HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"EN
14.11.2012 Official
Journal
of
the
European
Union
L
316/1
I
(Legislative acts)
REGULATIONS
REGULATION (EU) No 1024/2012 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
of 25 October 2012
on administrative cooperation through the Internal Market Information System and repealing
Commission Decision 2008/49/EC (‘the IMI Regulation’)
(Text with EEA relevance)
THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE
assistance. In particular, IMI helps competent authorities
EUROPEAN UNION,
to identify their counterpart in another Member State, to
manage the exchange of information, including personal
data, on the basis of simple and unified procedures and
Having regard to the Treaty on the Functioning of the European
to overcome language barriers on the basis of pre-defined
Union, and in particular Article 114 thereof,
and pre-translated workflows. Where available, the
Commission should provide IMI users with any existing
additional translation functionality that meets their needs,
Having regard to the proposal from the European Commission,
is compatible with the security and confidentiality
requirements for the exchange of information in IMI
After transmission of the draft legislative act to the national
and can be offered at a reasonable cost.
parliaments,
(3) In
order
to
overcome
language
barriers,
IMI
should
in
Having regard to the opinion of the European Economic and
principle be available in all official Union languages.
Social Committee ( 1 ),
(4) The
purpose
of
IMI
should
be
to
improve
the
functioning
Acting in accordance with the ordinary legislative procedure ( 2 ),
of the internal market by providing an effective, user-
friendly tool for the implementation of administrative
cooperation between Member States and between
Whereas:
Member States and the Commission, thus facilitating
the application of Union acts listed in the Annex to
this Regulation.
(1) The
application
of
certain
Union
acts
governing
the
free
movement of goods, persons, services and capital in the
internal market requires Member States to cooperate
more effectively and exchange information with one
(5) The
Commission
Communication
of
21
February
2011
another and with the Commission. As practical means
entitled ‘Better governance of the Single Market through
to implement such information exchange are often not
greater administrative cooperation: A strategy for
specified in those acts, appropriate practical arrangements
expanding and developing the Internal Market
need to be made.
Information System (“IMI”)’ sets out plans for the

possible expansion of IMI to other Union acts. The
Commission Communication of 13 April 2011 entitled
(2) The
Internal
Market
Information
System
(‘IMI’)
is
a
‘Single Market Act: Twelve Levers to boost growth and
software application accessible via the internet,
strengthen confidence — “Working together to create
developed by the Commission in cooperation with the
new growth”’ stresses the importance of IMI for
Member States, in order to assist Member States with the
strengthening cooperation among the actors involved,
practical implementation of information exchange
including at local level, thus contributing to better
requirements laid down in Union acts by providing a
governance of the single market. It is therefore
centralised communication mechanism to facilitate
necessary to establish a sound legal framework for IMI
cross-border exchange of information and mutual
and a set of common rules to ensure that IMI functions
efficiently.
( 1 ) OJ C 43, 15.2.2012, p. 14.
( 2 ) Position of the European Parliament of 11 September 2012 (not yet
published in the Official Journal) and decision of the Council of
(6)
Where the application of a provision of a Union act
4 October 2012.
requires Member States to exchange personal data and

---

L 316/2
EN
Official Journal of the European Union
14.11.2012
provides for the purpose of this processing, such a
(10) In
order
to
ensure
transparency,
in
particular
for
data
provision should be considered an adequate legal basis
subjects, the provisions of Union acts for which IMI is
for the processing of personal data, subject to the
to be used should be listed in the Annex to this Regu
conditions set out in Articles 8 and 52 of the Charter
lation.
of Fundamental Rights of the European Union. IMI
should be seen primarily as a tool used for the
exchange of information, including personal data,
(11) IMI
may
be
expanded
in
the
future
to
new
areas,
where
it
which would otherwise take place via other means,
can help to ensure effective implementation of a Union
including regular mail, fax or electronic mail on the
act in a cost-efficient, user-friendly way, taking account
basis of a legal obligation imposed on Member States’
of technical feasibility and overall impact on IMI. The
authorities and bodies in Union acts. Personal data
Commission should conduct the necessary tests to
exchanged via IMI should only be collected, processed
verify the technical readiness of IMI for any envisaged
and used for purposes in line with those for which it
expansion. Decisions to expand IMI to further Union acts
was originally collected and should be subject to all
should be taken by means of the ordinary legislative
relevant safeguards.
procedure.
(12) Pilot
projects
are
a
useful
tool
for
testing
whether
the
(7) Following
the
privacy-by-design
principle,
IMI
has
been
expansion of IMI is justified and for adapting technical
developed with the requirements of data protection legis
functionality and procedural arrangements to the
lation in mind and has been data protection-friendly
requirements of IMI users before a decision on the
from its inception, in particular because of the
expansion of IMI is taken. Member States should be
restrictions imposed on access to personal data
fully involved in deciding which Union acts should be
exchanged in IMI. Therefore, IMI offers a considerably
subject to a pilot project and on the modalities of that
higher level of protection and security than other
pilot project, in order to ensure that the pilot project
methods of information exchange such as regular mail,
reflects the needs of IMI users and that the provisions
telephone, fax or electronic mail.
on processing of personal data are fully complied with.
Such modalities should be defined separately for each
pilot project.
(8) Administrative
cooperation
by
electronic
means
between
Member States and between Member States and the
Commission should comply with the rules on the
(13) Nothing
in this Regulation should preclude Member
protection of personal data laid down in Directive
States and the Commission from deciding to use IMI
95/46/EC of the European Parliament and of the
for the exchange of information which does not
Council of 24 October 1995 on the protection of indi
involve the processing of personal data.
viduals with regard to the processing of personal data
and on the free movement of such data ( 1 ) and in Regu
lation (EC) No 45/2001 of the European Parliament and
(14) This
Regulation
should
set
out
the
rules
for
using
IMI
for
of the Council of 18 December 2000 on the protection
the purposes of administrative cooperation, which may
of individuals with regard to the processing of personal
cover, inter alia, the one-to-one exchange of information,
data by the Community institutions and bodies and on
notification procedures, alert mechanisms, mutual
the free movement of such data (
assistance arrangements and problem-solving.

