EDPS Opinion on the Proposal for a Council Directive amending Directive 2011/16/EU on administrative cooperation in the field of taxation

3 April 2023

Opinion 9/2023

on the Proposal for a Council Directive amending Directive 2011/16/EU on administrative cooperation in the field of taxation

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Council Directive (EU) amending Directive 2011/16/EU on administrative cooperation in the field of taxation . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

With this Opinion, issued pursuant to Article 42(1) of Regulation (EU) 2018/1725, the EDPS puts forward recommendations on the Proposal for a Council Directive amending Directive 2011/16/EU on administrative cooperation in the field of taxation having regard to the fundamental rights to privacy and to the protection of personal data (‘the Proposal’).

The EDPS welcomes the objectives pursued by the Proposal, notably to ensure tax administrations have access to information that is necessary to perform their duties effectively and to strengthen the general compliance with the provisions of Directive 2011/16/EU. Against this background, the EDPS makes a number of recommendations aiming at ensuring full compliance of the Proposal with the applicable data protection legal framework.

Reuse of personal data for a different purpose by the competent authority of a Member State may only be allowed if it is grounded in Union or Member State law on the basis of which the further processing is lawfully authorised, constituting a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1) GDPR. To provide a higher level of harmonisation and legal certainty, the EDPS considers that the Proposal should provide an (exhaustive) list of the purposes for which personal data might be further processed.

As regards access by the Commission to the information recorded in the central directory on administrative cooperation in the field of taxation, the EDPS recommends clarifying which specific obligations of the Commission under the Directive warrant access to the information recorded in the central directory and to clearly specify the purpose of such access.

The EDPS welcomes, as a matter of principle that the Proposal aims to further clarify the roles and responsibilities of the Member States and the Commission within the meaning of data protection law. At the same time, the EDPS notes that Article 25(3) of Directive 2011/16/EU (both in its current form and as it would be amended by the Proposal) defines the respective roles of the Member States and Commission within the meaning of data protection law in a horizontal manner. To avoid unnecessary duplication, the EDPS recommends deleting the last two sentences of Article 8ad(10) as provided in Article 1(6) of the Proposal. Concerning Article 25(3) as it would be amended by the Proposal, the EDPS recommends clearly indicating in which cases the entities involved in the data processing shall be considered as a controller (alone) and when they shall be considered as joint controller.

Finally, the EDPS considers that the Proposal should provide not only for minimum, but also for a maximum period of storage duration. In addition, the Proposal should specify that the records of information received through the exchange of information must be deleted after the maximum data retention period, or earlier, if they are no longer necessary.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 8 December 2022, the European Commission issued a Proposal for a Council Directive (EU) amending Directive 2011/16/EU on administrative cooperation in the field of taxation (‘the Proposal’) .

2. The objectives of the Proposal are : - to introduce provisions for the reporting, due diligence and exchange of information on certain crypto-assets and e-money; - to introduce the obligation for the competent authorities of the Member States to exchange information on tax rulings with a cross-border element concerning high net worth individuals; - to introduce provisions on penalties to be applied to infringements of the national provisions transposing Directive 2011/16/EU (‘the Directive’) .

3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 9 February 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in recital 43 of the Proposal. The EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General comments

4. The EDPS welcomes the objectives pursued by the Proposal, notably to ensure tax administrations have access to information that is necessary to perform their duties 4 effectively and to strengthen the general compliance with the provisions of the Directive. The initiative will require in particular crypto-assets service providers to report relevant information to the competent authorities of the Member States on crypto-transactions.

5. The EDPS recalls that on 28 October 2020 issued his Opinion on a proposal for an amendment of Council Directive 2011/16/EU relating to administrative cooperation in the field of taxation . The EDPS recalls that in his Opinion he highlighted the importance of the implementation of the principles of data protection by design and by default, data minimisation and data accuracy in the context of automatic exchanges of information between national tax authorities. Compliance with this principle is also relevant having regard to the implementation of the exchanges of information pursuant to the Proposal.

6. The Proposal specifies, in recital 44, that it respects the fundamental rights and observes the principles recognised by the Charter of Fundamental Rights of the European Union. In particular, the Proposal ‘seeks to’ ensure full respect for the right of protection of personal data laid down and the freedom to conduct business. The EDPS recommends deleting the words ‘seeks to’ in order to indicate clearly that the Proposal ‘ensures’ full respect for the right of protection of personal data laid down in Article 8 of the Charter. In addition, the EDPS recommends to explicitly recall in the recital the applicability of GDPR and EUDPR to the processing of personal data in the context of the Proposal.

3. Specific comments

3.1. Purpose limitation

7. The EDPS observes that the Proposal would amend Article 16(1) of the Directive to provide that the information to be exchanged pursuant to the Directive may be used for the assessment, administration and enforcement of the national law of Member States concerning the taxes referred to in Article 2 of the Directive as well as VAT, other indirect taxes, customs duties and anti-money laundering and countering the financing of terrorism .

