Regulation (EU) No 1024/2012 of the European Parliament and of the CouncilShow full title

[F1 Regulation (EU) No 1024/2012 of the European Parliament and of the Council

of 25 October 2012

on administrative cooperation through the Internal Market Information System and repealing Commission Decision 2008/49/EC (‘the IMI Regulation’)

(Text with EEA relevance)

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 114 thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Having regard to the opinion of the European Economic and Social Committee(1),

Acting in accordance with the ordinary legislative procedure(2),

Whereas:

(1) The application of certain Union acts governing the free movement of goods, persons, services and capital in the internal market requires Member States to cooperate more effectively and exchange information with one another and with the Commission. As practical means to implement such information exchange are often not specified in those acts, appropriate practical arrangements need to be made.

(2) The Internal Market Information System (‘IMI’) is a software application accessible via the internet, developed by the Commission in cooperation with the Member States, in order to assist Member States with the practical implementation of information exchange requirements laid down in Union acts by providing a centralised communication mechanism to facilitate cross-border exchange of information and mutual assistance. In particular, IMI helps competent authorities to identify their counterpart in another Member State, to manage the exchange of information, including personal data, on the basis of simple and unified procedures and to overcome language barriers on the basis of pre-defined and pre-translated workflows. Where available, the Commission should provide IMI users with any existing additional translation functionality that meets their needs, is compatible with the security and confidentiality requirements for the exchange of information in IMI and can be offered at a reasonable cost.

(3) In order to overcome language barriers, IMI should in principle be available in all official Union languages.

(4) The purpose of IMI should be to improve the functioning of the internal market by providing an effective, user-friendly tool for the implementation of administrative cooperation between Member States and between Member States and the Commission, thus facilitating the application of Union acts listed in the Annex to this Regulation.

(5) The Commission Communication of 21 February 2011 entitled ‘Better governance of the Single Market through greater administrative cooperation: A strategy for expanding and developing the Internal Market Information System (“IMI”)’ sets out plans for the possible expansion of IMI to other Union acts. The Commission Communication of 13 April 2011 entitled ‘Single Market Act: Twelve Levers to boost growth and strengthen confidence — “Working together to create new growth”’ stresses the importance of IMI for strengthening cooperation among the actors involved, including at local level, thus contributing to better governance of the single market. It is therefore necessary to establish a sound legal framework for IMI and a set of common rules to ensure that IMI functions efficiently.

(6) Where the application of a provision of a Union act requires Member States to exchange personal data and provides for the purpose of this processing, such a provision should be considered an adequate legal basis for the processing of personal data, subject to the conditions set out in Articles 8 and 52 of the Charter of Fundamental Rights of the European Union. IMI should be seen primarily as a tool used for the exchange of information, including personal data, which would otherwise take place via other means, including regular mail, fax or electronic mail on the basis of a legal obligation imposed on Member States’ authorities and bodies in Union acts. Personal data exchanged via IMI should only be collected, processed and used for purposes in line with those for which it was originally collected and should be subject to all relevant safeguards.

(7) Following the privacy-by-design principle, IMI has been developed with the requirements of data protection legislation in mind and has been data protection-friendly from its inception, in particular because of the restrictions imposed on access to personal data exchanged in IMI. Therefore, IMI offers a considerably higher level of protection and security than other methods of information exchange such as regular mail, telephone, fax or electronic mail.

(8) Administrative cooperation by electronic means between Member States and between Member States and the Commission should comply with the rules on the protection of personal data laid down in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(3) and in Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data(4). The definitions used in Directive 95/46/EC and Regulation (EC) No 45/2001 should also apply for the purposes of this Regulation.

(9) The Commission supplies and manages the software and IT infrastructure for IMI, ensures the security of IMI, manages the network of national IMI coordinators and is involved in the training of and technical assistance to the IMI users. To that end, the Commission should only have access to such personal data that are strictly necessary to carry out its tasks within the responsibilities set out in this Regulation, such as the registration of national IMI coordinators. The Commission should also have access to personal data when retrieving, upon a request by another IMI actor, such data that have been blocked in IMI and to which the data subject has requested access. The Commission should not have access to personal data exchanged as part of administrative cooperation within IMI, unless a Union act provides for a role for the Commission in such cooperation.

