COMMISSION IMPLEMENTING DECISION (EU) 2019/2212

of 20 December 2019

on a pilot project to implement certain administrative cooperation provisions set out in Regulation (EU) 2017/2394 of the European Parliament and of the Council on cooperation between authorities responsible for the enforcement of consumer protection laws by means of the Internal Market Information System

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 1024/2012 of the European Parliament and of the Council of 25 October 2012 on administrative cooperation through the Internal Market Information System and repealing Commission Decision 2008/49/EC (‘the IMI Regulation’) (1), and in particular Article 4(1) thereof,

Whereas:

(1) The Internal Market Information System (‘IMI’) established by Regulation (EU) No 1024/2012 is a software application that is accessible via the internet and was developed by the Commission, in cooperation with the Member States, to help Member States comply with information exchange requirements in Union acts by providing a centralised communication mechanism to facilitate the cross-border exchange of information and mutual assistance.

(2) Article 4(1) of Regulation (EU) No 1024/2012 allows the Commission to carry out pilot projects to assess the effectiveness of IMI in the implementation of administrative cooperation provisions in Union acts not listed in the Annex to that Regulation.

(3) Regulation (EU) 2017/2394 of the European Parliament and of the Council (2) lays down the conditions under which competent authorities responsible for the enforcement of Union consumer protection laws are to cooperate and coordinate actions with each other and with the Commission. Article 35 of that Regulation requires the Commission to establish and maintain an electronic database for all communications between competent authorities, single liaison offices and the Commission under that Regulation. It also requires any information provided by entities issuing external alerts pursuant to Article 27 of that Regulation to be stored and processed in that electronic database. In addition, Article 23(3) of that Regulation provides for the European Banking Authority to act as observer in certain cases, and the European Banking Authority should therefore be able to access the electronic database in such a case to allow it to observe the relevant communications.

(4) The Commission has adopted Commission Implementing Decision (EU) 2019/2213 (3) laying down the practical and operational arrangements for the functioning of the electronic database established under Regulation (EU) 2017/2394 as respects communications made under certain provisions of that Regulation. IMI could be an effective tool in the implementation of the administrative cooperation provisions falling within the scope of Commission Implementing Decision (EU) 2019/2213 Those provisions should therefore be the subject of a pilot project under Article 4 of Regulation (EU) No 1024/2012.

(5) Regulation (EU) 2017/2394 defines different actors responsible for applying the administrative cooperation provisions laid down in that Regulation. In order to guarantee the effective application of those provisions, those actors should be considered as IMI actors for the purposes of the pilot project.

(6) IMI should provide the technical functionality allowing the competent authorities, the single liaison offices, the Commission, and other actors to fulfil their obligations under Regulation (EU) 2017/2394 falling within the scope of Implementing Decision (EU) 2019/2213 IMI should ensure that access to IMI by those actors is restricted to the functionality for which they need access in order to fulfil their obligations under that Regulation.

(7) IMI allows IMI actors to communicate and interact with each other in a structured manner. This means that structured forms have to be used for the exchange and processing of all information via IMI. Use of these forms will therefore fulfil any requirements in Regulation (EU) 2017/2394 to use standard forms for communications that fall within the scope of the pilot project (for example, the requirement in Article 13(3) of that Regulation).

(8) Article 35(3) of Regulation (EU) 2017/2394 provides that data relating to infringements must be stored in the electronic database for no longer than is necessary for the purposes for which they were collected and processed and in any case for no longer than 5 years from the end of the relevant cooperation. Therefore, IMI should ensure that as soon as data relating to an infringement are no longer needed, the data can be deleted from IMI, and that such data are in any event deleted by no later than 5 years after the date specified point (a), (b) or (c) of the second subparagraph of Article 35(3) of Regulation (EU) 2017/2394. Only a record of the information exchanges should remain accessible in IMI. This provision should operate without prejudice to Article 14 of Regulation (EU) No 1024/2012 insofar as the application of that Article would result in the earlier blocking or deletion of personal data stored as part of the pilot project.

(9) Pursuant to Article 4(2) of Regulation (EU) No 1024/2012, the Commission is to submit an evaluation of the outcome of the pilot project to the European Parliament and the Council. It is appropriate to specify the date by which the evaluation is to be submitted. In the interests of consistency, the date specified should be the same as the date by which the report required by Article 40 of Regulation (EU) 2017/2394 is to be submitted.

(10) The measures provided for in this Decision are in accordance with the opinion of the Committee established by Article 24 of Regulation (EU) No 1024/2012,

HAS ADOPTED THIS DECISION:

Article 1

The pilot project

Articles 11 to 23, 26, 27 and 28 of Regulation (EU) 2017/2394 shall be subject to a pilot project to implement the administrative cooperation provisions set out in those Articles by means of the Internal Market Information System (‘IMI’).

Article 2

Competent authorities and other IMI actors

1. For the purposes of the pilot project, the competent authorities and single liaison offices designated pursuant to Article 5 of Regulation (EU) 2017/2394 and the entities empowered to issue external alerts pursuant to Article 27(1) of that Regulation shall be considered as competent authorities within the meaning of point (f) of the second paragraph of Article 5 of Regulation (EU) No 1024/2012.

