Regulation 2009/792 - Detailed rules for the Member States' notification to the Commission of information and documents in implementation of the common organisation of the markets, the direct payments' regime, the promotion of agricultural products and the regimes applicable to the outermost regions and the smaller Aegean islands - Main contents

EN

Official Journal of the European Union

L 228/3

Due to the generalised use of new information and communication technologies by the Commission and the Member States — in particular with the competent national authorities responsible for implementing the common agricultural policy (CAP) — the documents held by the Commission and the Member States are increasingly in electronic or digitised form.

The Commission has intensified its efforts to develop computer systems that make it possible to manage documents and procedures electronically in its own internal working procedures and in its relations with the authorities involved in the CAP. In parallel, Member States have developed computer systems at national level to meet the requirements of shared management of the CAP.

In this context and given the need to ensure uniform and harmonised management of the CAP by all those involved, a legal framework should be established and provide for common rules applicable to the information systems set up for the purpose of notifying information and documents to the Commission from the Member States and the authorities or bodies designated by them under the CAP.

For these objectives to be achieved effectively, the scope of this legal framework should be defined, both in terms of the legislation and the actors concerned.

With regard to the legislation, Regulations (EC) No 247/2006, (EC) No 1405/2006, (EC) No 1234/2007, (EC) No 3/2008 and (EC) No 73/2009 and their implementing provisions (hereafter CAP Regulations) lay down a wide range of obligations for the Member States to notify to the Commission information and documents needed for the implementation of those Regulations. Therefore, they should be taken into account in accordance with their own specific features.

As regards the actors involved, the rights and obligations laid down by the CAP Regulations, both for the Commission and for Member States and their competent authorities and bodies, require precise identification of the individuals and authorities responsible for actions and measures taken.

The CAP Regulations generally provide that information should be transmitted electronically or by means of an information system but do not necessarily specify the principles that apply. To ensure consistency and sound management and simplify the procedures for users and the authorities responsible for the systems, it is therefore desirable to establish common principles applicable to all information systems set up.

For documents to be recognised as valid for the Commission's purposes and in the Member States, it should be possible to guarantee the authenticity, integrity and legibility over time of the documents and the associated metadata throughout the period for which they are required to be kept.

With a view to providing that guarantee, the authorities or individuals authorised to send communications should always be identified in the information systems set up, based on the powers allocated to them. The identification process must be under the responsibility of the competent authorities referred to in each of the CAP Regulations. However, in the interests of sound management, it should be left to the Member States and the Commission to determine the conditions for designating authorised individuals, providing for designation through a single liaison body. Furthermore, the conditions for granting access rights to information systems set up by the Commission should be determined.

Given the wide range of notification obligations addressed under the scope of this Regulation, the information systems will be progressively made available to the competent authorities of the Member States. The obligation to notify through those information systems should be applicable when the corresponding provisions of the CAP Regulations provide for the application of this Regulation.

Documents must be managed in accordance with the personal data protection rules. To that end, the general rules laid down by Community legislation, notably Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (6), Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (7), Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (8) and Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (9), should apply.

The measures provided for in this Regulation are in accordance with the opinion of the Management Committee for Direct Payments and the Management Committee for the Common Organisation of Agricultural Markets,

Regulation (EC) No 247/2006 and its implementing rules,

Regulation (EC) No 1405/2006 and its implementing rules,

Regulation (EC) No 1234/2007 and its implementing rules,

Regulation (EC) No 3/2008 and its implementing rules,

Regulation (EC) No 73/2009 and its implementing rules,

‘notification obligation’ means the obligation to submit documents from the Member States to the Commission, provided for in the Community legislation referred to in Article 1;

‘competent authorities’ means the authorities or bodies designated by the Member States as responsible for fulfilling the notification obligation;

‘authority responsible for the information systems’ means the authority, department, body or person that is responsible in the Commission for validating and using the system and is identified as such in that system;

‘metadata’ means the data describing the context, contents and structure of documents and their management over time.

designate a single liaison body responsible for:

inform the Commission of the identity and contact details of the liaison body it has designated.

they shall allow each user to be unequivocally identified and shall incorporate effective control measures of access rights in order to protect against illegal, malicious or unauthorised access, deletion, alteration or movement of documents, files, metadata and stages of the procedure;

they shall be equipped with physical protection systems against intrusions and environmental incidents and software protection against cyber attacks;

they shall prevent, by various means, any unauthorised changes and incorporate integrity mechanisms to check if a document has been altered over time;

they shall keep an audit trail for each essential stage of the procedure;

they shall safeguard stored data in an environment which is secure in both physical and software terms, in accordance with point (b);

they shall provide reliable format conversion and migration procedures in order to guarantee that documents are legible and accessible throughout the entire storage period required;

they shall have sufficiently detailed and up-to-date functional and technical documentation on the operation and characteristics of the system, that documentation being accessible at all times to the organisational entities responsible for the functional and/or technical specifications.