CELEX: 
Language: en
Date: 2021-05-21 00:00:00
Title: COMMISSION DELEGATED REGULATION (EU) …/... laying down the detailed arrangements under Directive (EU) 2021/555 of the European Parliament and of the Council for the systematic exchange, by electronic means, of information relating to refusals to grant authorisations to acquire or possess certain firearms

EXPLANATORY MEMORANDUM
            
            
               1.CONTEXT OF THE DELEGATED ACT
            
            
               In May 2017, Directive 91/477/EEC on control of the acquisition and possession of weapons
                  1
                was revised
                  2
               . Amongst other things, the revision aimed at making it harder to legally acquire certain types of firearms, improve traceability and enhance co-operation between Member States. Directive (EU) 2021/555
                  3
                (‘the Firearms Directive’) codifies Directive 91/477/EEC and its subsequent amendments. Relevant references in the text therefore refer to the text of Directive (EU) 2021/555.
            
            
               One aspect of the revision was to improve the exchange of information concerning firearms between Member States. This was to be achieved in two ways. 
            
            
               Firstly, the Firearms Directive aims at improving the administrative exchange of information between Member States’ authorities on the transfers of firearms within the Union (Article 16), by making this exchange of information more systematic and based on an electronic system (Article 18). 
            
            
               Secondly, Article 18(4) of the Firearms Directive requires competent authorities in Member States to exchange, by electronic means, information with regard to refusals to grant authorisations, as provided for in Articles 9 and 10 of that Directive (that is, authorisations to acquire or possess firearms classified in category A or B), on grounds of security or relating to the reliability of person concerned. This administrative exchange of information is currently not being done systematically by Member States.
            
            
               In that context, Article 18(5) of the Firearms Directive entrusts the Commission to provide Member States with a system for the electronic exchange of information. In addition, it granted the Commission the powers to adopt delegated acts in accordance with Article 290 of the Treaty of the Functioning of the European Union in order to supplement Directive (EU) 2021/555 with the relevant rules laying down the detailed arrangements for the systematic exchange of information by electronic means. 
            
            
               Following discussions with Member States, the Commission decided to provide for an electronic system for the exchange of information with regard to refusals to grant authorisations to acquire or possess firearms classified in category A or B, on grounds of security or relating to the reliability of persons concerned, by enabling the use of the Internal Market Information System established by Regulation (EU) No 1024/2012 of the European Parliament and of the Council on administrative cooperation through the Internal Market Information System
                  4
               , specifically customised for such refusals. Accordingly, further to the detailed arrangements for the electronic exchange of information provided for in this delegated act, Commission Implementing Decision C(2021) 3401
                  5
                subjects to a pilot project under Article 4 of Regulation (EU) No 1024/2012 the administrative cooperation provisions set out in Article 18 of the Firearms Directive, relating to the refusals to grant firearm authorisations. 
            
            
               In the context of discussing the measures to be adopted under Article 18(5) of the Firearms Directive, Member States in an expert group on exchange of information also agreed to the adoption of two delegated acts to deal with the two types of electronic information exchanges foreseen in the Firearms Directive. Consequently, while this delegated act focuses specifically on establishing the detailed arrangements for the systematic exchange by electronic means of information related to refusals to grant firearms authorisations on grounds of security or relating to reliability of persons concerned, the setting up of an electronic exchange system for the exchange of information concerning the transfer of firearms is the subject of another delegated act, namely Commission Delegated Regulation (EU) 2019/686 of 16 January 2019 laying down the detailed arrangements under Directive (EU) 2021/555 for the systematic exchange, by electronic means, of information relating to the transfer of firearms within the Union
                  6
               . 
            
            
               The approach of having two delegated acts was based on various considerations. Firstly, the two types of information exchanges potentially involve different actors in the Member States. With respect to the transfer of firearms between Member States, custom authorities in Member States tend to be the relevant authorities in this information exchange. With respect to refusals to grant firearms authorisations, other authorities, depending on the administrative structure of Member States, are more likely to provide the relevant information. 
            
            
               Secondly, the setting up of an electronic exchange of information for refusals to grant authorisations required a more in-depth analysis, notably in respect of data protection considerations.
                     
            
            
               2.CONSULTATIONS PRIOR TO THE ADOPTION OF THE ACT
            
            
               The Commission carried out the appropriate consultations during its preparatory work. An expert working group on exchange of information was convened in June 2017 and met regularly over a 21-month period to discuss the arrangements of such an electronic exchange. 
            
