Opinion 1/2026 on the Proposal for a Regulation amending Regulation (EU) No 904/2010 as regards access of the EPPO and OLAF to VAT information

on the Proposal for a Regulation amending Regulation (EU) No 904/2010 as regards access of the EPPO and OLAF to VAT information

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Council Regulation amending Regulation (EU) No 904/2010 as regards the access of the European Public Prosecutor’s Office (EPPO) and the European Anti-Fraud Office (OLAF) to value added tax information at Union level .

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725.

This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 14 November 2025, the European Commission issued the Proposal for a Council Regulation amending Regulation (EU) No 904/2010 as regards the access of the European Public Prosecutor’s Office (EPPO) and the European Anti-Fraud Office (OLAF) to value added tax information at Union level (‘the Proposal’). The Proposal aims to address the urgent problem of combating intra- Community value added tax (VAT) fraud, including by providing for specific direct and centralised access to relevant VAT information for the EPPO and OLAF.

The Proposal concerns the boundaries between administrative VAT cooperation and criminal enforcement. The EDPS stresses that personal data processing for administrative purposes and for criminal law enforcement purposes are distinct from each other, and that this separation must also be carefully reflected by the Proposal.

The EDPS welcomes the objectives of the Proposal and recognises that EPPO’s and OLAF’s direct access to VAT information is necessary to achieve the objective to effectively combat cross-border VAT fraud. In making this assessment, the EDPS has taken into consideration the specific characteristics of Missing Trader Intra-Community (MTIC) fraud, the targeted nature of the access and the specific categories of information concerned, which first and foremost relates to VAT numbers and business-to-business transactions.

The Proposal should clearly explain and underline the exceptional nature of providing direct (albeit limited) access to administrative databases for law enforcement purposes. The EDPS considers that further clarification is warranted to avoid that the Proposal would be misconstrued as a precedent for more general application.

The Proposal should also ensure the implementation of appropriate legal, technical and organisational safeguards tailored to the targeted nature of the measure. While the details of the technical and organisational measures can be further specified by a way of implementing act, as envisaged by the Proposal, certain parameters should already be defined at the level of the basic act. To this end, the EDPS recommends including in the Proposal a number of additional safeguards to help ensure compliance with the principles of purpose limitation, data minimisation and accountability.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 14 November 2025, the European Commission issued the Proposal for a Council Regulation amending Regulation (EU) No 904/2010 as regards the access of the European Public Prosecutor’s Office (EPPO) and the European Anti-Fraud Office (OLAF) to value added tax information at Union level (‘the Proposal’).

2. The objective of the Proposal is to address the urgent problem of combating intra- Community value added tax (VAT) fraud , by providing for specific direct and centralised access to relevant VAT information for the EPPO and OLAF without prejudice to the 5 6 7 existing rights of access stemming from the EPPO and OLAF Regulations .

3. Under current Regulation (EU) No 904/2010 , EPPO and OLAF do not have an explicit right to receive information on cross-border VAT fraud from the European network of national VAT antifraud officials, Eurofisc, and no centralised access for targeted searches to VAT relevant information through the EU IT systems . Instead, they must fulfil their mandate of combating fraud at EU level by cooperating bilaterally with tax authorities at national level .

4. The Proposal would amend Regulation (EU) No 904/2010 on administrative cooperation and combating fraud in the field of VAT, which sets out procedures allowing European Union (EU) Member States’ authorities to work together and share information on VAT and to combat VAT fraud.

5. The Proposal targets especially Missing Trader Intra-Community (MTIC) fraud (or ‘carousel fraud’). This is a type of VAT fraud that exploits the EU’s rules for tax-free trade between Member States .

6. The Proposal would strengthen the cooperation between Eurofisc, the EPPO and OLAF by providing a legal basis for the exchange of information and access to VAT data, enhancing the EU's ability to combat fraud against the financial interests of the Union . The Proposal aims to provide to the EPPO and OLAF a direct and streamlined communication with Eurofisc and a specific, direct and centralised access to relevant VAT information in relation with their respective mandates.

7. The Proposal would establish a duty for Eurofisc working field coordinators to communicate spontaneously to the EPPO and OLAF any indication of suspected fraud based on the information exchanged between Member States on cross-border VAT fraud, in respect of which the EPPO could exercise its competence , or in accordance with OLAF’s mandate . In addition, they would be obliged to communicate to the EPPO or to OLAF any relevant information upon request .

8. The Proposal would also require the competent authorities of the Member States to grant 16 17 the EPPO and OLAF centralised access for targeted searches to VAT relevant information through the EU IT systems for the purpose of investigating specific criminal offences as defined in Article 4 of the EPPO Regulation and for investigations in accordance with OLAF tasks.

