Digital sovereignty
Article 37
1. The EU Customs Data Hub shall be designed to ensure that the data available therein is protected from unauthorised access and other threats to its integrity and security, which is in the public interest. The EU Customs Data Hub infrastructure other than telecommunication transmission infrastructure shall be solely controlled and administered by the Commission or the EU Customs Authority and shall be located within the territory of the Union. 2. When performing tasks related to the development, hosting, operation and maintenance of the EU Customs Data Hub, and any related data processing in that Hub, suppliers and other service providers and their subcontractors shall be reliable, secure and free from the influence of governments of third countries and shall not be directly or indirectly subject to any law, including executive orders, of a third country that could require the disclosure of data in the EU Customs Data Hub to any authorities of that country. They shall also ensure the reliability, security and independence of the EU Customs Data Hub. Those suppliers and other service providers, and their subcontractors, shall be legally established in the Union and not controlled, directly or indirectly, by any undertaking of a third country as defined in Article 2, point (7), of Regulation (EU) 2019/452 of the European Parliament and of the Council ( 36 ) . For critical services, including any data-related activities, the contracting authority may require the supplier, other service provider or subcontractor to have a security clearance. 3. The contracting authority for the EU Customs Data Hub may at any time require tenderers, suppliers and other service providers, and their subcontractors, to provide evidence of the measures that they have in place to prevent any unauthorised disclosure of data from the EU Customs Data Hub, including documentation establishing that they fulfil the obligations set out in paragraph 2 with regard to independence and non-disclosure, and to provide evidence of the fact that they are reliable, secure and free from influence of governments of third countries. 4. The security of the supply chain of all IT components, hardware and software shall be ensured to the greatest extent possible. The contracting authority for the EU Customs Data Hub may require suppliers and other service providers, and their subcontractors, to provide evidence in that regard. 5. Where the contracting authority for the EU Customs Data Hub has reason to believe that the measures taken by tenderers, suppliers and other service providers, or their subcontractors, to comply with their obligations under paragraphs 2, 3 and 4 are insufficient, or that the evidence provided by them under this Article is not wholly reliable, it may take any measures under the relevant contract or in the relevant procurement process that it considers necessary to remedy the situation, including the suspension or termination in part or in full of that contract or the exclusion from that procurement process. This shall be without prejudice to any other additional remedial rights provided for: (a) by the contracting authority for the EU Customs Data Hub in the relevant contract; or (b) in Union or national law. 6. Unless provided for in Title III or XIII or in an international agreement by which the Union is bound, data processed in the EU Customs Data Hub shall not be transferred or made available to a third country, to an international organisation or to natural or legal persons established outside the territory of the Union. 7. The EU Customs Data Hub shall be designed to the highest extent possible to avoid pre-commercial, commercial, technical, contractual and organisational obstacles that discourage, hinder or prevent the transfer or porting of data, applications or digital assets by the contracting authority to another service provider, or their use in an interoperable environment.