Rights for Europol and Frontex to obtain data available in the EU Customs Data Hub
Article 43
1. The European Union Agency for Law Enforcement Cooperation (Europol) may, upon request, obtain data, including personal data and commercially sensitive data, available in the EU Customs Data Hub to the extent necessary to perform its tasks in accordance with Article 4 of Regulation (EU) 2016/794, provided that those tasks relate to customs matters and in accordance with the rules laid down in an implementing act adopted pursuant to paragraph 8 of this Article. 2. The European Border and Coast Guard Agency (Frontex) may, upon request, obtain non-personal data or aggregated data available in the EU Customs Data Hub to the extent necessary for risk analysis and operational coordination related to border management activities falling within its mandate as set out in Regulation (EU) 2019/1896. 3. Any request referred to in paragraph 1 or 2 shall be submitted to the EU Customs Authority. The requestor of the data shall provide the reasons for the request and ensure that it falls within the scope of the legal framework under which the requestor operates. 4. The EU Customs Authority shall process the request for data referred to in paragraph 1 or 2 and verify whether it is made in accordance with this Article. The EU Customs Authority shall also verify, in co-operation with the relevant national central unit or, if designated by the relevant Member State, a liaison officer, whether the customs authority concerned has objected to the transmission of those data to the requestor of the data on the grounds specified in the implementing act referred to in paragraph 8 and in accordance with the procedure established therein. 5. The data exchanged under this Article shall be only those necessary for the purposes stated in the request. The EU Customs Authority shall make those data available via the EU Customs Data Hub expeditiously. 6. Each Union body, office or agency covered by this Article shall ensure that the data requested are necessary, appropriate and proportionate. The Union body, office or agency concerned shall also ensure that the use of the data is in accordance with the safeguards laid down in the applicable Union legal acts. 7. The Commission is empowered to adopt delegated acts in accordance with Article 282 to amend this Article in order to allow Union bodies, offices and agencies other than those referred to in paragraphs 1 and 2 of this Article to request and obtain data available in the EU Customs Data Hub in accordance with the rules laid down in paragraphs 3 to 6 of this Article to the extent necessary for carrying out their tasks under Union law and provided that those tasks relate to other legislation applied by the customs authorities. 8. The Commission shall adopt implementing acts: (a) laying down the modalities for the Union bodies, offices and agencies covered by this Article to request and obtain data; (b) establishing the procedure for the verification referred to in paragraph 4 of this Article, in particular by specifying: (i) how to identify the customs authorities concerned with the data; (ii) how to handle situations where multiple customs authorities are concerned with the data; (iii) the grounds on which the customs authorities concerned with the data can object to the transmission of the data, including taking into consideration the sensitivity of the data requested; (c) laying down restrictions on, and liability for, the onward transfer of the data by the requester; (d) where appropriate, addressing the need for the requestor to designate a specific contact point, person or persons or to provide additional safeguards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 283(4).