(10) In order to ensure transparency, in particular for data subjects, the provisions of Union acts for which IMI is to be used should be listed in the Annex to this Regulation.

(11) IMI may be expanded in the future to new areas, where it can help to ensure effective implementation of a Union act in a cost-efficient, user-friendly way, taking account of technical feasibility and overall impact on IMI. The Commission should conduct the necessary tests to verify the technical readiness of IMI for any envisaged expansion. Decisions to expand IMI to further Union acts should be taken by means of the ordinary legislative procedure.

(12) Pilot projects are a useful tool for testing whether the expansion of IMI is justified and for adapting technical functionality and procedural arrangements to the requirements of IMI users before a decision on the expansion of IMI is taken. Member States should be fully involved in deciding which Union acts should be subject to a pilot project and on the modalities of that pilot project, in order to ensure that the pilot project reflects the needs of IMI users and that the provisions on processing of personal data are fully complied with. Such modalities should be defined separately for each pilot project.

(13) Nothing in this Regulation should preclude Member States and the Commission from deciding to use IMI for the exchange of information which does not involve the processing of personal data.

(14) This Regulation should set out the rules for using IMI for the purposes of administrative cooperation, which may cover, inter alia, the one-to-one exchange of information, notification procedures, alert mechanisms, mutual assistance arrangements and problem-solving.

(15) The right of the Member States to decide which national authorities carry out the obligations resulting from this Regulation should remain unaffected by this Regulation. Member States should be able to adapt functions and responsibilities in relation to IMI to their internal administrative structures, as well as to implement the needs of a specific IMI workflow. Member States should be able to appoint additional IMI coordinators to carry out the tasks of national IMI coordinators, alone or jointly with others, for a particular area of the internal market, a division of the administration, a geographic region, or according to another criterion. Member States should inform the Commission of the IMI coordinators they have appointed, but they should not be obliged to indicate additional IMI coordinators in IMI, where this is not required for its proper functioning.

(16) In order to achieve efficient administrative cooperation through IMI, Member States and the Commission should ensure that their IMI actors have the necessary resources to carry out their obligations in accordance with this Regulation.

(17) While IMI is in essence a communication tool for administrative cooperation between competent authorities, which is not open to the general public, technical means may need to be developed to allow external actors such as citizens, enterprises and organisations to interact with the competent authorities in order to supply information or retrieve data, or to exercise their rights as data subjects. Such technical means should include appropriate safeguards for data protection. In order to ensure a high level of security, any such public interface should be developed in such a way as to be technically fully separate from IMI, to which only IMI users should have access.

(18) The use of IMI for the technical support of the SOLVIT network should be without prejudice to the informal character of the SOLVIT procedure which is based on a voluntary commitment of the Member States, in accordance with the Commission Recommendation of 7 December 2001 on principles for using ‘SOLVIT’ — the Internal Market Problem Solving Network(5) (‘the SOLVIT Recommendation’). To continue the functioning of the SOLVIT network on the basis of existing work arrangements, one or more tasks of the national IMI coordinator may be assigned to SOLVIT centres within the remit of their work, so that they can function independently from the national IMI coordinator. The processing of personal data and of confidential information as part of SOLVIT procedures should benefit from all guarantees set out in this Regulation, without prejudice to the non-binding character of the SOLVIT Recommendation.

(19) While IMI includes an internet-based interface for its users, in certain cases and at the request of the Member State concerned, it may be appropriate to consider technical solutions for the direct transfer of data from national systems to IMI, where such national systems have already been developed, notably for notification procedures. The implementation of such technical solutions should depend on the outcome of an assessment of their feasibility, costs and expected benefits. Those solutions should not affect the existing structures and the national order of competencies.

(20) Where Member States have fulfilled the obligation to notify under Article 15(7) of Directive 2006/123/EC of the European Parliament and of the Council of 12 December 2006 on services in the internal market(6) by using the procedure in accordance with Directive 98/34/EC of the European Parliament and of the Council of 22 June 1998 laying down a procedure for the provision of information in the field of technical standards and regulations and of rules on Information Society services(7), they should not also be required to make the same notification through IMI.

(21) The exchange of information through IMI follows from the legal obligation on Member States’ authorities to give mutual assistance. To ensure that the internal market functions properly, information received by a competent authority through IMI from another Member State should not be deprived of its value as evidence in administrative proceedings solely on the ground that it originated in another Member State or was received by electronic means, and it should be treated by that competent authority in the same way as similar documents originating in its Member State.

