EDPS Opinion 31/2023 on the Proposal for a Regulation establishing the Union Customs Code and the European Union Customs Authority

11 July 2023

Opinion 31/2023

on the Proposal for a Regulation establishing the Union Customs Code and the European Union Customs Authority

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council establishing the Union Customs Code and the European Union Customs Authority, and repealing Regulation (EU) No 952/2013 .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 17 May 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council establishing the Union Customs Code and the European Union Customs Authority, and repealing Regulation (EU) No 952/2013.

The Proposal aims to revise the current Union Customs Code in order to strengthen the capacity of customs to supervise and control which goods enter and leave the Customs Union. It should also simplify the customs legislation by reducing formalities and compliance costs for businesses and administrations. A new EU Customs Authority is created, together with a single online environment, the EU Customs Data Hub, which over time would replace the existing customs IT infrastructure in EU Member States.

The EDPS acknowledges the essential role that the EU Customs Hub is expected to play in the new architecture, by enabling the processing of large amounts of data, including personal data, for customs purposes. In this context, the EDPS welcomes the reference to the EU data protection law in the Proposal, as well as the inclusion of requirements relating to the processing of personal data.

At the same time, the EDPS considers that the Proposal lacks precision regarding the different categories of data subjects whose personal data may be processed in the EU Customs Data Hub, the categories of personal data concerned, as well as the purposes of the processing. Further consideration should also be given to the automated processing of personal data in the context of risk analysis, and to the storage period of personal data which should be limited to what is strictly necessary for the purposes pursued. Finally, the Proposal should ensure that the roles and responsibilities of each of the entities processing personal data in the context of the EU Customs Data Hub are clearly defined.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 17 May 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council establishing the Union Customs Code and the European Union Customs Authority, and repealing Regulation (EU) No 952/2013 (‘the Proposal’).

2. The objective of the Proposal is to ‘bring a step change to the Customs Union’ , by establishing the European Union Customs Authority (‘the EU Customs Authority’), as well as the European Union Customs Data Hub (‘EU Customs Data Hub’) . The reform aims to strengthen the capacity of customs to supervise and control which goods enter and leave the Customs Union .

3. This reform follows up on the 2020 Customs Action Plan of the Commission, and the foresight exercise engaged by the Commission with stakeholders, academia and international partners on the future of customs in the EU 2040 .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 17 May 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 30 of the Proposal.

2. General remarks

5. The EDPS notes that the Proposal constitutes ‘the most ambitious and comprehensive reform of the Customs Union since its birth in 1968’ . The reform is based on a new partnership among EU customs authorities and between customs and business, with two overarching objectives: reducing compliance costs for administrations and businesses through simplified and modernised procedures, and enabling EU Customs to better protect the financial and non-financial interest of the EU and its Member States as well as the Single Market, based on common, EU-wide risk management and more harmonised controls.

6. The reform is expected to have important consequences on the way data, including personal data, are processed for customs purposes. According to the Commission, ‘the EU Customs Authority will pool customs expertise at central level to carry out EU risk management, exploiting for risk analysis purposes the wealth of constantly updated data in the EU Customs Data Hub’ . Moreover, The EU Customs Authority should also be the ‘central customs interlocutor for non-customs authorities’ tasked with preserving the integrity of the Single Market, and should ensure operational cooperation and coordination with relevant entities, ‘including EU Agencies such as Europol and Frontex’ .

7. The EU Customs Data Hub would entail processing of large amounts of data, supporting risk analysis, economic analysis and data analysis, including through the use of artificial intelligence systems, and support cooperation with other electronic systems, by means of interoperability .

8. Processing of personal data by the EU Customs authority and through the EU Customs Hub constitutes an interference with the fundamental rights to privacy and to the protection of personal data. Such interference must be necessary and proportionate . In order to satisfy the requirement of proportionality, the legislation must lay down clear and precise rules governing the scope and application of the measures in question and imposing minimum safeguards, so that the persons whose personal data is affected have sufficient guarantees that data will be effectively protected against the risk of abuse. It should be clear, precise and its application foreseeable to the persons whose personal data is affected . In order to ensure that the interference remains limited to what is strictly necessary, the Proposal should clearly indicate which categories of personal data may be used by which competent authority and for which specific purposes.

