Roles and responsibilities for personal data processed in the EU Customs Data Hub
Article 46
1. The customs authorities of the Member States, the Commission and the EU Customs Authority shall be considered joint controllers in relation to the processing of personal data in the EU Customs Data Hub for the purposes of risk management and cooperation, as referred to in Article 41(2), points (b) and (c), Article 41(3), points (b) and (d), and Article 41(4), points (a) and (e). 2. Each customs authority individually shall be considered to be a controller in relation to the personal data that it processes for the purposes referred to in Article 41(2), point (a). Where two or more customs authorities are involved in carrying out the tasks referred to in Article 41(2), point (a), for joint purposes and by joint means, they shall be considered to be joint controllers. 3. The Commission shall be considered to be the sole controller in relation to the personal data it processes for the purposes referred to in Article 41(4), points (c), (d), (f) and (g). 4. Until 28 February 2034, the Commission, OLAF and the EU Customs Authority shall each be considered to be the sole controller for the data that they process under Article 41(10). 5. The joint controllers referred to in paragraph 1 shall: (a) work together to process the requests made by the data subjects in a timely manner and to facilitate the exercise of the rights of data subjects; (b) assist each other in matters involving the identification and handling of any data breach related to the joint processing; (c) exchange the relevant information necessary to inform data subjects pursuant to Chapter III, Section 2, of Regulation (EU) 2016/679, Chapter III, Section 2, of Regulation (EU) 2018/1725 and Chapter III of Directive (EU) 2016/680, where applicable; (d) ensure and protect the security, integrity, availability and confidentiality of the personal data processed jointly pursuant to Article 32 of Regulation (EU) 2016/679, Article 33 of Regulation (EU) 2018/1725 and Article 25 of Directive (EU) 2016/680, where applicable. 6. The Commission shall adopt implementing acts establishing the roles and relationships of each of the joint controllers referred to in paragraph 1 in relation to the data subjects, in compliance with Article 26 of Regulation (EU) 2016/679 and Article 28 of Regulation (EU) 2018/1725. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 283(4) of this Regulation.