(22) In order to guarantee a high level of data protection, maximum retention periods for personal data in IMI need to be established. However, those periods should be well-balanced taking into due consideration the need for IMI to function properly, as well as the rights of the data subjects to fully exercise their rights, for instance by obtaining evidence that an information exchange took place in order to appeal against a decision. In particular, retention periods should not go beyond what is necessary to achieve the objectives of this Regulation.

(23) It should be possible to process the name and contact details of IMI users for purposes compatible with the objectives of this Regulation, including monitoring of the use of the system by IMI coordinators and the Commission, communication, training and awareness-raising initiatives, and gathering information on administrative cooperation or mutual assistance in the internal market.

(24) The European Data Protection Supervisor should monitor and seek to ensure the application of this Regulation, inter alia by maintaining contacts with national data protection authorities, including the relevant provisions on data security.

(25) In order to ensure the effective monitoring of, and reporting on, the functioning of IMI and the application of this Regulation, Member States should make relevant information available to the Commission.

(26) Data subjects should be informed about the processing of their personal data in IMI and of the fact that they have the right of access to the data relating to them and the right to have inaccurate data corrected and illegally processed data erased, in accordance with this Regulation and national legislation implementing Directive 95/46/EC.

(27) In order to make it possible for the competent authorities of the Member States to implement legal provisions for administrative cooperation and efficiently exchange information by means of IMI, it may be necessary to lay down practical arrangements for such an exchange. Those arrangements should be adopted by the Commission in the form of a separate implementing act for each Union act listed in the Annex or for each type of administrative cooperation procedure and should cover the essential technical functionality and procedural arrangements required to implement the relevant administrative cooperation procedures via IMI. The Commission should ensure the maintenance and development of the software and IT infrastructure for IMI.

(28) In order to ensure sufficient transparency for data subjects, the predefined workflows, question and answer sets, forms and other arrangements relating to administrative cooperation procedures in IMI should be made public.

(29) Where Member States apply, in accordance with Article 13 of Directive 95/46/EC, any limitations on or exceptions to the rights of data subjects, information about such limitations or exceptions should be made public in order to ensure full transparency for data subjects. Such exceptions or limitations should be necessary and proportionate to the intended purpose and subject to adequate safeguards.

(30) Where international agreements are concluded between the Union and third countries that also cover the application of provisions of Union acts listed in the Annex to this Regulation, it should be possible to include the counterparts of IMI actors in such third countries in the administrative cooperation procedures supported by IMI, provided that it has been established that the third country concerned offers an adequate level of protection of personal data in accordance with Directive 95/46/EC.

(31) Commission Decision 2008/49/EC of 12 December 2007 concerning the implementation of the Internal Market Information System (IMI) as regards the protection of personal data(8) should be repealed. Commission Decision 2009/739/EC of 2 October 2009 setting out the practical arrangements for the exchange of information by electronic means between the Member States under Chapter VI of Directive 2006/123/EC of the European Parliament and of the Council on services in the internal market(9) should continue to apply to issues relating to the exchange of information under Directive 2006/123/EC.

(32) In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission’s exercise of implementing powers(10).

(33) The performance of the Member States regarding the effective application of this Regulation should be monitored in the annual report on the functioning of IMI based on statistical data from IMI and any other relevant data. The performance of Member States should be evaluated, inter alia, based on average reply times with the aim of ensuring rapid replies of good quality.

(34) Since the objective of this Regulation, namely laying down the rules for the use of IMI for administrative cooperation, cannot be sufficiently achieved by the Member States and can therefore, by reason of its scale and effects, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve that objective.

(35) The European Data Protection Supervisor has been consulted in accordance with Article 28(2) of Regulation (EC) No 45/2001 and delivered an opinion on 22 November 2011(11),

HAVE ADOPTED THIS REGULATION:

Textual Amendments

F1 Regulation revoked (E.W.S.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 5

CHAPTER I U.K. GENERAL PROVISIONS

[F2 Article 1 U.K. Subject matter

This Regulation lays down rules for the use of an Internal Market Information System (‘IMI’) for administrative cooperation among the IMI actors, including the processing of personal data.]