9. The EDPS notes positively the reference in the Proposal to the EU data protection law, as well as the inclusion of provisions relating to the purposes, categories and retention periods of personal data processed in the EU Customs Data Hub, the roles and responsibilities for personal data processed and the restriction of data subject rights . At the same time, the EDPS considers that the content of several provisions should be developed further in order to ensure respect for fundamental rights.

10. The EDPS notes that the implementation of the new Union Customs code would be rolled out in steps over the coming 10 to 15 years. In the meantime, the IT deployment of the 2013 Customs Reform establishing the current Union Customs Code (UCC) Regulation, in force since May 2016, is still ongoing and is expected be completed by the end of 2025. In this regard, the EDPS recalls all his previous formal comments on delegated or implementing acts linked to Regulation (EU) 952/2013, and especially his call for a more comprehensive legal basis , which also remain fully relevant during the implementation of the 2013 Customs Reform.

3. Purpose limitation and user access

11. According to Article 5(1)(b) of the GDPR and Article 4(1)(b) of the EUDPR, personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. The principle of purpose limitation is designed to establish the boundaries within which personal data collected for a given purpose may be processed and may be put to further use.

12. Article 31 of the Proposal is entitled ‘Purposes of the processing of personal data and other data in the EU Customs Data Hub’. The article is organised along 11 different categories of users and defines the purposes of the processing of personal data through a broad justification for each user category’s access rights to the Data Hub.

13. The EDPS considers that not all purposes listed in Article 31 of the Proposal provide the required degree of specificity on the purposes of the processing of personal data. In particular, Article 31(2)(a) contains a generic reference to all possible different legal bases for activities by customs authorities, without providing any details as regards the specific legislation in question .

14. The EDPS considers that this purpose definition, based on a general reference to ‘the implementation customs legislation or other legislation’ is too broad. Absent further specification, it does not provide a clear indication of which purposes are being pursued or to determine which categories of personal data would be relevant, necessary and proportionate to the purpose.

15. In the same vein, Article 31(2)(c) of the Proposal would authorise customs authorities to process personal data in the EU Customs Data Hub to carry out the tasks necessary for ‘the cooperation under the conditions provided for in Title XIII’. Article 239(1) of the Proposal, however, refers in very general terms to cooperation among customs authorities and with other authorities, without referring to specific provisions of legislation that would require the processing and exchange of personal data among those authorities.

16. The EDPS notes that the processing of personal data stored in the future EU Customs Data Hub would correspond to a broad range of purposes, including police and judicial activities with access to the Hub by the European Union Agency for Law Enforcement Cooperation (Europol) and the European Public Prosecutor’s Office (EPPO) . Bearing in mind the diversity of uses to be offered by the Hub, the EDPS considers that further efforts are needed to ensure that the new structure should not lead to a weakening of the fundamental rights and freedoms of natural persons, and in particular of their rights to privacy and data protection.

17. The EDPS considers that the Proposal should refer to the specific provisions of ‘customs legislation or other legislation applied by the customs authorities’ that would justify the processing and exchange of personal data. Where Union law is concerned, relevant provisions could be listed in an Annex to the Proposal. Where national law would provide the legal basis for the processing of personal data in the Customs Data Hub, Member States should be required by the Proposal to notify these provisions to the Commission and to make them publicly available.

18. The EDPS recognizes that the Proposal aims to mitigate some of these shortcomings by providing in Article 31(13) that the Commission is empowered to adopt delegated acts to amend paragraphs 2 to 4 to clarify and complement the purposes laid down therein, in light of the evolving needs in implementing customs legislation or other legislation. Moreover, Article 31(14) of the Proposal requires the Commission to lay down, by means of implementing acts, a number of safeguards, in order to ensure that the personal data stored or otherwise available in the EU Customs Data Hub should be processed in compliance with the EU data protection law. The EDPS considers, however, that the purposes of the processing should be clearly established in the Proposal itself. At a minimum, Article 31 of the Proposal should make reference to the specific provisions of Union customs legislation or other Union legislation that would justify the processing of personal data in the EU Customs Data Hub.

4. Categories of data subjects and of personal data

19. Paragraphs 1 and 2 of Article 32 of the Proposal provide indications on both categories of data subjects whose personal data might be processed, and of categories of personal data that would be processed. Paragraph 3 of the same article states that delegated acts might be adopted to amend or supplement those categories ‘to take into account of developments in information technology and in the light of the state of progress in the information society’.

