EDPS Opinion on the package of legislative Proposals on VAT in the Digital Age

3 March 2023

Opinion 7/2023

on the package of legislative proposals on VAT in the Digital Age

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall, ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal

data’

This Opinion relates to the VAT in the Digital Age package that consists of three legislative proposals: a Proposal for a Council Directive amending Directive 2006/112/EC as regards VAT rules for the digital age; a Proposal for a Council Regulation amending Regulation (EU) No 904/2010 as regards the VAT administrative cooperation arrangements needed for the digital age; and a Proposal for a Council Implementing Regulation amending Implementing Regulation (EU) No 282/2011 as regards information requirements for certain VAT schemes. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 8 December 2022, the European Commission issued the package of legislative proposals on VAT in the Digital Age that consists of: a Proposal for a Council Directive amending Directive 2006/112/EC as regards VAT rules for the digital age; a Proposal for a Council Regulation amending Regulation (EU) No 904/2010 as regards the VAT administrative cooperation arrangements needed for the digital age; and a Proposal for a Council Implementing Regulation amending Implementing Regulation (EU) No 282/2011 as regards information requirements for certain VAT schemes.

The EDPS welcomes the objectives pursued by the VAT in the Digital Age package, notably the modernisation of VAT reporting obligations, the adaptation of VAT rules applicable to platform economy and the introduction of Single VAT Registration. Having regard to the new rules on digital reporting envisaged by the Proposal for a Council Directive, the EDPS recalls that any processing of personal data must fully comply with the GDPR and the EUDPR, including the principles of purpose limitation and data minimisation. To ensure compliance with the principle of purpose limitation, the EDPS recommends explicitly specifying in the enacting terms of the Proposal that the information collected may only be processed for the purpose of fighting VAT fraud by the competent tax administration.

Information contained in invoices may reveal sensitive information concerning specific natural persons, such as information concerning purchased goods (including intimate products), travel arrangements or legal services. The EDPS welcomes that the information to be provided to the tax administration under the digital reporting requirements are an extract (a specified subset) of the information from the invoice and not the whole invoice as such. This is a key safeguard to ensure compliance with the principle of data minimisation under Article 5(1)(c) of the GDPR and Article 4(1)(c) of the EUDPR and to reduce the impact of the processing of personal data on the rights and freedoms of the data subjects. In this regard, the EDPS welcomes that the Proposal for a Council Directive excludes the name and address of the customer and the taxable person from the information to be transmitted.

The EDPS also welcomes that the Proposal for a Council Regulation explicitly designates the roles of the Member States and Commission under EU data protection law. At the same time, the EDPS recalls that the designation must be aligned with the responsibilities assigned to each actor. Moreover, any further specification of the responsibilities of the Member States and the Commission by way of implementing acts must be fully in line with the roles established by the legislative act.

Finally, the EDPS highlights that the safeguards laid down under Chapter XV of Regulation (EU) No 904/2010 (Conditions governing the exchange of information) should remain applicable to the processing of personal data laid down in the Proposal for a Council Regulation.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 8 December 2022, the European Commission (‘Commission’) issued a Proposal for a Council Directive amending Directive 2006/112/EC as regards VAT rules for the digital age (‘the Proposal for a Council Directive’) ; a Proposal for a Council Regulation amending Regulation (EU) No 904/2010 as regards the VAT administrative cooperation arrangements needed for the digital age (‘the Proposal for a Council Regulation’) ; a Proposal for a Council Implementing Regulation amending Implementing Regulation (EU) No 282/2011 as regards information requirements for certain VAT schemes (‘the Proposal for a Council Implementing Regulation’) . In the context of this Opinion, we refer to the three legislative proposals as the ‘VAT in the Digital Age package’.