Textual Amendments

F2 Substituted by Regulation (EU) 2018/1724 of the European Parliament and of the Council of 2 October 2018 establishing a single digital gateway to provide access to information, to procedures and to assistance and problem-solving services and amending Regulation (EU) No 1024/2012 (Text with EEA relevance).

Article 2 U.K. Establishment of IMI

IMI is hereby formally established.

Article 3 U.K. Scope

[F3 1. IMI shall be used for exchanges of information, including of personal data, among the IMI actors and for the processing of that information for the purposes of administrative cooperation required in accordance with the provisions of the legislation listed in the Annex.]

F4 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F3 Art. 3(1) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(2)(a)

F4 Art. 3(2) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(2)(b)

F5 Article 4 U.K. Expansion of IMI

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F5 Art. 4 omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(3)

Article 5 U.K. Definitions

[F6 For the purposes of this Regulation, the definitions laid down in the UK GDPR as supplemented by the Data Protection Act 2018 shall apply.]

In addition, the following definitions shall also apply:

(a)

[F2 ‘IMI’ means the electronic tool provided by the Commission to facilitate administrative cooperation among the IMI actors;]

(b)

[F2 ‘administrative cooperation’ means the collaboration between IMI actors by exchanging and processing information for the purpose of better application of [F7 the legislation listed in the Annex];]

(c)

F8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(d)

‘administrative cooperation procedure’ means a pre-defined workflow provided for in IMI allowing IMI actors to communicate and interact with each other in a structured manner;

(e)

‘IMI coordinator’ means a body appointed by a Member State [F9 or the United Kingdom] to perform support tasks necessary for the efficient functioning of IMI in accordance with this Regulation;

(f)

‘competent authority’ means any body established at either national, regional or local level and registered in IMI with specific responsibilities relating to the application of [F10 the legislation listed in the Annex];

(g)

[F2 ‘IMI actors’ means the competent authorities, the IMI coordinators, the Commission and the Union bodies, offices and agencies;]

(h)

‘IMI user’ means a natural person working under the authority of an IMI actor and registered in IMI on behalf of that IMI actor;

(i)

F11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(j)

‘blocking’ means applying technical means by which personal data become inaccessible to IMI users via the normal interface of IMI;

(k)

‘formal closure’ means applying the technical facility provided by IMI to close an administrative cooperation procedure;

(l)

[F12 ‘the Information Commissioner’ means the Information Commissioner provided for under section 114 of the Data Protection Act 2018;

(m)

‘the UK GDPR’ has the meaning given in section 3(10) of the Data Protection Act 2018.]

Textual Amendments

F2 Substituted by Regulation (EU) 2018/1724 of the European Parliament and of the Council of 2 October 2018 establishing a single digital gateway to provide access to information, to procedures and to assistance and problem-solving services and amending Regulation (EU) No 1024/2012 (Text with EEA relevance).

F6 Words in Art. 5 substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(4)(a)

F7 Words in Art. 5(b) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(4)(b)

F8 Art. 5(c) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(4)(c)

F9 Words in Art. 5(e) inserted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(4)(d)

F10 Words in Art. 5(f) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(4)(e)

F11 Art. 5(i) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(4)(f)

F12 Art. 5(l)(m) inserted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(4)(g)

CHAPTER II U.K. FUNCTIONS AND RESPONSIBILITIES IN RELATION TO IMI

Article 6 U.K. IMI coordinators

1. [F13 The Secretary of State] shall appoint one national IMI coordinator whose responsibilities shall include:

(a) registering or validating registration of IMI coordinators and competent authorities;

(b) acting as the main contact point for IMI actors of the [F14 United Kingdom] for issues relating to IMI, including providing information on aspects relating to the protection of personal data in accordance with this Regulation;

(c) acting as interlocutor of the Commission for issues relating to IMI including providing information on aspects relating to the protection of personal data in accordance with this Regulation;

(d) providing knowledge, training and support, including basic technical assistance, to IMI actors of the [F15 United Kingdom];

(e) ensuring the efficient functioning of IMI as far as it is within their control, including the provision of timely and adequate responses by IMI actors of the [F16 United Kingdom] to requests for administrative cooperation.

2. [F17 The Secretary of State] may, in addition, appoint one or more IMI coordinators in order to carry out any of the tasks listed in paragraph 1, in accordance with its internal administrative structure.

