Companies wishing to obtain a customs authorisation must fulfil a number of conditions. One of these conditions pertains to the applicant’s reliability. The applicant must not have committed any serious or repeated infringement of customs or tax regulations or any serious criminal offence in the course of his economic activities (sec 39 lit. a Union Customs Code). In the case of legal entities, the reliability of a company’s responsible natural persons is also decisive. For the re-evaluation of existing authorisations, which have been necessary since the entry into force of the Union Customs Code, the German customs authorities commenced sending requests for information to the tax offices responsible for these persons in order to check their reliability. The self-assessment questionnaires to be completed when applying for or re-evaluating a customs authorisation therefore required the indication of the Tax ID and the relevant tax office of all managing persons. In addition, this data had to be provided for persons responsible for customs affairs and/or persons handling customs affairs. This included, for example, customs officers (see KMLZ Newsletter 31/2017). Many companies did not want to disclose this information to the customs authorities. The Fiscal Court in Düsseldorf was tasked with deciding in a procedure according to the legality of the customs authorities’ request for tax IDs and the identification of the responsible tax offices, within the context of the re-evaluation of customs authorisations and referred this case to the ECJ.

 

In its judgement of 16 January 2019 (C-496/17), the ECJ found the requirement of a Tax ID and the relevant tax office by the customs authorities to be generally permissible. Nevertheless, the German customs authority is now no longer permitted to continue to fully exercise its current practice. The ECJ considered it necessary to restrict the affected group of persons. According to sec 24 para 1 UA 2 UCC-IA, the reliability of a company is to be assessed only by reference to the person who is responsible for the company or exercises control over its management. Furthermore, the person responsible for customs affairs is decisive. According to the provision’s wording, this list is exhaustive. However, contrary to the provision’s wording, more than one person may be affected. Depending on the company’s organisational structure, several natural persons can be jointly responsible for the company or for its customs affairs. However, with the exception of the head of a company’s customs department, the provision does not extend to members of advisory and supervisory boards, heads of departments, including the accounting department, or customs officers themselves.

 

According to the ECJ, the processing of the tax data requested by the customs authorities does not violate EU legislation on the protection of personal data. Thus, the survey must be carried out, in particular, for a defined, clear and legitimate purpose (sec 5 para 1 lit. b and c General Data Protection Regulation). Sec 6 para 1 lit. c General Data Protection Regulation permits the use of personal data if it is necessary in order to fulfil a legal obligation on the part of the responsible person. The customs authorities are subject to the obligation to verify the fulfillment of the conditions of a customs authorisation. In order to do so, they need the required data. According to the ECJ, this constitutes a clear purpose. The survey is an appropriate measure to enable the evaluation of the affected persons’ reliability. The collection of the data is limited to the extent necessary for the purposes of the processing. It has a limited scope and does not refer to sensitive information about an individual’s personal situation.

 

It is not decisive whether the infringements were committed by the person within the framework of the economic activity of the company. Private violations are also relevant. The ECJ also emphasises that, according to the principle of good faith laid down in sec 5 General Data Protection Regulation, the affected persons must be informed of the collection of their data.

 

Since the UCC’s introduction, all companies are required to re-evaluate their customs authorisations by 1 May 2019. Thus, the ECJ’s decision affects all companies with customs authorisations. In recent months, not only companies applying for a new authorisation, but also any companies holding pre-existing customs authorisations have been asked to complete the questionnaires. The customs authority has suspended its requests for Tax IDs until further notice (see KLMZ Newsletter 31/2017). The follow-up decision of the Fiscal Court in Düsseldorf is still pending. However, it can be assumed that the customs authority will react promptly to the ECJ’s judgement and adapt its requirements. The request for Tax IDs will, once again, be forthcoming, but only with respect to that category of persons identified by the ECJ. Affected companies should inform those persons, whose data has been communicated to the customs authorities, of this fact. Persons who are not covered by sec 24 para 1 UA 2 UCC-IA should request the deletion of their data. In the future, companies should closely examine the nature of the personal data, which is made available to the customs authority. It must be ensured that only the data of the persons responsible for the company and those persons who are ultimately responsible for customs affairs is communicated. The group of persons whose data has to be communicated may be limited by management regulations or other organizational measures assigning the responsibility for customs affairs.

 

Dobrinka Atanasova

Lawyer

+49 (0) 89 217 50 1255