2. The VAT in the Digital Age package is part of the Commission’s 2020 Action Plan for fair 5 6 and simple taxation supporting the recovery . It has three main objectives : 1) modernising VAT reporting obligations, by introducing Digital Reporting Requirements, which will standardise the information that needs to be submitted by taxable persons on each transaction to the tax authorities in an electronic format and, at the same time, it will impose the use of e-invoicing for cross-border transactions; 2) updating the VAT rules applicable to the platform economy, in particular by enhancing the role of the platforms in the collection of VAT; 3) avoiding the need for multiple VAT registrations in the EU and improving the functioning of the tool implemented to declare and pay the VAT due on distance sales of goods, by introducing Single VAT Registration (SVR), improving and expanding the existing systems of One-Stop Shop (OSS)/Import One-Stop Shop (IOSS) and reverse charge in order to minimise the instances for which a taxable person is required to register in another Member State.

3. In addition, the Proposal for a Council Regulation introduces a set of amendments to Regulation (EU) 904/2010, establishing among others a new central system at EU level for the exchange of VAT information between Member States’ tax administrations that is adapted to the specificities of Digital Reporting Requirements (‘central VIES system’) .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 10 January 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in recital 25 of the Proposal for a Council Regulation. A reference to this consultation is however absent in the recitals of the Proposal for a Council Directive and in the recitals of the Proposal for a Council Implementing Regulation. The EDPS therefore recommends inserting a reference to this consultation in both Proposals.

2. General comments

5. The EDPS welcomes the objectives pursued by the VAT in the Digital Age package, notably the modernisation of VAT reporting obligations, the adaptation of VAT rules applicable to platform economy and the introduction of Single VAT Registration.

6. Having regard to the new rules on digital reporting envisaged by the Proposal for a Council Directive, the EDPS recalls that any processing of personal data must fully comply with the 8 9 GDPR and the EUDPR, and notably with the principle of purpose limitation and data 10 11 minimisation . Integrity and confidentiality are also of key importance, especially with regard to the setting up of the central VIES system at EU level.

7. The Proposal for a Council Regulation specifies, in recital 24, that the latter respects the fundamental rights and observes the principles recognised by the Charter of Fundamental Rights of the European Union. In particular, the Proposal ‘seeks to’ ensure full respect for the right of protection of personal data laid down in Article 8 of the Charter. The EDPS recommends deleting the words ‘seeks to’ in order to indicate clearly that this Regulation ‘ensures’ full respect for the right of protection of personal data laid down in Article 8 of the Charter and to explicitly recall the applicability of GDPR and the EUDPR to the processing of personal data in the context of the proposal.

8. The EDPS notes that the Proposal for a Council Directive, while containing rules on digital reporting that have an impact on the processing of personal data, does not contain a similar recital. The EDPS therefore recommends inserting a recital in the Proposal for a Council Directive recalling that the proposal ensures full respect for the fundamental rights to privacy and to the protection of personal data, as well as the applicability of GDPR and the EUDPR to the processing of personal data in the context of the proposal.

9. Finally, the EDPS recalls that the setting up a centralised information system is likely entail higher risks for data subjects as compared to a decentralised and interconnected information system. The EDPS also points to the large volume of the intra-Community transaction information that would be processed in the central VIES and to the risks stemming from possible cyberattacks and data breaches. It is therefore essential that the central VIES should guarantee an appropriate level of security and the exchange of information between national tax authorities and the central VIES should only take place through a secure common communication network.

3. Specific comments

3.1. Digital reporting requirements

10. The EDPS notes that the Proposal for a Council Directive would replace the obligation to provide recapitulative statements with a digital reporting system for intra-Community transactions. The Digital reporting requirements would provide information to the tax authorities on a transaction-by-transaction basis in order to allow cross-matching of data and increase the control capabilities of tax administrations . Such processing would be functional to the early discovery of the Missing Trader Intra-Community Fraud .

