FantasticSearch

1. An authorisation shall be required for the export of cyber-surveillance items not listed in Annex I if the exporter has been informed by the competent authority that the items in question are or may be intended, in their entirety or in part, for use in connection with internal repression and/or the commission of serious violations of human rights and international humanitarian law.

2. Where an exporter is aware, according to its due diligence findings, that cyber-surveillance items which the exporter proposes to export, not listed in Annex I, are intended, in their entirety or in part, for any of the uses referred to in paragraph 1 of this Article, the exporter shall notify the competent authority. That competent authority shall decide whether or not to make the export concerned subject to authorisation. The Commission and the Council shall make available guidelines for exporters, as referred to in Article 26(1).

3. A Member State may adopt or maintain national legislation imposing an authorisation requirement on the export of cyber-surveillance items not listed in Annex I if the exporter has grounds for suspecting that those items are or may be intended, in their entirety or in part, for any of the uses referred to in paragraph 1 of this Article.

4. A Member State which imposes an authorisation requirement pursuant to paragraph 1, 2 or 3 shall immediately inform its customs authorities and other relevant national authorities and shall provide the other Member States and the Commission with relevant information on the authorisation requirement in question, in particular as regards the items and entities concerned, unless it considers that it is not appropriate to do so in light of the nature of the transaction or the sensitivity of the information concerned.

5. Member States shall give due consideration to information received pursuant to paragraph 4 and shall review it in light of the criteria set out in paragraph 1 within 30 working days. They shall inform their customs authorities and other relevant national authorities. In exceptional cases, any Member State may request the extension of that 30-day period. However, the extension shall not exceed 30 working days.

6. Where all Member States notify each other and the Commission that an authorisation requirement should be imposed for essentially identical transactions, the Commission shall publish in the C series of the Official Journal of the European Union information regarding the cyber-surveillance items and, where appropriate, destinations subject to authorisation requirements as notified by Member States for that purpose.

7. Member States shall review the information published pursuant to paragraph 6 at least annually, on the basis of relevant information and analyses provided by the Commission. Where all Member States notify each other and the Commission that the publication of an authorisation requirement should be amended or renewed, the Commission shall promptly and accordingly amend or renew the information published pursuant to paragraph 6 in the C series of the Official Journal of the European Union.

8. In order to allow for an examination of all valid denials by the Member States, Article 16(1), (2) and (5) to (7) shall apply to cases concerning cyber-surveillance items not listed in Annex I.

9. All exchanges of information required pursuant to this Article shall take place in accordance with the legal requirements concerning the protection of personal information, commercially sensitive information or protected defence, foreign policy or national security information. Such exchanges of information shall be made via secure electronic means, including through the system referred to in Article 23(6).

10. Member States shall consider supporting the inclusion of items published pursuant to paragraph 6 of this Article in the appropriate international non-proliferation regimes or export control arrangements with a view to extending controls. The Commission shall provide analyses of the relevant data gathered pursuant to Article 23(2) and to Article 26(2).

11. This Regulation is without prejudice to the right of Member States to take national measures under Article 10 of Regulation (EU) 2015/479.