[F18 3. The Secretary of State shall inform the Commission of the IMI coordinators appointed in accordance with paragraphs 1 and 2 and of the tasks for which they are responsible.]

4. All IMI coordinators may act as competent authorities. In such cases an IMI coordinator shall have the same access rights as a competent authority. Each IMI coordinator shall be a controller with respect to its own data processing activities as an IMI actor.

Textual Amendments

F13 Words in Art. 6(1) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(5)(a)(i)

F14 Words in Art. 6(1)(b) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(5)(a)(ii)

F15 Words in Art. 6(1)(d) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(5)(a)(iii)

F16 Words in Art. 6(1)(e) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(5)(a)(iv)

F17 Words in Art. 6(2) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(5)(b)

F18 Art. 6(3) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(5)(c)

Article 7 U.K. Competent authorities

1. When cooperating by means of IMI, competent authorities, acting through IMI users in accordance with administrative cooperation procedures, shall ensure that, in accordance with the applicable [F19 legislation listed in the Annex], an adequate response is provided within the shortest possible period of time, and in any event within [F20 any deadline set by that legislation].

2. A competent authority may invoke as evidence any information, document, finding, statement or certified true copy which it has received electronically by means of IMI, on the same basis as similar information obtained in [F21 the United Kingdom], for purposes compatible with the purposes for which the data were originally collected.

3. Each competent authority shall be a controller with respect to its own data processing activities performed by an IMI user under its authority and shall ensure that data subjects can exercise their rights in accordance with Chapters III and IV, where necessary, in cooperation with the Commission.

Textual Amendments

F19 Words in Art. 7(1) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(6)(a)(i)

F20 Words in Art. 7(1) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(6)(a)(ii)

F21 Words in Art. 7(2) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(6)(b)

F22 Article 8 U.K. Commission

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F22 Art. 8 omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(7)

Article 9 U.K. Access rights of IMI actors and users

1. Only IMI users shall have access to IMI.

[F23 2. The Secretary of State shall designate the IMI coordinators and competent authorities and the areas in which they have competence.]

3. Each IMI actor [F24 of the United Kingdom] shall grant and revoke, as necessary, appropriate access rights to its IMI users in the F25 ... area for which it is competent.

[F2 4. Appropriate means shall be put in place by the [F26 Secretary of State and United Kingdom] bodies, offices and agencies to ensure that IMI users [F27 of the United Kingdom] are allowed to access personal data processed in IMI only on a need-to-know basis and within the F28 ... area or areas for which they were granted access rights in accordance with paragraph 3.]

5. The use of personal data processed in IMI for a specific purpose in a way that is incompatible with that original purpose shall be prohibited, unless explicitly provided for by [F29 domestic law].

6. Where an administrative cooperation procedure involves the processing of personal data, only the IMI actors participating in that procedure shall have access to such personal data.

Textual Amendments

F2 Substituted by Regulation (EU) 2018/1724 of the European Parliament and of the Council of 2 October 2018 establishing a single digital gateway to provide access to information, to procedures and to assistance and problem-solving services and amending Regulation (EU) No 1024/2012 (Text with EEA relevance).

F23 Art. 9(2) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(8)(a)

F24 Words in Art. 9(3) inserted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(8)(b)(i)

F25 Words in Art. 9(3) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(8)(b)(ii)

F26 Words in Art. 9(4) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(8)(c)(i)

F27 Words in Art. 9(4) inserted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(8)(c)(ii)

F28 Words in Art. 9(4) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(8)(c)(iii)

F29 Words in Art. 9(5) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(8)(d)

Article 10 U.K. Confidentiality

[F30 1. IMI actors and IMI users of the United Kingdom shall be subject to the rules of professional secrecy or other equivalent duties of confidentiality in accordance with the law of the United Kingdom.]

2. IMI actors [F31 of the United Kingdom] shall ensure that requests of other IMI actors for confidential treatment of information exchanged by means of IMI are respected by IMI users working under their authority.

Textual Amendments

F30 Art. 10(1) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(9)(a)

F31 Words in Art. 10(2) inserted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(9)(b)

[F32 Article 11 U.K. Administrative cooperation procedures

IMI shall be based on administrative cooperation procedures implementing the provisions of the legislation listed in the Annex.]

