Access requirements
1. Each operator shall have access to the information and documents they submitted or manage through the systems or software.
2. Each operator acting in the systems or software in the role of a waste producer, a notifier, a consignee or a facility receiving waste shall have access to the information and documents concerning shipments of waste referred to in in Article 4(1), (2) and (3) of Regulation (EU) 2024/1157 in which they are involved.
3. Each operator acting in the systems or software in the role of a waste producer, a person who arranges the shipment, a consignee or a facility receiving waste shall have access to the information and documents concerning shipments of waste referred to in Article 4(4) or (5) of Regulation (EU) 2024/1157 in which they are involved.
4. Each operator acting in the central system or software in the role of carrier shall have access to the following documents and information:
(a)
notification documents in which this operator is indicated as carrier, after all relevant competent authorities provide their consent, where relevant;
(b)
consents, including the attached conditions, where relevant, of the competent authorities referred to in point (a);
(c)
movement documents created on the basis of the notification documents referred to in point (a);
(d)
Annex VII documents in which this operator is indicated as a carrier, after they are authenticated by the person who arranges the shipment.
5. Each authority acting in the systems in the role of a competent authority shall have access to the following:
(a)
information and documents which are submitted, managed or exchanged by this competent authority through the central system or its local system;
(b)
information and documents concerning the shipments of waste referred to in Article 4(1), (2) and (3) of Regulation (EU) 2024/1157 in which they are involved;
(c)
information and documents concerning shipments of waste referred to in Article 4(4) and (5) of Regulation (EU) 2024/1157 that are intended to be or are carried out from, through or to the territory of their Member State.
6. Each authority acting in the role of authority involved in inspections shall have access to all data, information and documents concerning any shipment of waste, and may store such relevant data, information and documents for the purposes of enforcement, in particular criminal proceedings, in accordance with national rules regarding storage of such data, information and documents.
7. The systems and, where relevant, software shall display the following information:
(a)
the number of days for performing the actions listed in entries 2, 4, 8 and 14 to 16 of the table set out in Annex III to this Regulation, in accordance with the deadlines set out in Articles 8, 9 and 14 of Regulation (EU) 2024/1157;
(b)
the number of days that have passed from the expiry of the deadlines referred to in point (a).
8. The systems and software shall display the information referred to in paragraph 7 starting from the date on which a user authenticated a document submitted in the system, as referred to in Article 14(2), point (a).
9. The local systems and software shall display the information referred to in paragraph 7 in a clear and visible manner for all users involved in a given shipment, in such a way that the stage of the procedure can be clearly identified at any time.
10. The Commission may access information and documents exchanged in the central system in order to comply with its obligations pursuant to Regulation (EU) 2024/1157 and to ensure the proper functioning of the central system.
Storage requirements
1. The systems and software shall store all the information and documents exchanged through the central system in accordance with Article 20 of Regulation (EU) 2024/1157.
2. Where the information or documents were updated after submission in the central system by any of the users, the provisions of paragraph 1 shall concern the storage of the following information and documents:
(a)
the updated versions of the information, documents and attachments as well as all changes introduced from its initial submission;
(b)
all attachments uploaded after the initial submission.
Reciprocal exchange of data and their synchronisation
1. The exchange of data between the central system and local systems or software shall be reciprocal.
2. Synchronisation of data introduced in a system shall be performed after every operation referred to in Annex II Parts A to E, and in any case at least every 12 hours.
3. The provisions of this Article do not apply to inspection systems and any software that interoperates with the central system only for the purposes of information and document retrieval.
Security
The systems and software shall be designed and developed in such a way that they achieve an appropriate level of security, in particular cybersecurity, and that they perform consistently in those respects throughout their lifecycle.
Data governance
The systems and software shall ensure that the data they collect is of high quality, including by application of data quality verification mechanisms and data accuracy monitoring tools.
Data confidentiality
The systems and software shall be designed and developed in such a way that they ensure confidentiality of the data exchanged, including protection against unauthorized or unlawful access and against accidental loss, destruction or damage, using appropriate technical measures.
