What changed between the adopted text of 13 Mar 2024 and the adopted text of 16 Sept 2026

Removed:3. The Commission is empowered to adopt delegated acts in accordance with Article 261 to amend or supplement the categories of data subjects and the categories of personal data referred to in paragraphs 1 and 2 of this Article to take account of developments in information technology and in the light of the state of progress in the information society.

Removed:Article 33 Retention period of personal data in the EU Customs Data Hub

Removed:1. Personal data in the EU Customs Data Hub may be stored by means of a specific service for a maximum period of 10 years, starting from the date on which that data is recorded in the service. The cases provided for in Article 48 and investigations launched by OLAF, EPPO or by Member States’ authorities, infringement procedures launched by the Commission and administrative and judicial proceedings involving personal data shall have a suspensive effect on the retention period with regard to that data.

Removed:2. After the period of time provided for in paragraph 1, personal data shall be erased or anonymised, according to the circumstances.

Removed:3. The Commission shall lay down, by means of implementing acts, the rules for anonymising the personal data after the expiry of the retention period. [Am. 165]

Removed:Article 34 Roles and responsibilities for personal data processed in the EU Customs Data Hub

Removed:1. The customs authorities of the Member States, the Commission and the EU Customs Authority shall be considered joint controllers for the personal data processing in the EU Customs Data Hub for the purposes of risk management and cooperation, as referred to in Article 31(2), points (b) and (c), Article 31(3), points (a) and (c), and Article 31(4), points (a) and (e).

Removed:2. Each customs authority alone shall be considered controller in relation to the personal data it processes for the purposes referred to in Article 31(2),point (a).

Removed:3. The Commission shall be considered sole controller in relation to the personal data it processes for the purposes referred to in Article 31(4), points (c), (d) and (f) to (g).

Removed:4. Until the date set out in Article 265(3), the Commission, OLAF, EPPO and the EU Customs Authority shall be considered sole controllers in relation to the data processing referred to in Article 31(12).

Removed:5. The joint controllers referred to in paragraph 1 shall:

Removed:(a) work together to process the request(s) made by the data subject(s) in a timely manner and to facilitate the exercise of the rights of data subjects;

Removed:(b) assist each other in matters involving the identification and handling of any data breach related to the joint processing;

Removed:(c) exchange the relevant information necessary to inform data subjects pursuant to Chapter III, Section 2 of Regulation (EU) 2016/679, Chapter III, Section 2 of Regulation (EU) 2018/1725, and Chapter III of Directive (EU) 2016/680, where applicable;

Removed:(d) ensure and protect the security, integrity, availability and confidentiality of the personal data processed jointly pursuant to Article 32 of Regulation (EU) 2016/679, Article 33 of Regulation (EU) 2018/1725, and Article 25 of Directive (EU) 2016/680, where applicable.

Removed:6. The Commission shall lay down, by means of implementing acts, the respective roles and relationships of the joint controllers vis-à-vis the data subjects, in compliance with Article 26 of Regulation (EU) 2016/679 and Article 28 of Regulation (EU) 2018/1725. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 262(4).

Removed:Article 35 Restriction of data subject’s rights

Removed:1. Where the exercise by a data subject of the right of access and right to restriction of processing referred to in Articles 15 and 18 of Regulation (EU) 2016/679 and Articles 17 and 20 of Regulation (EU) 2018/1725, or the communication of a data breach referred to in Article 34(1) of Regulation (EU) 2016/679 and Article 35(1) of Regulation (EU) 2018/1725, would jeopardise an ongoing investigation concerning a natural person in the field of customs, the performance of customs controls or the management of a specific risk identified in relation to a natural person in the field of customs, the customs authorities, the EU Customs Authority and the Commission may, in accordance with Article 23(1), points (c), (e), (f) and (h), of Regulation (EU) 2016/679, and the Commission and the EU Customs Authority may, in accordance with Article 25(1), points (a), (c), (e), and (g), of Regulation (EU) 2018/1725, restrict wholly or partly those rights as long as the restriction is necessary and proportionate.