            
               Consultations were also held with the European Data Protection Supervisor to ensure that such exchange of information between Member States takes place in compliance with the rules on data protection laid down in Regulation (EU) 2016/679
                  7
                of the European Parliament and of the Council. 
            
            
               During the consultation period on the Better Regulation Portal, no comment was received on the draft text.
            
            
               Close to the adoption of this delegated act, and after the consultation period, several Member States expressed concerns in writing about some of the provisions, mostly with respect to what they considered as excessive administrative burden and lack of clarity of the scope. Subsequently, the Commission made some additional changes to take the concerns into account, while not affecting the substance of the text. Member States where consulted by way of written procedure on this new version, which was supported by a large majority.
            
            
               3.LEGAL ELEMENTS OF THE DELEGATED ACT
            
            
               The delegated act describes the arrangements by which the exchange of information between Member States, relating to refusals to grant authorisations to acquire or possess firearms as provided for in Articles 9 and 10 of the Firearms Directive, on grounds of security or the reliability of persons concerned, is to be done in the electronic system. Furthermore, the delegated act establishes that this electronic system will be the Internal Market Information System, as stipulated in Article 2 of the delegated act.
            
            
               With respect to the scope of the Regulation, the powers of the Commission are constrained by the extent of the delegation. The Commission may not provide in this Regulation for a legally binding definition of the notion of “grounds of security or relating to the reliability of persons concerned” used – but not defined – in Article 18(4) of the Firearms Directive. However, when dealing with this notion, Member States should take into account the objectives of the Directive and in particular of Article 6(1)(b). The latter provision subjects the acquisition and possession of firearms “only [to] persons who have good cause and who […] are not likely to be a danger to themselves or others, to public order or to public safety” (including by having been convicted of a violent intentional crime).
            
         
         
            
               Member States’ representatives in the expert working group on exchange of information expressed their preference for a repository in the Internal Market Information System whereby information on a given refusal would be entered by the competent authorities in Member State concerned and made accessible to the competent authorities that have access to the repository in the other Member States. The expert working group considered that such an approach would provide for a systematic and reliable information exchange while keeping the administrative burden to a minimum for Member States. 
            
            
               Article 3 of the delegated act details the information that must be entered in the Internal Market Information System in order to enable an authority of a Member State to search for a specific individual who may have been refused a firearms authorisation in another Member State, as provided for in Articles 9 and 10 of the Firearms Directive  on grounds of security or reliability. It is pertinent to note that the Member States will not enter into the Internal Market Information System any information on the reasons for the refusal to grant an authorisation to an individual. In particular, no information on the criminal records or on the medical or psychological status of an individual will be entered into the Internal Market Information System. Where an authority in a Member State needs further information concerning the reason for the refusal, that authority can contact the relevant competent authority of that other Member State outside of the Internal Market Information System using appropriate means of communication and in compliance with relevant data protection legislation.
            
            
               Article 4 of the delegated act sets out certain obligations in relation to the obligation to remove, update and review information on the validity of the refusal decision, as appropriate. It provides that where a refusal decision is annulled or otherwise held to be invalid, the information relating to it entered in the Internal Market Information System should be removed within 30 calendar days. Article 4 also addresses other circumstances, where information entered in the Internal Market Information System relating to a refusal decision ceases to be accurate and complete for whatever reason (for instance as a result of the subsequent revocation or amendment of the decision). In such cases, it requires the competent authority to update the information relating to the refusal decision in question in the Internal Market Information System within 30 calendar days. Moreover, in the case of a refusal decision imposing an indefinite or a fixed term ban of more than 10 years, Article 4 provides that the information must be reviewed periodically and that the competent authority shall confirm that the refusal decision is still in force or update the information relating to it. 
            
            
               Article 5 of the delegated act sets out the period of time during which information should remain in the Internal Market Information System. Article 5 ensures that at any given point in time, the Internal Market Information System will contain information on any refusal decision that has been made or has been in effect in the course of the previous 10 years, provided the refusal decision was adopted after the start of application of the delegated act, and in the case of indefinite or fixed-term ban of more than 10 years, provided the competent authorities have complied with the periodic review obligations laid down in Article 4. The 10-year duration is informed by the different practices amongst Member States for retaining information on refusals to grant authorisations in their national systems. Moreover, a 10-year period is long enough to provide for a useful and effective tool for Member States when undertaking background checks for individual persons with respect to potential security or reliability risks related to possessing a firearm. 
            
