Purposes of the processing of personal data and other data in the EU Customs Data Hub
Article 41
1. Persons may process data available in the EU Customs Data Hub, including personal and commercially sensitive data, that they transmitted or that were transmitted on their behalf or that are addressed to or intended for them. Such processing shall take place exclusively to: (a) exercise that person’s rights or fulfil that person’s obligations under customs legislation or other legislation applied by the customs authorities, including determining the liability of any person for any duty, fees and taxes due in the Union; and (b) demonstrate that person’s compliance with customs legislation and other legislation applied by the customs authorities. 2. A customs authority may process data, including personal and commercially sensitive data, available in the EU Customs Data Hub exclusively and to the extent necessary for the following purposes, and in accordance with the rules laid down in an implementing act adopted pursuant to paragraph 12 of this Article: (a) to carry out its tasks in relation to the implementation of customs legislation or other legislation applied by the customs authorities, including determining the liability of any person for any duty, fees and taxes due in the Union and verifying compliance with that legislation; (b) to carry out its tasks in relation to controls and risk management as provided for in Title IV; (c) to carry out the tasks necessary for the cooperation under the conditions provided for in Title XIII. To ensure the effectiveness of customs controls, all customs authorities may receive and process the data resulting from a customs control where non-compliant goods have been detected. 3. The EU Customs Authority may process data, including personal and commercially sensitive data, available in the EU Customs Data Hub exclusively and to the extent necessary for the following purposes: (a) to carry out the tasks provided for in Articles 42 and 43; (b) to carry out its tasks on customs risk management, as provided for in Title IV, Chapter 2; (c) to carry out the tasks provided for in Title XII, Chapter 2, and in Title XI; (d) to carry out the tasks relevant for cooperation under the conditions provided for in Title XIII. 4. The Commission may process data, including personal and commercially sensitive data, available in the EU Customs Data Hub exclusively and to the extent necessary for the following purposes: (a) to carry out its tasks in relation to risk management, as provided for in Title IV, Chapter 2; (b) to carry out its tasks in relation to the tariff classification of goods, their origin and value and their customs surveillance, in accordance with Titles I and IX; (c) to carry out its tasks in relation to restrictive measures and crisis management, in accordance with Title XI; (d) to carry out its tasks in relation to the EU Customs Authority, in accordance with Title XII; (e) to carry out the tasks necessary for cooperation, under the conditions provided for in Title XIII; (f) to assess and evaluate the performance of the customs union in accordance with Title XV, Chapter 1; (g) to monitor the implementation, and ensure the uniform application, of customs legislation or other legislation applied by the customs authorities, including verifying the liability of any person for any duty, fees and taxes due in the Union; (h) to develop, produce and disseminate European official statistics and other analyses provided for in Union legal acts for which the data in the EU Customs Data Hub is necessary; (i) where relevant, to contribute to the implementation of other legislation applied by the customs authorities, in accordance with the scope and purpose provided for therein. 5. The European Anti-Fraud Office (OLAF) may process data, including personal and commercially sensitive data, available in the EU Customs Data Hub exclusively and to the extent necessary for carrying out its activities concerning customs matters pursuant to Article 1 of Regulation (EU, Euratom) No 883/2013 and to Regulation (EC) No 515/97, and under the conditions relating to data protection laid down in those Regulations. 6. The tax authorities of the Member States may process data, including personal and commercially sensitive data, available in the EU Customs Data Hub exclusively and to the extent necessary to determine the liability of any person for any excise duty, fees and taxes due in the Union in connection with the relevant goods, and in accordance with the rules laid down in an implementing act adopted pursuant to paragraph 12. 7. The national statistical authorities of the Member States may process data, including personal data and commercially sensitive data, available in the EU Customs Data Hub exclusively and to the extent necessary for the development, production and dissemination of European and national official statistics, and in accordance with the rules laid down in an implementing act adopted pursuant to paragraph 12. 8. The competent authorities as defined in Article 3, point (3), of Regulation (EU) 2017/625 may process data, including personal and commercially sensitive data, available in the EU Customs Data Hub exclusively and to the extent necessary for enforcing Union legal acts governing the placing on the market or the safety of food, feed and plants and for cooperating with customs authorities to minimise the risks that non-compliant products enter the Union, and in accordance with the rules laid down in an implementing act adopted pursuant to paragraph 12 of this Article. 9. The market surveillance authorities designated by Member States in accordance with Article 10 of Regulation (EU) 2019/1020 may process data, including personal and commercially sensitive data, available in the EU Customs Data Hub exclusively and to the extent necessary for enforcing Union legal acts governing the placing on the market or the safety of products and for cooperating with customs authorities to minimise the risks that non-compliant goods enter the Union, and in accordance with the rules laid down in an implementing act adopted pursuant to paragraph 12 of this Article. 10. Until 28 February 2034, the Commission, OLAF and, once it is established, the EU Customs Authority may process data, including personal data, from the existing electronic systems for the exchange of information developed by the Commission and Member States pursuant to Regulation (EU) No 952/2013, provided that they do so exclusively for the purposes stated in paragraphs 3, 4 and 5 of this Article. 11. The Commission is empowered to adopt delegated acts in accordance with Article 282 to amend paragraphs 2, 3 and 4 of this Article by clarifying and complementing the purposes laid down in those paragraphs in light of evolving needs of the customs authorities, the EU Customs Authority and the Commission when implementing customs legislation or other legislation applied by the customs authorities. 12. The Commission shall adopt implementing acts laying down rules and modalities for processing data in the EU Customs Data Hub by the authorities referred to in paragraphs 2 and 6 to 9. In establishing those rules and modalities, the Commission shall, for each authority or category of authorities: (a) assess the existing safeguards applied by the authority or category of authorities concerned to ensure that the data is processed only for the relevant purpose; (b) ensure the proportionality and the necessity of the processing in relation to the relevant purpose; (c) determine the specific categories of data which the authority can process; (d) require the authorities referred to in paragraphs 6 to 9, where necessary, to provide a specific contact point or additional safeguards; (e) assess the need to restrict subsequent sharing of the relevant data. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 283(4).