8. The EDPS notes that Article 16(2) of the Directive, as it would be amended by the Proposal, also provides for the possibility for the competent authority receiving the information to use the information and documents received pursuant to this Directive for other purposes than those referred to in Article 16(1). However, this can be done only with the permission of the competent authority of the Member State communicating the information, and only in so far as this is allowed under the legislation of the Member State of the competent authority receiving the information .

9. The EDPS also notes that the revised wording of Article 16(2) would allow for the use of information for other purposes than those referred to in Article 16(1) without the permission of the authority sending the information. However, this can be done only in accordance with national law and to the extent that the information and documents to be used and the intended purposes are referred to in a list which is made publically available by the competent authority of each Member State and which is also communicated to the competent authorities of all other Member States.

10. Furthermore, Article 16(2) as it would be amended by the Proposal provides that the competent authority that receives the information may use it without the permission of the sending Member State for any purpose that is covered by an act based on Article 215 of the Treaty on the Functioning of the European Union (TFEU) and share it for such purpose with the competent authority in charge for restrictive measures in the Member State concerned.

11. The EDPS recalls that the purpose limitation principle requires that any processing of personal data must be done for a specified, explicit and legitimate purpose and not further processed in a manner that is incompatible with the original purpose .

12. Any processing of personal data, including processing carried out by public authorities such as competent authorities in charge of taxation, must satisfy the conditions of lawfulness set by Article 6 of Regulation (EU) 2016/679 (‘GDPR’) . In this regard, according to Article 6(1)(e) GDPR, the processing of personal data is lawful if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In addition, according to Article 6(1)(c) GDPR, the processing of personal data is lawful if it is necessary for compliance with a legal obligation to which the controller is subject. In accordance with Article 6(3) GDPR, read in combination with recital 45 GDPR, the basis for the processing referred to in Article 6(1)(e) or (c) is to be defined by EU law or by Member State law to which the controller is subject. Moreover, the EU or Member State law must meet an objective of public interest and be proportionate to the legitimate aim pursued . The combined provisions of Article 6(1)(e) or (c) GDPR and Article 6(3) therefore require a legal basis, EU or Member State law, which serves as a basis for the processing of personal data by the relevant controllers .

13. Where the processing of personal data is carried out for a purpose other than that for which those data have been collected, it follows from Article 6(4) GDPR that such processing is allowed provided that it is based on EU or Member State law and that it constitutes a necessary and proportionate measure in a democratic society to safeguard one of the objectives referred to in Article 23(1) GDPR .

14. It is important to recall that, in order to safeguard the objective of general public interest, the controller (in the case at hand, the competent taxation authority) would thus be allowed to further process the personal data regardless of the compatibility of that processing with the purposes for which the personal data were initially collected .

15. Consequently, the Proposal should clarify that any personal data received may only be used for a different purpose if the further processing is based on EU or Member State law that constitutes a necessary and proportionate measure in a democratic society to safeguard one of the objectives referred to in Article 23(1) GDPR.

16. In order to provide a higher level of harmonisation and legal certainty, the EDPS additionally recommends to provide in the Proposal itself an (exhaustive) list of purposes for which personal data might be further processed.

3.2. Central register for the exchange of information reported by Reporting Crypto-Asset Service Providers

17. The Proposal provides that the Commission shall establish a central register (‘the central register’) to support the mandatory automatic exchange of information reported by Reporting Crypto-Asset Service Providers . The practical arrangements necessary for the establishment of the central register will be adopted by the Commission .

18. The EDPS notes that the categories of information that may be processed in the central register are specified in subparagraph F(2) of Section V of Annex V . In addition, information to be communicated in the framework of Article 8ad(2) and (3) will be recorded in the central directory on administrative cooperation in the field of taxation (see further Section 3.3. of this Opinion) .

19. The EDPS notes that Article 8ad(10), as provided by the Proposal, defines the Commission’s role and responsibilities within the meaning of data protection law in relation to the central register. According to this Article, the Commission, when processing personal data for the purpose of this Directive must be considered to process the personal data on behalf of the controllers and must comply with the requirements for processors in the EUDPR. Moreover, Article 8ad(10) specifies that the processing of personal data will be governed by a contract within the meaning of Article 28(3) GDPR and Article 29(3) EUDPR.

20. The EDPS welcomes, as a matter of principle, that the Proposal seeks to define the role and responsibilities of the actors involved in the processing. The EDPS notes, however, that Article 25(3) of the Directive (both in its current form and as it would be amended by the Proposal), defines the respective roles of the Member States and Commission within the meaning of data protection law in a horizontal manner (i.e. as regards ‘all exchange of information pursuant to this Directive’) (see further section 3.5 of this Opinion). To avoid unnecessary duplication, the EDPS recommends deleting the last two sentences of Article 8ad(10) as provided in Article 1(6) of the Proposal.

