REGULATION (EU) 2015/1525 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

18.9.2015 | EN | Official Journal of the European Union | L 243/1 ---|---|---|--- * * * REGULATION (EU) 2015/1525 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 9 September 2015 amending Council Regulation (EC) No 515/97 on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, and in particular Articles 33 and 325 thereof, Having regard to the proposal from the European Commission, After transmission of the draft legislative act to the national parliaments, Having regard to the opinion of the Court of Auditors, Acting in accordance with the ordinary legislative procedure (1), Whereas: (1) | In order to ensure that Council Regulation (EC) No 515/97 (2) covers all possible movements of goods in relation to the customs territory of the Union, it is appropriate to clarify the definitions of ‘customs legislation’ and ‘carriers’ with regard to the concepts of entry and exit of goods. ---|--- (2) | With a view to further enhancing administrative and criminal procedures for dealing with irregularities, it is necessary to ensure that evidence obtained through mutual assistance can be considered as admissible in proceedings before the administrative and judicial authorities of the Member State of the applicant authority. ---|--- (3) | With a view to increasing clarity, consistency and transparency, it is necessary to determine in more concrete terms the authorities which should have access to the directories established on the basis of Regulation (EC) No 515/97. For that purpose, a uniform reference to competent authorities should be established. Direct access for those authorities is an important condition for the effective implementation of the mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters. ---|--- (4) | Data concerning container movements make it possible to identify fraud with regard to goods that are moved in and out of the customs territory of the Union. Such data serve to assist in preventing, investigating and prosecuting operations which constitute, or appear to constitute, breaches of customs legislation. In order to collect and use a set of data as complete as possible, while avoiding potential negative impacts on small and medium-sized enterprises in the freight forwarding sector, it is necessary that carriers submit to the Member States data concerning container movements in so far as they collect such data in electronic formats by way of their equipment tracking systems or have such data stored on their behalf. Such data should be directly transmitted to a single directory established by the Commission for that purpose. ---|--- (5) | In order to ensure a high level of consumer protection, the Union has a duty to combat customs fraud and thus contribute to the internal market's objective of having safe products with genuine certificates of origin. ---|--- (6) | The detection of fraud depends significantly on the identification and cross-analysis of relevant operational data sets. It is necessary therefore to establish, at Union level, a directory containing data on the import, export and transit of goods, including the transit of goods within the Member States and direct exports. For that purpose, the Commission should systematically replicate data from the sources operated by the Commission into the import, export and transit directory, and Member States should have the option to supply to the Commission data relating to transit of goods within a Member State and direct exports, depending on the availability of data and Member States' information technology infrastructure. ---|--- (7) | The introduction, pursuant to Decision No 70/2008/EC of the European Parliament and of the Council (3), of the electronic customs systems in 2011, by which documents supporting imports and exports are no longer kept by customs authorities but by economic operators, has led to delays in the conduct of European Anti-fraud Office (OLAF) investigations in the customs area, as OLAF relies on those authorities to help it obtain such documents. Moreover, the three-year limitation period to recover customs debt puts additional constraints on the successful conduct of investigations. In order to accelerate the conduct of investigations in the area of customs, in addition to the other possibilities for the Commission to obtain information concerning declarations, the procedure in accordance with which the Commission may request from Member States documents supporting import and export declarations should be specified. ---|--- (8) | In order to ensure the confidentiality and increase the security of data entered into the directories established on the basis of this Regulation and of Regulation (EC) No 515/97, provision should be made for limiting access to those data to specific users and for defined purposes only. ---|--- (9) | Regulation (EC) No 515/97 provides for the processing of data. Such processing may also cover personal data and should be carried out in accordance with Union law. In particular, the processing of personal data should be carried out in a manner compatible with the purpose of that Regulation and in accordance with Directive 95/46/EC of the European Parliament and of the Council (4) and Regulation (EC) No 45/2001 of the European Parliament and of the Council (5) and, in particular, with Union requirements relating to data quality, to proportionality, to purpose