9. Access would be granted to European Prosecutors, European Delegated Prosecutors and selected staff of the EPPO and authorised staff of OLAF who hold a personal user identification allowing centralised access to the information. The access would be limited to targeted searches based on specific data categories, which would be defined in an implementing act, and for the purpose of investigating or prosecuting specific suspected criminal offences as referred to in Article 4 of the EPPO Regulation, for the purposes of opening and carrying out investigations in accordance with OLAF tasks as referred to in Article 1(1) of the OLAF Regulation, i.e. not for random searches .

10. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 14 and 18 November 2025 pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 12 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

11. The Proposal raises important questions as to the role of the EPPO, whose investigative powers under the EPPO Regulation rely on the European Delegated Prosecutors’ (EDP’s) powers under national law. The Proposal would create an exception to this rule, by adding an investigative power at Union level that can be exercised by other staff of the EPPO than the EDP’s.

12. The Explanatory Memorandum to the Proposal refers to the ongoing review of the EU antifraud architecture aimed at streamlining tasks, competences and coordination between the different EU actors in charge of prevention, investigation and repression of fraud affecting the EU’s financial interests . It is therefore the EDPS’ understanding that the Proposal is intended as an immediate measure to address an urgent problem, which is also mentioned in the White Paper for the Anti-fraud Architecture Review , and that the review of the anti-fraud architecture will be an opportunity to ensure further coherence and consistency.

13. The Proposal also raises important questions regarding the boundaries between administrative VAT cooperation and criminal law enforcement. The EDPS stresses that personal data processing for administrative purposes and for criminal law enforcement purposes are distinct from each other. This separation must also be carefully reflected by the Proposal.

14. The EDPS notes that the Proposal might also raise questions about sector-specific data protection legislation at national level, which may include the concept of tax secrecy (which limits direct access to VAT-related databases by entities other than tax authorities). While acknowledging that other national legal standards may exist, the current Opinion can only address the question of compatibility with the Union legal framework on data protection.

15. Against this background, the EDPS welcomes the objectives of the Proposal and recognises that EPPO’s and OLAF’s direct access to VAT information is necessary to achieve the objective to effectively combat cross-border VAT fraud. In making this assessment, the EDPS has taken into consideration the specific characteristics of Missing Trader Intra- Community (MTIC) fraud, the targeted nature of the access and the specific categories of information concerned, which first and foremost relates to VAT numbers and business-tobusiness transactions.

16. At the same time, the Proposal should clearly explain and underline the exceptional nature of providing direct (albeit limited) access to administrative databases for law enforcement purposes. The EDPS considers that such an explicit further clarification is warranted to avoid that the Proposal would be misconstrued as a precedent for more general application.

17. The Proposal should also ensure the implementation of appropriate legal, technical and organisational safeguards tailored to the targeted nature of the measure. While the details of the technical and organisational measures can be further specified by a way of an implementing act, as envisaged by the Proposal, certain parameters should already be defined at the level of the basic act. To this end, the EDPS recommends including in the Proposal a number of additional safeguards to help ensure compliance with the principles of purpose limitation, data minimisation and accountability, which are set out below.

3. Data categories

18. The EDPS notes that the data categories that would be affected by the direct access functionality are listed in Article 1(5) of the Proposal, which would add Article 49a and 49b to Regulation (EU) No 904/2010. The EDPS understands that, under observance of the timeline provided by the Proposal, the following systems and databases would be accessed by EPPO and OLAF: • the VAT Information Exchange System (VIES), • the Surveillance system (one of the electronic systems under the Union Customs Code), and • the Central Electronic System of Payment Information (CESOP).

19. Furthermore, it is the EDPS’ understanding that the access to these systems would technically enable access to the following data categories: • information on VAT identification numbers and VAT intra-Community transactions ; • relevant information on VAT exempt importations related to the Import One-Stop- Shop (IOSS) and customs procedure 42 /63 importations ; and • aggregated payment information .

20. The EDPS is concerned that, due to the legislative technique of cross-referencing, the Proposal does not clearly set out the relevant data categories in a manner that is clearly foreseeable and accessible to individuals. At the same time, the EDPS understands the challenges that stem from a tiered system of applicability and the envisaged change from a decentralised VIES to a centralised VIES in the future. To enhance clarity and foreseeability, the EDPS recommends providing a clear indication of the main data categories concerned, if only by way of a recital. The exact categories of data available in these systems, that OLAF and EPPO would need to access for the purpose of fighting cross border tax fraud, could then be further specified in an implementing act.