4.1 Categories of data subjects

20. The EDPS recalls that, in line with the data minimisation principle laid down in Article 5(1)(c) of the GDPR and Article 4(1)(c) of the EUDPR, the collection of personal data should be limited to what is necessary to fulfil the purposes for which they are processed. Consequently, the EDPS considers that the different categories of data subjects and personal data that are necessary to achieve the purposes of the processing as set out in the Proposal should be sufficiently specified, in order to avoid overly broad categories.

21. Against this background, the EDPS notes that, among the categories of data subjects, one of them is defined as ‘data subjects who are occasionally involved in activities covered by the customs legislation or by other legislation applied by the customs authorities’ . It seems that such a category could potentially concern any person. The EDPS underlines the importance of clearly defining the categories of data subjects, in particular where there is a need to limit processing to specific categories of data subjects due to the particularly intrusive nature of the measure. Thus, the EDPS recommends explicitly clarifying which individuals would belong to this category and whether specific safeguards should be envisaged for those data subjects who are only ‘occasionally’ involved in activities covered by legislation applied by customs authorities.

22. Similarly, another category of data subjects is defined as ‘data subjects whose personal data is contained in the data collected for risk management purposes pursuant to Article 50(3), point (a)’ . However, Article 50(3), point (a) simply refers to the collection, processing, exchange and analysis of ‘relevant data available in the EU Customs Data Hub and from other sources, including relevant data from authorities other than customs authorities’. It seems that the description of the categories of data subjects is circular, without providing any foreseeability as regards the individuals affected. Here again, the EDPS considers necessary to further clarify which persons might be affected by the processing.

4.2 Categories of personal data

23. As regards categories of personal data which might be processed in the EU Customs Data Hub, the EDPS considers that two of the three categories are not sufficiently specified in the Proposal.

24. Article 31(2) refers to ‘personal data in the EU Customs Data model referred to in Article 36’ of the Proposal. According to Article 36, the determination of data required for the fulfilment of the purposes referred to in Article 31 (1) to (4) should be achieved by means of delegated acts adopted by the Commission. The EDPS considers that the different categories of personal data that are necessary for the purposes of the processing as set out in the Proposal should be laid down in the Proposal itself, and not relegated to implementing provisions. The EDPS understands that it may not be possible, given the number of purposes and the evolution of IT systems processing data, to specify each data category in full detail in the Proposal itself. The EDPS considers, however, that only more detailed data fields (sub-categories of data) falling under the already defined categories of data should be specified through the adoption of delegated acts.

25. It is also the case of personal data included in the data collected for risk management purposes pursuant to Article 50(3), point (a), which refers to the collection, processing, exchange and analysis of ‘relevant data available in the EU Customs Data Hub and from other sources, including data from authorities other than customs authorities’. The choice of open-ended formulations, such as ‘relevant data available’, ‘other sources’, “other authorities”, does not provide a sufficiently clear indication category of data to be made available pursuant to the Proposal, nor does it provide a clear indication as to their source. As a result, the Proposal does not provide persons whose personal data is affected with sufficient guarantees that data will be effectively protected against the risk of abuse.

26. Against this background, the EDPS considers that the Proposal should further specify those two categories of personal data, so as to provide a comprehensive overview of the categories of personal data concerned. Moreover, the Proposal should clearly specify the purpose(s) for which each category of personal data may be processed.

5. Customs risk management

27. According to Article 29 of the Proposal, the EU Customs Data Hub should, among other tasks, ‘enable risk analysis, economic analysis and data analysis, including through the use of artificial intelligence systems, in accordance with (the future Artificial Intelligence Act)’.

28. Article 50 of the Proposal further provides that ‘economic operators’ , namely persons who, in the course of their business, are involved in activities covered by customs legislation, may be selected on the basis of an automated risk analysis and subject to customs controls. These economic operators can be natural persons.

29. According to the case law of the CJEU, the risk criteria to be used to select persons by means of an automated processing, when resulting in individual decisions, should: (1) be based on circumstances that are reliable and directly linked to objective factors; (2) not entail a (direct or indirect) risk of discrimination (such as race, ethnic origin, religion, political orientation, sexual orientation); and (3) not be excessively broad . Such criteria should apply in the context of customs controls.

30. As indicated above, the EDPS considers that the Proposal is insufficiently clear and precise as to the categories of personal data and their source. A clear specification of the categories of personal data and the sources with which those personal data may be combined (or compared) is necessary in order to establish that the processing of personal data in the context of customs risk management is limited to what is strictly necessary.