limitation, and to rights to information and to access, rectification, erasure and blocking of personal data, with organisational and technical measures and with international transfers of personal data. Specific provision should be made for limiting access to data entered to specific users only, in order also to ensure the confidentiality of data entered. ---|--- (10) | The Commission and Member States should protect confidential business information and they should ensure the confidential treatment of information exchanged by means of the directory of reported Container Status Messages and the import, export and transit directory. ---|--- (11) | In order to ensure up-to-date information and to guarantee the right to transparency and right to information of data subjects as set out in Regulation (EC) No 45/2001 and Directive 95/46/EC, it should be possible for the Commission to publish on the internet updates to the lists of competent authorities designated by the Member States and the Commission departments authorised to have access to the CIS. ---|--- (12) | The processing of personal data for the purposes of Regulation (EC) No 515/97 and any delegated and implementing acts adopted pursuant thereto should observe the fundamental right to respect for private and family life recognised by Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms, as well as the rights to respect for private and family life, and the right to the protection of personal data, recognised, respectively, by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. Such delegated and implementing acts should also ensure that any processing of personal data takes place in accordance with Directive 95/46/EC and Regulation (EC) No 45/2001. ---|--- (13) | In order to improve the consistency of data protection supervision, the European Data Protection Supervisor should cooperate closely with the Joint Supervisory Authority set up under Council Decision 2009/917/JHA (6), with a view to achieving coordination of the audits of the CIS. ---|--- (14) | The provisions governing the storage of data in the CIS frequently result in unjustifiable losses of information. This is because Member States do not systematically carry out the yearly reviews due to the administrative burden involved and the lack of appropriate resources. It is therefore necessary to simplify the procedure governing the storage of data in the CIS by removing the obligation to review data annually and by setting a maximum storage period of five years which can be increased, subject to justification, by an additional period of two years, corresponding to periods provided for the directories established on the basis of Regulation (EC) No 515/97. That period is necessary due to the long procedures for processing irregularities and because those data are needed for the conduct of joint customs operations and of investigations. ---|--- (15) | In order to further enhance the possibilities for the analysis of fraud and to facilitate the conduct of investigations, data concerning current investigation files stored in the Customs files identification database should be rendered anonymous, when one year has elapsed since the last observation, and should thereafter be retained in a form in which identification of the data subject is no longer possible. ---|--- (16) | Since the objective of this Regulation, namely to improve the detection, investigation and prevention of customs-related fraud in the Union cannot be sufficiently achieved by the Member States but can rather, by reason of its scale or effects, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary to achieve that objective. ---|--- (17) | Carriers who, at the time of the entry into force of this Regulation, are bound by private contract obligations as regards the supply of data on container movements, should be entitled to benefit from a deferred application of their obligation to report Container Status Messages (CSMs), in order to renegotiate their contracts and to ensure that future contracts are compatible with the obligation to provide data to the Member States. ---|--- (18) | Regulation (EC) No 515/97 confers powers on the Commission to implement some of the provisions of that Regulation. As a consequence of the entry into force of the Treaty of Lisbon, the powers conferred on the Commission under that Regulation need to be aligned to Articles 290 and 291 of the Treaty on the Functioning of the European Union (TFEU). ---|--- (19) | In order to supplement certain non-essential elements of Regulation (EC) No 515/97 and in particular to specify the information to be entered into the CIS, the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission to determine the operations in connection with the application of agricultural legislation for which information has to be introduced into the CIS. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level and, where appropriate, with business representatives. The Commission, when preparing and drawing up delegated acts, should ensure a simultaneous, timely and appropriate transmission of relevant documents to the European Parliament and to the Council. ---|--- (20) | In order to ensure uniform conditions for the implementation of Regulation (EC) No 515/97, implementing powers should be conferred on the Commission in respect of the frequency of reporting CSMs, the format of the CSM data, the method of transmission of the CSMs and the specific elements to be included in the CIS relating to each of the categories in which data should be entered. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council (7). The examination procedure should be used for the adoption of implementing acts. ---|--- (21) | The European Data Protection Supervisor has been consulted and issued an opinion on 11 March 2014. ---|--- (22) | Regulation (EC) No 515/97 should therefore be amended accordingly, ---|--- HAVE ADOPTED THIS REGULATION: Article 1 Regulation (EC) No 515/97 is amended as follows: (1) | Article 2(1) is amended as follows: | (a) | the first indent is replaced by the following: | ‘— | “customs legislation” means customs legislation as defined in point 2 of Article 5 of Regulation (EU) No 952/2013 of the European Parliament and of the Council (*1), ---|--- (*1) Regulation (EU) No 952/2013 of the European Parliament and of the Council of 9 October 2013 laying down the Union Customs Code (OJ L 269, 10.10.2013, p. 1).’;" (b) | the following indents are added: | ‘— | “customs territory of the Union” means the customs territory of the Union as defined in Article 4 of Regulation (EU) No 952/2013, ---|--- — | “carriers” means the persons within the meaning of point 40 of Article 5 of Regulation (EU) No 952/2013.’; ---|--- (2) | Article 12 is replaced by the following: ‘Article 12 Without prejudice to Article 51, information, including documents, certified true copies of documents, attestations, all instruments or decisions which emanate from administrative authorities, reports and any intelligence, obtained by the staff of the requested authority and communicated to the applicant authority in the course of the assistance provided for in Articles 4 to 11 may constitute admissible evidence in the same way as if they had been obtained in the Member State where the proceedings take place: | (a) | in administrative proceedings of the Member State of the applicant authority, including subsequent appeal procedures; ---|--- (b) | in judicial proceedings of the Member State of the applicant authority, unless otherwise explicitly stated by the requested authority at the time of communication of the information.’; ---|--- (3) | Article 16 is replaced by the following: ‘Article 16 Without prejudice to Article 51, information, including documents, certified true copies of documents, attestations, all instruments or decisions which emanate from administrative authorities, reports and any intelligence, obtained by the staff of the communicating authority and communicated to the receiving authority in the course of the assistance provided for in Articles 13 to 15 may constitute admissible evidence in the same way as if they had been obtained in the Member State where the proceedings take place: | (a) | in administrative proceedings of the Member State of the receiving authority, including subsequent appeal procedures; ---|--- (b) | in judicial proceedings of the Member State of the receiving authority, unless otherwise explicitly stated by the communicating authority at the time of communication of the information.’; ---|--- (4) | Article 18a is amended as follows: | (a) | paragraphs 1 and 2 are replaced by the following: ‘1. Without prejudice to the competences of the Member States and with a view to assisting the authorities referred to in Article 29 to detect movements of goods that are the object of operations in potential breach of customs and agricultural legislation, and means of transport, including containers, used for that purpose, the Commission shall establish and manage a directory of data reported by carriers (“transport directory”). The transport directory shall be directly accessible to those authorities. They may use the transport directory, including for the analysis of data and the exchange of information, only for the purposes of this Regulation. 2\. In managing the transport directory, the Commission shall be empowered: | (a) | to access or extract and store the contents of the data, by any means or in any form, and to use data in compliance with legislation applicable to intellectual property rights. The Commission shall put in place adequate safeguards, including technical and organisational measures and transparency requirements relating to data subjects. Data subjects shall have the right to access and correct data; ---|--- (b) | to compare and contrast data that are accessible in or extracted from the transport directory, to index them and to enrich them from other data sources and to analyse them in compliance with Regulation (EC) No 45/2001 of the European Parliament and of the Council (*2); ---|--- (c) | to make the data in the transport directory available to the authorities referred to in Article 29 of this Regulation, using electronic data-processing techniques. ---|--- (*2) Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).’;" (b) | paragraph 4 is replaced by the following: ‘4. For the movement of containers referred to in paragraph 3 of this Article, the Commission shall establish and manage a directory of reported Container Status Messages (“CSM directory”). The CSM directory shall be directly accessible to the authorities referred to in Article 29. The carriers referred to in paragraph 1 of this Article that store data on the movement and status of containers or have such data stored on their behalf shall report Container Status Messages (CSMs) to the customs authorities of Member States