Regulation (EC) No 766/2008 of the European Parliament and of the Council of 9 July 2008 amending Council Regulation (EC) No 515/97 on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters

Without prejudice to other provisions of this Regulation, and in pursuit of the objectives thereof, in particular where no customs declaration or simplified declaration is presented or where it is incomplete or where there is a reason to believe that the data contained therein are false, the Commission or the competent authorities of each Member State may exchange with the competent authority of any other Member State or the Commission the following data: (a) business name; (b) trading name; (c) address of the business; (d) VAT identification number of the business; (e) excise duties identification number ; (f) information as to whether the VAT identification number and/or the excise duties identification number is in use; (g) names of the managers, directors and, if available, principal shareholders of the business; (h) number and date of issue of the invoice; and (i) amount invoiced. This Article shall apply only to movements of goods as described in the first indent of Article 2(1).

1 Without prejudice to the competences of the Member States, with a view to assisting the authorities referred to in Article 1(1) to detect movements of goods that are the object of operations in potential breach of customs and agricultural legislation and means of transport, including containers, used for that purpose, the Commission shall establish and manage a directory of data received from public or private service providers active in the international supply chain. That directory shall be directly accessible to those authorities.

2 In managing that directory, the Commission shall be empowered: (a) to access or extract the contents of the data, by any means or in any form, and to reuse data in compliance with legislation applicable to intellectual property rights; the terms and procedures for data access or extraction shall be governed by a technical arrangement between the Commission, acting on behalf of the Community, and the service provider; (b) to compare and contrast data that are accessible in or extracted from the directory, to index them, to enrich them from other data sources and to analyse them in compliance with Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data ; (c) to make the data in this directory available using electronic data-processing techniques to the authorities referred to in Article 1(1).

3 The data referred to in this Article concern in particular movements of containers and/or means of transport and goods and persons concerned with those movements. Those shall include, where available, the following data: (a) for movements of containers: container number, container loading status, date of movement, type of movement (loaded, unloaded, transhipped, entered, left, etc.), name of vessel or registration of means of transport, number of voyage/journey, place, freight bill or other transport document; (b) for movements of means of transport: name of vessel or registration of means of transport, freight bill or other transport document, number of containers, weight of load, description and/or coding of goods, reservation number, seal number, place of first loading, place of final unloading, places of transhipment, expected date of arrival at place of final unloading; (c) for persons involved in the movements to which points (a) and (b) apply: the name, maiden name, forenames, former surnames, aliases, date and place of birth, nationality, sex and address; (d) for businesses involved in the movements to which points (a) and (b) apply: the business name, trading name, address of the business, registration number, VAT identification number and excise duties identification number and address of the owners, shippers, consignees, freight forwarders, carriers and other intermediaries or persons involved in the international supply chain.

4 Within the Commission, only designated analysts shall be empowered to process personal data to which paragraphs 2(b) and 2(c) apply. Personal data which are not necessary for the purpose of achieving the aim in question shall be deleted immediately or have any identifying factors removed. In any event, they may be stored for no more than three years.

1 The Commission shall be authorised to provide training and all forms of assistance other than financial assistance for the liaison officers of third countries and of European and international organisations and agencies.

2 The Commission may make expertise, technical or logistical assistance, training or communication activity or any other operational support available to the Member States both for the achievement of the objectives of this Regulation and in the performance of Member States’ duties in the framework of the implementation of the customs cooperation provided for by Articles 29 and 30 of the Treaty on European Union.

Provided that the third country concerned has legally committed itself to providing the assistance necessary to assemble all the evidence of the irregular nature of operations which appear to be in breach of customs or agricultural legislation or to determine the extent of the operations which have been found to be in breach of such legislation, information obtained pursuant to this Regulation may be communicated to it: by the Commission or by the Member State concerned, subject, where appropriate, to the prior agreement of the competent authorities of the Member State which provided it, or by the Commission or the Member States concerned within the framework of a joint action if information is provided by more than one Member State, subject to the prior agreement of the competent authorities of the Member States which provided it. Such communication by a Member State shall be made in compliance with its domestic provisions applicable to the transfer of personal data to third countries. In all cases, it shall be ensured that the rules of the third country concerned offer a degree of protection equivalent to that provided for in Article 45(1) and (2).;

1 The items to be included in the CIS relating to each of the categories referred to in Article 24(a) to (h) shall be determined in accordance with the regulatory procedure with scrutiny referred to in Article 43(2) to the extent that this is necessary to achieve the aim of the System. Personal data may under no circumstances appear in the category referred to in Article 24(e).

