Customs Information System (CIS)
What is Customs Information System?
The purpose of the Customs Information System shall be to assist the competent authorities of the Member States with the prevention, investigation, detection or prosecution of criminal offences under national laws, by making information available more rapidly, thereby increasing the effectiveness of the cooperation and control procedures of the customs administrations of the Member States (Article 1(2) of Council Decision 2009/917/JHA of 30 November 2009 on the use of information technology for customs purposes and also Article 23(2) of Council Regulation (EC) No 515/97 of 13 March 1997 on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters). The Customs Information System consists of a central database facility (CIS EU), accessible through terminals in each Member State. It comprises exclusively data necessary to achieve its purpose mentioned above.
CIS also includes a special database FIDE (hereinafter referred to as the “Customs Files Identification Database”), with reference to Article 41a of Regulation (EC) 515/97 and Article 15 of Decision 2009/917/JHA. The purpose of the Customs Files Identification Database shall be to enable the national authorities responsible for carrying out customs investigations, when opening a file on or investigating one or more persons or businesses, and for Europol and Eurojust, to identify the competent authorities of other Member States which are investigating or have investigated those persons or businesses.
Which categories of information are processed in the CIS?
Categories of information processed in the CIS are commodities, means of transport, businesses, persons, fraud trends, availability of expertise, goods detained, seized or confiscated and cash detained, seized or confiscated (listed in Article 24 of Regulation (EC) 515/97 and in Article 3(1) of Decision 2009/917/JHA).
The personal data which can be processed in the CIS are listed in Article 25 of Regulation (EC) 515/97 and in Article 4 of Decision 2009/917/JHA.
What are the rights of data subject?
Great emphasis is placed on ensuring and guaranteeing the rights of individuals in relation to the personal data processed in the CIS. By exercising them, the data subject actively participates in the protection of his or her data and privacy, which is a prerequisite for their existence. The data subject rights are exercised in accordance with the laws and procedures of the Member State in which they are applied.
Right to access the data
The right of access means the possibility for anyone to request information, in accordance with the national law of the Member State in which the right is exercised, as to whether and, where applicable, what personal data are processed in the CIS in relation to his or her person. In the Czech Republic, data subjects are guaranteed direct access to their personal data through the data controller, which is the General Directorate of Customs (Generální ředitelství cel).
The request for information shall be refused by the competent customs authority in the cases provided for in Article 36(2) of Regulation (EC) 515/97 or Section 28(2) of Act No. 110/2019 Coll. on Personal Data Processing.
Right to rectification or erasure
Any person may, in accordance with the laws, regulations and procedures of each Member State or with the internal rules applicable to the Commission, have personal data relating to them corrected or deleted if those data are factually inaccurate, or were included or are stored in the CIS contrary to the aim stated in Article 23(2) of Regulation (EC) 515/97 or if the principles of Article 26 of the latter have not been observed.
How to proceed when exercising these rights in the Czech Republic?
The right of access to personal data, the right to rectification or the right to erasure is exercised directly by the data subject through a written request / complaint addressed to the controller, which is the General Directorate of Customs. The request must contain basic identification data of the data subject, i.e. name, surname, date and place of birth, residential address. It is necessary to provide a copy of valid ID. The controller is obliged to provide a response to the request free of charge within 30 days. Further information can be found on the website of the General Directorate of Customs.
Contact details
General Directorate of Customs
Budějovická 7
140 69 Prague 4
Czech Republic
Data box ID: 7puaa4c
E-mail address: podatelna@cs.mfcr.cz
As the procedure for exercising the above rights may vary from one Member State to another, an English-language guide is available which clearly summarises the information needed to contact the relevant authorities in each Member State and how to proceed.
It is recommended to use the contact forms available from the General Directorate of Customs website.
Right to bring an action
Any person may bring an action before the court or the authority competent under the law of any member state (Art. 36(5) of Regulation (EC) 515/97) to correct or delete factually inaccurate personal data or personal data included or stored in the CIS contrary to the Regulation (EC) 515/97 or to obtain access to personal data or to obtain compensation under Art. 40(2) of Regulation (EC) 515/97.
When to contact the Office for Personal Data Protection?
The Office for Personal Data Protection is competent to review the processing of personal data in cases where there is a suspicion of unlawful procedure by the data controller or where the data subject has received an unsatisfactory response in exercising his or her rights. If the applicant first contacts the Office for Personal Data Protection with a request for information, rectification or erasure, such request will be forwarded to controller (General Directorate of Customs). However, this may lead to delays in processing his or her request.
It is recommended to use the contact form:
Complaint concerning the processing of personal data in the Custom Information System (CIS)