            
               Article 6 of the delegated act creates a review clause, requiring the Commission to re-examine the delegated act within two years of its entry in application.  This article will enable the Commission to assess in practice the added value of the delegated act as a mechanism to help Member States to obtain more information about the risks posed by persons applying for authorisations for firearms. Member States will also be in a position to provide evidence-based feedback on potential administrative burden created by some of the provisions. 
            
            
               Pursuant to Article 7, the delegated act will enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. However, it will start to apply only six months from the date of publication, in order to give sufficient time to the Member States to put the necessary procedures in place. 
            
            
               COMMISSION DELEGATED REGULATION (EU) …/...
            
            
               of 21.5.2021
            
            
               laying down the detailed arrangements under Directive (EU) 2021/555 of the European Parliament and of the Council for the systematic exchange, by electronic means, of information relating to refusals to grant authorisations to acquire or possess certain firearms
            
            
               (Text with EEA relevance)
            
            
               THE EUROPEAN COMMISSION,
            
            
               Having regard to the Treaty on the Functioning of the European Union,
            
            
               Having regard to Directive (EU) 2021/555 of the European Parliament and of the Council  of 24 March 2021 on the control of the acquisition and possession of weapons
                  8
               , and in particular Article 18(5), the second subparagraph, thereof,
            
            
               Whereas:
            
            
               (1)Articles 9 and 10 of Directive (EU) 2021/555 provide for the grant of authorisations to acquire or possess firearms classified in category A or category B, including grants made by confirming, renewing or prolonging an existing authorisation. Chapter 2 of that Directive also provides for the periodic review and withdrawal of such authorisations.
            
            
               (2)Article 18(4) of Directive (EU) 2021/555 requires the competent authorities of the Member States to exchange information with regard to refusals to grant authorisations as provided for in Articles 9 and 10 of that Directive on grounds of security or relating to the reliability of the person concerned. Since Directive (EU) 2021/555 does not define the concepts of grounds of security or relating to the reliability of the person concerned, Member States should take into account the objectives of Directive (EU) 2021/555 and in particular of Article 6(1)(b) thereof, when interpreting those concepts.
            
            
               (3)The obligation under Article 18(4) of Directive (EU) 2021/555 with regard to refusals to grant authorisations is understood to cover any administrative or judicial decision made by a public authority of a Member State, the object or effect of which is to preclude a person from acquiring or possessing a firearm falling within the scope of Article 9 or 10 of that Directive, whether or not following a request for authorisation, whether or not relating to specific firearms and whether or not made pursuant to powers arising under that Directive specifically. For example, the obligation covers a blanket ban on the acquisition or possession of firearms by a particular person, regardless of whether that person had previously applied for an authorisation. It also covers any administrative or judicial decision withdrawing an existing authorisation or refusing to confirm, renew or prolong an existing authorisation. Article 18(4) of Directive (EU) 2021/555 requires competent authorities to exchange information on all these various types of decision, provided the decision was made either on grounds of security or relating to the person’s reliability.
            
            
               (4)Article 18(5) of Directive (EU) 2021/555 requires the Commission to provide for a system for the exchange of any information mentioned in that Article. This would therefore include a system for exchange of the information mentioned in paragraph 4 of that Article relating to refusals to grant authorisations.
            
            
               (5)The administrative cooperation provisions in Article 18 of Directive (EU) 2021/555 relating to the transfer of firearms from one Member State to another are the subject of a pilot project under Article 4 of Regulation (EU) No 1024/2012 of the European Parliament and of the Council
                  9
               . The Internal Market Information System established by that Regulation could also be an effective tool in implementing the administrative cooperation provision set out in Article 18(4) of Directive (EU) 2021/555 relating to refusals to grant authorisations. Accordingly, Commission Implementing Decision C(2021) 3401
                  10
                makes that provision subject to a pilot project under Article 4 of Regulation (EU) No 1024/2012. In order to protect the personal data of individuals and their rights to privacy, that Implementing Decision specifies that the Internal Market Information System will only allow national authorities to check whether information relating to specific individuals is included in the Internal Market Information System, not to search by reference to more general criteria. Regulation (EU) No 1024/2012 also contains specific safeguards governing access to and the processing of personal data in the Internal Market Information System, for example the rules under Article 9(4) allowing access on a need-to-know basis only. It is therefore appropriate to identify the Internal Market Information System as the system to be used by the competent authorities of the Member States for the purposes of the exchange of information relating to refusals to grant authorisations, and to lay down the detailed arrangements for such exchanges.
            