2 With regard to the categories referred to in Article 24(a) to (d), the items of information to be included in respect of personal data shall comprise no more than: (a) name, maiden name, forenames, former surnames and aliases; (b) date and place of birth; (c) nationality; (d) sex; (e) number and place and date of issue of the identity papers (passports, identity cards, driving licences); (f) address; (g) particular objective and permanent physical characteristics; (h) a warning code indicating any history of being armed or violent or of having escaped; (i) reason for inclusion of data; (j) suggested action; (k) registration number of the means of transport.

3 With regard to the category referred to in Article 24(f), the items of information to be included in respect of personal data shall comprise no more than the experts’ names and forenames.

4 With regard to the categories referred to in Article 24(g) and (h), the items of information to be included in respect of personal data shall comprise no more than: (a) name, maiden name, forenames, former surnames and aliases; (b) date and place of birth; (c) nationality; (d) sex; (e) address.

5 In all cases, no personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership and data concerning the health or sex life of an individual shall be included.;

1 Personal data which are included in the categories referred to in Article 24 shall be included in the CIS solely for the purposes of the following suggested actions: (a) sighting and reporting; (b) discreet surveillance; (c) specific checks; and (d) operational analysis.

2 Personal data which are included in the categories referred to in Article 24 may be included in the CIS only if, in particular on the basis of prior illegal activities or of information provided by way of assistance, there is a real indication that the person in question has carried out, is carrying out or is about to carry out operations in breach of customs or agricultural legislation which are of particular relevance at Community level.;

1 Subject to Article 30(1), CIS partners shall be prohibited from using personal data from the CIS for any purpose other than that stated in Article 23(2).

2 Data may be duplicated only for technical purposes, provided that such duplication is required for the purpose of searches carried out by the authorities referred to in Article 29.

3 Personal data included in CIS by a Member State or the Commission may not be copied in data-processing systems for which the Member States or the Commission are responsible, except in systems of risk management used to direct national customs controls or in an operational analysis system used to coordinate actions at Community level. In that case, only the analysts designated by the national authorities of each Member State and those designated by Commission services shall be empowered to process personal data obtained from the CIS within the framework respectively of a risk management system used to direct customs controls by national authorities or an operational analysis system used to coordinate actions at Community level. Member States shall send the Commission a list of the risk management departments whose analysts are authorised to copy and process personal data entered in the CIS. The Commission shall inform the other Member States accordingly. It shall also provide all Member States with the corresponding information regarding its own services responsible for operational analysis. The list of designated national authorities and Commission services shall be published for information by the Commission in the Official Journal of the European Union. Personal data copied from the CIS shall be kept only for the time necessary to achieve the purpose for which they were copied. The need for their retention shall be reviewed at least annually by the copying CIS partner. The storage period shall not exceed 10 years. Personal data which are not necessary for the continuation of the analysis shall be deleted immediately or have any identifying factors removed.;

1 The CIS shall also include a specific database called the Customs files identification database (FIDE). Subject to the provisions of this Title, all the provisions of this Regulation relating to the CIS shall also apply to the FIDE, and any reference to the CIS shall include that database.

2 The objectives of the FIDE shall be to help to prevent operations in breach of customs legislation and of agricultural legislation applicable to goods entering or leaving the customs territory of the Community and to facilitate and accelerate their detection and prosecution.

3 The purpose of the FIDE shall be to allow the Commission, when it opens a coordination file within the meaning of Article 18 or prepares a Community mission in a third country within the meaning of Article 20, and the competent authorities of a Member State designated as regards administrative enquiries in accordance with Article 29, when they open an investigation file or investigate one or more persons or businesses, to identify the competent authorities of the other Member States or the Commission departments which are or have been investigating the persons or businesses concerned, in order to achieve the objectives specified in paragraph 2 by means of information on the existence of investigation files.

4 If the Member State or the Commission making a search in the FIDE needs fuller information on the registered investigation files on persons or businesses, it shall ask for the assistance of the supplier Member State.

5 The customs authorities of the Member States may use the FIDE within the framework of customs cooperation provided for in Articles 29 and 30 of the Treaty on European Union. In such a case, the Commission shall ensure the technical management of the database.

1 The competent authorities may enter data from investigation files in the FIDE for the purposes defined in Article 41a(3) concerning cases which are in breach of customs legislation or agricultural legislation applicable to goods entering or leaving the customs territory of the Community and which are of particular relevance at Community level. The data shall cover only the following categories: (a) persons and businesses which are or have been the subject of an administrative enquiry or a criminal investigation by the relevant service of a Member State, and are suspected of committing or of having committed a breach of customs or agriculture legislation or of participating in or of having participated in an operation in breach of such legislation, have been the subject of a finding relating to such an operation, or have been the subject of an administrative decision or an administrative penalty or judicial penalty for such an operation; (b) the field concerned by the investigation file; (c) the name, nationality and details of the relevant service in the Member State and the file number. The data referred to in points (a), (b) and (c) shall be introduced separately for each person or business. The creation of links between those data shall be prohibited.