2 ). The definitions used
in Directive 95/46/EC and Regulation (EC) No 45/2001
should also apply for the purposes of this Regulation.
(15) The
right
of
the
Member
States
to
decide
which
national
authorities carry out the obligations resulting from this
Regulation should remain unaffected by this Regulation.
(9) The
Commission
supplies
and
manages
the
software
and
Member States should be able to adapt functions and
IT infrastructure for IMI, ensures the security of IMI,
responsibilities in relation to IMI to their internal admin
manages the network of national IMI coordinators and
istrative structures, as well as to implement the needs of
is involved in the training of and technical assistance to
a specific IMI workflow. Member States should be able to
the IMI users. To that end, the Commission should only
appoint additional IMI coordinators to carry out the tasks
have access to such personal data that are strictly
of national IMI coordinators, alone or jointly with others,
necessary to carry out its tasks within the responsibilities
for a particular area of the internal market, a division of
set out in this Regulation, such as the registration of
the administration, a geographic region, or according to
national IMI coordinators. The Commission should also
another criterion. Member States should inform the
have access to personal data when retrieving, upon a
Commission of the IMI coordinators they have
request by another IMI actor, such data that have been
appointed, but they should not be obliged to indicate
blocked in IMI and to which the data subject has
additional IMI coordinators in IMI, where this is not
requested access. The Commission should not have
required for its proper functioning.
access to personal data exchanged as part of adminis
trative cooperation within IMI, unless a Union act
provides for a role for the Commission in such cooper
(16) In
order
to
achieve
efficient
administrative
cooperation
ation.
through IMI, Member States and the Commission should
ensure that their IMI actors have the necessary resources
( 1 ) OJ L 281, 23.11.1995, p. 31.
to carry out their obligations in accordance with this
( 2 ) OJ L 8, 12.1.2001, p. 1.
Regulation.

---

EN
14.11.2012 Official
Journal
of
the
European
Union
L
316/3
(17) While
IMI
is
in
essence
a
communication
tool
for
admin
mutual assistance. To ensure that the internal market
istrative cooperation between competent authorities,
functions properly, information received by a
which is not open to the general public, technical
competent authority through IMI from another Member
means may need to be developed to allow external
State should not be deprived of its value as evidence in
actors such as citizens, enterprises and organisations to
administrative proceedings solely on the ground that it
interact with the competent authorities in order to supply
originated in another Member State or was received by
information or retrieve data, or to exercise their rights as
electronic means, and it should be treated by that
data subjects. Such technical means should include
competent authority in the same way as similar
appropriate safeguards for data protection. In order to
documents originating in its Member State.
ensure a high level of security, any such public
interface should be developed in such a way as to be
technically fully separate from IMI, to which only IMI
(22) In
order
to
guarantee
a
high
level
of
data
protection,
users should have access.
maximum retention periods for personal data in IMI
need to be established. However, those periods should
be well-balanced taking into due consideration the need
(18) The use of IMI for the technical support of the SOLVIT
for IMI to function properly, as well as the rights of the
network should be without prejudice to the informal
data subjects to fully exercise their rights, for instance by
character of the SOLVIT procedure which is based on a
obtaining evidence that an information exchange took
voluntary commitment of the Member States, in
place in order to appeal against a decision. In particular,
accordance with the Commission Recommendation of
retention periods should not go beyond what is
7 December 2001 on principles for using ‘SOLVIT’ —
necessary to achieve the objectives of this Regulation.
the Internal Market Problem Solving Network ( 1 ) (‘the
SOLVIT Recommendation’). To continue the functioning
of the SOLVIT network on the basis of existing work
arrangements, one or more tasks of the national IMI
(23) It
should
be
possible
to
process
the
name
and
contact
coordinator may be assigned to SOLVIT centres within
details of IMI users for purposes compatible with the
the remit of their work, so that they can function inde
objectives of this Regulation, including monitoring of
pendently from the national IMI coordinator. The
the use of the system by IMI coordinators and the
processing of personal data and of confidential
Commission, communication, training and awareness-
information as part of SOLVIT procedures should
raising initiatives, and gathering information on adminis
benefit from all guarantees set out in this Regulation,
trative cooperation or mutual assistance in the internal
without prejudice to the non-binding character of the
market.
SOLVIT Recommendation.
(24) The
European
Data
Protection
Supervisor
should
monitor
(19) While
IMI
includes
an
internet-based
interface
for
its
and seek to ensure the application of this Regulation,
users, in certain cases and at the request of the
inter alia by maintaining contacts with national data
Member State concerned, it may be appropriate to
protection authorities, including the relevant provisions
consider technical solutions for the direct transfer of
on data security.
data from national systems to IMI, where such national
systems have already been developed, notably for notifi
cation procedures. The implementation of such technical
(25) In
order
to ensure
the
effective
monitoring of,
and
solutions should depend on the outcome of an
reporting on, the functioning of IMI and the application
assessment of their feasibility, costs and expected
of this Regulation, Member States should make relevant
benefits. Those solutions should not affect the existing
information available to the Commission.
structures and the national order of competencies.
(20) Where
Member
States
have
fulfilled
the
obligation
to
(26) Data subjects should be informed about the processing of
notify under Article 15(7) of Directive 2006/123/EC of
their personal data in IMI and of the fact that they have
the European Parliament and of the Council of
the right of access to the data relating to them and the
12 December 2006 on services in the internal
right to have inaccurate data corrected and illegally
market (
processed data erased, in accordance with this Regulation

