Contents
Article 19Specific role of the Commission and the competent authorities#
1.The Commission shall be the controller for:
(a)the processing of personal data for the access management for the Commission Portal in accordance with Article 12 of this Regulation;
(b)the processing of personal data registered in the CBAM Operators Portal;
(c)the use, validation and retrieving of EORI or other data for the purpose of the risk analysis and circumvention monitoring as provided for in Articles 15, and 27 of Regulation (EU) 2023/956.
2.The competent authority shall be the controller for:
(a)the personal data processing to take decisions on the granting and revocation of authorisations of CBAM declarants in accordance with Regulation (EU) 2023/956;
(b)the personal data processing to take decisions regarding penalties in accordance with Article 26 of Regulation (EU) 2023/956;
(c)the processing of personal data for the access management of the authorised CBAM declarants, applicants, persons for whom the status of authorised CBAM declarants was revoked, and persons delegated to act on behalf of and in the name of those persons, established within their Member State in accordance with Articles 8, 11 and 13 of this Regulation;
(d)the processing of personal data of accredited verifiers.
3.The competent authority and the Commission shall be joint controllers for:
(a)management of the CBAM registry;
(b)the personal data processing for the management of CBAM declarations in accordance with Regulation (EU) 2023/956;
(c)the personal data processing for the CBAM certificates management in accordance with Regulation (EU) 2023/956;
(d)the personal data processing for the monitoring of the single mass-based threshold in accordance with Article 2a of Regulation (EU) 2023/956.
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.