I. – Express freight companies carrying out the activities mentioned in 4.2 of Annex 30a to Commission Regulation (EEC) No 2454/93 of 2 July 1993 laying down provisions for the implementation of Council Regulation (EEC) No 2913/92 establishing the Community Customs Code, and postal service providers shall transmit to the Directorate-General for Customs and Indirect Taxation the data they hold relating to the identification of the goods and objects transported and their means of transport.
The following are excluded from the transmission mentioned in the first paragraph:
1° The data mentioned in I of article 6 of law no. 78-17 of 6 January 1978 relating to information technology, files and civil liberties;
2° Data relating to goods imported from or exported to States that are not members of the European Union.
Under no circumstances may this transmission infringe the confidentiality of correspondence.
II – In order to detect the offences referred to in articles 414, 414-2, 415 and 459 of this Code, to gather evidence of these offences and to track down the perpetrators, the Minister responsible for customs is authorised to implement automated processing of the data transmitted pursuant to I of this article.
Only individually designated customs officers specially authorised by the Minister responsible for customs shall have access to this data.
III – The processing mentioned in II shall comply with the aforementioned Act No. 78-17 of 6 January 1978.
The service providers and companies mentioned in I of this article shall inform the persons concerned by the processing implemented by the Directorate General of Customs and Excise.
IV – A decree in the Conseil d’Etat, issued after consultation with the Commission Nationale de l’Informatique et des Libertés (French Data Protection Authority), sets out the terms and conditions for the application of this article, in compliance with the aforementioned law no. 78-17 of 6 January 1978.
This decree specifies in particular
1° The nature of and procedures for transmitting the data referred to in I ;
2° The categories of data concerned by the processing mentioned in II;
3° The procedures for access to and use of the data by the agents mentioned in II;
4° Procedures for monitoring compliance with the obligation mentioned in the second paragraph of III;
5° The procedures for destroying data at the end of the period referred to in V;
6° The procedures for exercising the right of access and rectification of data by the persons concerned.
V. – The data subject to the processing mentioned in II is kept for a maximum period of two years from the date of recording.