            
               (6)In order to avoid a disproportionate administrative burden on Member States, the detailed arrangements laid down by this Regulation for the exchange of information via the Internal Market Information System should only apply to refusal decisions made by national administrative or judicial authorities on or after the date of application of this Regulation. 
            
         
         
            
               (7)In order to respect the data protection rights of the individuals concerned, the information to be entered into the Internal Market Information System by a competent authority should be confined to the minimum necessary to enable the competent authorities of other Member States to verify whether a given person is or has been the subject of a refusal decision made on grounds of security or relating to their reliability. The information should therefore only include personal data such as a person’s name, their place and country of birth and their nationality.
            
            
               (8)Similarly, in order to protect the personal data of individuals and their rights to privacy, information on the specific reasons why a refusal decision was made should not be recorded in the Internal Market Information System. In particular, information on a person’s criminal record or their medical or psychological status should not be recorded in the Internal Market Information System. Where a competent authority in a Member State needs further information about the reasons for a refusal decision made in another Member State, that competent authority would be able to contact the relevant authority in the other Member State outside of the Internal Market Information System using an appropriate means of communication and in compliance with relevant data protection legislation. To that end, when recording a refusal decision in the Internal Market Information System, Member States should indicate the name and contact details of the administrative or judicial authority that made the refusal decision and, where different, the name and contact details of the authority that can be contacted by the competent authorities of other Member States when they are seeking further information about the refusal decision.
            
            
               (9)Refusals should be recorded in the Internal Market Information System even if they may be subject to administrative or judicial appeal. If a refusal decision is annulled or otherwise held to be invalid after information relating to it has been entered in the Internal Market Information System, the relevant authority should be required to remove the entry relating to that refusal no later than 30 calendar days after the refusal decision was annulled or found to be invalid. 
            
            
               (10)In order to ensure that the information contained in the Internal Market Information System remains accurate and complete, Member States should be required to update their entries whenever a relevant change occurs. For example, if a 5-year ban were subsequently reduced to 3 years, the Member State would need to update the entry to record the new end date of the ban. In the case of bans of more than 10 years, including indefinite bans, Member States should also be required to review the entry at least once every 10 years and confirm that it remains valid (or update it accordingly). 
            
            
               (11)It is necessary to determine the period of time that information on a given refusal is to remain accessible by Member States in the Internal Market Information System. That period has to strike a balance between the need to make the information exchange system as effective and useful as possible for Member States and the need to protect the personal data of individuals and their rights to privacy. A refusal could be a simple, one-off decision rejecting a request for authorisation and leaving the applicant free to re-apply for authorisation at any time in the future, or it could be a decision with on-going effect, such as a rejection decision that has the effect, directly or indirectly, of barring the applicant from re-applying for authorisation for a period of time or a decision banning a person from possessing firearms for a fixed or indefinite period. Taking into account current practices in Member States for the various types of refusal that could occur, it is appropriate to provide in this Regulation for information on a refusal decision to remain accessible in the Internal Market Information System for a period of 10 years after the refusal decision was made, in the case of simple, one-off decisions, or for a period of 10 years after the refusal decision ceased to have effect, in the case of decisions with on-going effect. 
            
            
               (12)The Commission should review this Regulation within two years of its date of application in order to take into account possible implementation issues that could be raised by Member States.
            
            
               (13)Application of this Regulation should be deferred in order to allow Member States sufficient time to put in place the necessary procedures, 
            
            
               HAS ADOPTED THIS REGULATION:
            
            
               Article 1
            
            
               Scope
            
            
               This Regulation applies to the exchange, via the system referred to in Article 18(5) of Directive (EU) 2021/555, of information concerning refusals to grant authorisations as provided for in Articles 9 and 10 of that Directive on grounds of security or relating to the reliability of the person concerned. 
            
            
               A refusal falls within the scope of this Regulation only if the administrative or judicial decision by which the person concerned is precluded from acquiring or possessing the relevant firearms (referred to in this Regulation as ‘the refusal decision’) was made on or after the date of application of this Regulation. 
            