2 The personal data referred to in paragraph 1(a) shall consist only of the following: (a) for persons: the name, maiden name, forename, former surnames and alias, date and place of birth, nationality and sex; (b) for businesses: the business name, trading name, address of the business, VAT identification number and excise duties identification number.

3 Data shall be entered for a limited period in accordance with Article 41d.

1 The introduction and consultation of data in the FIDE shall be reserved exclusively to the authorities referred to in Article 41a.

2 Any consultation of the FIDE must specify the following personal data: (a) for persons: the forename and/or name and/or maiden name and/or former surnames and/or alias and/or date of birth; (b) for businesses: the business name and/or trading name and/or VAT identification number and/or excise duties identification number.

1 The period for which data may be stored shall depend on the laws, regulations and procedures of the Member State supplying them. The following are the maximum periods, calculated from the date of entry of the data in the investigation file, which may not be exceeded: (a) data concerning current investigation files may not be stored for more than three years without any operation in breach of customs and agricultural legislation being observed; data must be deleted before that time limit if one year has elapsed since the last observation; (b) data concerning administrative enquiries or criminal investigations in which an operation in breach of customs and agricultural legislation has been established but which have not given rise to an administrative decision, a conviction or an order to pay a criminal fine or an administrative penalty may not be stored for more than six years; (c) data concerning administrative enquiries or criminal investigations which have given rise to an administrative decision, a conviction or an order to pay a criminal fine or an administrative penalty may not be stored for more than 10 years. These periods shall not be cumulative.

2 At all stages of an investigation file as referred to in paragraph 1(a), (b) and (c), as soon as a person to whom, or a business to which, Article 41b applies is cleared of suspicion under the laws, regulations and procedures of the supplier Member State, data concerning that person or business shall immediately be deleted.

3 The FIDE shall delete the data automatically as soon as the maximum storage period provided for in paragraph 1 has elapsed.;

1 This Regulation is the basic act on which the financing of all Community action provided for herein is based, including: (a) all costs of installing and maintaining the permanent technical infrastructure making available to the Member States the logistical, office automation and IT resources to coordinate joint customs operations, in particular special surveillance operations provided for in Article 7; (b) the reimbursement of transport, accommodation and daily allowance costs of representatives of the Member States taking part in the Community missions provided for in Article 20, joint customs operations organised by or jointly with the Commission and training courses, ad hoc meetings and preparatory meetings for administrative investigations or operational actions conducted by the Member States, where they are organised by or jointly with the Commission. Where the permanent technical infrastructure referred to in point (a) is used for the purposes of the customs cooperation provided for in Articles 29 and 30 of the Treaty on European Union, the transport, accommodation costs and the daily allowances of the representatives of the Member States shall be borne by the Member States; (c) expenditure relating to the acquisition, study, development and maintenance of computer infrastructure (hardware), software and dedicated network connections, and to related production, support and training services for the purpose of carrying out the actions provided for in this Regulation, in particular preventing and combating fraud; (d) expenditure relating to the provision of information and expenditure on related actions allowing access to information, data and data sources for the purpose of carrying out the actions provided for in this Regulation, in particular preventing and combating fraud; (e) expenditure relating to use of the CIS provided for in instruments adopted under Articles 29 and 30 of the Treaty on European Union and in particular in the Convention on the use of information technology in customs matters drawn up by the Council Act of 26 July 1995 , in so far as those instruments provide that that expenditure shall be borne by the general budget of the European Union.

2 Expenditure relating to the acquisition, study, development and maintenance of the Community components of the common communication network used for the purposes of paragraph 1(c) shall also be borne by the general budget of the European Union. The Commission shall conclude the necessary contracts on behalf of the Community to ensure the operational nature of those components.

3 Without prejudice to the expenses relating to the operation of the CIS and the amounts provided for by way of compensation pursuant to Article 40, the Member States and the Commission shall waive all claims for the reimbursement of expenditure relating to the supply of information or of documents or to the implementation of an administrative investigation or of any other operational action pursuant to this Regulation which are carried out at the request of a Member State or the Commission, except as regards the allowances, if any, paid to experts.

The Commission, in cooperation with the Member States, shall report each year to the European Parliament and to the Council on the measures taken in implementation of this Regulation.;

This Regulation shall enter into force on the third day following its publication in the Official Journal of the European Union.