Commission Implementing Regulation (EU) 2024/2145 of 31 July 2024 laying down rules for information exchange in the European Union Customs Single Window Certificate Exchange System pursuant to Regulation (EU) 2022/2399 of the European Parliament and of the Council

1 EU CSW-CERTEX shall perform a business transformation of data by mapping the relevant customs procedures and re-export with the respective administrative decision or status indicated in the supporting documents for a Union non-customs formality, or vice versa, including determining the applicability of quantity management, in accordance with the rules tables provided for in Annex I to this Regulation.

2 For the Information and Communication System for Market Surveillance, EU CSW-CERTEX shall enable the exchange of data for the purpose of cooperation between customs and market surveillance authorities in accordance with Implementing Regulation (EU) 2021/2248.

EU CSW-CERTEX shall map the data elements identified in accordance with Delegated Regulation (EU) 2024/2514 to those specified in Regulation (EU) No 952/2013 and perform a technical transformation of those data elements in accordance with the data mapping tables provided for in Annex II to this Regulation.

Data elements within Union non-customs formalities specified in Article 1 of Delegated Regulation (EU) 2024/2514 that cannot be matched directly to data elements in customs formalities, shall be mapped using a specific data element identified as ‘EU SWE-C data element’.

The functionalities of EU CSW-CERTEX indicated in this Chapter shall operate individually or in combination with each other for the information exchange and processing referred to in Article 10(1) and (2) of Regulation (EU) 2022/2399.

1 Where a supporting document is referenced in a customs declaration or re-export declaration, EU CSW-CERTEX shall: (a) verify that the supporting document is available and retrieve it from its respective Union non-customs system; (b) transform the data included in that supporting document in accordance with Articles 1, 2 and 3; (c) transmit the data, together with the original supporting document where requested, to the national single window environment for customs where the customs declaration or re-export declaration was lodged.

2 If the status of a supporting document changes in a manner that would affect the identification of procedures in accordance with Article 1, EU CSW-CERTEX shall perform the actions referred to in paragraph 1 of this Article in an automated manner.

1 Where a supporting document is referenced in a customs declaration or re-export declaration, and that declaration is accepted by customs authorities with quantity management applied in accordance with Annex I to this Regulation, EU CSW-CERTEX shall: (a) perform the actions specified in Article 5(1), point (a); (b) transmit a verification from the Union non-customs systems to the national single window environments for customs confirming that the specific quantities of goods declared in the customs declaration or re-export declaration do not exceed those indicated in the supporting document.

2 If the verifications provided for in paragraph 1 are successful, EU CSW-CERTEX shall communicate the outcome of the quantity reservation and the content of the supporting document to the national single window environments for customs.

3 Where goods for which a quantity has been reserved in accordance with paragraph 2 are released or re-exported, EU CSW-CERTEX shall retrieve information from the respective national single window environment for customs on the quantity released or re-exported and forward that information to the respective Union non-customs systems, where those quantities shall be considered consumed.

4 Where goods for which a quantity has been reserved in accordance with paragraph 2 are not released, EU CSW-CERTEX shall retrieve information from the respective national single window environment for customs on the unreleased quantity and forward that information to the respective Union non-customs systems, where those quantities shall be considered neither reserved nor consumed.

5 If the verifications provided for in paragraph 1 are not successful, EU CSW-CERTEX shall transmit to the national single window environment for customs the reason for the failed reservation.

Where a customs declaration is amended in accordance with Article 173 of Regulation (EU) No 952/2013 or invalidated pursuant to Article 174 of that Regulation, and a supporting document is referenced in the customs declaration in accordance with Articles 5 and 6 of this Regulation, EU CSW-CERTEX shall receive the information about the amendment or invalidation from the respective national single window environments for customs and transmit it to the respective Union non-customs systems to update or withdraw the quantity of goods consumed. The feedback on updated or withdrawn quantities shall be transmitted back to the national single window environments for customs.

1 By way of derogation from Article 6, customs authorities may, under their full responsibility and in exceptional circumstances, instruct EU CSW-CERTEX to bypass the automated verifications referred to in paragraph 1 of that Article, and to amend, accept, or refuse, as appropriate, the specific quantities of goods described in the supporting documents.

2 EU CSW-CERTEX shall transmit the outcome of the actions referred to in paragraph 1 to the respective Union non-customs system.

1 Where Union legislation other than customs legislation requires customs authorities to provide additional information for the fulfilment of a Union non-customs formality, and a supporting document for that Union non-customs formality is referenced in a customs declaration, EU CSW-CERTEX shall facilitate the retrieval of that additional information from the respective national single window environment for customs and make it available to the relevant Union non-customs system.