Removed:2. The customs authorities, the Commission and the EU Customs Authority shall assess the necessity and proportionality of the restrictions referred to in paragraph 1 on a case-by-case basis before they are applied, considering the potential risks to the rights and freedoms of the data subject.

Removed:3. When processing personal data received from other organisations in the context of its tasks, the customs authorities, the EU Customs Authority or the Commission, when acting as a controller or a joint controller, shall consult those organisations on potential grounds for imposing the restrictions as referred to in paragraph 1, and the necessity and proportionality of such restrictions before applying a restriction referred to in paragraph 1.

Removed:4. Where the customs authorities, the Commission or the EU Customs Authority restrict, wholly or partly, the rights referred to in paragraph 1, they shall take the following steps:

Removed:(a) inform the data subject concerned, in its reply to the request, of the restriction applied and of the principal reasons therefore, and of the possibility of lodging a complaint with the national data protection authorities or the European Data Protection Supervisor or of seeking a judicial remedy in a national court or the Court of Justice of the European Union; and

Removed:(b) record the reasons for the restriction, including an assessment of the necessity for and proportionality of the restriction, and the reasons why providing access would jeopardise risk management and customs controls.

Removed:The provision of information referred to in point (a) of the first subparagraph may be deferred, omitted or denied in accordance with Article 25(8) of Regulation (EU) 2018/1725, or where the provision of that information would be prejudicial to the purposes of the restriction.

Removed:5. The customs authorities, the Commission or the EU Customs Authority shall include a section in the data protection notices published on its website/intranet providing general information to data subjects on the potential for restriction of data subjects’ rights.

Removed:6. The Commission shall lay down, by means of implementing acts, the safeguards to prevent the abuse and unlawful access or transmission of the personal data in respect of which restrictions apply or could be applied. Such safeguards shall include the definition of roles, responsibilities and procedural steps, and due monitoring of restrictions and a periodic review of their application, which shall take place at least every 6 months. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 262(4).

Removed:Article 36 EU Customs Data Model

Removed:The Commission is empowered to adopt delegated acts in accordance with Article 261 to supplement this Regulation in order to determine the data required for the fulfilment of the purposes referred to in Article 31(1) to (4). Those data requirements shall constitute the EU Customs Data Model.

Removed:Article 37 Technical means for cooperation

Removed:1. The Commission, the EU Customs Authority and the customs authorities shall use the EU Customs Data Hub when exchanging with the authorities and Union bodies referred to in Article 31(6) to (11)(9) and 11 in accordance with this Regulation. The Commission, the EU Customs Authority and the customs authorities shall use Europol’s Secure Information Exchange Network Application (SIENA) when exchanging information with Europol. [Am. 166]

Removed:2. For the Union other formalities and systems listed in the Annex to Regulation (EU) 2022/2399, the EU Customs Data Hub shall ensure interoperability through the EU Single Window Environment for Customs established by that Regulation.

Removed:3. Where authorities other than customs authorities or Union bodies, or authorities from third countries make use of electronic means established by, used to achieve the objectives of, or referred to in Union legislation, the cooperation may take place by means of interoperability of those electronic means with the EU Customs Data Hub. [Am. 167]

Removed:4. Where authorities other than customs authorities, including authorities from third countries, do not make use of electronic means established by, used to achieve the objectives of, or referred to in, Union legislation, those authorities may use the specific services and systems of the EU Customs Data Hub in accordance with Article 31. [Am. 168]

Removed:5. The Commission shall adopt, by means of implementing acts, the rules for technical modalities for interoperability and connection referred to in paragraphs 3 and 4. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 262(4).

Removed:Article 38 Exchange of additional information between customs authorities and economic operators

Removed:1. Customs authorities and economic operators may exchange any information not specifically required under the customs legislation, in particular for the purpose of mutual cooperation in the identification and counteraction of risk. That exchange may take place under a written agreement and may include access to the electronic systems of economic operators by the customs authorities.

Removed:2. Any information provided by one party to the other in the course of the cooperation referred to in paragraph 1 shall be confidential unless both parties agree otherwise or unless the provisions in force provide otherwise.

