Information technology for customs purposes

KEY POINTS

The CIS consists of a central database, accessible from every EU country. It comprises exclusively data necessary to achieve its aim, including personal data, in the following areas:

• commodities (products that can be bought or sold);
• means of transport;
• businesses;
• persons;
• fraud trends;
• availability of expertise;
• items detained, seized or confiscated;
• cash detained, seized or confiscated.

Data protection

• Directive (EU) 2016/680 applies to data protection unless otherwise provided for in this decision.
• The CIS contains the data (including that of a personal character) necessary to achieve the system’s objective through activities such as sighting and reporting, discreet surveillance, specific checks and strategic and operational analysis.
• This decision respects the fundamental rights and adheres to the principles recognised in particular by the Charter of Fundamental Rights of the European Union. It does not prevent EU countries from applying their constitutional rules relating to public access to official documents.
• Only the EU countries supplying the information to the CIS database have the right to amend, add or erase that data.
• Data will be kept only for the time necessary to achieve the purpose for which it was entered. The need for retention is reviewed at least annually by the supplying country.

Customs files identification database

• A special database known as the customs files identification database was set up, allowing national authorities to know whether persons or businesses they are investigating are also being investigated or have been investigated in other EU countries. For the purpose of this database EU countries share among themselves, as well as with Europol and Eurojust, a list of serious contraventions of national laws: those punishable by.at least a 12-month custodial sentence or a fine of at least €15,000.
• An EU country is not obliged to share information with this special database where this would harm public policy or other essential interests.
• Data is retained for 3 years if it has not been established that an infringement has taken place, with data erased 12 months after the most recent investigative act. This is extended to 6 years where there is an infringement that has not led to a conviction or 10 years where there has been a conviction.

Supervision and administration

• Each EU country designates a national supervisory authority or authorities responsible for personal data protection to carry out independent supervision of data covered by the decision. A joint supervisory authority was also set up, consisting of 2 representatives from each EU country’s respective national supervisory authority.
• The European Data Protection Supervisor oversees the activities of the Commission regarding the CIS.
• A committee consisting of representatives from the customs administrations of the EU countries, with the involvement of the Commission, is responsible for the implementation and correct application of this decision (based on unanimity) and the proper technical and operational functioning of the CIS (decisions by two-thirds majority).