Processing of personal data by the CBAM unit of customs

Purpose of processing personal data

The CBAM Unit of Customs is as the national competent authority in charge of the national implementation of EU’s Carbon Border Adjustment Mechanism (CBAM). During the transitional period (1.10.2023-31.12.2025), personal data are processed when CBAM administrative matters become pending nationally (correction procedure for CBAM reports, imposition of penalty fees, application for subsequent changes to the CBAM report for the transitional period).

Customs’ CBAM Unit provides guidance and processes questions sent by economic operators to the address cbamtoimipiste@tulli.fi, concerning IT-related problems in the CBAM Transitional Registry. The CBAM Unit also processes personal data when it starts a so-called correction procedure in cases of failure to fulfil the reporting obligation during the transitional period. Because of a failure to report, the operators are advised to submit the missing report to the Commission’s CBAM Transitional Registry or to correct an erroneous report. The CBAM Unit can also impose a penalty fee for failure to fulfil the reporting obligation.

The processing of personal data is based on legislation. Personal data are processed for the performance of Customs’ statutory tasks. These tasks are laid down in Regulation (EU) 2023/956 of the European Parliament and of the Council establishing a carbon border adjustment mechanism, and in the implementing regulations issued pursuant to it. In addition, the tasks are laid down in the act on implementation of the Carbon Border Adjustment Mechanism of the European Union. The basis for the legal processing of personal data in accordance with the Data Protection Regulation is compliance with the controller’s statutory obligation.

Categories of personal data

The following data of individuals are collected:

first and last names, personal identity codes or date of birth, email addresses and phone numbers (mobile phones), home address or other addresses
EORI number
rank, occupation, position, country of residence, status of representation, native language, communication language and citizenship
details of customer transactions

The following data are collected of responsible persons and contact persons at businesses:

first and last names, personal identity codes or date of birth, email addresses and phone numbers (mobile phones), home address or other addresses
rank, occupation, position, country of residence, status of representation, native language, communication language and citizenship
details of customer transactions

Sources of personal data

The personal data to be processed by the CBAM Unit are obtained from Customs’ customers (individuals and business customers) and the Commission, which informs Customs about missing or erroneous CBAM reports. Data related to customs clearances of CBAM goods are obtained from the customs clearance system. Customers can contact Customs’ CBAM Unit concerning IT-related problems in the CBAM Transitional Registry (via the address cbamtoimipiste@tulli.fi).

Regular disclosures of personal data

The data of the CBAM Unit can be handed over to parties concerned.

CBAM data can be transferred on reasonable grounds to other functions within Customs, for the performance of Customs’ official tasks.

Furthermore, data are disclosed to other authorities for the performance of official tasks in accordance with the Act on the Openness of Government Activities of Finland (621/1999) and in accordance with the Act on the Processing of Personal Data by Finnish Customs (650/2019). The data are disclosed when the right to information has been prescribed by special provisions in legislation. Most commonly, the data are disclosed upon request to other authorities based on the legal right to information, when the request concerns the performance of official tasks.

CBAM data can be handed over to the Commission based on the Regulation (EU) 2023/956 of the European Parliament and of the Council establishing a carbon border adjustment mechanism, and on the delegated and implementing regulations issued pursuant to it.

Personal data storage and deletion periods

Data of the CBAM Unit that are collected during the CBAM transitional period are stored for 10 years in accordance with statutory obligations or as defined. The storage times are specified in Customs’ data management plan. If the statutory basis for storing personal data has ended, the data are deleted in accordance with Customs’ normal practice based on an annual review.

Contact person of the data controller and additional information

Jarkko Koho
jarkko.koho(at)tulli.fi