Recommendation for a Council Decision authorizing the Commission to open negotiations regarding the Agreement between EU & Norway on administrative cooperation, fight against fraud & recovery of claims in the area of VAT

20 June 2022

Opinion 12/2022

on the Recommendation for a Council Decision to authorise the Commission to open negotiations for the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, fight against fraud and recovery of claims in the area of value added tax

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the EDPS' mission to advise the EU institutions on coherently and consistently applying the EU data protection principles, including when negotiating agreements with third countries. It builds on the general obligation that international agreements must comply with the provisions of TFEU and the respect for fundamental rights that stands at the core of EU law. In particular, compliance with Articles 7 and 8 of the Charter of Fundamental Rights of the EU and Article 16 TFEU must be ensured.

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Recommendation that are relevant from a data protection perspective.

1

Executive Summary

On 26 April 2022, the European Commission issued a Proposal for a Recommendation for a Council Decision to authorise the Commission to open negotiations for the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, fight against fraud and recovery of claims in the area of value added tax (‘the Proposal’).

The objective of the Proposal is to amend the Agreement currently in place between the European Union and the Kingdom of Norway on administrative cooperation (‘the Agreement’). The Agreement allows the EU Member States and Norway to cooperate to fight against VAT fraud and assist each other to recover claims in the field of VAT in a similar way as EU Member States do under Council Regulation (EU) No 904/2010 and Council Directive 2010/24/EU. The amendment of the Agreement would allow administrative cooperation with Norway with new cooperation tools, similar to the ones introduced in Council Regulation (EU) 904/2010 with Council Regulation (EU) 2018/1541.

The Annex to the Proposal contains the negotiating directives for the amendment of the Agreement, which would cover administrative cooperation via the exchange of information by using other means than standard forms; administrative enquiries carried out jointly and Eurofisc follow-up actions, introduced by Council Regulation (EU) 2018/1541. The negotiating directives also indicate the need to replace the reference to the repealed Directive 95/46/EC by Regulation (EU) 2016/679 (‘the GDPR’).

The EDPS takes note of the data protection safeguards concerning the principle of purpose limitation and of storage limitation laid down in Article 55(5) of Council Regulation (EU) No 904/2010 as amended by Council Regulation (EU) 2018/1541, according to which cooperation between Norway and the EU Member States shall take place. However, the EDPS recommends including in the negotiating directives an explicit reference to these safeguards.

The EDPS takes note of the safeguards concerning the protection of personal data already contained in the Agreement. However, the EDPS recommends further substantial alignment of Article 6(7) of the Agreement with the provisions contained in Chapter V of the GDPR.

The EDPS also recommends inserting a reference to this consultation of the EDPS in a Recital of the Proposal.

2

Contents

3. Need for further alignment with Chapter V of the GDPR .. 6

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 26 April 2022, the European Commission issued a Proposal for a Recommendation for a Council Decision to authorise the Commission to open negotiations for the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, fight against fraud and recovery of claims in the area of value added tax (‘the Proposal’).

2. The objective of the Proposal is to amend the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, fight against fraud and recovery of claims in the area of value added tax (‘the Agreement’) by including new tools that would allow for better cooperation and enhance the fight against fraud, thus bringing advantages to both parties to the Agreement (Norway and Member States) .

3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 28 April 2022, pursuant to Article 42(1) of EUDPR.

2. General remarks

4. The Proposal aims at amending the Agreement by including new tools that would enhance administrative cooperation between the competent authorities of Norway and the Member States in the area of the fight against tax fraud concerning value added tax (‘VAT’).

5. The Agreement entered into force in September 2018 and allows the EU Member States and Norway to cooperate according to the rules established under Council Regulation (EU) No

6. The Annex to the Proposal contains the negotiating directives for the amendment of the Agreement. According to the Annex, the negotiations should cover the following administrative cooperation tools, introduced by Council Regulation (EU) 2018/1541 amending Council Regulation (EU) No 904/2010 : - the exchange of information by using other means than standard forms; - administrative enquiries carried out jointly by competent authorities of Norway and of the Member States; - Eurofisc follow-up actions.

