EDPS Opinion 30/2023 on the Proposal for a Regulation amending Council Decision 2009/917/JHA, as regards its alignment with data protection

4 July 2023

Opinion 30/2023

on the Proposal for a Regulation amending Council Decision 2009/917/JHA as regards its alignment with data protection rules

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council amending Council Decision 2009/917/JHA, as regards its alignment with Union rules on the protection of personal data . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 11 May 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council amending Council Decision 2009/917/JHA, as regards its alignment with Union rules on the protection of personal data. Council Decision 2009/917/JHA is the legal act establishing the Customs Information System (CIS) in the former third pillar of the EU. Besides this legal act, there is Council Regulation (EC) No 515/97 which established the CIS of the former first pillar. The latter legal act is not affected by the Proposal.

The objective of the Proposal is to align the data protection rules in Council Decision 2009/917/JHA with the principles and rules laid down in Directive (EU) 2016/680 (‘the LED’), in order to provide a strong and coherent personal data protection framework in the Union.

The EDPS focuses in this Opinion on the matter of granting international or regional organisations access to the CIS, on the need for further clarity regarding applicable law and supervision, and on the potential to further harmonize supervision coordination with regard to the CIS.

While the EDPS welcomes the introduction of certain additional safeguards as regards access by international or regional organisations, he also recommends laying down further substantive conditions that would go beyond the provisions on international transfers. The EDPS further recommends clarifying the role of the EDPS in the supervision of the CIS, as well as the applicable data protection rules. Lastly, the EDPS invites the EU co-legislators to examine how supervision coordination for the two different CIS under Council Decision 2009/917/JHA and Council Regulation (EC) No 515/97 can be reconciled in one body.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 11 May 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council amending Council Decision 2009/917/JHA, as regards its alignment with Union rules on the protection of personal data (‘the Proposal’). Council Decision 2009/917/JHA is the legal act establishing the Customs Information System (CIS) in the former third pillar of the EU. Besides this legal act, there is the Council Regulation (EC) No 515/97 which established the CIS of the former first pillar. The latter legal act is not affected by the Proposal.

2. The objective of the Proposal is to align the data protection rules in Council Decision 2009/917/JHA with the principles and rules laid down in Directive (EU) 2016/680 (‘the LED’), in order to provide a strong and coherent personal data protection framework in the Union .

3. A legislative proposal to this effect was already envisaged in the Commission Communication of 24 June 2020 entitled ‘Way forward on aligning the former third pillar acquis with data protection rules’ . That Communication identified current Council Decision 2009/917/JHA on the use of information technology for customs purposes [CIS former third pillar] and nine other legal acts that should be aligned with the LED. Pursuant to Article 62(6) of the LED, the Commission is required to review acts of Union law which regulate the processing of personal data by the competent authorities for the purposes set 4 out in Article 1(1) of the LED, in order to assess the need to align those acts with the LED and to make, where appropriate, the necessary proposals to amend these acts to ensure a consistent approach to the protection of personal data within the scope of the LED.

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 11 May 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 8 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

5. The EDPS welcomes the alignment of the Council Decision with the LED as proposed by the Commission and in particular with regard to purpose specification, limitation to specific categories of data subjects and categories of personal data, and conditions for subsequent processing.

6. The EDPS further welcomes the decision to replace the term ‘serious contravention’ by the term ‘criminal offences’ throughout the text, including in Articles 15(3) and 22, and the additional clarifications provided in Recital 3 of the Proposal. The EDPS considers it particularly important and welcomes that the Commission recalls that the objective of the CIS should remain limited to assisting in connection to the prevention, investigation, detection or prosecution of the criminal offences under national laws in respect of which national customs administrations are competent. In conclusion, the Commission alludes to the fact that as a result, not all criminal offences should be considered to be covered, but only those which are particularly relevant in the context of customs (e.g., illicit drugs trafficking, illicit weapons trafficking and money laundering). In the same vein, it is also useful that the recital recalls that the introduction of the term ‘criminal offences’ would not affect the specific requirements set out in Council Decision 2009/917/JA regarding the establishment and sending of a list of relevant criminal offences under national law.

7. The EDPS focuses in this Opinion on the matter of granting international or regional organisations access to the CIS, on the need for further clarity regarding applicable law and supervision, and on the potential to further harmonize supervision coordination with regard to the CIS.

3. Access to the CIS by international or regional organisations

8. The EDPS notes that Article 1(6) of the Proposal would introduce changes to Article 7(3) of the Council Decision regarding access to the Customs Information System by international or regional organisations. While the provision currently requires the Council to take into account any reciprocal arrangements and any opinion on the adequacy of data protection measures by the Joint Supervisory Authority, the Proposal would make access dependent 5 on compliance with the conditions for international transfers of data under the LED. In addition, and in line with the new model of coordinated supervision, the opinion of the Joint Supervisory Authority would be replaced by consultation of the EDPB.

9. While the EDPS welcomes the clarification that access to the CIS by international or regional organisations should be “exceptional”, he considers that the Proposal should also specify substantive criteria on the basis of which such exceptional access would be granted.