2 The functionality referred to in paragraph 1 may be used by customs authorities to amend or delete the additional information transmitted to the Union non-customs system through EU CSW-CERTEX.

1 Where a national single window environment for customs requests a specific list of supporting documents, or data therein, EU CSW-CERTEX shall retrieve those supporting documents or data from the respective Union non-customs system and make them available to the national single window environment for customs as required.

2 Where a national single window environment for customs periodically requests a specific list of supporting documents, or data therein, it shall specify the period for which that request is made. In that case, EU CSW-CERTEX shall retrieve those supporting documents or data from the Union non-customs system and make them available to the national single window environment for customs as and when required.

1 The Commission shall inform customs authorities and partner competent authorities immediately and without delay of the following: (a) any planned unavailability of EU CSW-CERTEX or its functionalities; (b) any unavailability of EU CSW-CERTEX or one of its functionalities due to a temporary failure.

2 In the cases referred to in paragraph 1, points (a) and (b), the exchange of customs formalities and Union non-customs formalities between customs authorities and partner competent authorities shall take place in accordance with the relevant provisions of Regulation (EU) No 952/2013 and Union legislation other than customs legislation.

1 The following processing activities performed by EU CSW-CERTEX shall fall within the scope of joint controllership between the Commission, customs authorities and partner competent authorities within the meaning of Article 28(1) of Regulation (EU) 2018/1725 and Article 26(1) of Regulation (EU) 2016/679: (a) the receipt of personal data from national single window environments for customs and Union non-customs systems; (b) the business and technical transformation of personal data in accordance with Articles 1, 2 and 3; (c) the transmission of transformed personal data to national single window environments for customs or Union non-customs systems.

2 When processing personal data, the joint controllers shall comply with Regulations (EU) 2016/679 and (EU) 2018/1725.

1 The Commission shall be considered controller for the processing of personal data in the context of the following activities: (a) system maintenance and urgent servicing; (b) the business and technical transformation of personal data in accordance with customs legislation and Union legislation other than customs legislation, without prejudice to the transformation taking place pursuant to Article 12(1), point (b).

2 Customs authorities shall each be considered controller for the processing of personal data required to take decisions on customs formalities in accordance with customs legislation.

3 Partner competent authorities shall each be considered controller for the processing of personal data required to fulfil Union non-customs formalities in accordance with Union legislation other than customs legislation applicable to the specific Union non-customs formality.

1 The Commission shall be responsible for: (a) ensuring privacy by design and privacy by default when developing EU CSW-CERTEX in accordance with Article 5(1) of Regulation (EU) 2022/2399; (b) establishing and keeping up to date the list of all recipients of personal data; (c) ensuring that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; (d) nominating a contact point for data protection matters; (e) assisting customs authorities and partner competent authorities in responding to data subject requests, where needed.

2 Customs authorities shall be responsible for: (a) ensuring privacy by design and privacy by default in developing the interconnection between their national single window environment for customs and EU CSW-CERTEX, in accordance with Article 5(4) and (5) of Regulation (EU) 2022/2399; (b) establishing and keeping up to date the list of all recipients of personal data (in the Member States, third countries and international organisations); (c) ensuring that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; (d) cooperating with the national supervisory authority in the performance of their tasks; (e) nominating a contact point for data protection matters; (f) responding to data subject requests when those requests are addressed to them and cooperating with partner competent authorities and the Commission as necessary in accordance with Article 16(5) of this Regulation.

3 Each partner competent authority shall be responsible for: (a) establishing and keeping up to date the list of all recipients of personal data (in the Member States, third countries and international organisations); (b) ensuring that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; (c) nominating a contact point for data protection matters; (d) responding to data subject requests when those requests are addressed to them and cooperating with customs authorities and the Commission as necessary in accordance with Article 16(5) of this Regulation.

1 The Commission shall, following consultations with customs authorities and partner competent authorities, implement appropriate technical and organisational measures to ensure security of processing in accordance with Article 32 of Regulation (EU) 2016/679 and Article 33 of Regulation (EU) 2018/1725.

2 Customs authorities and partner competent authorities shall implement appropriate organisational measures to ensure the security of processing.

3 The technical measures and organisational measures referred to in paragraphs 1 and 2 shall be designed to: (a) ensure the security, integrity, confidentiality, availability and continuity of the personal data processed, in accordance with the relevant legislation; (b) protect against any unauthorised or unlawful processing, loss, use, disclosure of, or access to any personal data in their possession; (c) restrict disclosure of or access to personal data to the intended recipients in accordance with this Regulation, Regulation (EU) No 952/2013 and Union legislation other than customs legislation relevant for the specific Union non-customs formalities.

4 The joint controllers shall notify each other and provide assistance in case of security incidents, including personal data breaches. Such notification shall take place no later than 48 hours from the moment one of the joint controllers becomes aware of the security incident.