Textual Amendments

F32 Art. 11 substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(10)

F33 Article 12 U.K. External actors

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F33 Art. 12 omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(11)

CHAPTER III U.K. PROCESSING OF PERSONAL DATA AND SECURITY

Article 13 U.K. Purpose limitation

IMI actors [F34 of the United Kingdom] shall exchange and process personal data only for the purposes defined in the relevant provisions of [F35 any legislation] listed in the Annex.

Data submitted to IMI by data subjects shall only be used for the purposes for which the data were submitted.

Textual Amendments

F34 Words in Art. 13 inserted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(12)(a)

F35 Words in Art. 13 substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(12)(b)

Article 14 U.K. Retention of personal data

1. Personal data processed in IMI shall be blocked in IMI as soon as they are no longer necessary for the purpose for which they were collected, depending on the specificities of each type of administrative cooperation and, as a general rule, no later than six months after the formal closure of the administrative cooperation procedure.

However, if a longer period is provided for in [F36 any legislation] listed in the Annex, personal data processed in IMI may be retained for a maximum of 18 months after the formal closure of an administrative cooperation procedure.

2. Where a repository of information for future reference by IMI actors is required pursuant to [F37 any legislation] listed in the Annex, the personal data included in such a repository may be processed for as long as they are needed for this purpose either with the data subject’s consent or where this is provided for in that [F38 legislation].

3. Personal data blocked pursuant to this Article shall, with the exception of their storage, only be processed for purposes of proof of an information exchange by means of IMI with the data subject’s consent, unless processing is requested for overriding reasons in the public interest.

4. The blocked data shall be automatically deleted in IMI three years after the formal closure of the administrative cooperation procedure.

5. At the express request of a competent authority in a specific case and with the data subject’s consent, personal data may be deleted before the expiry of the applicable retention period.

F39 6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F40 7. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F36 Words in Art. 14(1) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(13)(a)

F37 Words in Art. 14(2) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(13)(b)(i)

F38 Word in Art. 14(2) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(13)(b)(ii)

F39 Art. 14(6) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(13)(c)

F40 Art. 14(7) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(13)(d)

Article 15 U.K. Retention of personal data of IMI users

1. By way of derogation from Article 14, paragraphs 2 and 3 of this Article shall apply to the retention of personal data of IMI users [F41 of the United Kingdom]. Those personal data shall include the full name and all electronic and other means of contact necessary for the purposes of this Regulation.

2. Personal data relating to IMI users shall be stored in IMI as long as they continue to be users of IMI and may be processed for purposes compatible with the objectives of this Regulation.

3. When a natural person ceases to be an IMI user, the personal data relating to that person shall be blocked by technical means for a period of three years. Those data shall, with the exception of their storage, only be processed for purposes of proof of an information exchange by means of IMI and shall be deleted at the end of the three-year period.

Textual Amendments

F41 Words in Art. 15(1) inserted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(14)

F42 Article 16 U.K. Processing of special categories of data

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F42 Art. 16 omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(15)

Article 17 U.K. Security

F43 1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F43 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F43 3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

4. IMI actors [F44 of the United Kingdom] shall take all procedural and organisational measures necessary to ensure the security of personal data processed by them in IMI in accordance with [F45 Articles 5(1)(f), 28 and 32 of the UK GDPR.]

Textual Amendments

F43 Art. 17(1)-(3) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(16)(a)

F44 Words in Art. 17(4) inserted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(16)(b)(i)

F45 Words in Art. 17(4) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(16)(b)(ii)

CHAPTER IV U.K. RIGHTS OF DATA SUBJECTS AND SUPERVISION

Article 18 U.K. Information to data subjects and transparency

1. IMI actors [F46 of the United Kingdom] shall ensure that data subjects are informed about processing of their personal data in IMI as soon as possible and that they have access to information on their rights and how to exercise them, including the identity and contact details of the controller and of the controller’s representative, if any, in accordance with [F47 Articles 13 and 14 of the UK GDPR].

F48 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F46 Words in Art. 18(1) inserted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(17)(a)(i)

F47 Words in Art. 18(1) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(17)(a)(ii)

F48 Art. 18(2) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(17)(b)

Article 19 U.K. Right of access, correction and deletion

1. IMI actors [F49 of the United Kingdom] shall ensure that data subjects may effectively exercise their right of access to data relating to them in IMI, and the right to have inaccurate or incomplete data corrected and unlawfully processed data deleted, in accordance with [F50 any enactment]. The correction or deletion of data shall be carried out as soon as possible, and at the latest 30 days after the request by the data subject is received by the IMI actor responsible.