10. The EDPS recalls that providing access to large-scale IT systems of the Union to international organisations should remain an exception. In fact, most of the legal acts establishing Union large-scale IT systems in the field of the JHA actually lay down a prohibition of the transfer of the data stored in them to third countries or international organisations, with some clearly defined exceptions .

11. Therefore, the EDPS recommends further enhancing Article 7(3) of the Council Decision by ensuring that access to CIS by international or regional organisations would be possible only if specific substantive conditions, defining especially the types of cooperation that could warrant such access, the types of international or regional organisations, the specific purposes that could justify granting of access, the types of personal data to be accessed, as well as technical and organisational safeguards applicable in that context.

4. Role of the European Data Protection Supervisor

12. The EDPS welcomes the decision to abandon the model of joint supervision of the CIS by a Joint Supervisory Authority, in line with the CIS for the former first pillar , and have the processing activities at European level monitored by the EDPS. The general competence for the EDPS to supervise the CIS follows from Article 52(3) EUDPR in the absence of a specific provision. The new Article 26 of the Council Decision, as amended by the Proposal, would only address the necessary coordinated supervision, without clarifying the role of the EDPS .

13. However, as a rule, the co-legislators have so far not relied on Article 52(3) EUDPR alone when establishing coordinated supervision within the framework of the EDPB, but clarified 6 explicitly that the EDPS is responsible for monitoring the processing of personal data by the respective EU institution or agency and for ensuring that it is carried out in accordance with the respective legal act, for example in Article 70 of Regulation (EU) 2018/1862 , Article 43 of Regulation (EU) 2016/794 , Article 42 of Regulation (EC) No 767/2008 , Article 56 of Regulation (EU) 2017/2226 and Article 67 of Regulation (EU) 2018/1240 . For the sake of clarity and legal security, the EDPS recommends to maintain this practice and clarify the role of the EDPS in the Proposal, using the cited provisions as a blueprint.

5. Applicable data protection law

14. In the same vein, the EDPS takes note of Article 1(11) which would provide for an amendment of Article 20 according to which Directive (EU) 2016/680 shall apply to the processing of personal data under this Decision. However, the LED cannot apply to the activities of the Commission as processor of the CIS directly. While it is possible that the Member States as controllers reach agreements with the Commission as processor on the basis of national laws implementing the LED, the processing activities of the Commission, including the CIS as such, would still fall under the EUDPR (whereas the processing operations in the CIS by the competent authorities of the Member States fall under the national laws implementing the LED).

15. Therefore, the EDPS recommends to amend Article 1(11) of the Proposal to also refer to the EUDPR in addition of the LED, as applicable. As both legal acts would apply de lege, alternatively Article 1(11) could also provide for the deletion of Article 20, and instead of a provision in the enacting terms, a recital could confirm the applicability of the relevant data protection rules. 7

6. Undivided supervision coordination for the CIS as a whole

16. The dissolution of the Joint Supervisory Authority and supervision at EU level vested in the EDPS, would bring about the need to coordinate supervision at Member State level with the EDPS. The Proposal provides that the model of coordinated supervision pursuant to Article 62 of the EUDPR should apply to the CIS of the former third pillar. That means the framework of the EDPB would be used to coordinate among Member States’ supervisory authorities and with the EDPS, rather than setting up a specific coordination group. The EDPS welcomes the choice for this horizontal model of supervision which applies to a steadily growing number of important electronic systems. In the customs sector, the electronic systems established under the Union Customs Code already follow this model of supervision coordination .

17. However, it should be noted that the replacement of the joint supervision model by coordinated supervision provides for an opportunity to consolidate supervision coordination for the two different CIS under Council Decision 2009/917/JHA and Council Regulation (EC) No 515/97. Council Regulation (EC) No 515/97 provides already for coordinated supervision, but follows the model of system-specific supervision coordination. A specific body, the CIS Supervision Coordination Group, has been set up for this purpose. The EDPS regrets that, at this point in time, there is still no prospect of transferring the supervision coordination for the CIS of the former first pillar to the framework of Article 62 EUDPR. As a result, two parallel formats co-exist in which CIS data protection matters are discussed and coordinated among supervisory authorities.

18. The EDPS therefore invites the co-legislators to examine if Article 37 of Council Regulation (EC) No 515/97 could not be brought in line with the horizontal model of coordinated supervision, on the occasion of this Proposal.

7. Conclusions

19. In light of the above, the EDPS makes the following recommendations: (1) to specify the substantive conditions, in addition to the provisions on international transfers, that must be fulfilled so that the Council may permit under exceptional circumstances an international or regional organisation to have direct access to data in the CIS, (2) to clarify the role of the EDPS in the supervision of the CIS, 8 (3) to modify Article 1(11) of the Proposal as to either add a reference to the EUDPR, as applicable, or to delete Article 20 of Council Decision 2009/917/JHA and recall the applicable law in a recital, and (4) to examine how to reconcile supervision coordination for the two different CIS under Council Decision 2009/917/JHA and Council Regulation (EC) No 515/97 in one body. Brussels, 4 July 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI p.o. Leonardo CERVERA NAVAS Head of EDPS Secretariat 9