            
               Article 2
            
            
               The electronic exchange system
            
            
               For the purposes of exchanging information to which this Regulation applies, the system referred to in Article 18(5) of Directive (EU) 2021/555 shall be the Internal Market Information System as provided for in Implementing Decision C(2021) 3401.
            
            
               Article 3
            
            
               Information to be exchanged
            
            
               1.The information to be exchanged pursuant to Article 18(4) of Directive (EU) 2021/555 with regard to a refusal to grant an authorisation as provided for in Article 9 or 10 of that Directive on grounds of security or relating to the reliability of the person concerned shall comprise the following: 
            
            
               (a)the name of the person concerned; 
            
            
               (b)the date of birth of that person; 
            
         
         
            
               (c)the place and country of birth of that person;
            
            
               (d)the nationality of that person; 
            
            
               (e)the date on which the refusal decision was made; 
            
            
               (f)the national reference number or other unique identifier of the refusal decision, if such a number or identifier has been allocated to the refusal decision in the Member State where it was made;
            
            
               (g)the name and contact details of the administrative or judicial authority that made the refusal decision and, if different, the name and contact details of the authority to be contacted in order to seek further information about the refusal;
            
            
               (h)to which one of the following three categories the refusal decision belongs:
            
            
               (i)
                     refusal decisions that operate to preclude a person from acquiring or possessing a firearm indefinitely, without a fixed end date; 
            
            
               (ii)
                     refusal decisions that operate to preclude a person from acquiring or possessing a firearm for a defined period, with a fixed end date (including decisions rejecting a request for authorisation that have the effect of barring the person from re-applying for authorisation within a defined period, with a fixed end date); 
            
            
               (iii)
                     refusal decisions that do not fall within either point (i) or point (ii); 
            
            
               (i)if the refusal decision falls within point (h)(ii), the fixed end date in question;
            
            
               (j)to which one of the following three categories the refusal decision belongs:
            
            
               (i)
                     refusal decisions made in response to a request for authorisation as provided for in Article 9 or 10 of Directive (EU) 2021/555, or in response to a request to confirm, renew or prolong such an authorisation;
            
            
               (ii)
                     refusal decisions withdrawing an authorisation granted, confirmed, renewed or prolonged under Article 9 or 10 of Directive (EU) 2021/555;
            
            
               (iii)
                     refusal decisions that do not fall within either point (i) or point (ii). 
            
            
               2.In addition to information mentioned in paragraph 1, points (a) to (d), Member States may choose to provide further identification details of the person concerned, such as a tax code, passport number or identity card number, where necessary to correctly identify that person.
            
            
               3.The information listed in paragraph 1 and, where applicable, the further details referred to in paragraph 2 shall be entered in the Internal Market Information System within 30 calendar days of the date on which the refusal decision was made and shall be immediately accessible by the competent authorities of all Member States. 
            
            
               Article 4
            
            
               Obligations to remove, update and review information 
            
            
               1.Where a refusal decision is annulled or otherwise held to be invalid after information relating to it has been entered in the Internal Market Information System, the competent authority shall remove the entry from the Internal Market Information System within 30 calendar days of the annulment or finding of invalidity. 
            
            
               2.Where, in circumstances other than those referred to in paragraph 1, information entered in the Internal Market Information System relating to a refusal decision ceases to be accurate and complete for whatever reason, including as a result of the subsequent revocation or amendment of the refusal decision, the competent authority shall update the information in the Internal Market Information System relating to that refusal within 30 calendar days from the date on which the information ceased to be accurate or complete. In a case involving revocation of the refusal decision, the date from which the revocation takes effect (‘the revocation date’) shall be added to the entry in the Internal Market Information System. 
            
         
         
            
               3.In the case of an entry in the Internal Market Information System for a refusal decision falling within Article 3(1)(h)(i), the competent authority shall review the entry at least once every 10 years from the date on which the refusal decision was made and shall update the entry, immediately following each such review, to confirm that the refusal decision remains in force or, if the decision has been revoked, to record the revocation date in accordance with paragraph 2. 
            
            
               4.In the case of an entry for a refusal decision falling within Article 3(1)(h)(ii) with a fixed end date that is more than 10 years after the date on which the refusal decision was made, the competent authority shall review the entry at least once every 10 years from the date on which the refusal decision was made, up until the date recorded in the Internal Market Information System as the fixed end date, and shall update the entry, immediately following each such review, to confirm that the refusal decision remains in force or, if the decision has been revoked, to add the revocation date in accordance with paragraph 2.
            