3.3. Central directory on administrative cooperation in the field of taxation

21. The EDPS notes that the Proposal provides that the Commission, acting on behalf of the Member States, will develop and provide with technical and logistical support a central directory on administrative cooperation in the field of taxation (‘the central directory’), where the information to be exchanged between competent authorities under Article 8ad(2) and (3) will be recorded .

22. According to recital 36 of the Proposal, the central directory would be accessible to the Member States and only for statistical purposes to the Commission. In this regard, the EDPS notes that the specification on the access only for statistical purpose by the Commission is not explicitly reflected in the enacting terms of the Proposal as such, which provide that “The Commission shall also have access to the information recorded in that directory for the purposes of complying with its obligations under this Directive, however with the limitations set out in Article 8a(8), Article 8ab(17) and Article 8ad(8).”.

23. The EDPS recommends resolving the discrepancy between recital 36 of the Proposal and the enacting terms, in particular clarifying which specific obligations of the Commission under the Directive warrant access to the information recorded in the central directory, s well as what the specific purpose of such access shall be. Moreover, the EDPS recalls that, pursuant to Article 21(7) of the Directive, the Commission shall have only have access to anonymous and aggregated data for statistical purposes.

24. The EDPS recalls that Article 13 EUDPR and Article 89 GDPR stipulate that when personal data are (further) processed for statistical purposes, those data shall in principle be rendered anonymous (or alternatively pseudonymous), provided that the statistical purpose be fulfilled in this manner . In this regard, the EDPS notes that Article 21(7) of Council Directive 2011/16/EU already provides that “[f]or the purpose of collecting statistics, the Commission shall have access to information about the exchanges recorded to the interface and which can be extracted automatically. The Commission shall have only access to anonymous and aggregated data”.

3.4. Amendments to Article 25 of the Proposal

25. Article 25(3) of the Directive, as it would be amended by the Proposal, specifies that Reporting Financial Institutions, intermediaries, Reporting Platform Operators, Reporting Crypto-Asset Service Providers and the competent authorities of Member States shall be considered to be controllers, ‘acting alone or jointly’. When processing personal data for the purpose of this Directive, the Commission shall be considered to process the personal data on behalf of the controllers and shall comply with the requirements for processors in

26. The EDPS welcomes that the Proposal aims to further clarify the roles and responsibilities of the Member States and the Commission within the meaning of data protection law. However, the EDPS considers that the Proposal should clearly indicate in which cases the entities involved in the processing shall be considered as a controller (alone) and when they shall be considered as joint controllers. In this regard, the EDPS notes that the Explanatory Memorandum to the Proposal indicates that the Member States act as joint controllers .

3.5. Storage duration

27. The EDPS notes that Article 22 of the Directive as it would be amended by the Proposal provides for a retention period for all records of information received through the exchange of information between Member States pursuant to Articles 8 to 8ad of the Directive of a minimum of five years from the date of receipt by the receiving competent authority .

28. The EDPS recalls that the principle of storage limitation requires that personal data are stored in a form that permits identification of data subjects for no longer than is necessary for the purpose for which the personal data are processed. Therefore, the Proposal should contain a (harmonised) maximum, not only a minimum, data retention period.

29. The EDPS also recommends specifying in Article 22 that the records of information received through the exchange of information must be deleted after the maximum data retention period, or earlier, if they are no longer necessary.

3.6. Implementing acts

30. The EDPS notes that, in accordance with the new Article 8ad(9), the Commission shall, by means of implementing acts, lay down the practical arrangements necessary for the registration and identification of Reporting Crypto-Asset Service Providers.

31. In this regard, the EDPS recalls that, when a proposal for legislation has a possible impact on the protection of personal data, the European Commission has to submit it to the EDPS for consultation.

4. Conclusions

32. In light of the above, the EDPS makes the following recommendations: (1) to indicate that the Proposal ensures full respect for the right of protection of personal data laid down in Article 8 of the Charter and to recall the applicability of GDPR and the EUDPR to the processing of personal data in the context of the Proposal; (2) to clarify that the reuse of personal data by the competent authority of each Member State may only be allowed if it is grounded in Union or Member State law which lays down a list of purposes for which the further processing may be lawfully authorised constituting a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1) GDPR and to provide in the Proposal itself an (exhaustive) list of purposes for which personal data might be further processed; (3) to amend the enacting terms of the Proposal to clarify which specific obligations of the Commission under the Directive warrant access to the information recorded in the central directory; (5) concerning Article 25(3) of the Directive as it would be amended by the Proposal, to clearly indicate in which cases the entities involved in the processing shall be considered as a controller (alone) and when they shall be considered as joint controllers; (6) to provide for a maximum period of storage duration and to specify that the records of information received through the exchange of information must be deleted after the maximum data retention period, or earlier, if they are no longer necessary. Brussels, 3 April 2023 [e-signed] Wojciech Rafał WIEWIÓROWSKI 10