4. If, when including data in the Customs Information System, a Member State notes that its report conflicts with a previous report as to content or suggested action, it shall immediately advise the Member State which made the previous report. The two Member States shall then attempt to resolve the matter. In the event of disagreement, the first report shall stand, but those parts of the new report which do not conflict shall be included in the System.

5. Subject to the provisions of this Convention, where in any Member State a court, or other competent authority within that Member State, makes a final decision as to amendment, supplementation, correction, or deletion, of data in the Customs Information System, the Member States undertake mutually to enforce such a decision. In the event of conflict between such decisions of courts or other competent authorities in different Member States, including those referred to in Article 15 (4) concerning correction or deletion, the Member State which included the data in question shall delete it from the System.

Chapter V

RETENTION OF DATA

Article 12

1. Data included in the Customs Information System shall be kept only for the time necessary to achieve the purpose for which it was included. The need for its retention shall be reviewed at least annually by the supplying Member State.

2. The supplying Member State may, within the review period, decide to retain data until the next review if its retention is necessary for the purposes for which it was included. Without prejudice to Article 15, if there is no decision to retain data it shall automatically be transferred to that part of the Customs Information System to which access shall be limited in accordance with paragraph 4.

3. The Customs Information System shall automatically inform the supplying Member State of a scheduled transfer of data from the Customs Information System under paragraph 2, giving one month’s notice.

4. Data transferred under paragraph 2 shall continue to be retained for one year within the Customs Information System, but, without prejudice to Article 15, shall be accessible only to a representative of the committee referred to in Article 16 or to the supervisory authorities referred to in Articles 17 (1) and 18 (1). During that period they may consult the data only for the purposes of checking its accuracy and lawfulness, after which it must be deleted.

Chapter VI

PERSONAL DATA PROTECTION

Article 13

1. Each Member State intending to receive personal data from, or include it in, the Customs Information System shall, no later than the time of entry into force of this Convention, adopt the national legislation sufficient to achieve a level of protection of personal data at least equal to that resulting from the principles of the 1981 Strasbourg Convention.

2. A Member State shall receive personal data from, or include it in, the Customs Information System only where the arrangements for the protection of such data provided for in paragraph 1 have entered into force in the territory of that Member State. The Member State shall also have previously designated a national supervisory authority or authorities in accordance with Article 17.

3. In order to ensure the proper application of the data protection provisions in this Convention, the Customs Information System shall be regarded in every Member State as a national data file subject to the national provisions referred to in paragraph 1 and any more stringent provisions contained in this Convention.

Article 14

1. Subject to Article 8 (1), each Member State shall ensure that it shall be unlawful under its laws, regulations and procedures for personal data from the Customs Information System to be used other than for the purpose of the aim stated in Article 2 (2).

2. Data may be duplicated only for technical purposes, provided that such duplication is necessary for direct searching by the authorities referred to in Article 7. Subject to Article 8 (1), personal data included by other Member States may not be copied from the Customs Information System into other national data files.

Article 15

1. The rights of persons with regard to personal data in the Customs Information System, in particular their right of access, shall be put into effect in accordance with the laws, regulations and procedures of the Member State in which such rights are invoked.

If laid down in the laws, regulations and procedures of the Member State concerned, the national supervisory authority provided for in Article 17 shall decide whether information is to be communicated and the procedures for so doing.

A Member State which has not supplied the data concerned may only communicate data if it has first given the supplying Member State an opportunity to adopt its position.

2. A Member State, to which an application for access to personal data is made, shall refuse access if access may undermine the performance of the legal task specified in the report pursuant to Article 5 (1), or in order to protect the rights and freedoms of others. Access shall be refused in any event during the period of discreet surveillance or sighting and reporting.

3. In each Member State, a person may, according to the laws, regulations and procedures of the Member State concerned, have personal data relating to himself corrected or deleted if that data is factually inaccurate, or was included or is stored in the Customs Information System contrary to the aim stated in Article 2 (2) of this Convention or to the provisions of Article 5 of the 1981 Strasbourg Convention.