2 ) by using the procedure in accordance with
Directive 98/34/EC of the European Parliament and of
and national legislation implementing Directive
the Council of 22 June 1998 laying down a procedure
95/46/EC.
for the provision of information in the field of technical
standards and regulations and of rules on Information
Society services ( 3 ), they should not also be required to
(27) In
order
to
make
it
possible
for
the
competent
authorities
make the same notification through IMI.
of the Member States to implement legal provisions for
administrative cooperation and efficiently exchange
information by means of IMI, it may be necessary to
(21) The
exchange
of
information
through
IMI
follows
from
lay down practical arrangements for such an exchange.
the legal obligation on Member States’ authorities to give
Those arrangements should be adopted by the
Commission in the form of a separate implementing
act for each Union act listed in the Annex or for each
( 1 ) OJ L 331, 15.12.2001, p. 79.
( 2 ) OJ L 376, 27.12.2006, p. 36.
type of administrative cooperation procedure and should
( 3 ) OJ L 204, 21.7.1998, p. 37.
cover the essential technical functionality and procedural

---

L 316/4
EN
Official Journal of the European Union
14.11.2012
arrangements required to implement the relevant admin
should be evaluated, inter alia, based on average reply
istrative cooperation procedures via IMI. The
times with the aim of ensuring rapid replies of good
Commission should ensure the maintenance and devel
quality.
opment of the software and IT infrastructure for IMI.
(34) Since
the
objective
of
this
Regulation,
namely
laying
(28) In order to ensure sufficient transparency for data
down the rules for the use of IMI for administrative
subjects, the predefined workflows, question and
cooperation, cannot be sufficiently achieved by the
answer sets, forms and other arrangements relating to
Member States and can therefore, by reason of its scale
administrative cooperation procedures in IMI should be
and effects, be better achieved at Union level, the Union
made public.
may adopt measures, in accordance with the principle of
subsidiarity as set out in Article 5 of the Treaty on
European Union. In accordance with the principle of
(29) Where Member States apply, in accordance with
proportionality, as set out in that Article, this Regulation
Article 13 of Directive 95/46/EC, any limitations on or
does not go beyond what is necessary in order to achieve
exceptions to the rights of data subjects, information
that objective.
about such limitations or exceptions should be made
public in order to ensure full transparency for data
subjects. Such exceptions or limitations should be
(35) The European Data Protection Supervisor has been
necessary and proportionate to the intended purpose
consulted in accordance with Article 28(2) of Regulation
and subject to adequate safeguards.
(EC) No 45/2001 and delivered an opinion on
22 November 2011 ( 4 ),
(30) Where
international
agreements
are
concluded
between
the Union and third countries that also cover the appli
HAVE ADOPTED THIS REGULATION:
cation of provisions of Union acts listed in the Annex to
this Regulation, it should be possible to include the
counterparts of IMI actors in such third countries in
CHAPTER I
the administrative cooperation procedures supported by
IMI, provided that it has been established that the third
GENERAL PROVISIONS
country concerned offers an adequate level of protection
Article 1
of personal data in accordance with Directive 95/46/EC.
Subject matter
This Regulation lays down rules for the use of an Internal
(31) Commission Decision 2008/49/EC of 12 December
2007 concerning the implementation of the Internal
Market Information System (‘IMI’) for administrative cooper
Market Information System (IMI) as regards the
ation, including processing of personal data, between
protection of personal data (
competent authorities of the Member States and between

1 ) should be repealed.
Commission Decision 2009/739/EC of 2 October 2009
competent authorities of the Member States and the
setting out the practical arrangements for the exchange
Commission.
of information by electronic means between the Member
States under Chapter VI of Directive 2006/123/EC of the
Article 2
European Parliament and of the Council on services in
the internal market ( 2 ) should continue to apply to issues
Establishment of IMI
relating to the exchange of information under Directive
IMI is hereby formally established.
2006/123/EC.
Article 3
(32) In
order
to
ensure
uniform
conditions
for
the
implemen
tation of this Regulation, implementing powers should be
Scope
conferred on the Commission. Those powers should be
exercised in accordance with Regulation (EU) No
1. IMI
shall
be
used
for
administrative
cooperation
between
182/2011 of the European Parliament and of the
competent authorities of the Member States and between
Council of 16 February 2011 laying down the rules
competent authorities of the Member States and the
and general principles concerning mechanisms for
Commission necessary for the implementation of Union acts
control by the Member States of the Commission’s
in the field of the internal market, within the meaning of
exercise of implementing powers (
Article 26(2) of the Treaty on the Functioning of the