Storage of personal data
1. The systems or software shall store personal data from information and documents exchanged in accordance with Article 27(1) of Regulation (EU) 2024/1157 for five years as follows:
(a)
from the date of submission of a certificate in the systems or software in accordance with Article 15(4) or Article 16(6) of Regulation (EU) 2024/1157 in the context of a notification;
(b)
from the date of submission of the last certificate in the systems or software in accordance with Article 15(4) or Article 16(6) of Regulation (EU) 2024/1157 in context of a general notification;
(c)
from the date of submission of a certificate in the systems or software in accordance with Article 18(9) of Regulation (EU) 2024/1157 in context of an Annex VII document.
2. Where the certificates referred to in paragraph 1 are not issued within one year following the deadlines referred to, respectively, in Article 15(4), Article 16(6) or Article 18(9) of Regulation (EU) 2024/1157, the systems or software shall store personal data from information and documents exchanged in accordance with Article 27(1) of that Regulation for the following time periods:
(a)
ten years from the date on which a notification was submitted in the systems or software;
(b)
five years from the date on which the Annex VII document was submitted in the systems or software.
3. Where not all the concerned competent authorities consented to the notification, the systems or software shall store personal data from information and documents exchanged in accordance with Article 27(1) of Regulation (EU) 2024/1157 for five years from the date on which a notification was submitted in the systems or software.
4. Data, information and documents containing personal data stored by the authorities involved in inspections for the purposes of enforcement, as referred to in Article 18(6), shall be stored no longer than necessary for that purpose in accordance with national laws.
General provision on data protection
1. Processing of personal data may take place in the systems and software for the purposes of achieving the objectives of Regulation (EU) 2024/1157, in particular to ensure the protection of the environment and human health related to shipments of waste. The systems and software shall enable the exchange of information, documents or data between competent authorities, authorities involved in inspections and operators and consequently the processing of personal data, to ensure the following activities:
(a)
issuing by the competent authorities of decisions concerning shipments of waste referred to in Article 4(2) and (3) of Regulation (EU) 2024/1157 in accordance with that Regulation;
(b)
proper enforcement measures taken by competent authorities and authorities involved in inspections related to shipments of waste, in accordance with Articles 60 to 66 of Regulation (EU) 2024/1157 and where relevant in accordance with Article 67 to 71 of that Regulation.
2. Processing of personal data may take place in the systems or software only in respect of the following categories of data subjects:
(a)
natural persons who use the systems;
(b)
natural persons whose personal information is contained in documents concerning shipments of waste, in particular the notification document, the movement document or the Annex VII document;
(c)
natural persons whose personal information is contained in additional documents concerning shipments of waste, in particular in the documents listed in Annex II to Regulation (EU) 2024/1157;
(d)
authorised staff of competent authorities or authorities involved in inspections whose personal information is contained in any documents referred to in points (b) and (c);
(e)
Commission staff and third-party providers acting on behalf of the Commission that perform operations and maintenance activities in relation to the central system.
3. Processing of personal data may take place in the systems or software only in respect of the following categories of personal data:
(a)
name, address, e-mail address, phone number, signature, function performed when representing the operator and identification number of natural persons referred to in paragraph 2, points (a), (b) and (c), required under Union law;
(b)
the name, signature and function performed by staff referred to in paragraph 2, points (a), (d) and (e), when representing the authority concerned.
4. The competent authorities of the Member States, and where relevant, of the third countries, shall be regarded as the controllers within the meaning of Article 4(7) of Regulation (EU) 2016/679 with respect to personal data exchanged through the central system in accordance with Article 27(1) of Regulation (EU) 2024/1157 and this Regulation. The competent authorities of the Member States, and where relevant, of the third countries, shall process such data for the purposes referred to in paragraph 1 of this Article.
Controllers shall ensure the security, integrity, authenticity and confidentiality of the data processed for the purposes set out in Article 25(1) of this Regulation.
5. Notwithstanding paragraph 4, the Commission shall be regarded as controller within the meaning of Article 3(8) of Regulation (EU) 2018/1725 with respect to personal data exchanged through the central system in accordance with Article 27(1) of Regulation (EU) 2024/1157 and this Regulation. The Commission may process such data for the following purposes:
(a)
publishing information on shipments of waste in accordance with Article 21 of Regulation (EU) 2024/1157;
(b)
preparation of statistics related to shipments of waste and reports on that matter, including reports referred to in Articles 62(5), 67(4), 73(4) and (5) and 84 of Regulation (EU) 2024/1157;
(c)
exercise of the inspection powers provided to the Commission in accordance with Articles 67 to 71 of Regulation (EU) 2024/1157.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
