Skip to content
DRAFT REPORT (COM(2023)0244 – C90170/2023 – 2023/0143(COD))

On the proposal for a regulation of the European Parliament and of the Council amending Council Decision 2009/917/JHA, as regards its alignment with Union rules on the protection of personal data

LIBE-PR-753732

Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Cornelia Ernst

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 26 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

This is the rapporteur's draft report on the Commission proposal to amend Council Decision 2009/917/JHA on the Customs Information System so it aligns with EU personal data protection rules. The draft resolution adopts Parliament's first-reading position and calls on the Commission to refer the matter to Parliament again if it replaces or substantially amends its proposal. The amendments align the Decision with Directive (EU) 2016/680 and Regulation (EU) 2018/1725, set a maximum retention period of three years, and give the European Data Protection Supervisor a monitoring and audit role.

Committee position. The rapporteur proposes to adopt Parliament's first-reading position with amendments that align Council Decision 2009/917/JHA with Directive (EU) 2016/680 and Regulation (EU) 2018/1725, shorten the retention period to three years, delete access by international organisations, and strengthen the role of the European Data Protection Supervisor.

Key points

  1. The draft resolution adopts Parliament's position at first reading on the proposal to amend Council Decision 2009/917/JHA.
  2. It calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal.
  3. Amendment 1 changes Recital 2 to refer to the principle of purpose limitation and to the coordinated supervision model under Article 62 of Regulation (EU) 2018/1725.
  4. Amendment 2 changes Recital 5 to set a maximum retention period of three years, extendable by two years with justification, and removes the annual review obligation.
  5. Amendment 3 replaces the definition of personal data in Article 2(1)(2) with the definition in Article 3(1) of Directive (EU) 2016/680.
  6. Amendment 4 states that the Commission is the processor under Article 3(12) of Regulation (EU) 2018/1725, acting in accordance with Article 29 of that Regulation, on behalf of national authorities as controllers.
  7. Amendment 5 requires reasonable and objective grounds for entering personal data into the Customs Information System.
  8. Amendment 6 deletes Article 7(3), which allowed the Council to permit access to the Customs Information System by international or regional organisations.
  9. Amendments 7, 8 and 9 change references to rules on the protection of personal data and remove the reference to Article 7(3) in Article 8(2).
  10. Amendment 10 adds a reference to Chapters V and IX of Regulation (EU) 2018/1725 for transfers to third countries and international or regional organisations.
  11. Amendment 11 requires retention of personal data to be reviewed at least once every three years, with an exceptional extension of at most two years where strictly necessary in an individual case.
  12. Amendments 12 and 13 make Regulation (EU) 2018/1725 applicable and give the European Data Protection Supervisor responsibility for monitoring processing by the Commission, with an audit at least every three years and coordinated supervision with national authorities.

Who is affected

  • Member states' customs and national authorities designated to use the Customs Information System, which must follow the amended data protection rules.
  • The Commission, which is considered the processor of personal data in the Customs Information System and is subject to audit by the European Data Protection Supervisor.
  • Europol and Eurojust, which may process personal data from the Customs Information System only to achieve the aim in Article 1(2).
  • International or regional organisations, which would no longer be able to access the Customs Information System under the deleted Article 7(3).

Figures and deadlines

  • maximum retention period of three years, extendable by an additional period of two years
  • retention reviewed at least once every three years
  • audit of processing of personal data by the Commission at least every three years

Legal basis: Article 294(2) and Article 16(2) of the Treaty on the Functioning of the European Union