3 ).
European Union (TFEU), which provide for administrative
cooperation, including the exchange of personal data, between
(33) The
performance
of
the
Member
States
regarding
the
Member States or between Member States and the Commission.
effective application of this Regulation should be
Those Union acts are listed in the Annex.
monitored in the annual report on the functioning of
IMI based on statistical data from IMI and any other
relevant data. The performance of Member States
2. Nothing
in
this
Regulation
shall
have
the
effect
of
rendering mandatory the provisions of Union acts which have
no binding force.
( 1 ) OJ L 13, 16.1.2008, p. 18.
( 2 ) OJ L 263, 7.10.2009, p. 32.
( 3 ) OJ L 55, 28.2.2011, p. 13.
( 4 ) OJ C 48, 18.2.2012, p. 2.

---

EN
14.11.2012 Official
Journal
of
the
European
Union
L
316/5
Article 4
(g) ‘IMI actors’ means the competent authorities, IMI coor
dinators and the Commission;
Expansion of IMI
1. The
Commission
may
carry
out
pilot
projects
in
order
to (h) ‘IMI user’ means a natural person working under the
assess whether IMI would be an effective tool to implement
authority of an IMI actor and registered in IMI on behalf
provisions for administrative cooperation of Union acts not
of that IMI actor;
listed in the Annex. The Commission shall adopt an imple
menting act to determine which provisions of Union acts
(i) ‘external actors’ means natural or legal persons other than
shall be subject to a pilot project and to set out the modalities
IMI users that may interact with IMI only through separate
of each project, in particular the basic technical functionality
technical means and in accordance with a specific pre-
and procedural arrangements required to implement the
defined workflow provided for that purpose;
relevant administrative cooperation provisions. That imple
menting act shall be adopted in accordance with the exam
(j) ‘blocking’ means applying technical means by which
ination procedure referred to in Article 24(3).
personal data become inaccessible to IMI users via the
normal interface of IMI;
2. The
Commission
shall
submit
an
evaluation
of
the
outcome of the pilot project, including data protection issues
(k) ‘formal closure’ means applying the technical facility
and effective translation functionalities, to the European
provided by IMI to close an administrative cooperation
Parliament and the Council. Where appropriate, that evaluation
procedure.
may be accompanied by a legislative proposal to amend the
Annex to expand the use of IMI to the relevant provisions of
CHAPTER II
Union acts.
FUNCTIONS AND RESPONSIBILITIES IN RELATION TO IMI
Article 5
Article 6
Definitions
IMI coordinators
For the purposes of this Regulation, the definitions laid down in
1. Each
Member
State
shall
appoint
one
national
IMI
coor
Directive 95/46/EC and Regulation (EC) No 45/2001 shall
dinator whose responsibilities shall include:
apply.
(a) registering or validating registration of IMI coordinators and
competent authorities;
In addition, the following definitions shall also apply:
(b) acting as the main contact point for IMI actors of the
(a) ‘IMI’ means the electronic tool provided by the Commission
Member States for issues relating to IMI, including
to facilitate administrative cooperation between competent
providing information on aspects relating to the protection
authorities of the Member States and between competent
of personal data in accordance with this Regulation;
authorities of the Member States and the Commission;
(c) acting as interlocutor of the Commission for issues relating
(b) ‘administrative cooperation’ means the working in collab
to IMI including providing information on aspects relating
oration of competent authorities of the Member States or
to the protection of personal data in accordance with this
competent authorities of the Member States and the
Regulation;
Commission, by exchanging and processing information,
including through notifications and alerts, or by providing
(d) providing knowledge, training and support, including basic
mutual assistance, including for the resolution of problems,
technical assistance, to IMI actors of the Member States;
for the purpose of better application of Union law;
(e) ensuring the efficient functioning of IMI as far as it is within
(c) ‘internal market area’ means a legislative or functional field
their control, including the provision of timely and adequate
of the internal market, within the meaning of Article 26(2)
responses by IMI actors of the Member States to requests
TFEU, in which IMI is used in accordance with Article 3 of
for administrative cooperation.
this Regulation;
2. Each
Member
State
may,
in
addition,
appoint
one
or
more
IMI coordinators in order to carry out any of the tasks listed in
(d) ‘administrative cooperation procedure’ means a pre-defined
paragraph 1, in accordance with its internal administrative
workflow provided for in IMI allowing IMI actors to
structure.
communicate and interact with each other in a structured
manner;
3. Member States shall inform the Commission of the IMI
coordinators appointed in accordance with paragraphs 1 and 2
(e) ‘IMI coordinator’ means a body appointed by a Member
and of the tasks for which they are responsible. The
State to perform support tasks necessary for the efficient
Commission shall share that information with the other
functioning of IMI in accordance with this Regulation;
Member States.
(f) ‘competent authority’ means any body established at either
4. All
IMI
coordinators
may
act
as
competent
authorities.
In
national, regional or local level and registered in IMI with
such cases an IMI coordinator shall have the same access rights
specific responsibilities relating to the application of
as a competent authority. Each IMI coordinator shall be a
national law or Union acts listed in the Annex in one or
controller with respect to its own data processing activities as
more internal market areas;
an IMI actor.

