Skip to content
REPORT (COM(2023)0244 – C90170/2023 – 2023/0143(COD))

On the proposal for a regulation of the European Parliament and of the Council amending Council Decision 2009/917/JHA, as regards its alignment with Union rules on the protection of personal data

A-9-2023-0361

Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Cornelia Ernst

Official HTML ↗ PDF DOCX
✦ In shortFull textProcedure & committee votes
✦ In short · AI summary of this text, generated 26 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of the Commission proposal to align Council Decision 2009/917/JHA on the Customs Information System with EU personal data rules. It sets a three-year retention period, extendable by two years, and removes the annual review obligation. It defines personal data by reference to Directive (EU) 2016/680, makes the Commission the processor and national authorities the controllers, and requires reasonable and objective grounds for entering data. It deletes the Council's power to permit access by international or regional organisations, restricts use of data to designated national authorities, and applies Directive (EU) 2016/680 and Regulation (EU) 2018/1725. It makes the European Data Protection Supervisor responsible for monitoring the Commission's processing, requires an audit at least every three years, and provides for coordinated supervision with national authorities.

Committee position. The Committee on Civil Liberties, Justice and Home Affairs adopts its position at first reading with amendments to the Commission proposal, aligning Council Decision 2009/917/JHA with EU personal data rules, and calls on the Commission to refer the matter to Parliament again if it substantially amends its proposal.

Key points

  1. Aligns Council Decision 2009/917/JHA with Directive (EU) 2016/680, respecting purpose limitation, specified categories of data subjects and data, data security, special categories protection and conditions for subsequent processing.
  2. Simplifies retention by removing the annual review obligation and setting a general maximum retention period of three years, extendable by two years subject to justification.
  3. Defines personal data by reference to Article 3, point (1), of Directive (EU) 2016/680.
  4. Considers the Commission the processor, acting in accordance with Article 29 of Regulation (EU) 2018/1725 on behalf of national authorities designated by each Member State, which are the controllers.
  5. Allows entry of personal data into the Customs Information System only if there are reasonable and objective grounds to suggest the person concerned has committed, is committing or will commit criminal offences under national laws.
  6. Deletes Article 7(3), which allowed the Council to permit access to the Customs Information System by international or regional organisations.
  7. Requires Member States, Europol and Eurojust to process personal data from the Customs Information System only to achieve the aim in Article 1(2), in accordance with EU rules on the protection of personal data.
  8. Restricts use of data obtained from the Customs Information System to national authorities designated by each Member State and competent to act to achieve the aim in Article 1(2).
  9. Allows transmission to and further processing by other national authorities, and transfer to competent authorities of third countries and international or regional organisations, in accordance with EU data protection rules.
  10. Requires personal data in the Customs Information System to be kept only as long as necessary, with retention reviewed at least once every three years and possible extension by at most two years where strictly necessary in an individual case.
  11. Applies Directive (EU) 2016/680 and Regulation (EU) 2018/1725 to the processing of personal data under the Decision.
  12. Makes the European Data Protection Supervisor responsible for monitoring the Commission's processing, requires an audit at least every three years with a report to Parliament, the Council, the Commission and national supervisory authorities, and provides for coordinated supervision under Article 62 of Regulation (EU) 2018/1725.

Who is affected

  • National customs authorities designated by each Member State, which are controllers of personal data in the Customs Information System.
  • The Commission, considered the processor of personal data in the Customs Information System.
  • Member States, Europol and Eurojust, which may process data from the Customs Information System only for the stated aim.
  • International or regional organisations, which can no longer be granted access to the Customs Information System.
  • The European Data Protection Supervisor and national supervisory authorities, responsible for monitoring and coordinated supervision.

Figures and deadlines

  • Maximum retention period of three years as a general rule.
  • Additional retention period of two years, subject to justification.
  • Retention reviewed at least once every three years.
  • Audit of the Commission's processing at least every three years.

Legal basis: Article 294(2) and Article 16(2) of the Treaty on the Functioning of the European Union.