2. Where the accuracy or lawfulness of data blocked pursuant to Article 14(1) is contested by the data subject, this fact shall be recorded, as well as the accurate, corrected information.

Textual Amendments

F49 Words in Art. 19(1) inserted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(18)(a)

F50 Words in Art. 19(1) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(18)(b)

F51 Article 20 U.K. Exceptions and limitations

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F51 Art. 20 omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(19)

Article 21 U.K. Supervision

[F52 1. The Information Commissioner shall independently monitor the lawfulness of the processing of personal data by the IMI actors of the United Kingdom and, in particular, shall ensure that the rights of data subjects set out in this Chapter are protected in accordance with this Regulation.]

F53 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F54 3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F55 4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F52 Art. 21(1) substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(20)(a)

F53 Art. 21(2) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(20)(b)

F54 Art. 21(3) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(20)(b)

F55 Deleted by Regulation (EU) 2018/1724 of the European Parliament and of the Council of 2 October 2018 establishing a single digital gateway to provide access to information, to procedures and to assistance and problem-solving services and amending Regulation (EU) No 1024/2012 (Text with EEA relevance).

CHAPTER V U.K. GEOGRAPHIC SCOPE OF IMI

F56 Article 22 U.K. National use of IMI

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F56 Arts. 22-30 (including binding words) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(21)

F56 Article 23 U.K. Information exchange with third countries

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F56 Arts. 22-30 (including binding words) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(21)

CHAPTER VI U.K. FINAL PROVISIONS

F56 Article 24 U.K. Committee procedure

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F56 Arts. 22-30 (including binding words) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(21)

F56 Article 25 U.K. Monitoring and reporting

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F56 Arts. 22-30 (including binding words) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(21)

F56 Article 26 U.K. Costs

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F56 Arts. 22-30 (including binding words) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(21)

F56 Article 27 U.K. Repeal

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F56 Arts. 22-30 (including binding words) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(21)

F56 Article 28 U.K. Effective application

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F56 Arts. 22-30 (including binding words) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(21)

F56 Article 29 U.K. Exceptions

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F56 Arts. 22-30 (including binding words) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(21)

F56 Article 30 U.K. Entry into force

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F56 Arts. 22-30 (including binding words) omitted (N.I.) (9.12.2022) by virtue of The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(21)

F56 ...

[F57 ANNEX U.K. Provisions on administrative cooperation in legislation that are implemented by means of IMI, referred to in Article 3.

Textual Amendments

F57 Annex substituted (N.I.) (9.12.2022) by The Internal Market Information System Regulation (Amendment etc.) Regulations 2022 (S.I. 2022/1306), regs. 1(2), 3(22)

1. Article 8 of Regulation (EU) 2019/515 of the European Parliament and of the Council of 19 March 2019 on the mutual recognition of goods lawfully marketed in another Member State and repealing Regulation (EC) No. 764/2008. U.K.

2. Articles 5 and 7 of Directive 2014/60/EU of the European Parliament and of the Council of 15 May 2014 on the return of cultural objects unlawfully removed from the territory of a Member State and amending Regulation (EU) No 1024/2012. U.K.

3. Article 18 of Directive (EU) 2021/555 of the European Parliament and of the Council of 24 March 2021 on control of the acquisition and possession of weapons.]] U.K.

(1)

OJ C 43, 15.2.2012, p. 14.

(2)

Position of the European Parliament of 11 September 2012 (not yet published in the Official Journal) and decision of the Council of 4 October 2012.

(3)

OJ L 281, 23.11.1995, p. 31.

(4)

OJ L 8, 12.1.2001, p. 1.

(5)

OJ L 331, 15.12.2001, p. 79.

(6)

OJ L 376, 27.12.2006, p. 36.

(7)

OJ L 204, 21.7.1998, p. 37.

(8)

OJ L 13, 16.1.2008, p. 18.

(9)

OJ L 263, 7.10.2009, p. 32.

(10)

OJ L 55, 28.2.2011, p. 13.

(11)

OJ C 48, 18.2.2012, p. 2.