---

L 316/6
EN
Official Journal of the European Union
14.11.2012
Article 7
2. Member
States
shall
designate
the
IMI
coordinators
and
competent authorities and the internal market areas in which
Competent authorities
they have competence. The Commission may play a
1. When
cooperating
by
means
of
IMI,
competent
auth
consultative role in that process.
orities, acting through IMI users in accordance with adminis
trative cooperation procedures, shall ensure that, in accordance
3. Each
IMI
actor
shall
grant
and
revoke,
as
necessary,
appro
with the applicable Union act, an adequate response is provided
priate access rights to its IMI users in the internal market area
within the shortest possible period of time, and in any event
for which it is competent.
within the deadline set by that act.
4. Appropriate
means
shall
be
put
in
place
by
the
2. A
competent
authority
may
invoke
as
evidence
any Commission and the Member States to ensure that IMI users
information, document, finding, statement or certified true
are allowed to access personal data processed in IMI only on a
copy which it has received electronically by means of IMI, on
need-to-know basis and within the internal market area or areas
the same basis as similar information obtained in its own
for which they were granted access rights in accordance with
country, for purposes compatible with the purposes for which
paragraph 3.
the data were originally collected.
5. The
use
of
personal
data
processed
in
IMI
for
a
specific
3. Each
competent
authority
shall
be
a
controller
with purpose in a way that is incompatible with that original
respect to its own data processing activities performed by an
purpose shall be prohibited, unless explicitly provided for by
IMI user under its authority and shall ensure that data subjects
national law in accordance with Union law.
can exercise their rights in accordance with Chapters III and IV,
where necessary, in cooperation with the Commission.
6. Where
an
administrative
cooperation
procedure
involves
the processing of personal data, only the IMI actors partici
Article 8
pating in that procedure shall have access to such personal data.
Commission
Article 10
1. The
Commission
shall
be
responsible
for
carrying
out
the
Confidentiality
following tasks:
1. Each
Member
State
shall
apply
its
rules
of
professional
(a) ensuring the security, availability, maintenance and devel
secrecy or other equivalent duties of confidentiality to its IMI
opment of the software and IT infrastructure for IMI;
actors and IMI users, in accordance with national or Union
legislation.
(b) providing a multilingual system, including existing trans
lation functionalities, training in cooperation with the
2. IMI
actors
shall
ensure
that
requests
of
other
IMI
actors
Member States, and a helpdesk to assist Member States in
for confidential treatment of information exchanged by means
the use of IMI;
of IMI are respected by IMI users working under their authority.
Article 11
(c) registering the national IMI coordinators and granting them
access to IMI;
Administrative cooperation procedures
IMI shall be based on administrative cooperation procedures
(d) performing processing operations on personal data in IMI,
implementing the provisions of the relevant Union acts listed
where provided for in this Regulation, in accordance with
in the Annex. Where appropriate, the Commission may adopt
the purposes determined by the applicable Union acts listed
implementing acts for a specific Union act listed in the Annex
in the Annex;
or for a type of administrative cooperation procedure, setting
out the essential technical functionality and the procedural
(e) monitoring the application of this Regulation and reporting
arrangements required to enable the operation of the relevant
back to the European Parliament, the Council and the
administrative cooperation procedures, including where
European Data Protection Supervisor in accordance with
applicable the interaction between external actors and IMI as
Article 25.
referred to in Article 12. Those implementing acts shall be
adopted in accordance with the advisory procedure referred to
2. For the purposes of performing the tasks listed in
in Article 24(2).
paragraph 1 and producing statistical reports, the Commission
shall have access to the necessary information relating to the
Article 12
processing operations performed in IMI.
External actors
3. The
Commission
shall
not
participate
in
administrative Technical means may be provided to allow external actors to
cooperation procedures involving the processing of personal
interact with IMI where such interaction is:
data except where required by a provision of a Union act
listed in the Annex.
(a) provided for by a Union act;
Article 9
(b) provided for in an implementing act referred to in Article 11
Access rights of IMI actors and users
in order to facilitate administrative cooperation between
competent authorities in Member States for the application
1. Only IMI users shall have access to IMI.
of the provisions of Union acts listed in the Annex; or