5 In the case of a personal data breach, the Commission shall notify the European Data Protection Supervisor in accordance with Article 34 of Regulation (EU) 2018/1725.

6 The joint controllers shall in any case notify each other of the following: (a) any potential or actual risk to the availability, confidentiality and integrity of the personal data processed in EU CSW-CERTEX; (b) any security incidents that are linked to the processing operation.

1 In accordance with Articles 13 and 14 of Regulation (EU) 2016/679 and Articles 15 and 16 of Regulation (EU) 2018/1725, the Commission, partner competent authorities and customs authorities shall ensure that data subjects are duly informed of the processing operations carried out within the framework of this Regulation and shall update the data protection statement of their systems accordingly.

2 Customs authorities and partner competent authorities shall ensure that any information and communication to data subjects regarding their rights is provided in a transparent manner. The Commission shall ensure that customs authorities and partner competent authorities have the required information to subsequently provide such information and communication to data subjects.

3 The Commission, customs authorities and partner competent authorities shall facilitate the exercise of the rights of data subjects.

4 The Commission, customs authorities and partner competent authorities shall handle requests from data subjects and shall cooperate without undue delay to handle those requests and provide each other with swift and efficient assistance.

5 Where a joint controller receives a data subject request that does not fall under its responsibility in accordance with Article 12, it shall forward that request to the joint controller responsible promptly and at the latest within 3 calendar days from the receipt of the request. The Commission shall assist in identifying the joint controller responsible.

6 Where a data subject requests access to personal data and that personal data is processed by EU CSW-CERTEX, the joint controller to which the request is addressed shall consult the other joint controllers before dealing with the request.

7 Where a joint controller decides to restrict the rights of data subjects for processing activities falling outside of the scope of the joint controllership and concerning personal data that may be exchanged pursuant to this Regulation, it shall inform the other joint controllers without undue delay.

8 In accordance with Article 34 of Regulation (EU) 2016/679 and Article 35 of Regulation (EU) 2018/1725, the controller responsible for a personal data breach shall notify affected data subjects if the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons. The controller responsible shall inform the other controllers of such notification.

Without prejudice to the specific rules for accessing personal data or determining its recipients in accordance with customs legislation or Union legislation other than customs legislation, access to personal data processed in EU CSW-CERTEX shall only be allowed to authorised staff of the Commission, customs authorities and partner competent authorities for the purposes of managing and operating EU CSW-CERTEX.

1 A joint controller shall notify the other joint controllers before it engages one or more data processors to carry out processing operations on its behalf.

2 The notification referred to in paragraph 1 shall take place at the latest 5 working days before the conclusion of the processing agreement with a processor.

1 National coordinators as referred to in Article 17 of Regulation (EU) 2022/2399 and the Commission shall ensure that the contact information of the joint controllers along with any other relevant information referred to in this Chapter is kept up to date and shared between the joint controllers.

2 The Commission shall make available to the joint controllers the information referred to in paragraph 1.

1 The Commission, customs authorities and partner competent authorities shall collaborate in the technical design of the functionalities of EU CSW-CERTEX.

2 At the latest 1 year before the dates set out in the Annex to Regulation (EU) 2022/2399, the Commission shall make available to the Member States the technical specifications for the interconnection of national single window environments for customs with EU CSW-CERTEX and the specific Union non-customs systems in accordance with Article 5(4) and (5) of that Regulation.

3 At the request of the Member States, the Commission may carry out piloting activities that contribute to the functioning and the design of the functionalities of EU CSW-CERTEX in view of its enhancement and readiness to interconnect with new Union non-customs systems and to exchange data required to fulfil new Union non-customs formalities.

1 Member States shall notify the Commission at least 1 month in advance of their intention to: (a) interconnect their national single window environments for customs with EU CSW-CERTEX; (b) update the interconnection of their national single window environment for customs with EU CSW-CERTEX.

2 In the cases referred to in paragraph 1, the Commission shall assist the Member States, including by ensuring that the necessary technical and operational activities are performed on EU CSW-CERTEX or the relevant Union non-customs systems.

3 Upon successful interconnection, the Commission shall authorise a Member State to use EU CSW-CERTEX to exchange information with its national single window environment for customs.

4 Member States shall ensure that the notification referred to in paragraph 1 takes into account the time required for the national single window environments for customs to successfully interconnect with EU CSW-CERTEX.

5 By way of derogation from paragraph 3, in duly justified cases, the Commission may authorise a Member State to use EU CSW-CERTEX to exchange information with its national single window environment for customs if the interconnection is functional, but not completed.

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. Article 20(2) shall apply from 3 March 2027.