Commission Implementing Regulation (EU) 2021/2248 of 16 December 2021 specifying the details of the electronic interface between national customs systems and the information and communication system for market surveillance, and the data to be transmitted by means of that interface (Text with EEA relevance)

For the purposes of this Regulation, the following definitions shall apply: (a) ‘Information and Communication System for Market Surveillance’ or ‘ICSMS’ means the information and communication system on market surveillance provided for in Article 34(1) of Regulation (EU) 2019/1020; (b) ‘interface’ means the electronic interface to be developed by the Commission pursuant to Article 34(7) of Regulation (EU) 2019/1020.

1 For the purposes of notification to market surveillance authorities of the suspension of release for free circulation of a product pursuant to Article 26(2) of Regulation (EU) 2019/1020, the data to be transmitted shall include: (a) relevant data available from national customs systems, including data from the customs declaration, as listed in Annex I, Section 1, to this Regulation; (b) additional data to be entered in national customs systems, as listed in Annex I, Section 2, to this Regulation.

2 Where market surveillance authorities request customs authorities to maintain the suspension of the release for free circulation of the product, inform customs authorities of their approval for such release or require customs authorities not to release the product for free circulation pursuant to Articles 27 and 28 of Regulation (EU) 2019/1020, the data to be transmitted shall include: (a) the decision of the market surveillance authorities as regards the approval or refusal to release the product for free circulation, or their request to maintain the suspension, in accordance with Annex II to this Regulation; (b) follow-up to the communications referred to in point (a) of this paragraph, both by customs authorities and market surveillance authorities, in accordance with Annex III to this Regulation.

3 For the purposes of a request by market surveillance authorities to suspend the release for free circulation of a product pursuant to Article 26(3) of Regulation (EU) 2019/1020, and of the reply by customs authorities, the data specified in Annex IV to this Regulation shall be transmitted.

1 Where a Member State uses the interface, customs authorities shall connect the national customs systems with that interface, test the connection and ensure that these systems remain interoperable with that interface.

2 Where the notifications and requests referred to in Article 26(2) and (3) of Regulation (EU) 2019/1020 take place by means of ICSMS and of the interface pursuant to Article 26(4) of that Regulation, the following provisions shall apply: (a) customs authorities shall enter in their national customs systems the data to be transmitted, where such data are not already present, and shall authorise the transmission of these data via the interface to ICSMS; (b) market surveillance authorities shall enter in ICSMS the data to be transmitted and shall authorise the transmission of these data via the interface to the national customs systems of the relevant customs authorities; (c) once the transmission of the data referred to in points (a) and (b) of this paragraph has been authorised, the interface shall transmit these data to the other system; (d) all subsequent data transmissions relating to the notifications and requests shall take place via the interface.

3 Where the market surveillance authorities do not respond to the notification within the time limits set out in Article 27, point (a), of Regulation (EU) 2019/1020, ICSMS shall transmit to national customs systems, via the interface, an automatic message indicating that the product may be released for free circulation where all the other requirements and formalities relating to such a release have been fulfilled.

1 Processing of personal data may take place in the interface only for the following purposes: (a) enabling information to be exchanged between national customs systems and ICSMS for the control of products entering the Union market in accordance with Articles 25 to 28 of Regulation (EU) 2019/1020; (b) performing the transformation of data, where necessary, to ensure alignment of customs and non-customs terminology and thereby enabling the exchange of information referred to in point (a).

2 The interface may process personal data only for the following categories of data subjects: (a) natural persons whose personal information is contained in the customs declaration; (b) natural persons whose personal information is contained in the supporting documents or in any other additional documentary evidence required for the verification of compliance with Union law of the products subject to the customs declaration; (c) authorised staff of customs authorities and market surveillance authorities or any other relevant authority or authorised body whose personal information is contained in any documents referred to in points (a) and (b); (d) Commission staff and third party providers acting on behalf of the Commission that perform operations and maintenance activities related to the interface.

3 The interface may process only the following categories of personal data: (a) name and contact information (including address, country code, e-mail, telephone) or identification number of the natural persons referred to in paragraph 2, points (a) and (b); (b) name, contact information (including address, country code, e-mail, telephone) and signature of the authorised staff referred to in paragraph 2, points (c) and (d).

4 The transformation of personal data referred to in paragraph 1, point (b), shall be performed using information technology infrastructure located in the Union.

1 As regards the processing of personal data in the interface, the Commission shall be a joint controller within the meaning of Article 28(1) of Regulation (EU) 2018/1725, and customs authorities and market surveillance authorities shall be joint controllers within the meaning of Article 26(1) of Regulation (EU) 2016/679.

2 The Commission shall enter into a joint controllership arrangement with the other joint controllers, to establish the respective responsibilities of the joint controllers and comply with the obligations under Regulations (EU) 2016/679 and (EU) 2018/1725.

3 The joint controllers shall ensure that they: (a) work together to process the requests made by the data subject in a timely manner; (b) assist each other in matters involving the identification and handling of any data breach related to joint processing; (c) exchange the relevant information necessary to inform data subjects pursuant to Section 2 of Regulation (EU) 2016/679 and Section 2 of Regulation (EU) 2018/1725; (d) ensure and protect the security, integrity, availability and confidentiality of the personal data processed jointly pursuant to Article 32 of Regulation (EU) 2016/679 and Article 33 of Regulation (EU) 2018/1725.

Data transmitted via the interface pursuant to this Regulation shall not remain in the interface longer than necessary for their transmission and shall be kept confidential by the Commission during the transmission. This data shall be used only for the purpose of implementation of Regulation (EU) 2019/1020.

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 16 December 2025.