Removed:Article 39 Provision of information by the customs authorities

Removed:1. Any person may request information concerning the application of the customs legislation from the customs authorities. The customs authorities may refuse such a request where it does not relate to an activity pertaining to international trade in goods that is actually envisaged.

Removed:2. Customs authorities shall maintain a regular dialogue with economic operators and other authorities involved in international trade in goods. They shall promote transparency by making the customs legislation, general administrative rulings and application forms freely available, wherever practical without charge, and through the internet.

Removed:2a. A comprehensive and user-friendly digital interface shall also provide access to all information related to autonomous measures, including tariffs, quotas, sanctions, and embargoes with the aim of enhancing companies' compliance with these measures. This shall also promote greater coherence among various autonomous measures. [Am. 169]

Removed:Article 40 Information and supporting documents

Removed:1. When providing or making available the data and information required for the specific customs procedure under which goods are placed or intended to be placed, persons shall provide or make available digital copies of original paper documents, where such paper originals exist, used to obtain that data and information.

Removed:2. Until the date set out in Article 266(3), when a customs declaration is lodged, the supporting documents required for the application of the provisions governing the customs procedure for which the goods are declared shall be in the declarant's possession and at the disposal of the customs authorities at the time of lodgement.

Removed:3. The supporting documents for the applicable Union non-customs formalities listed in the Annex to Regulation (EU) 2022/2399 shall be deemed to have been provided or made available or to be in the possession of the declarant if the customs authorities are able to obtain the necessary data from the corresponding Union non-customs systems through the European Union Customs Single Window Certificates Exchange System in accordance with Article 10(1), points (a) and (c), of that Regulation.

Removed:4. Supporting documents shall also be provided by persons where necessary for customs risk management and controls.

Removed:5. Without prejudice to other legislation applied by the customs authorities, customs authorities may authorise economic operators to draw up the supporting documents referred to in paragraph 3.

Removed:6. Unless otherwise stated for specific documents, the person concerned shall, for the purposes of customs controls, keep the documents and information for at least 3 years, by any means accessible by and acceptable to the customs authorities. That period shall run:

Removed:(a) from the end of the year in which the goods are released;

Removed:(b) from the end of the year in which they cease to be subject to customs supervision, in the case of goods released for free circulation duty-free or at a reduced rate of import duty on account of their end-use;

Removed:(c) from the end of the year in which the customs procedure concerned has been discharged or temporary storage has ended, in the case of goods placed under another customs procedure or of goods in temporary storage.

Removed:7. Without prejudice to Article 182(4), where a customs control in respect of a customs debt shows that the relevant entry in the accounts has to be corrected and the person concerned has been notified of this, the documents and information shall be kept for 3 years beyond the time limit provided for in paragraph 6 of this Article.

Removed:8. Where an appeal has been lodged or where administrative or judicial proceedings have begun, the documents and information shall be kept for the period provided for in paragraph 1 or until the appeals procedure or the administrative or judicial proceedings are terminated, whichever is the latest.

Removed:Title IIIa EU SINGLE WINDOW ENVIRONMENT FOR CUSTOMS

Removed:Article 40a Establishment of an EU Single Window Environment for Customs

Removed:1. An EU Single Window Environment for Customs is established. It shall include the EU Customs Data Hub referred to in Article 29 and the Union non-customs systems referred to in Annex Ia.

Removed:2. The Commission shall interconnect the EU Customs Data Hub with the Union non-customs systems by the dates set out in Annex Ia and enable information about the Union non-customs formalities listed therein to be exchanged.

Removed:3. The Commission is empowered to adopt delegated acts in accordance with Article 261 to amend Annex Ia, as regards the Union non-customs formalities, their respective Union non-customs systems as laid down in Union legislation other than customs legislation, and the date for the establishment of the interconnections referred to in paragraph 2 of this Article.

Removed:Article 40b Government to Government digital cooperation for Union non-customs formalities

Removed:1. For each of the Union non-customs formalities listed in Annex Ia, EU CSW-CERTEX shall enable information to be exchanged between the EU Customs Data Hub and the relevant Union non-customs systems for the following purposes: