Processing of personal data by the CBAM unit of customs

Purpose of the processing personal data

The CBAM Unit of Finnish Customs is as the national competent authority in charge of the national implementation of the EU’s Carbon Border Adjustment Mechanism (CBAM). Personal data are processed when CBAM administrative matters become pending nationally (exceeding of the threshold, monitoring of the obligation to purchase certificates, processing of annual declarations, controls, enforcement and imposition of administrative penalties). Personal data are also processed when processing CBAM administrative matters concerning the transitional period, which ended on 31 December 2025 (correction procedure for CBAM reports, imposition of penalty fees, application for subsequent changes to the CBAM report for the transitional period).

The processing of personal data is based on legislation. Personal data are processed for the performance of Customs’ statutory tasks. These tasks are laid down in Regulation (EU) 2023/956 of the European Parliament and of the Council establishing a carbon border adjustment mechanism, and in the implementing regulations issued pursuant to it. In addition, the tasks are laid down nationally in the act on the implementation of the EU Regulation establishing a carbon border adjustment mechanism. The basis for the legal processing of personal data in accordance with the Data Protection Regulation is compliance with the controller’s statutory obligation.

Categories of personal data

The following data of individuals are collected:

  • first and last names, personal identity codes or date of birth, email addresses and phone numbers (mobile phones), home address or other addresses
  • EORI number
  • rank, occupation, position, country of residence, status of representation, native language, communication language and citizenship 
  • details of customer transactions.

The following data are collected of responsible persons and contact persons at businesses:

  • first and last names, personal identity codes or date of birth, email addresses and phone numbers (mobile phones), home address or other addresses
  • rank, occupation, position, country of residence, status of representation, native language, communication language and citizenship 
  • details of customer transactions.

Sources of personal data

The personal data processed by the CBAM Unit are obtained from Customs’ customers (individuals and businesses) and the Commission, which notifies Customs of any deviations and shortcomings in fulfilling the CBAM obligations. Data related to customs clearances of CBAM goods are obtained from the customs clearance system.

Regular disclosures of personal data

 Data held by the CBAM Unit can be disclosed to parties concerned.

CBAM data can be transferred to other functions within Customs on justifiable grounds related to the performance of official tasks.

Furthermore, data are disclosed to other authorities for the performance of official tasks in accordance with the Act on the Openness of Government Activities of Finland (621/1999) and the Act on the Processing of Personal Data by Finnish Customs (650/2019). The data are disclosed when the right to information has been prescribed by special provisions in legislation. Most commonly, the data are disclosed upon request to other authorities based on the legal right to information, when the request concerns the performance of official tasks.

CBAM data can be disclosed to the Commission based on Regulation (EU) 2023/956 of the European Parliament and of the Council establishing a carbon border adjustment mechanism, and on the delegated and implementing regulations issued pursuant to it.

Time limits for storage and deletion of personal data

Data held by the CBAM Unit that were collected during the CBAM transitional period, are stored for 10 years in accordance with statutory obligations or as defined. The storage times are specified in Customs’ data management plan. If the statutory basis for storing personal data has ended, the data are deleted in accordance with Customs’ normal practice based on an annual review. 

Contact person of the data controller and additional information

Jarkko Koho

jarkko.koho(at)tulli.fi