---

EN
14.11.2012 Official
Journal
of
the
European
Union
L
316/7
(c) necessary for submitting requests in order to exercise their
7. Technical
means
shall
be
put
in
place
to
encourage
IMI
rights as data subjects in accordance with Article 19.
actors to formally close administrative cooperation procedures
as soon as possible after the exchange of information has been
completed and to enable IMI actors to involve IMI coordinators
Any such technical means shall be separate from IMI and shall
responsible in any procedure which has been inactive without
not enable external actors to access IMI.
justification for longer than two months.
CHAPTER III
Article 15
PROCESSING OF PERSONAL DATA AND SECURITY
Article 13
Retention of personal data of IMI users
Purpose limitation
1.
By way of derogation from Article 14, paragraphs 2 and 3
of this Article shall apply to the retention of personal data of
IMI actors shall exchange and process personal data only for the
IMI users. Those personal data shall include the full name and
purposes defined in the relevant provisions of the Union acts
all electronic and other means of contact necessary for the
listed in the Annex.
purposes of this Regulation.
Data submitted to IMI by data subjects shall only be used for
the purposes for which the data were submitted.
2.
Personal data relating to IMI users shall be stored in IMI as
long as they continue to be users of IMI and may be processed
for purposes compatible with the objectives of this Regulation.
Article 14
Retention of personal data
3. When
a
natural
person
ceases
to
be
an
IMI
user,
the
1. Personal data processed in IMI shall be blocked in IMI as
personal data relating to that person shall be blocked by
soon as they are no longer necessary for the purpose for which
technical means for a period of three years. Those data shall,
they were collected, depending on the specificities of each type
with the exception of their storage, only be processed for
of administrative cooperation and, as a general rule, no later
purposes of proof of an information exchange by means of
than six months after the formal closure of the administrative
IMI and shall be deleted at the end of the three-year period.
cooperation procedure.
However, if a longer period is provided for in an applicable
Article 16
Union act listed in the Annex, personal data processed in IMI
may be retained for a maximum of 18 months after the formal
Processing of special categories of data
closure of an administrative cooperation procedure.
1. The processing of special categories of data referred to in
Article 8(1) of Directive 95/46/EC and Article 10(1) of Regu
2. Where
a
repository
of
information
for
future
reference
by lation (EC) No 45/2001 by means of IMI shall be allowed only
IMI actors is required pursuant to a binding Union act listed in
on the basis of a specific ground mentioned in Article 8(2) and
the Annex, the personal data included in such a repository may
(4) of that Directive and Article 10(2) of that Regulation and
be processed for as long as they are needed for this purpose
subject to appropriate safeguards provided for in those Articles
either with the data subject’s consent or where this is provided
to ensure the rights of individuals whose personal data are
for in that Union act.
processed.
3. Personal
data
blocked
pursuant
to
this
Article
shall,
with 2. IMI
may
be
used
for
the
processing
of
data
relating
to
the exception of their storage, only be processed for purposes of
offences, criminal convictions or security measures referred to
proof of an information exchange by means of IMI with the
in Article 8(5) of Directive 95/46/EC and Article 10(5) of Regu
data subject’s consent, unless processing is requested for over
lation (EC) No 45/2001, subject to safeguards provided for in
riding reasons in the public interest.
those Articles, including information on disciplinary, adminis
trative or criminal sanctions or other information necessary to
4. The
blocked
data
shall
be
automatically
deleted
in
IMI establish the good repute of an individual or a legal person,
three years after the formal closure of the administrative
where the processing of such data is provided for in a Union act
cooperation procedure.
constituting the basis for the processing or with the explicit
consent of the data subject, subject to specific safeguards
referred to in Article 8(5) of Directive 95/46/EC.
5. At
the
express
request
of
a
competent
authority
in
a
specific case and with the data subject’s consent, personal
data may be deleted before the expiry of the applicable
retention period.
Article 17
Security
6. The
Commission
shall
ensure
by
technical
means
the 1. The
Commission
shall
ensure
that
IMI
complies
with
the
blocking and deletion of personal data and their retrieval in
rules on data security adopted by the Commission pursuant to
accordance with paragraph 3.
Article 22 of Regulation (EC) No 45/2001.

