Changes between two versions
What changed between the draft committee report and the plenary report
From · draft committee report· 3 Oct 2023
on the proposal for a regulation of the European Parliament and of the Council amending Council Decision 2009/917/JHA, as regards its alignment with Union rules on the protection of personal data
To · plenary report· 15 Nov 2023
on the proposal for a regulation of the European Parliament and of the Council amending Council Decision 2009/917/JHA, as regards its alignment with Union rules on the protection of personal data
Changes to the text itself, in document order. Cover page, citations and punctuation-only edits are left out; they are under “Every difference”.
The changes · 14
Change 1
Changed:Recital 5: (5) To ensure the optimal preservation of the data while reducing the administrative burden for the competent authorities, the procedure governing the retention of personal data in the CIS should be simplified by removing the obligation to review data annually and by setting as a general rule a maximum retention period of three years which can be increased, subject to justification, by an additional period of two years. That retention period is necessary and proportionate in view of the typical length of criminal proceedings and the need for the data for the conduct of joint customs operations and of investigations.
Change 2
Changed:Council Decision 2009/917/JHA
Change 3
Changed:Article 1 – paragraph 1 – point 2, Article 2 – paragraph 1 – point 2: (2) Point 2 ofIn Article 2 point (2) is replaced by the following: / 2.‘2. “personal data” means personal data as defined in Article 3, point (1), of Directive (EU) 2016/680.2016/680 of the European Parliament and of the Council1a;’; / 1a Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).
Change 4
Changed:Council Decision 2009/917/JHA
10 more changes
Change 5
Changed:Council Decision 2009/917/JHA
Change 6
Changed:Council Decision 2009/917/JHA
Change 7
Changed:Article 1 – paragraph 1 – point 6 – introductory part,6, Article 7 – paragraph 3: (6) Paragraph 3 ofIn Article 7 paragraph 3 is deleted.deleted; / (deleted) / (deleted) / (deleted)
Change 8
Changed:Council Decision 2009/917/JHA
Change 9
Changed:Council Decision 2009/917/JHA
Change 10
Changed:Article 1 – paragraph 1 – point 7 a (new), Article 8 – paragraph 2: (7a) Paragraph 2 ofIn Article 8 paragraph 2 is replaced by the following: / “2.‘2. Without prejudice to paragraphs 1 and 4 of this Article, and Articles 11 and 12, data obtained from the Customs Information System shall only be used by national authorities in each Member State designated by the Member State in question, which are competent, in accordance with the laws, regulations and procedures of that Member State, to act in order to achieve the aim stated in Article 1(2).”1(2).’;
Change 11
Removed:Removing a reference to Art 7(3) as a consequence of our deletion of that paragraph.
Added:Decision 2009/917/JHA
Removed:Council Decision 2009/917/JHA
Change 12
Changed:Council Decision 2009/917/JHA
Change 13
Removed:Art 94 in Chaper IX has specific rules for transfer of operational personal data to third countries and should be added as a reference here for completeness.
Added:Decision 2009/917/JHA
Removed:Council Decision 2009/917/JHA
Added:Article 1 – paragraph 1 – point 9, Article 14: Personal data entered into the Customs Information System shall be kept only for the time necessary to achieve the aim stated in Article 1(2). The need for their retention shall, as a general rule, be reviewed at least once every three years. However, exceptionally, that data may be kept for an additional period of at most two years, where and insofar as strictly necessary in order to achieve that aim in an individual case.
Show 3 more lines
Removed:Article 1 – paragraph 1 – point 9, Article 14: Article 14 / Personal data entered into the Customs Information System shall be kept only for the time necessary to achieve the aim stated in Article 1(2). The need for their retention shall be reviewed at least once every three years. However, exceptionally, that data may be kept for an additional period of at most two years, where and insofar as strictly necessary in order to achieve that aim in an individual case.
Added:Decision 2009/917/JHA
Removed:Council Decision 2009/917/JHA
Change 14
Removed:Adding a reference to EUDPR for completeness, given that some processing operations are performed by EUI.
Added:Decision 2009/917/JHA
Removed:Council Decision 2009/917/JHA
Added:Article 1 – paragraph 1 – point 13, Article 26: 1. The European Data Protection Supervisor shall be responsible for monitoring the processing of personal data under this Regulation by the Commission and for ensuring that it is carried out in accordance with this Regulation. The tasks and powers referred to in Articles 57 and 58 of Regulation (EU) 2018/1725 shall apply accordingly. / 2. The European Data Protection Supervisor shall carry out an audit of the processing of personal data by the Commission under this Regulation in accordance with international auditing standards at least every three years. A report on that audit shall be sent to the European Parliament, to the Council, to the Commission and to the national supervisory authorities. / 3. The European Data Protection Supervisor and the national supervisory authorities, each acting within the scope of their respective competences, shall cooperate actively within the framework of their responsibilities to ensure coordinated supervision in accordance with Article 62 of Regulation (EU) 2018/1725.
Show 1 more line
Removed:Article 1 – paragraph 1 – point 13, Article 26: Article 26 / '1. The European Data Protection Supervisor shall be responsible for monitoring the processing of personal data under this Regulation by the Commission and for ensuring that it is carried out in accordance with this Regulation. The tasks and powers referred to in Articles 57 and 58 of Regulation (EU) 2018/1725 shall apply accordingly. / 2. The European Data Protection Supervisor shall carry out an audit of the processing of personal data by the Commission under this Regulation in accordance with international auditing standards at least every three years. A report on that audit shall be sent to the European Parliament, to the Council, to the Commission and to the national supervisory authorities. / 3. The national supervisory authorities of the Member States and the European Data Protection Supervisor, each acting within the scope of their respective competences, shall actively cooperate within the framework of their responsibilities and shall ensure coordinated supervision in accordance with Article 62 of Regulation (EU) 2018/1725.’