31. The EDPS recommends a careful assessment and appropriate mitigation of potential adverse effects on the persons subject of control, in particular having regard to any possible stigmatisation or prejudice against affected persons.

6. Storage period

32. The EDPS welcomes the introduction, in Article 33 of the Proposal of a maximum retention period for the storage of personal data in the EU Customs Data Hub. This period of 10 years is duly justified in Recital 27 ‘in light of the possibility for customs authorities to notify the customs debt up to 10 years after having received the necessary information about a consignment, as well as to ensure that the Commission, the EU Customs Authority, OLAF, customs and authorities other than customs can cross-check the information in the EU Customs Data Hub against the information stored in and exchanged with other systems’. He regrets however the possibility to suspend the retention period in cases of post-release controls, investigations launched by OLAF, EPPO or by Member States’ authorities, infringement procedures launched by the Commission and administrative and judicial proceedings involving personal data. Such suspensions may potentially lead to an extension of the maximum storage period beyond the period necessary and create a legal uncertainty as regards the final duration for the storage of personal data. Thus, the EDPS recommends to envisage, prior to the expiry of the global retention period, periodical reviews of the need for the continued storage of the personal data in the EU Customs Data Hub, including in the context of situations having a suspensive effect on the retention period. In addition, the EDPS recommends to limit to the strict minimum the use of periods of suspension for the calculation of retention periods.

33. Moreover, personal data may be retained for law enforcement purposes, in accordance with Article 33(1) of the Proposal. In such cases, the determination of a storage duration must, in accordance with the CJEU case law, be based on objective criteria, and different storage duration should be set for the different categories of data stored on the ‘basis of their possible usefulness for the purposes of the objective pursued or according to the persons concerned’. The EDPS invites the co-legislators to specify which categories of personal data should be retained in the context of criminal investigations launched by EPPO, or Member States’ authorities.

7. Roles and responsibilities

34. The EDPS welcomes Article 34 of the Proposal, which is dedicated to the ‘roles and responsibilities for personal data processed in the EU Customs Data Hub’. The EDPS notes, however that, Article 34 does not explicitly define the roles of the actors involved for each of the purposes listed in Article 31 of the Proposal. In particular, it is not clear which authority should be the controller for the personal data processing referred to in Article 31(1) of the Proposal. Similarly, the designation of the controllers for the personal data processing referred to in Article 31(3)(b) and Article 31(4)(b) and (h), 31(7), (8), (9) and (10) is missing. The EDPS considers that for every purpose of the processing established by the Proposal, there should be at least one or more (joint) controller(s) 25 26 identified . In cases where customs authority is designated as sole controller , it should be clarified whether or not the Commission would be acting as processor. If so, an empowering provision for a controller-processor arrangement should be considered (similar to what is provided as regards the arrangement for joint controllers in Article 34(6) of the Proposal).

35. In addition, Article 29(3) provides for the establishment, by the Commission, of a ‘data quality framework’. While welcoming such an initiative in order to support the accuracy principle laid down in the EU data protection law, the EDPS recommends to determine the authorities responsible for its implementation.

8. Conclusions

36. In light of the above, the EDPS makes the following recommendations: (1) to further specify the purposes for which the personal data available in the EU Data Customs Hub should be processed; (2) to make reference the specific provisions of Union customs legislation or other Union legislation that justify the processing of personal data in the EU Customs Data Hub; (3) to require Member States to notify which provisions of national legislation that justify the processing of personal data in the EU Customs Data Hub and to make these notifications publically available; (4) to specify which individuals are considered to be ‘occasionally’ involved in activities covered by a legislation applied to customs authorities within the meaning of Article 32(1)(b) of the Proposal; (5) to specify the data subjects whose personal data shall be processed for risk management purposes within the meaning of Article 50(3)(a) of the Proposal; (6) to provide a comprehensive overview of the categories of personal data concerned and the purpose(s) for which each category of personal data may be processed; (7) to specify the categories of personal data and the sources with which those personal data may be combined (or compared) for the purposes of customs risk management; (8) to provide for periodical reviews of the need for the continued storage of the personal data in the EU Customs Data Hub and to limit to the strict minimum the use of periods of suspension for the calculation of retention periods; (9) to clearly define which entities should be considered as controllers and/or processors for the processing of personal data for each of the purposes referred to in Article 31 of the Proposal. Brussels, 11 July 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 12