4. In the territory of each Member State, any person may, in accordance with the laws, regulations and procedures of the Member State in question, bring an action or, if appropriate, a complaint before the courts or the authority competent under the laws, regulations and procedures of that Member State concerning personal data relating to himself on the Customs Information System, in order to:

(i) correct or delete factually inaccurate personal data;

(ii) correct or delete personal data included or stored in the Customs Information System contrary to this Convention;

(iii) obtain access to personal data;

(iv) obtain compensation pursuant to Article 21 (2).

The Member States concerned undertake mutually to enforce the final decisions taken by a court, or other competent authority, pursuant to (i), (ii) and (iii).

5. The references in this Article and in Article 11 (5) to a ’final decision’ do not imply any obligation on the part of any Member State to appeal against a decision taken by a court or other competent authority.

Chapter VII

INSTITUTIONAL FRAMEWORK

Article 16

1. A Committee consisting of representatives from the Customs Administrations of the Member States shall be set up. The Committee shall take its decisions unanimously where the provisions of the first indent of paragraph 2 are concerned and by a two-thirds majority where the provisions of the second indent of paragraph 2 are concerned. It shall adopt its rules of procedure unanimously.

2. The Committee shall be responsible:

- for the implementation and correct application of the provisions of this Convention, without prejudice to the powers of the authorities referred to in Articles 17 (1) and 18 (1);

- for the proper functioning of the Customs Information System with regard to technical and operational aspects. The Committee shall take all necessary steps to ensure that the measures set out in Articles 12 and 19 are properly implemented with regard to the Customs Information System. For the purpose of applying this paragraph, the Committee may have direct access to, and use of, data from the Customs Information System.

3. The Committee shall report annually to the Council, in accordance with Title VI of the Treaty on European Union, regarding the efficiency and effectiveness of the Customs Information System, making recommendations as necessary.

4. The Commission shall be party to the Committee’s proceedings.

Chapter VIII

PERSONAL DATA PROTECTION SUPERVISION

Article 17

1. Each Member State shall designate a national supervisory authority or authorities responsible for personal data protection to carry out independent supervision of such data included in the Customs Information System.

The supervisory authorities, in accordance with their respective national laws shall carry out independent supervision and checks, to ensure that the processing and use of data held in the Customs Information System do not violate the rights of the person concerned. For this purpose the supervisory authorities shall have access to the Customs Information System.

2. Any person may ask any national supervisory authority to check personal data relating to himself on the Customs Information System and the use which has been or is being made of that data. That right shall be governed by the laws, regulations and procedures of the Member State in which the request is made. If the data has been included by another Member State, the check shall be carried out in close coordination with that Member State’s national supervisory authority.

Article 18

1. A Joint Supervisory Authority shall be set up, consisting of two representatives from each Member State drawn from the respective independent national supervisory authority or authorities.

2. The Joint Supervisory Authority shall perform its task in accordance with the provisions of this Convention and of the 1981 Strasbourg Convention taking into account Recommendation R (87) 15 of 17 September 1987 of the Committee of Ministers of the Council of Europe.

3. The Joint Supervisory Authority shall be competent to supervise operation of the Customs Information System, to examine any difficulties of application or interpretation which may arise during its operation, to study problems which may arise with regard to the exercise of independent supervision by the national supervisory authorities of the Member States, or in the exercise of rights of access by individuals to the System, and to draw up proposals for the purpose of finding joint solutions to problems.

4. For the purpose of fulfilling its responsibilities, the Joint Supervisory Authority shall have access to the Customs Information System.

5. Reports drawn up by the Joint Supervisory Authority shall be forwarded to the authorities to which the national supervisory authorities submit their reports.