4. Indications of suspected cross-border VAT fraud

21. The EDPS notes that pursuant to Article 1(2) of the Proposal, amending Article 24d of Regulation (EU) No 904/2010, Eurofisc working field coordinators should communicate to EPPO or to OLAF ʻany indication of suspected cross-border VAT fraudʼ in respect of which EPPO or OLAF could exercise its competence. 8

22. As neither EPPO nor OLAF are obliged to take up every case that falls under their mandate, a tiered approach to data transmission can help to comply with the principle of data minimisation. In some cases, it may be sufficient to provide indications without the sharing of (all) personal data, and to share further information once it has been established that the EPPO or OLAF intend to exercise their competence. This may help to avoid unnecessary sharing in the event that the EPPO or OLAF do not take up a case.

23. Against this background, the EDPS welcomes that Eurofisc working field coordinators should in first instance communicate to EPPO or to OLAF ‘indications’ of suspected crossborder VAT fraud. To provide even more clarity, the EDPS recommends stating explicitly that Eurofisc working field coordinators should only actively communicate the information necessary to enable EPPO or OLAF to decide whether to exercise their competence.

5. Technical and organisational safeguards

24. The EDPS notes that Recital 11 of the Proposal refers to necessary adaptations to the existing and planned systems affected by the Proposal. It is the understanding of the EDPS that the Commission will include a separate gateway or interface for OLAF and EPPO access when determining the technical details in an implementing act. The EDPS welcomes such approach, as it seems suited to support purpose limitation and data minimisation.

25. While the details of the technical and organisational measures would be further specified by way of an implementing act, as envisaged by the Proposal, due to the exceptional nature of such access, certain parameters should be spelled out at the level of the basic act, at least by way of defining objectives that would lower the risk of possible untargeted searches (‘fishing expeditions’) or abuse.

26. For example, the EDPS recommends that access is limited to certain information necessary for the investigation of a specific crime with specific suspects through technical measures; this should not only be ensured by defining appropriate search terms, but also by technically restricting the response behaviour of the data base in case of too many hits .

27. In addition, the EDPS recommends requiring at the level of the basic act that technical measures ensure that every access could be attributed to a concrete investigation (case file) and investigator (user). Further measures to ensure accountability could be provided by way of an implementing act. Comprehensive audit logging mechanisms should create a record of all access to the applications and databases, and these logs should be monitored to ensure the proper use of the system and the proper management of security incidents and personal data breaches. The overall solution should also ensure that incidents and personal data breaches are managed appropriately.

28. Furthermore, the EDPS recommends specifying in the Proposal that measures should be in place to ensure that national authorities are made aware and can, where appropriate, challenge access that appears to go beyond what is necessary.

29. Finally, the EDPS recommends requiring OLAF and the EPPO to put in place internal organisational measures to safeguard against unwarranted ‘fishing expeditions’ or other potential violations of tax secrecy. These safeguards could include internal authorisation processes, as have been established, for example, for Europol's access to the Visa Information System (VIS), the European Union's centralised biometric database (Eurodac), and the other EU large-scale information systems containing 'administrative' data .

6. Ex-post evaluation and review

30. The EDPS notes that under Article 49(1), (3) and (4) of Council Regulation (EU) No 904/2010, a system to evaluate how well administrative cooperation is combating tax evasion and avoidance is already in place, including annual statistics by Member States about the information accesses by the EPPO and OLAF. It is the EDPS’ understanding that these clauses also apply to the amendments to be introduced by the Proposal.

31. Accordingly, the Regulation’s application is supposed to be reviewed every five years . In this regard, the EDPS recommends that during the future reviews specific attention is paid to the practical application and the impact of the envisaged direct access to VAT data by the EPPO and OLAF.

7. Conclusions

32. In light of the above, the EDPS makes the following recommendations: (1) to clearly explain and underline the exceptional nature of providing direct access to administrative databases for law enforcement purposes; (2) to further clarify the data categories affected by OLAF and EPPO access, at least by way of a recital; (3) to clarify that Eurofisc working field coordinators should only actively communicate the information necessary to enable EPPO or OLAF to decide whether to exercise their competence; (4) to require technical measures ensuring that access remains limited to information necessary for the investigation of a specific crime; (5) to require technical measures ensuring that every access can be attributed to a concrete investigation (case file) and investigator (user); (6) to require measures ensuring that national authorities are made aware and can, where appropriate, challenge access that appears to go beyond what is necessary; (7) to require OLAF and the EPPO to put in place internal organisational measures to safeguard against unwarranted ‘fishing expeditions’ or abuse; and (8) to pay specific attention to the practical application and the impact of the envisaged direct access to VAT data by EPPO and OLAF during the future reviews. Brussels, 7 January 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 11