11. Article 264, as it would be amended by the Proposal for a Council Directive, provides for an exhaustive list of information to be transmitted by the taxable person to the tax administration. To a large extent, this information is the same as the information that had to be submitted in the recapitulative statements, but detailed for each transaction instead of aggregated by customer . In addition, there are new fields that have been added to improve the detection of fraud. These new fields are the reference to the previous invoice in case of rectification of invoices, the identification of the bank account into which the payment for the invoice will be credited and the dates agreed for the payment of the amount of the transaction. With a view to a full standardization and interoperability, implementing rules shall be adopted by the Commission to define a common electronic message to this purpose .

12. In case of intra-Community acquisitions of goods, the taxable person identified for VAT purposes in the Member State which issued the VAT identification number under which that person made such acquisitions shall set out the following information in the data to be transmitted: (a) that person’s VAT identification number in that Member State and under which the acquisition and subsequent supply of goods were made; (b) the VAT identification number, in the Member State in which dispatch or transport of the goods ended, of the person to whom the subsequent supply was made by the taxable person; (c) the value, exclusive of VAT, of each supply made by the taxable person in the Member State in which dispatch or transport of the goods ended .

13. The EDPS considers that the processing of information to be provided by the taxable person to tax administration under the digital reporting requirements may be necessary for the purpose of fighting VAT fraud. To ensure compliance with the principle of purpose limitation, the EDPS recommends explicitly specifying in the enacting terms of the Proposal that the information collected may only be processed for the purpose of fighting VAT fraud by the competent tax administration.

14. The EDPS points out that information contained in invoices may reveal sensitive information concerning specific natural persons, such as information concerning purchased goods (including intimate products), travel arrangements or legal services. Moreover, largescale collection of data on the quantity and nature of goods supplied or services rendered to specific individuals on a transaction-by transaction basis would provide the means of establishing a detailed profile of the individuals concerned.

15. The EDPS welcomes that the information to be provided to the tax administration under the digital reporting requirements are an extract (a specified subset) of the information from the invoice and not the whole invoice as such. This is a key safeguard to ensure compliance with the principle of data minimisation under Article 5(1)(c) of the GDPR and Article 4(1)(c) of the EUDPR, as well as to reduce the impact of the processing of personal data on the rights and freedoms of the data subjects. In this regard, the EDPS welcomes that the proposed amendment to Article 264 of the Council Directive excludes the full name and address of the customer and the taxable person from the information to be transmitted.

16. The EDPS also welcomes the specification in recital 15 of the Proposal for a Council Directive, that to achieve the necessary harmonisation in the reporting of data on intra- Community transactions, the information to be reported should be the same in all Member States, without the possibility for Member States to request additional data.

3.2. Central electronic system for the exchange of VAT information

17. The previous section of this Opinion described how the reporting obligations of intra- Community supplies in the form of periodical recapitulative statements for VAT purposes would be replaced by digital reporting requirements. Currently, the recapitulative statements are stored in national VAT databases. These databases are then connected through an electronic interface called VIES (VAT Information Exchange System). In this regard, the Commission manages the communication between the Member States via VIES, while national VIES applications are developed by the Member States .

18. The Proposal for a Council Regulation would amend Regulation (EU) No 904/2010 on VAT administrative cooperation , setting up a central electronic system for VAT information (‘the central VIES’) . The central VIES would be developed, maintained, hosted and technically managed by the Commission . Each Member State would develop, maintain, host and technically manage a national electronic system to automatically transmit different categories of information to the central VIES . The most essential part of information exchanged through central VIES would be the information collected through the Digital Reporting Requirements. The other information relates to the identification of the taxable persons. Finally, it is explicitly mentioned that Member States may store the information they have to automatically transmit to the central VIES in the national electronic system which they use for transmitting the information for the purposes of reuse in national controls .

19. The Proposal for a Council Regulation lays down in Article 24j the functions of the central VIES. The central VIES would be able to aggregate per taxable person information on crossborder (intra-Community) business-to-business (B2B) transactions transmitted by the Member States. It would also allow the information transmitted by the Member States to be processed with other VAT information exchanged under Regulation (EU) No 904/2010, such as customs data .