2. For the purposes of the pilot project, the entities empowered to issue external alerts pursuant to Article 27(2) of Regulation (EU) 2017/2394 and the European Banking Authority in its capacity as an observer pursuant to Article 23(3) of that Regulation shall be considered as IMI actors within the meaning of point (g) of the second paragraph of Article 5 of Regulation (EU) No 1024/2012.

Article 3

Administrative cooperation

1. For the purposes of Article 11 of Regulation (EU) 2017/2394, IMI shall provide the technical functionality for, in particular, the following:

(a) submitting a request for information pursuant to that Article, including any accompanying information and evidence;

(b) forwarding the request to the appropriate competent authority;

(d) informing the applicant authority and the Commission of a refusal to comply with a request for information, including the reasons for the refusal;

(e) communicating in the event of a disagreement about a request for information.

2. For the purposes of Article 12 of Regulation (EU) 2017/2394, IMI shall provide the technical functionality for, in particular, the following:

(a) submitting a request for enforcement measures pursuant to that Article, including any accompanying information and evidence;

(b) forwarding the request to the appropriate competent authority;

(c) informing the applicant authority about the steps and measures taken or intended to be taken in response to the request, including communications concerning the time limit for complying with the request;

(d) notifying the applicant authority, the competent authorities of other Member States and the Commission of the measures taken and the effect of those measures;

(e) informing the applicant authority and the Commission of a refusal to comply with a request for enforcement measures;

(f) communicating in the event of a disagreement about a request for enforcement measures.

3. For the purposes of Articles 15 to 23 of Regulation (EU) 2017/2394, IMI shall provide the technical functionality for, in particular, the following:

(a) notifying an intention to launch a coordinated action;

(b) identifying and designating a coordinator for the coordinated action;

(d) communicating an intention to participate in a coordinated action;

(e) notifying the results of investigations pursuant to Article 17(3) of Regulation (EU) 2017/2394;

(f) communicating a decision to decline to take part in a coordinated action, including the reasons for the decision and any supporting documents;

(g) communicating a common position on the outcome of the investigation and the assessment of the widespread infringement;

(h) communicating with respect to commitments in coordinated actions;

(i) communicating with respect to progress of the coordinated action;

(j) communicating with respect to any mutual assistance requests that may be relevant for the coordinated action;

(k) communicating with respect to the coordination of any enforcement measures;

(l) communicating with respect to closure of the coordinated action.

4. For the purposes of Article 26 of Regulation (EU) 2017/2394, IMI shall provide the technical functionality for, in particular, the following:

(a) issuing an alert, including any relevant accompanying information and a possible indication of the intention of launching a coordinated action;

(b) correcting the information in an alert;

(d) requesting verification of whether similar infringements are taking place or enforcement measures have been taken;

(e) replying to such requests;

(f) attributing incoming communications to the appropriate competent authorities.

5. For the purposes of Article 27 of Regulation (EU) 2017/2394, IMI shall provide the technical functionality for, in particular, the following:

(a) issuing an external alert, including any relevant accompanying information;

(b) correcting the information in an external alert;

(d) attributing incoming communications to the appropriate competent authorities.

6. For the purposes of Article 28 of Regulation (EU) 2017/2394, IMI shall provide the technical functionality for, in particular, notifying measures taken to address an infringement.

Article 4

Access to IMI functionality

IMI shall ensure that all those considered under Article 2 to be competent authorities or other IMI actors for the purposes of the pilot project shall only be able to access the functionality in IMI that they need to access in order to meet their obligations under Regulation (EU) 2017/2394.

Article 5

Retention of data

1. IMI shall provide the technical functionality to allow for the deletion of all data stored in IMI as part of the pilot project relating to an infringement as soon as the relevant IMI actors indicate that those data are no longer needed for the purposes for which they were collected and processed. IMI shall also ensure that all such data are in any event deleted by no later than 5 years following the day specified for the relevant type of administrative cooperation procedure in point (a), (b) or (c) of the second subparagraph of Article 35(3) of Regulation (EU) 2017/2394.

2. Only a record of the fact of the relevant information exchange, excluding any data by which the infringement could be identified, shall remain accessible in IMI after deletion of those data.

3. Paragraph 1 does not affect the obligations under Article 14 of Regulation (EU) No 1024/2012 to block and delete personal data stored in IMI as part of the pilot project insofar as that Article would result in the earlier blocking or deletion of such data.

Article 6

Evaluation

The evaluation of the outcome of the pilot project required by Article 4(2) of Regulation (EU) No 1024/2012 shall be submitted to the European Parliament and the Council by 17 January 2023.

Article 7

This Decision shall enter into force on the twentieth day following that of its publication in the

Official Journal of the European Union

It shall apply from 17 January 2020.

Done at Brussels, 20 December 2019.

For the Commission

The President

Ursula VON DER LEYEN

(1)

OJ L 316, 14.11.2012, p. 1

(2) Regulation (EU) 2017/2394 of the European Parliament and of the Council of 12 December 2017 on cooperation between national authorities responsible for the enforcement of consumer protection laws and repealing Regulation (EC) No 2006/2004 (

OJ L 345, 27.12.2017, p. 1

(3) Commission Implementing Decision (EU) 2019/2213 of 20 December 2019 laying down the practical and operational arrangements for the functioning of the electronic database established pursuant to Regulation (EU) 2017/2394 of the European Parliament and of the Council as respects certain communications under that Regulation (See page 163 of this Official Journal).