---

L 316/8
EN
Official Journal of the European Union
14.11.2012
2. The
Commission
shall
put
in
place
the
necessary
measures 2. Where
the
accuracy
or
lawfulness
of
data
blocked
to ensure security of personal data processed in IMI, including
pursuant to Article 14(1) is contested by the data subject, this
appropriate data access control and a security plan which shall
fact shall be recorded, as well as the accurate, corrected
be kept up-to-date.
information.
3. The
Commission
shall
ensure
that,
in
the
event
of
a
security incident, it is possible to verify what personal data
Article 20
have been processed in IMI, when, by whom and for what
Exceptions and limitations
purpose.
Member States shall inform the Commission where they provide
4. IMI
actors
shall
take
all
procedural
and
organisational for exceptions to, or limitations of, the rights of data subjects
measures necessary to ensure the security of personal data
set out in this Chapter in national legislation in accordance with
processed by them in IMI in accordance with Article 17 of
Article 13 of Directive 95/46/EC.
Directive 95/46/EC.
Article 21
CHAPTER IV
Supervision
RIGHTS OF DATA SUBJECTS AND SUPERVISION
1. The national supervisory authority or authorities
Article 18
designated in each Member State and endowed with the
Information to data subjects and transparency
powers referred to in Article 28 of Directive 95/46/EC (the
‘National Supervisory Authority’) shall independently monitor
1. IMI
actors
shall
ensure
that
data
subjects
are
informed the lawfulness of the processing of personal data by the IMI
about processing of their personal data in IMI as soon as
actors of their Member State and, in particular, shall ensure that
possible and that they have access to information on their
the rights of data subjects set out in this Chapter are protected
rights and how to exercise them, including the identity and
in accordance with this Regulation.
contact details of the controller and of the controller’s repre
sentative, if any, in accordance with Article 10 or 11 of
Directive 95/46/EC and national legislation which is in
2. The
European
Data
Protection
Supervisor
shall
monitor
accordance with that Directive.
and seek to ensure that the personal data processing activities
of the Commission, in its role as an IMI actor, are carried out in
2. The
Commission
shall
make
publicly
available
in
a
way accordance with this Regulation. The duties and powers referred
which is easily accessible:
to in Articles 46 and 47 of Regulation (EC) No 45/2001 shall
apply accordingly.
(a) information concerning IMI in accordance with Articles 11
and 12 of Regulation (EC) No 45/2001, in a clear and
3. The
National
Supervisory
Authorities
and
the
European
understandable form;
Data Protection Supervisor, each acting within the scope of
their respective competencies, shall ensure coordinated super
(b) information on the data protection aspects of administrative
vision of IMI and its use by IMI actors.
cooperation procedures in IMI as referred to in Article 11 of
this Regulation;
4. The
European
Data
Protection
Supervisor
may
invite
the
(c) information on exceptions to or limitations of the rights of
National Supervisory Authorities to meet, where necessary, for
data subjects as referred to in Article 20 of this Regulation;
the purposes of ensuring coordinated supervision of IMI and its
use by IMI actors, as referred to in paragraph 3. The cost of
(d) types of administrative cooperation procedures, essential IMI
such meetings shall be borne by the European Data Protection
functionalities and categories of data that may be processed
Supervisor. Further working methods for this purpose, including
in IMI;
rules of procedure, may be developed jointly as necessary. A
joint report of activities shall be sent to the European
(e) a comprehensive list of all implementing or delegated acts
Parliament, the Council and the Commission at least every
regarding IMI, adopted pursuant to this Regulation or to
three years.
another Union act, and a consolidated version of the
Annex to this Regulation and its subsequent amendments
CHAPTER V
by other Union acts.
GEOGRAPHIC SCOPE OF IMI
Article 19
Article 22
Right of access, correction and deletion
National use of IMI
1. IMI
actors
shall
ensure
that
data
subjects
may
effectively 1. A
Member
State
may
use
IMI
for
the
purpose
of
adminis
exercise their right of access to data relating to them in IMI, and
trative cooperation between competent authorities within its
the right to have inaccurate or incomplete data corrected and
territory, in accordance with national law, only where the
unlawfully processed data deleted, in accordance with national
following conditions are satisfied:
legislation. The correction or deletion of data shall be carried
out as soon as possible, and at the latest 30 days after the
request by the data subject is received by the IMI actor respon
(a) no substantial changes to the existing administrative
sible.
cooperation procedures are required;

---

EN
14.11.2012 Official
Journal
of
the
European
Union
L
316/9
(b) a notification of the envisaged use of IMI has been
2. Where
reference
is
made
to
this
paragraph,
Article
4
of
submitted to the National Supervisory Authority where
Regulation (EU) No 182/2011 shall apply.
required under national law; and
(c) it does not have a negative impact on the efficient func
3. Where
reference
is
made
to
this
paragraph,
Article
5
of
tioning of IMI for IMI users.
Regulation (EU) No 182/2011 shall apply.
2. Where a Member State intends to make systematic use of
Article 25
IMI for national purposes, it shall notify its intention to the
Commission and seek its prior approval. The Commission
Monitoring and reporting
shall examine whether the conditions set out in paragraph 1
1. The
Commission
shall
report
to
the
European
Parliament
are met. Where necessary, and in accordance with this Regu
and the Council on the functioning of IMI on a yearly basis.
lation, an agreement setting out, inter alia, the technical,
financial and organisational arrangements for national use,
including the responsibilities of the IMI actors, shall be
2. By
5
December
2017
and
every
five
years
thereafter,
the
concluded between the Member State and the Commission.
Commission shall report to the European Data Protection
Supervisor on aspects relating to the protection of personal
Article 23
data in IMI, including data security.
Information exchange with third countries
3. For the purpose of producing the reports referred to in
1. Information,
including
personal
data,
may
be
exchanged paragraphs 1 and 2, Member States shall provide the
in IMI pursuant to this Regulation between IMI actors within
Commission with any information relevant to the application
the Union and their counterparts in a third country only where
of this Regulation, including on the application in practice of
the following conditions are satisfied:
the data protection requirements laid down in this Regulation.
(a) the information is processed pursuant to a provision of a
Article 26
Union act listed in the Annex and an equivalent provision
in the law of the third country;
Costs
(b) the information is exchanged or made available in
1. The
costs
incurred
for
the
development,
promotion,
accordance with an international agreement providing for:
operation and maintenance of IMI shall be borne by the
general budget of the European Union, without prejudice to
(i) the application of a provision of a Union act listed in
arrangements under Article 22(2).
the Annex by the third country;
2. Unless
otherwise
stipulated
in
a
Union
act,
the
costs
for
(ii) the use of IMI; and
the IMI operations at Member State level, including the human
resources needed for training, promotion and technical
(iii) the principles and modalities of that exchange; and
assistance (helpdesk) activities, as well as for the administration
of IMI at national level, shall be borne by each Member State.
(c) the third country in question ensures adequate protection of
personal data in accordance with Article 25(2) of Directive
95/46/EC, including adequate safeguards that the data
Article 27
processed in IMI shall only be used for the purpose for
Repeal
which they were initially exchanged, and the Commission
has adopted a decision in accordance with Article 25(6) of
Decision 2008/49/EC is repealed.
Directive 95/46/EC.
Article 28
2. Where the Commission is an IMI actor, Article 9(1) and
(7) of Regulation (EC) No 45/2001 shall apply to any exchange
Effective application
of personal data processed in IMI with its counterparts in a
third country.
Member States shall take all necessary measures to ensure
effective application of this Regulation by their IMI actors.
3. The
Commission
shall
publish
in
the Official Journal of the
European Union and keep up-to-date a list of third countries
Article 29
authorised to exchange information, including personal data,
in accordance with paragraph 1.
Exceptions
1. Notwithstanding
Article
4
of
this
Regulation,
the
IMI
pilot
CHAPTER VI
project launched on 16 May 2011 to test the suitability of IMI
FINAL PROVISIONS
for the implementation of Article 4 of Directive 96/71/EC of
the European Parliament and of the Council of 16 December
Article 24
1996 concerning the posting of workers in the framework of
the provision of services (
Committee procedure