20. Article 24k specifies the access rights to the central VIES by Member State competent authorities. The central VIES would only be accessible to authorised officials appointed by their Member States, including Eurofisc liaison officials, and for the exclusive purpose of the control of compliance with VAT legislation.

21. The EDPS notes that the Proposal for a Council Regulation lays down the role and responsibilities of the Member States having regard to the information transmitted to the central VIES , and specifically having regard to the validity/invalidity of the VAT identification number .

22. Furthermore, Article 24m lays down that the Commission will specify by means of an implementing act the tasks to be carried out by the Commission for the technical management of the central VIES, as well as the roles and responsibilities of Member States as controllers and the Commission as processor under the GDPR and the EUDPR.

23. The EDPS takes note of the proposed qualification of Member States as controllers under the GDPR and the Commission as processor under the EUDPR. A clear designation of roles is in line with the EDPS Guidelines on the concepts of controller, processor and joint controllership under Regulation (EU) 2018/1725 which recommends identifying the controller of specific processing operation(s) already in the basic legislative act, in order to avoid any possible problem of interpretation in assessing that role .

24. As equally mentioned in the EDPS Guidelines on the concepts of controller, processor and joint controllership under Regulation (EU) 2018/1725 , such determination must be aligned with the actual responsibilities assigned to the various actors by the legislative act. In the case at hand, the Proposal for a Council Regulation amending Regulation (EU) No 904/201 does not yet define in detail the actual responsibilities of Member States as controllers and the Commission as processor under the GDPR and the EUDPR. Regarding the Commission’s role, Article 24g(2) only provides that “[t]he Commission shall develop, maintain, host and technically manage an electronic, central VAT information exchange system (“central VIES”) for the purposes referred to in Article 1”.

25. In line with the wording of proposed Article 24m, letter (b), the Commission shall specify the responsibilities of Member States as controllers and the Commission as processor under the GDPR and the EUDPR by means of implementing acts. The EDPS recalls that the designation of the Member States as controllers needs to be taken into account when specifying the respective responsibilities of the Member States and the Commission in the context of those implementing acts. In particular, if the Commission is to act (only) as processor, operating under the (exclusive) control of the Member States, this should be duly reflected in those implementing acts, having due regard to the requirements of Article 28 GDPR and Article 29 EUDPR .

26. The EDPS highlights that the safeguards laid down under Chapter XVof Regulation (EU) No 904/2010 (Conditions governing the exchange of information) should remain applicable to the processing of personal data laid down in the Proposal for a Council Regulation, including the safeguards provided in Article 55 of Regulation (EU) No 904/2010.

27. The EDPS expects to be consulted by the Commission on the implementing acts that would further detail the format of the information and the responsibilities, conditions and safeguards for the processing of personal data pursuant to the Proposal for a Council Regulation (‘the basic act’). The EDPS also recommends, in this respect, that these implementing acts should enter into force and be applicable at the same time of entry into force and applicability of the basic act.

4. Conclusions

28. In light of the above, the EDPS makes the following recommendations: = • with regard to the Proposal for a Council Directive: (1) to add a recital recalling that the proposal ensures full respect for the fundamental rights to privacy and to the protection of personal data, as well as the applicability of GDPR and the EUDPR to the processing of personal data in the context of the proposal; (2) to explicitly specify in the enacting terms of the Proposal that the information collected may only be processed for the purpose of fighting VAT fraud by the competent tax administration; • with regard to the Proposal for a Council Regulation: (3) to delete in recital 24 the words “seeks to” in order to indicate clearly that this Regulation ‘ensures’ full respect for the right of protection of personal data laid down in Article 8 of the Charter and to explicitly recall the applicability of GDPR and the EUDPR to the processing of personal data in the context of the proposal. Brussels, 3 March 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10