            
               5.If a refusal decision is revoked, the obligation in paragraph 3 or, as applicable, paragraph 4 shall cease to apply to the entry once it has been updated to add the revocation date in accordance with paragraph 2.
            
            
               Article 5
            
            
               Period for which information remains accessible in the Internal Market Information System 
            
            
               1.Information exchanged via the Internal Market Information System in accordance with this Regulation shall remain accessible in the Internal Market Information System for 10 years from whichever of the following dates is the latest one, insofar as they are applicable to the refusal decision in question and taking account of any updates made pursuant to Article 4:
            
            
               (a)the date recorded in the Internal Market Information System as the date on which the refusal decision was made;
            
            
               (b)the date recorded in the Internal Market Information System as the date on which the entry was last updated to confirm that the refusal decision remains in force;
            
            
               (c)the date recorded in the Internal Market Information System as the fixed end date of the refusal decision.
            
            
               However, in the case of an entry in the Internal Market Information System subject to the obligation under Article 4(4), if the competent authority fails to comply with that obligation, the entry shall cease to be accessible in the Internal Market Information System on expiry of the deadline set by that Article for compliance with that obligation.
            
            
               2.Notwithstanding paragraph 1, for any refusal decision for which a date is recorded in the Internal Market Information System as the date from which revocation of the decision takes effect, the entry shall cease to be accessible in the Internal Market Information System on expiry of the period of 10 years from the date so recorded in the Internal Market Information System as the revocation date. 
            
            
               Article 6
            
            
               The Commission shall review this Regulation within two years of its date of  application.
            
            
               Article 7
            
            
               This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
            
            
               It shall apply from 31 January 2022.
            
            
               This Regulation shall be binding in its entirety and directly applicable in all Member States.
            
            
               Done at Brussels, 21.5.2021
            
            
               
                     For the Commission
               
               
                     The President
                     Ursula VON DER LEYEN
               
            
         
         
            
                  
                     (1)
                  
                        Directive 91/477/EEC of 18 June 1991 on control of the acquisition and possession of weapons (OJ L 256, 13.9.1991, p. 51).
               
               
                  
                     (2)
                  
                        By Directive (EU) 2017/853 of the European Parliament and of the Council of 17 May 2017 (OJ L 137, 24.5.2017, p. 22).
               
               
                  
                     (3)
                  
                        Directive (EU) 2021/555 of the European Parliament and of the Council of 24 March 2021 (OJL 115, 6.4.2021 p. 1-25). 
               
               
                  
                     (4)
                  
                        Regulation (EU) No 1024/2012 of the European Parliament and of the Council of 25 October 2012 on administrative cooperation through the Internal Market Information System and repealing Commission Decision 2008/49/EC (OJ L 316, 14.11.2012, p. 1).
               
               
                  
                     (5)
                  
                        Commission Implementing Decision C(2021) 3401 on a pilot project to implement the administrative cooperation provisions relating to refusals to grant authorisations set out in Directive (EU) 2021/555 of the European Parliament and of the Council by means of the Internal Market Information System.
               
               
                  
                     (6)
                  
                        OJ L 116, 3.5.2019, p. 1. Similarly to what is being proposed in the context of the present delegated act, in parallel to Commission Delegated Regulation (EU) 2019/686, an implementing decision on the use of the Internal Market Information System as a pilot project was adopted, i.e. Commission Implementing Decision (EU) 2019/689 of 16 January 2019 on a pilot project to implement certain cooperation provisions set out in Council Directive 91/477/EEC by means of the Internal Market Information system.
               
               
                  
                     (7)
                  
                        Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ L119, 4.5.2016, p.1).
               
               
                  
                     (8)
                  
                        OJ L 115, 6.4.2021, p.1-25.
               
               
                  
                     (9)
                  
                        Regulation (EU) No 1024/2012 of the European Parliament and of the Council of 25 October 2012 on administrative cooperation through the Internal Market Information System and repealing Commission Decision 2008/49/EC (OJ L 316, 14.11.2012, p. 1).
               
               
                  
                     (10)
                  
                        Commission Implementing Decision C(2021) 3401 on a pilot project to implement the administrative cooperation provisions relating to refusals to grant authorisations set out in Directive  (EU) 2021/555 by means of the Internal Market Information System.