1 ) may continue to operate on the
basis of the arrangements that were made prior to the entry
1. The
Commission
shall
be
assisted
by
a
committee.
That into force of this Regulation.
committee shall be a committee within the meaning of Regu
lation (EU) No 182/2011.
( 1 ) OJ L 18, 21.1.1997, p. 1.

---

L 316/10
EN
Official Journal of the European Union
14.11.2012
2. Notwithstanding Article 8(3) and points (a) and (b) of the
Article 4(2) of this Regulation, which shall also cover the inter
first paragraph of Article 12 of this Regulation, for the imple
action between administrative cooperation within the consumer
mentation of the administrative cooperation provisions of the
protection cooperation system established in accordance with
SOLVIT Recommendation through IMI, the involvement of the
Regulation (EC) No 2006/2004 of the European Parliament and
Commission in administrative cooperation procedures and the
of the Council of 27 October 2004 on cooperation between
existing facility for external actors may continue on the basis of
national authorities responsible for the enforcement of
the arrangements that were made prior to the entry into force
consumer protection laws (the Regulation on consumer
of this Regulation. The period as referred to in Article 14(1) of
protection cooperation) ( 2 ) and within IMI.
this Regulation shall be 18 months for personal data processed
in IMI for the purposes of the SOLVIT Recommendation.
4. Notwithstanding
Article
14(1)
of
this
Regulation,
any
periods up to a maximum of 18 months decided on the basis
3. Notwithstanding
Article
4(1)
of
this
Regulation,
the of Article 36 of Directive 2006/123/EC with regard to adminis
Commission may launch a pilot project to assess whether IMI
trative cooperation pursuant to Chapter VI thereof shall
is an efficient, cost-effective and user-friendly tool to implement
continue to apply in that area.
Article 3(4), (5) and (6) of Directive 2000/31/EC of the
European Parliament and of the Council of 8 June 2000 on
Article 30
certain legal aspects of information society services, in particular
Entry into force
electronic commerce, in the Internal Market (Directive on elec
tronic commerce) ( 1 ). No later than two years after the launch of
This Regulation shall enter into force on the twentieth day
that pilot project, the Commission shall submit to the European
following that of its publication in the Official Journal of the
Parliament and the Council the evaluation referred to in
European Union.
This Regulation shall be binding in its entirety and directly applicable in all Member States.
Done at Strasbourg, 25 October 2012.
For the European Parliament
For the Council
The President
The President
M. SCHULZ
A. D. MAVROYIANNIS
( 1 ) OJ L 178, 17.7.2000, p. 1.
( 2 ) OJ L 364, 9.12.2004, p. 1.

---

EN
14.11.2012 Official
Journal
of
the
European
Union L
316/11
ANNEX
PROVISIONS ON ADMINISTRATIVE COOPERATION IN UNION ACTS THAT ARE IMPLEMENTED BY
MEANS OF IMI, REFERRED TO IN ARTICLE 3
1. Directive 2006/123/EC of the European Parliament and of the Council of 12 December 2006 on services in the
internal market ( 1 ): Chapter VI, Article 39(5), as well as Article 15(7), unless a notification, as provided for in that latter
Article, is made in accordance with Directive 98/34/EC.
2. Directive 2005/36/EC of the European Parliament and of the Council of 7 September 2005 on the recognition of
professional qualifications ( 2 ): Article 8, Article 50(1), (2) and (3), and Article 56.
3. Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’
rights in cross-border healthcare ( 3 ): Article 10(4).
4. Regulation (EU) No 1214/2011 of the European Parliament and of the Council of 16 November 2011 on the
professional cross-border transport of euro cash by road between euro-area Member States ( 4 ): Article 11(2).
5. Commission Recommendation of 7 December 2001 on principles for using ‘SOLVIT’ — the Internal Market Problem
Solving Network ( 5 ): Chapters I and II.
( 1 ) OJ L 376, 27.12.2006, p. 36.
( 2 ) OJ L 255, 30.9.2005, p. 22.
( 3 ) OJ L 88, 4.4.2011, p. 45.
( 4 ) OJ L 316, 29.11.2011, p. 1.
( 5 ) OJ L 331, 15.12.2001, p. 79.

---

Document Outline

• �

---