EU-Switzerland agreement on the automatic exchange of tax information

Opinion 2/2015

Opinion of the EDPS on the EU-Switzerland agreement on the automatic exchange of tax information

8 July 2015

EXECUTIVE SUMMARY

2 | P a g e

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular Article 28(2) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

I. IMPLEMENTATION OF THE GLOBAL STANDARD FOR AUTOMATIC EXCHANGE OF FINANCIAL ACCOUNT INFORMATION

1. The importance of automatic exchange of information as a means to combat cross-border tax fraud and tax evasion by ensuring full tax transparency and cooperation between tax administrations worldwide has been recognised at the international level. The Organisation for Economic Cooperation and Development (OECD) was mandated by the G20 to develop a single global standard for automatic exchange of financial account information. The Global Standard was released by the OECD Council in July 2014.

2. In the EU, in order to preserve the level playing field of economic operators, agreements have been signed with Switzerland, Andorra, Liechtenstein, Monaco and San Marino providing for measures equivalent to those laid down in directive No. 2003/48/EC (on 1 taxation of savings income in the form of interest payments) . The purpose of these agreements was to regulate and facilitate the exchange of financial information, relevant for taxation purposes, among the competent authorities of the countries involved in the agreements, thus putting an end to banking secrecy in tax matters.

3. On 27 May 2015, the President of the Council signed, on behalf of the European Union, the Amending Protocol to the agreement between the European Community and the Swiss Confederation providing for measures equivalent to those laid down in Council Directive No 2003/48/EC on taxation of savings income in the form of interest payments (hereafter "the Agreement"). The approval of the conclusion of the Agreement by the European Parliament is currently pending.

4. In order to minimise costs and administrative burdens both for tax administrations and for economic operators, the Agreement aims at bringing the existing Savings Agreement with Switzerland in line with EU and international developments as regards automatic exchange of information. This will increase tax transparency in Europe and will be the legal basis for implementing the OCDE Global Standard on automatic exchange of information between Switzerland and the EU.

5. Therefore, in order to implement the Global Standard in the exchanges of data between the EU and the Swiss Confederation, the Agreement contains a number of provisions regulating the automatic exchange of tax information between the concerned tax authorities in Switzerland and in the Member States.

6. The increased attention against tax evasion and the automatic exchange of financial information, however, calls for appropriate safeguards for data protection rights. This is a 3 | P a g e crucial aspect, considering that the OECD rules on automatic exchange converge on principles already adopted by the US legislation on the subject (the US FATCA) which, nonetheless, have a different approach to data protection issues .

7. With respect to the protection of personal data, it must be noted that the Agreement includes, in its Article 6, provisions on confidentiality and data protection. In addition, it must be borne in mind that the Commission has adopted an adequacy decision finding that the data protection legal framework in force in Switzerland is consistent with the principles of Directive No 95/46/EC (the "Data Protection Directive") thus allowing for unrestricted transfer of data pursuant to Articles 25 and 26 of the same Directive.

8. In this Opinion, we would like to formulate a number of considerations focusing on the data protection implications of the Agreement, with a view to provide guidance on essential safeguards that should be embedded in future bilateral agreements entered into by the EU for the purpose of facilitating the automatic exchange of financial account information. II. DATA PROTECTION IMPLICATIONS OF THE PROVISIONS IMPLEMENTING THE AUTOMATIC EXCHANGE OF TAX INFORMATION. II.1 Proportionality of measures - Detection of Reportable Accounts and Due Diligence exercise

9. The automatic exchange of information, to be carried out annually, concerns primarily Reportable Accounts, established either in Switzerland or in any EU Member State, to be identified through a Due Diligence exercise (also regulated by the Agreement). A reportable account is an account to which the Agreement links a significant risk of tax evasion, such to trigger reporting obligations. The reporting entails the transfer and processing of a significant amount of personal data to and by Switzerland and EU Member States (e.g. name, address and place of birth of the account holder, balance of the account, amount of interests, dividends and/or other income obtained from the account).