7. The negotiating directives indicate the need to replace the reference to the repealed 8 9 Directive 95/46/EC by Regulation (EU) 2016/679 (‘the GDPR’) .

8. The EDPS takes note that, according to the Commission, the administrative cooperation, including the exchange of information between competent authorities, pursuant to the Agreement has already shown a very positive outcome .

9. The EDPS also takes note that the Joint Committee established under Article 41 of the Agreement has recommended the opening of negotiations to supplement and amend the Agreement as specified in the Proposal.

10. The EDPS notes that the Agreement, pursuant to which the administrative cooperation and exchange of information is currently taking place, contains a specific article on the protection of personal data , laying down in particular that any information obtained by a State under the Agreement is subject to protection of personal data in accordance with Directive 95/46/EC.

11. The EDPS notes that the provisions of Article 6 of the Agreement lay down among others the purpose of the exchange of information; which authority can access the information exchanged; safeguards on onward transfers, as well as safeguards concerning transfers to third countries. The EDPS also notes that both the competent authorities and the communication channel for the administrative cooperation are specified in Article 3 of the Agreement. Furthermore, the Joint Committee, established under Article 41 of the Agreement, is in charge of determining among others the frequency of practical arrangements for, and the exact categories of information subject to, automatic exchange.

12. Furthermore, the EDPS notes and welcomes that the negotiation directives include an explicit reference that the negotiations should not lead to the possibility for Norway to “access the databases of the Member States”.

13. The EDPS also notes that Council Regulation (EU) 2018/1541 amending Council Regulation (EU) No 904/2010, according to which cooperation between Norway and the EU Member States shall take place, amends Article 55(5) of Council Regulation (EU) No 904/2010 laying down data protection safeguards concerning the principle of purpose limitation (Article 5(1)(b) GDPR) and of storage limitation (Article 5(1)(e) GDPR). However, the EDPS recommends that these safeguards are explicitly referred to in the negotiation directives.

3. Need for further alignment with Chapter V of the GDPR

14. The EDPS welcomes the inclusion in the negotiating directives of the update concerning the applicable data protection law (namely, the GDPR, repealing Directive 95/46/EC).

15. The EDPS also notes that Article 6(7) of the Agreement details the conditions applicable to the transfer of information obtained in accordance with the Agreement to third countries. However, these conditions do not exactly reflect the possibilities and limitations provided for by the provisions in Chapter V of the GDPR. In particular, Article 6(7)(c) of the Agreement refers to “assistance arrangements” between the State transmitting the information and the third country, instead of referring to legally binding and enforceable instruments between public authorities and bodies and to administrative arrangements between public authorities or bodies pursuant to Article 46(2)(a) and Article 46(3)(b) GDPR and to the possible derogations pursuant to Article 49 GDPR.

16. Therefore, the EDPS recommends including in the negotiating directives a reference to the need to align the provisions in Article 6(7) of the Agreement to the relevant provisions contained in Chapter V of the GDPR.

4. Reference to this consultation

17. The EDPS notes the absence of a reference to this consultation in a Recital of the Proposal. Hence, the EDPS recommends inserting a reference to the EDPS consultation in a Recital of the Proposal. 6

5. Conclusions

18. In light of the above, the EDPS makes the following recommendations: (1) including in the negotiating directives an explicit reference to the data protection safeguards concerning the principle of purpose limitation and of storage limitation laid down in Article 55(5) of Council Regulation (EU) No 904/2010 as amended by Council Regulation (EU) 2018/1541; (2) including in the negotiating directives a reference to the need to align the provisions in Article 6(7) of the Agreement to the relevant provisions contained in Chapter V of the GDPR; (3) inserting a reference to the EDPS consultation in a Recital of the Proposal. Brussels, 20 June 2022 [e-signed] Wojciech Rafał Wiewiórowski 7