the Committee's

4.
proceedings.

CHAPTER XII

SECURITY OF THE CUSTOMS INFORMATION SYSTEM

CHAPTER XI

Article 26

PERSONAL DATA PROTECTION SUPERVISION

Article 24

1.
Each Member State shall designate a national supervisory
authority or authorities responsible for personal data protection
to carry out independent supervision of such data included in
the Customs Information System.

laws, shall carry out

The supervisory authorities, in accordance with their respective
national
independent supervision and
checks, to ensure that the processing and use of data held in the
Customs Information System do not violate the rights of the
person concerned. For this purpose the supervisory authorities
shall have access to the Customs Information System.

Any person may ask any national supervisory authority to
2.
check personal data relating to himself on the Customs Informa-
tion System and the use which has been or is being made of
those data. That right shall be governed by the laws, regulations
and procedures of the Member State in which the request is
made. If the data have been included by another Member State,
the check shall be carried out in close coordination with that
Member State's national supervisory authority.

Article 25

1.
A Joint Supervisory Authority shall be set up, consisting
of two representatives from each Member State drawn from the
respective
authority or
authorities.

independent national

supervisory

All necessary administrative measures to maintain security

1.
shall be taken:

(a) by the competent authorities of

the Member States in
respect of the terminals of the Customs Information System
in their respective States;

(b) by the Committee referred to in Article 23 in respect of the
Customs Information System and the terminals located on
the same premises as the System and used for technical
purposes and the checks required by paragraph 3 of this
Article.

In particular the competent authorities and the committee

2.
referred to in Article 23 shall take measures:

(a) to prevent any unauthorised person from having access to

installations used for the processing of data;

(b) to prevent data and data media from being read, copied,

modified or removed by unauthorised persons;

(c) to prevent

the unauthorised entry of data and any
unauthorised consultation, modification, or deletion of data;

(d) to prevent data in the Customs Information System from
being accessed by unauthorised persons by means of data
transmission equipment;

(e) to guarantee that, with respect to the use of the Customs
Information System, authorised persons have right of access
only to data for which they have competence;

(f) to guarantee that it is possible to check and establish to
which authorities data may be transmitted by data-transmis-
sion equipment;

The Joint Supervisory Authority shall perform its task in
2.
accordance with the provisions of
the
1981 Strasbourg Convention taking into account Recommenda-
tion R (87) 15.

this Decision and of

(g) to guarantee that it is possible to check and establish a
posteriori what data have been entered in the Customs
Information System, when and by whom, and to monitor
searches;

5.2.2009

EN

Official Journal of the European Union

C 29/15

(h) to prevent the unauthorised reading, copying, modification
or deletion of data during the transmission of data and the
transport of data media.

the Customs

Information System for

The Committee referred to in Article 23 shall monitor
3.
interrogation of
the
purpose of checking that searches made were admissible and
were made by authorised users. At least 1 % of all searches
made shall be checked. A record of such searches and checks
shall be maintained in the System and shall be used only for the
abovementioned purpose by the said Committee and the super-
visory authorities referred to in Articles 24 and 25. It shall be
deleted after six months.

Article 27

to

referred

customs

competent

administration

The
in
Article 10(1) shall be responsible for the security measures set
in relation to the terminals located in the
out in Article 26,
territory of the Member State concerned, the review functions
set out in Article 14(1) and (2) and Article 18, and otherwise
for the proper implementation of this Decision so far as is
necessary under the laws, regulations and procedures of that
Member State.

ware and dedicated network connections, and to related produc-
tion, support and training services, which cannot be kept sepa-
rate from the operation of the Customs Information System for
the purpose of applying the customs and agricultural rules of
the Community, and costs relating to the use of the Customs
Information System by the Member States in their territories
shall be borne by the general budget of
the European
Communities.

2.
Other expenditure incurred in the implementation of this
Decision shall be borne by the Member States. Each Member
State's share shall be determined according to the proportion of
its gross national product to the sum total of the gross national
products of the Member States for the year preceding the year
in which the costs are incurred.

the expression
For the purpose of applying this paragraph,
‘gross national product’ means the gross national product deter-
mined in accordance with Council Directive 89/130/EEC,
Euratom of 13 February 1989 on the harmonisation of the
compilation of gross national product at market prices (1) or
any Community instrument amending or replacing it.

CHAPTER XIV

IMPLEMENTATION AND FINAL PROVISIONS

CHAPTER XIII

Article 30

RESPONSIBILITIES AND LIABILITIES

Article 28

The information provided for under this Decision shall be
exchanged directly between the authorities of
the Member
States.

1.
Each Member State shall be responsible for the accuracy,
currency and lawfulness of data it has included in the Customs
Information System. Each Member State shall also be respon-
sible for complying with the provisions of Article 5 of the 1981
Strasbourg Convention.

Each Member State shall be liable, in accordance with its
2.
laws, regulations and procedures, for injury caused to a person
through the use of the Customs Information System in the
Member State concerned. This shall also be the case where the
injury was caused by the supplying Member State entering inac-
curate data or entering data contrary to this Decision.

If the Member State against which an action in respect of
3.
inaccurate data is brought
the Member State which
is not
supplied it, the Member States concerned shall seek agreement
as to what proportion, if any, of the sums paid out in compen-
sation shall be reimbursed by the supplying Member State to
the other Member State. Any such sums agreed shall be reim-
bursed on request.

Article 31

The Member States shall ensure that their national law conforms
to this Decision by … (*).

Article 32

This Decision replaces the Convention on the use of informa-
tion technology for customs purposes, as well as the Protocol of
12 March 1999 on the scope of the laundering of proceeds in
the Convention on the use of
information technology for
customs purposes and the inclusion of the registration number
of the means of transport in the Convention (2)
(hereinafter
referred to as the ‘protocol on the scope of the laundering of
proceeds’) and the Protocol of 8 May 2003 established in
accordance with Article 34 of the Treaty on European Union,
amending, as regards the creation of a customs files identifica-
tion database, the Convention on the use of information tech-
nology for customs purposes (3) (hereinafter referred to as the
‘Protocol on the creation of a customs files identification data-
base’), with effect from … (*).

Article 29

1.
Costs relating to the acquisition, study, development and
maintenance of central computer infrastructure (hardware), soft-

(1) OJ L 49, 21.2.1989, p. 26.
(*) Date of application of this Decision.
(2) OJ C 91, 31.3.1999, p. 2.
(3) OJ C 139, 13.6.2003, p. 2.

C 29/16

EN

Official Journal of the European Union

5.2.2009

Article 33

Unless otherwise provided in this Decision, measures imple-
menting the Convention on the use of information technology
for customs purposes and the respective protocols on the scope
of the laundering of proceeds and on the creation of a customs
files
repealed with effect
from … (*).

identification database

shall be

If no solution is found within six months, the matter may be
referred to the Court of Justice of the European Communities
by a party to the dispute.

Article 35

This Decision shall

1.
take effect on the twentieth day
following its publication in the Official Journal of the European
Union.

2.

It shall apply from …

Article 34

Any dispute between Member States on the interpretation or
application of this Decision shall, in an initial stage, be exam-
ined by the Council in accordance with the procedure set out in
Title VI of
the Treaty on European Union with a view to
reaching a solution.

Done at

For the Council

The President

(*) Date of application of this Decision.