10. Reportable Accounts, as mentioned, are identified not by virtue of specific circumstances linked to them or to the account holder, rather through a due diligence exercise carried out by financial institutions in both Switzerland and EU Member States. The due diligence consists mainly of an electronic record search of all electronically searchable data performed in relation to account holders whose residence information is missing- looking for evidence (e.g. mailing address, fix or mobile phone numbers, power of attorney granted) of the residence of such account holders in one of the jurisdictions where reporting and tax information exchange apply. If any of the evidence listed in the Agreement is discovered in the electronic search, or if there is a change in circumstances that results in one or more piece of evidence being associated with the account, then the reporting financial institution must treat the account holder as a resident for tax purposes of each jurisdiction for which a piece of evidence is identified. 4 | P a g e

11. In the recitals, the Agreement indicates that certain financial institutions and accounts that present a low risk of being used to evade tax should be excluded from the scope. Nonetheless, it also takes the position that thresholds should not be generally included, as they could easily be circumvented by splitting accounts into different financial institutions. It is not clear then, reading the Agreement, how such low-risk institutions and accounts should be identified.

12. Noting that the circumstances that identify a high risk of tax evasion -and trigger the reporting obligations- are not clear, that the due diligence exercise seems to rely heavily on electronic record search and that apparently there are no suitable criteria to exempt low risk accounts from reporting, we are concerned that the measures envisaged by the Agreement might exceed what is necessary and proportionate to achieve a legitimate policy goal (fight against tax evasion).

13. The relationship between legitimate public policy goals and protection of personal data has been addressed by the European Court of Justice in its Digital Rights Ireland judgment. In fact, based on the Court judgment annulling Directive No 2006/24/EC (Data Retention Directive applied to persons for whom there was no evidence capable of suggesting that their conduct might have a link, even an indirect or remote one with criminal activity), measures introducing massive and indiscriminate collection of data are deemed not to be proportionate, if they fail to narrow down the types of persons who can be targeted as individuals suspected of a crime.

14. Therefore, we consider that the Agreement should have included provisions and criteria that explicitly link the reporting of personal data concerning financial accounts to possible tax evasion and that exempt low-risk accounts from reporting. In this respect, such criteria should be applicable ex ante to determine which accounts (and which information) would need to be reported. Only at that stage -once the relevance (or irrelevance) of the reporting for the purpose of countering tax evasion has been established- the electronic search might help determining the residence of the account holder. II.2 Purpose limitation in the processing of exchanged information Processing of tax information for additional purposes

15. The Agreement includes provisions limiting the circulation and the use of the information exchanged through the automatic exchange system. To such effect, Article 6(2) (confidentiality and protection of personal data) provides that the information exchanged, including personal data, shall be disclosed on a "need-to-know" basis "only to persons and authorities (...) concerned with the assessment, collection or recovery of, the enforcement or prosecution in respect of, or the determination of appeals in relation to taxes of that jurisdiction, or the oversight of the above. Only the persons or authorities mentioned above may use the information and then only for purposes spelled out in the preceding sentence ".

16. In addition, Article 6(3) provides that the information exchanged "may be used for other purposes when [this is possible] under the laws of the supplying jurisdiction (...) and the competent authority of that jurisdiction authorises such use". 5 | P a g e

17. We welcome that the Agreement seeks to limit the circulation and use of the information exchanged, as purpose limitation is one of the fundamental principles of data protection enshrined in the Data Protection Directive. For the same reason, however, we are critical of the envisaged possibility to use the information for additional purposes, when this is possible under the laws of the supplying jurisdiction and there is the authorization of the competent authority of such jurisdiction. We consider that the problem is not so much that alternative uses are possible in the supplying jurisdiction as the fact that, in application of this provision, alternative uses become possible in the receiving jurisdiction, in a way which is potentially harmful to individual rights.

18. In this respect, the EDPS notes that purpose elasticity restricts the individual rights to protection of personal data, as the purpose for data processing should be specified, explicit and legitimate and disclosed ex ante to the data subject. Further processing for additional purposes may only take place if such purposes are compatible with the original purpose (Article 6 of the Data Protection Directive). In his viewpoint, Article 6 (3) of the Agreement further limits the rights of the individual without providing any safeguards (e.g. prior information of the data subjects as to possible alternative uses of their information). II.3 Rights of the data subject

19. Article 6(2) of the Agreement provides that "Information provided by a jurisdiction (being a Member State or Switzerland) to another jurisdiction (being, respectively, Switzerland or a Member State) may be transmitted by the latter to a third jurisdiction (being another Member State), subject to prior authorisation by the competent authority of the first-mentioned jurisdiction, from which the information originated. Information provided by one Member State to another Member State under its applicable law implementing Council Directive 2011/16/EU on administrative cooperation in the field of taxation may be transmitted to Switzerland subject to prior authorisation by the Competent Authority of the Member State from which the information originated".