in either of the following situations: | (a) | containers destined to be brought by maritime vessel into the customs territory of the Union from a third country, excluding: | — | containers destined to remain on board the same maritime vessel during its voyage and to leave the customs territory of the Union on board that maritime vessel; and ---|--- — | containers destined to be unloaded and reloaded onto the same maritime vessel during its voyage in order to enable the unloading or loading of other goods and to leave the customs territory of the Union on board that maritime vessel; ---|--- (b) | for shipments of goods in containers leaving the customs territory of the Union to a third country by maritime vessel and falling within the scope of: | — | Article 2 of Council Directive 92/84/EEC (*3); ---|--- — | Article 2 of Council Directive 2011/64/EU (*4); or ---|--- — | Article 2(1) of Council Directive 2003/96/EC (*5). ---|--- Data shall be transmitted by the carriers directly to the CSM directory. (*3) Council Directive 92/84/EEC of 19 October 1992 on the approximation of the rates of excise duty on alcohol and alcoholic beverages (OJ L 316, 31.10.1992, p. 29)." (*4) Council Directive 2011/64/EU of 21 June 2011 on the structure and rates of excise duty applied to manufactured tobacco (OJ L 176, 5.7.2011, p. 24)." (*5) Council Directive 2003/96/EC of 27 October 2003 restructuring the Community framework for the taxation of energy products and electricity (OJ L 283, 31.10.2003, p. 51).’;" (c) | the following paragraphs are added: ‘5. CSMs shall be reported: | (a) | from the moment when the container was reported empty before being brought into or before leaving the customs territory of the Union until the container is again reported empty; ---|--- (b) | for at least three months prior to the physical arrival to the customs territory of the Union until one month after the entry into the customs territory of the Union, in cases where specific CSMs needed to identify the relevant empty container events are not available in the carriers' electronic records; or ---|--- (c) | for at least three months after exit from the customs territory of the Union, in cases where specific CSMs needed to identify the relevant empty container events are not available in the carriers' electronic records. ---|--- 6\. The carriers shall report CSMs for the following or equivalent events, in so far as these are known to the reporting carrier and the data for such events have been generated, collected or maintained in their electronic records: — | confirmation of booking, ---|--- — | arrival at a loading or unloading facility, ---|--- — | departure from a loading or unloading facility, ---|--- — | loading onto or unloading from a conveyance, ---|--- — | instruction of stuffing or stripping, ---|--- — | confirmation of stuffing or stripping, ---|--- — | intra-terminal movements, ---|--- — | terminal gate inspection, ---|--- — | sending for heavy repair. ---|--- Each Member State shall provide for penalties for failure to comply with the obligation to provide data or for providing incomplete or false data. Such penalties shall be effective, proportionate and dissuasive. 7\. Within the Commission, only designated analysts shall be empowered to process personal data to which points (b) and (c) of paragraph 2 apply. Personal data which are not necessary for detecting the movement of goods as referred to in paragraph 1 shall be deleted immediately or have any identifying factors removed. In any event, they may be stored for no more than three years. The Commission shall implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, accidental loss or unauthorised disclosure, alteration and access or any other unauthorised form of processing. 8\. Data received from carriers shall be kept only for the time necessary to achieve the purpose for which they were introduced and may not be stored for more than five years. 9\. The Commission and the Member States shall protect confidential business information received from carriers. The Commission and the Member States shall apply the highest technical, organisational and personnel security rules of professional secrecy or other equivalent duties of confidentiality to their designated experts in accordance with national and Union law. The Commission and the Member States shall ensure that requests from other Member States for confidential treatment of information exchanged by means of the CSM directory are complied with.’; (5) | the following Article is inserted: ‘Article 18c The Commission shall adopt, by means of implementing acts, provisions regarding the frequency of reporting, the format of the data in the CSMs and the method of transmission of the CSMs. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 43a(2) by 29 February 2016.’; ---|--- (6) | the following Articles are inserted: ‘Article 18d 1\. The Commission shall establish and manage a directory (“import, export and transit directory”) containing data on: | (a) | import of goods, ---|--- (b) | transit of goods, and ---|--- (c) | export of goods, to the extent that the goods referred to in this point fall within the scope of: | (i) | Article 2 of Directive 92/84/EEC; ---|--- (ii) | Article 2 of Directive 2011/64/EU; or ---|--- (iii) | Article 2(1) of Directive 2003/96/EC. ---|--- The import, export and transit directory shall be maintained as detailed in Annexes 37 and 38 to Commission Regulation (EEC) No 2454/93 (*6). The Commission shall systematically replicate data from the sources operated by the Commission on the basis of Regulation (EU) No 952/2013 into the import, export and transit directory. The Member States may supply to the Commission data concerning the transit of goods within a Member State and direct export, depending on the availability of data and Member States' information technology infrastructure. The departments designated by the Commission and the national authorities referred to in Article 29 of this Regulation may use the import, export and transit directory to analyse data and compare data in the import, export and transit directory with CSMs reported under the CSM directory, and may exchange information on the results, for the purposes of this Regulation. 2\. The import, export and transit directory shall be accessible to the national authorities referred to in Article 29 of this Regulation. Within the Commission, only designated analysts shall be empowered to process data contained in the import, export and transit directory. Member States shall have direct access to: (a) | data on all declarations established and lodged in the Member State concerned; ---|--- (b) | data pertaining to economic operators with an EORI number provided for in Regulation (EEC) No 2454/93 and assigned by the authorities of that Member State; ---|--- (c) | transit data; ---|--- (d) | all other data except personal data referred to in Article 41b(2) of this Regulation. ---|--- The competent authorities having entered data in the Customs Information System referred to in Article 23(1) of this Regulation, or data from an investigation file in the Customs files identification database referred to in Article 41a(1) of this Regulation in accordance with Article 41b of this Regulation, shall have access to all data in the import, export and transit directory pertaining to that entry or that investigation file. 3\. Regulation (EC) No 45/2001 shall apply to the processing of personal data by the Commission in the context of data included in the import, export and transit directory. The Commission shall be considered as a controller within the meaning of point (d) of Article 2 of Regulation (EC) No 45/2001. The import, export and transit directory shall be subject to prior checking by the European Data Protection Supervisor in accordance with Article 27 of Regulation (EC) No 45/2001. Data contained in the import, export and transit directory may not be stored for more than five years, with an additional period of two years, if justified. 4\. The import, export and transit directory shall not include the special categories of data within the meaning of Article 10(5) of Regulation (EC) No 45/2001. The Commission shall implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, accidental loss or unauthorised disclosure, alteration and access or any other unauthorised form of processing. 5\. The Commission and the Member States shall protect confidential business information. The Commission and Member States shall apply the highest technical, organisational and personnel security rules of professional secrecy or other equivalent duties of confidentiality to their designated experts in accordance with national and Union law. The Commission and the Member States shall ensure that requests from other Member States for confidential treatment of information exchanged by means of the import, export and transit directory are complied with. Article 18e The Commission may request a Member State to provide documents which support import and export declarations and for which supporting documents have been generated or collected by economic operators, with respect to investigations related to the implementation of customs legislation. The request referred to in the first paragraph shall be addressed to the competent authorities. When more than one competent authority is designated by a Member State, the Member State shall specify the administrative department responsible for answering the request by the Commission. A Member State shall, within a period of four weeks starting from the receipt of the request by the Commission: — | provide the requested documentation; subject to justification, within an additional period of six weeks; ---|--- — | notify the Commission that the request was impossible to satisfy due to the failure of the economic operator to provide the requested information; or ---|--- — | decline the request as a consequence of a decision taken by that Member State's administrative or judicial authority according to Article 3. ---|--- (*6) Commission Regulation (EEC) No 2454/93 of 2 July 1993 laying down provisions for the implementation of Council Regulation (EEC) No 2913/92 establishing the Community Customs Code (OJ L 253, 11.10.1993, p. 1).’;" (7) | Article 21(1) is replaced by the following: ‘1. The findings and information obtained in the course of the Community missions referred to in Article 20, and in particular documents passed on by the competent authorities of the third countries concerned, as well as the information obtained during the course of an administrative enquiry, including by the Commission's services, shall be handled in accordance with Article 45.’; ---|--- (8) | Article 23(4) is replaced by the following: ‘4. The Commission shall be empowered to adopt delegated acts in accordance with Article 43 determining those operations in connection with the application of agricultural regulations which require the introduction of information into the CIS. Those delegated acts shall be adopted by 29 February 2016.’; ---|--- (9) | Article 25(1) is replaced by the following: ‘1. The Commission shall adopt, by means of implementing acts, provisions regarding the items to be included in the CIS relating to each of the categories referred to in Article 24 to the extent that this is necessary to achieve the aim of the CIS. Personal data may not appear in the category referred to in Article 24(e). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 43a(2) by 29 February 2016.’; ---|--- (10) | paragraphs 1 and 2 of Article 29 are replaced by the following: ‘1. Access to data included in the CIS shall be reserved exclusively for the national authorities designated by each Member State and the departments designated by the Commission. Those national authorities shall be customs authorities, but may also include other authorities competent, according to the laws, regulations and procedures of the Member State in question, to act in order to achieve the aim stated in Article 23(2). The supplying CIS partner shall have the right to determine which among those national authorities mentioned in the first subparagraph of this paragraph may have access to data that it has included in the CIS. 2\. Each Member State shall send the Commission a list of its designated competent national authorities which have access to the CIS, stating, for each authority, to which data it may have access and for what purposes. The Commission shall verify with the Member States concerned the list of the designated national authorities against disproportionate designations. After that verification, the Member States concerned shall confirm or amend the list of the designated national authorities. The Commission shall inform the other Member States accordingly. It shall also inform all the Member States of the corresponding details concerning the Commission departments authorised to have access to the CIS. The list of national authorities and Commission departments thus designated shall be published for information by the Commission in the Official Journal of the European Union and subsequent updates to the list shall be made public by the Commission on the internet.’; ---|--- (11) | Article 30 is amended as follows: | (a) | in paragraph 3, the third subparagraph is replaced by the following: ‘The list of the national authorities or departments thus designated shall be published for information by the Commission in the Official Journal of the European Union and subsequent updates to the list shall be made public by the Commission on the internet.’; ---|--- (b) | paragraph 4 is replaced by the following: ‘4. Data obtained from the CIS may, with the prior authorisation of, and subject to any conditions imposed by, the Member State which included them in the CIS, be communicated for use by national authorities other than those referred to in paragraph 2, third countries and international or regional organisations and/or Union agencies which contribute to the protection of the financial interests of the Union and the correct application of customs legislation. Each Member State shall take special measures to ensure the security of such data when they are being transmitted or supplied to departments located outside its territory. The first subparagraph of this paragraph shall apply mutatis mutandis to the Commission where it has entered the data in the CIS.’; ---|--- (12) | the title of Chapter 4 of Title V is replaced by the following: ‘Chapter 4 Storage of data’; ---|--- (13) | Article 33 is replaced by the following: ‘Article 33 Data included in the CIS shall be kept only for the time necessary to achieve the purpose for which they were introduced and may not be stored for more than five years with an additional period of two years if justified.’; ---|--- (14) | in Article 37, the following paragraph is added: ‘5. The European Data Protection Supervisor shall coordinate with the Joint Supervisory Authority, set up under Council Decision 2009/917/JHA (*7), each acting within the scope of their respective competence, with a view to ensuring coordinated supervision and audits of the CIS. (*7) Council Decision 2009/917/JHA of 30 November 2009 on the use of information technology for customs purposes (OJ L 323, 10.12.2009, p. 20).’;" ---|--- (15) | Article 38 is amended as follows: | (a) | in paragraph 1, point (b) is deleted; ---|--- (b) | paragraph 2 is replaced by the following: ‘2. In particular, both the Member States and the Commission shall take measures: | (a) | to prevent any unauthorised person from having access to installations used for the processing of data; ---|--- (b) | to prevent data and data media from being read, copied, modified or deleted by unauthorised persons; ---|--- (c) | to prevent the unauthorised entry of data and any unauthorised consultation, modification or deletion of data; ---|--- (d) | to prevent data in the CIS from being accessed by unauthorised persons by means of data-transmission equipment; ---|--- (e) | to guarantee that, with respect to the use of the CIS, authorised persons have right of access only to data for which they have competence; ---|--- (f) | to guarantee that it is possible to check and establish to which authorities data may be transmitted by data-transmission equipment; ---|--- (g) | to