Chapter XIX, Article 119 · Commission Implementing Regulation (EU) 2025/512

Contents

Article 119Controller and Processor for the systems#

For the systems referred to in Article 1 of this Regulation and in relation to the processing of personal data:

(a)the Member States shall act as controllers as defined in Article 4, point (7), of Regulation (EU) 2016/679 and shall comply with the obligations set out in that Regulation;

(b)the Commission shall act as processor as defined in Article 3, point (12), of Regulation (EU) 2018/1725 and shall comply with the obligations set out in that Regulation;

(c)by way of derogation from point (b), the Commission shall act as a joint controller together with the Member States in the ICS2 when processing the data for monitoring and evaluating the implementation of the common security and safety risk criteria and standards and of the control measures and priority control in accordance with Article 116(7), point (d) of this Regulation;

(d)by way of derogation from point (b), the Commission shall act as a joint controller together with the Member States in the ICS2 when processing the data to collect, store, process, or analyse additional elements of information in conjunction with entry summary declarations and to provide support to risk management processes as referred to in Article 43(3) of this Regulation, under the conditions set out by Article 116(7), point (e), of this Regulation;

(e)by way of derogation from point (b), the Commission shall also act as a joint controller together with the Member States in the CRMS;

(f)by way of derogation from point (b), the Commission shall act as joint controller together with the Member States in the REX system in the following cases:

(i)when processing the data for synchronisation with a national system;

(ii)when processing the data to access the data to verify customs declarations under Article 188 of the Code or post-release control under Article 48 of the Code;

(iii)when processing data for statistics and monitoring purposes on the use of the REX system for Member States;

(iv)when processing data for statistics and monitoring purposes on the use of the REX system for third countries.

(g)by way of derogation from point (b), the Commission shall act as a joint controller together with the Member States in the Surveillance system.