20. As this transfer of personal data takes place either between Member States (all bound by the Data Protection Directive) or toward Switzerland (which is the subject of a Commission adequacy decision), we do not have concerns as to the fact that the transfer complies with Articles 25 and 26 of the Data Protection Directive. We consider, however, that there is a specific need to ensure that data subjects are duly and timely informed on the circulation and use of their personal data, as required by Article 10 of the Data Protection Directive.

21. Therefore, the Agreement should have specified that information on data transfers should be provided to the data subject with a reasonable delay before the actual exchange of the data takes place (so that the individual concerned gets time to defend himself if relevant). The information provided should at the minimum inform the data subjects of the fact that their personal data will be sent to a competent authority for the purpose of fighting tax evasion, include a list of the category of data sent and the contact of the controller in their country of residence and inform them of their right to object and their right of redress. 6 | P a g e II.4 Data security and retention period Data security measures

22. The Agreement mandates (Article 3(5)) that the authorities in charge of the automatic exchange of tax information will agree on one or more methods for data transmission including encryption standards. It also provides (Article 6(4)) that each authority of a Member State or Switzerland will notify the other competent authority (i.e. that of Switzerland or the specific Member State) immediately regarding any breach of confidentiality, failure of safeguards and any sanctions and remedial actions consequently imposed.

23. In consideration of the sensitive nature of tax information (they can reveal valuable aspects of the life and activities of citizens), we welcome that such safeguards have been provided for. We consider, however, that the Agreement should have explicitly set forth the security standards to be complied with by the authorities (both in Switzerland and in the EU) engaging in systemic data exchange. Also, an optimal system of safeguards would require that sanctions are applied as a consequence not only of security breaches, but also for the violation of data protection provisions, so as to make the latter rules cogent and thus more effective.

24. Merging technology and data protection and designing a privacy-compliant system from the outset -rather than applying data protection rules ex post- is an example of privacy-bydesign approach. Such an effort is part of a philosophy that we support and that will be implemented also in the forthcoming General Data Protection Regulation. Retention period of exchanged tax information

25. With respect to the application of the Global Standard in time, we note that the Agreement provides that relevant tax information is to be exchanged with respect to the first year starting at the entry into force of the amending protocol (the body of provisions implementing the Global Standard) and all subsequent years and will be exchanged within nine months after the end of the calendar year to which the information relates.

26. On the one hand, the exchange of information on a certain number of accounts on an annual basis confirms our view that the information exchange is independent of the detection of any actual risk of tax evasion, thus questioning the proportionality of the measure itself (an issues we addressed in the paragraphs above). On the other hand, we note that nothing is said of what happens once tax information is collected and exchanged, namely there is no mention of any retention period.

27. The indication of an explicit retention period for the personal data collected and exchanged would have ensured that data are retained for the time strictly necessary to pursue legitimate policy goals and, once this is achieved, they are deleted, restoring in full individual rights. Should this not be the case, the massive and continuous exchange of tax information concerning citizens would result in a large archive difficult to control and potentially harmful to the citizens.

28. We therefore consider that the Agreement should have clearly indicated for how much time tax information should be retained, in order to counter tax evasion. It should have 7 | P a g e also explicitly provided for the deletion of such information once the retention period has expired. III. CONCLUSION

29. In the light of the considerations above, we take note of the fact that the implementation of the Global Standard is considered as necessary to counter tax evasion and thus ensure a level playing field to market operators.

30. We consider, nonetheless, that, during the negotiation phase, a number of corrections should have been made to the Agreement in order to better address data protection issues. We now call on the EU legislator to introduce such data protection safeguards in future measures implementing the Agreement and in future bilateral agreements to be concluded with other countries in the same field. In particular, any similar agreement or future implementing measure should:  ensure proportionality of the data processing, by making the collection and exchange of tax information conditional on the effective risk of tax evasion and by implementing criteria to exempt low-risk accounts from reporting;  limit the purpose of data processing to the pursuit of a legitimate policy goal and prevent use for additional purposes without informing data subjects;  provide for proper information of the data subjects (pursuant to Article 10 of the Data Protection Directive) as to the purpose and modalities of processing of their financial data, including the recipients of their data;  set forth explicit security and data protection standards to be complied with by private and public authorities engaging in the collection and exchange of tax information (privacy-by-design). It should also provide for sanctions in case of breach of such provisions;  provide for an explicit retention period applicable to the tax information exchanged and mandate for its deletion, once such information is no longer processed for the purpose of countering tax evasion. Bruxelles, 8 July 2015 (signed) Wojciech Rafał WIEWIÓROWSKI European Data Protection Assistant Supervisor 8 | P a g e