guarantee that it is possible to check and establish ex post facto what data have been introduced into the CIS, when and by whom, and to monitor interrogation; ---|--- (h) | to prevent the unauthorised reading, copying, modification or deletion of data during the transmission of data and the transport of data media.’; ---|--- (c) | paragraph 3 is deleted; ---|--- (16) | Article 41d is amended as follows: | (a) | paragraph 1 is replaced by the following: ‘1. The period for which data may be stored shall depend on the laws, regulations and procedures of the Member State supplying them. The maximum and non-cumulative periods, calculated from the date of entry of the data in the investigation file, which may not be exceeded are as follows: | (a) | data concerning current investigation files may not be stored for more than three years without any operation in breach of customs and agricultural legislation being observed; data must be anonymised before that time limit if one year has elapsed since the last observation; ---|--- (b) | data concerning administrative enquiries or criminal investigations in which an operation in breach of customs and agricultural legislation has been established but which have not given rise to an administrative decision, a conviction or an order to pay a criminal fine or an administrative penalty may not be stored for more than six years; ---|--- (c) | data concerning administrative enquiries or criminal investigations which have given rise to an administrative decision, a conviction or an order to pay a criminal fine or an administrative penalty may not be stored for more than 10 years.’; ---|--- (b) | paragraph 3 is replaced by the following: ‘3. The Commission shall make anonymous or delete the data as soon as the maximum storage period provided for in paragraph 1 has elapsed.’; ---|--- (17) | Article 43 is replaced by the following: ‘Article 43 1\. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article. 2\. The power to adopt delegated acts referred to in Article 23(4) shall be conferred on the Commission for a period of five years from 8 October 2015. The Commission shall draw up a report in respect of the delegation of power no later than nine months before the end of the five year period. The delegation of power shall be tacitly extended for periods of an identical duration, unless the European Parliament or the Council opposes such extension not later than three months before the end of each period. 3\. The delegation of power referred to in Article 23(4) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force. 4\. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council. 5\. A delegated act adopted pursuant to Article 23(4) shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.’; ---|--- (18) | The following Articles are inserted: ‘Article 43a 1\. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011 of the European Parliament and of the Council (*8). 2\. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. Article 43b By 9 October 2017, the Commission shall carry out an assessment of: | — | the necessity of extending the export data contained in the directories referred to in Articles 18a and 18d, by including data on goods other than the ones laid down in point (b) of the first subparagraph of Article 18a(4) and in point (c) of Article 18d(1), and ---|--- — | the feasibility of extending the data contained in the transport directory, by including data on import, export and transit of goods by land and air. ---|--- (*8) Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by Member States of the Commission's exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).’;" (19) | In Article 53, the following paragraph is added: ‘For carriers who, on 8 October 2015, are bound by private contracts that prevent them from fulfilling their obligation to report set out in Article 18a(4), that obligation shall apply from 9 October 2016.’. ---|--- Article 2 1\. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. 2\. It shall apply from 1 September 2016. 3\. Notwithstanding paragraph 2 of this Article, points 5, 8, 9, 17 and 18 of Article 1 shall apply from 8 October 2015. This Regulation shall be binding in its entirety and directly applicable in all Member States. Done at Strasbourg, 9 September 2015. For the European Parliament The President M. SCHULZ For the Council The President N. SCHMIT * * * (1) Position of the European Parliament of 15 April 2014 (not yet published in the Official Journal) and position of the Council at first reading of 15 June 2015 (not yet published in the Official Journal). Position of the European Parliament of 8 September 2015 (not yet published in the Official Journal). (2) Council Regulation (EC) No 515/97 of 13 March 1997 on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters (OJ L 82, 22.3.1997, p. 1). (3) Decision No 70/2008/EC of the European Parliament and of the Council of 15 January 2008 on a paperless environment for customs and trade (OJ L 23, 26.1.2008, p. 21). (4) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31). (5) Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1). (6) Council Decision 2009/917/JHA of 30 November 2009 on the use of information technology for customs purposes (OJ L 323, 10.12.2009, p. 20). (7) Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by Member States of the Commission's exercise of implementing powers (OJ L 55, 28.2.2011, p. 13). * * *