Chapter IX

SECURITY OF THE CUSTOMS INFORMATION SYSTEM

Article 19

1. All necessary administrative measures to maintain security shall be taken:

(i) by the competent authorities of the Member States in respect of the terminals of the Customs Information System in their respective States;

(ii) by the Committee referred to in Article 16 in respect of the Customs Information System and the terminals located on the same premises as the System and used for technical purposes and the checks required by paragraph 3.

2. In particular the competent authorities and the committee referred to in Article 16 shall take measures:

(i) to prevent any unauthorized person from having access to installations used for the processing of data;

(ii) to prevent data and data media from being read, copied, modified or removed by unauthorized persons;

(iii) to prevent the unauthorized entry of data and any unauthorized consultation, modification, or deletion of data;

(iv) to prevent data in the Customs Information System from being accessed by unauthorized persons by means of data transmission equipment;

(v) to guarantee that, with respect to the use of the Customs Information System, authorized persons have right of access only to data for which they have competence;

(vi) to guarantee that it is possible to check and establish to which authorities data may be transmitted by data transmission equipment;

(vii) to guarantee that it is possible to check and establish a posteriori what data has been introduced into the Customs Information System, when and by whom, and to monitor interrogation;

(viii) to prevent the unauthorized reading, copying, modification or deletion of data during the transmission of data and the transport of data media.

3. The committee referred to in Article 16 shall monitor interrogation of the Customs Information System for the purpose of checking that searches made were admissible and were made by authorized users. At least 1% of all searches made shall be checked. A record of such searches and checks shall be maintained in the System, shall be used only for the abovementioned purpose by the said committee and the supervisory authorities referred to in Articles 17 and 18, and shall be deleted after six months.

Article 20

The competent customs administration referred to in Article 10 (1) of this Convention shall be responsible for the security measures set out in Article 19, in relation to the terminals located in the territory of the Member State concerned, the review functions set out in Article 12 (1) and (2), and otherwise for the proper implementation of this Convention so far as is necessary under the laws, regulations and procedures of that Member State.

Chapter X

RESPONSIBILITIES AND LIABILITIES

Article 21

1. Each Member State shall be responsible for the accuracy, currency and lawfulness of data it has included in the Customs Information System. Each Member State shall also be responsible for complying with the provisions of Article 5 of the 1981 Strasbourg Convention.

2. Each Member State shall be liable, in accordance with its own laws, regulations and procedures for injury caused to a person through the use of the Customs Information System in the Member State concerned.

This shall also be the case where the injury was caused by the supplying Member State entering inaccurate data or entering data contrary to this Convention.

3. If the Member State against which an action in respect of inaccurate data is brought is not the Member State which supplied it, the Member States concerned shall seek agreement as to what proportion, if any, of the sums paid out in compensation shall be reimbursed by the supplying Member State to the other Member State. Any such sums agreed shall be reimbursed on request.

Article 22

1. The costs incurred in connection with the operation and use of the Customs Information System by the Member States on their territories shall be borne by each of them.

2. Other expenditure incurred in the implementation of this Convention, except for that which cannot be kept separate from the operation of the Customs Information System for the purpose of applying the customs and agricultural rules of the Community, shall be borne by the Member States. Each Member State’s share shall be determined according to the proportion of its gross national product to the sum total of the gross national products of the Member States for the year preceding the year in which the costs are incurred.

For the purpose of applying this paragraph, the expression ’gross national product’ means the gross national product determined in accordance with Council Directive 89/130/EEC, Euratom of 13 February 1989 on the harmonization of the compilation of gross national product at market prices2 or any amending or replacing Community instrument.

Chapter XI

IMPLEMENTATION AND FINAL PROVISIONS

Article 23

The information provided for under this Convention shall be exchanged directly between the authorities of the Member States.

Article 24

1. This Convention shall be subject to adoption by the Member States in accordance with their respective constitutional requirements.

2. Member States shall notify the Secretary-General of the Council of the European Union of the completion of their constitutional requirements for adopting this Convention.