EDPS Opinion the Proposal on the signing and conclusion of the provisional application of the Amending Protocol between the EU and Liechtenstein on the automatic exchange of financial account information to improve international tax compliance

Opinion 19/2025

on the Proposal for a Council Decision on the signing and conclusion of the Amending Protocol to the Agreement between the European Union and the Principality of Liechtenstein on the automatic exchange of financial account information to improve international tax compliance

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Liechtenstein on the automatic exchange of financial account information to improve international tax compliance and to (ii) the Proposal for a COUNCIL DECISION on the conclusion, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Liechtenstein on the automatic exchange of financial account information to improve international tax compliance .

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

Executive Summary

The EDPS is consulted on the Proposals for Council Decisions to sign and conclude, on behalf of the Union, the Amending Protocol to the Agreement between the European Union and the Principality of Liechtenstein on the automatic exchange of financial account information to improve international tax compliance.

The Amending Protocol aims to ensure that the automatic exchange of financial account information between EU Member States and Liechtenstein is aligned with the updated Common Reporting Standard developed by the Organisation for Economic Co-operation and Development. In addition, the Amending Protocol aims to align the text of the Agreement with the new data protection framework (i.e. the GDPR for EU Members States and the Data Protection Act of 4 October 2018 for Liechtenstein). Finally, the Amending Protocol would ensure that the existing agreement between the European Union and Liechtenstein remains aligned with Union legislation in the same field.

As an EEA EFTA country, Liechtenstein is not considered as a third country within the meaning of Chapter V of the GDPR. The EDPS recommends the Commission to further clarify the status of Liechtenstein in a recital to the Proposals.

The EDPS observes that the Agreement would require Member States and Liechtenstein to restrict the scope of the right of access and the right to information. In this respect, the EDPS recalls the conditions for such restrictions provided under Article 23 GDPR.

2

Contents

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 17 July, the European Commission issued: - a Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Liechtenstein on the automatic exchange of financial account information to improve international tax compliance (‘the Conclusion Proposal’) ; - a Proposal for a Council Decision on the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Liechtenstein on the automatic exchange of financial account information to improve international tax compliance (‘the Signing Proposal’) .

2. The objective of the Signing Proposal is to authorise the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Liechtenstein (Liechtenstein) on the automatic exchange of financial account information to improve international tax compliance (‘the Agreement’).

3. The objective of the Conclusion Proposal is to approve the Amending Protocol .

4. The Agreement provides the legal basis for the reciprocal automatic exchange of financial account information between the EU Member States and Andorra, in accordance with the Common Reporting Standard (CRS) developed by the Organisation for Economic Cooperation and Development (OECD).

5. The Amending Protocol aims to (i) ensure that the automatic exchange of financial account information between EU Member States and Liechtenstein is aligned with, and continues to take place in accordance with, the updated CRS from 1 January 2026; and to (ii) align the text of the Agreement with the new data protection framework (i.e. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General data protection regulation, GDPR) for EU Members States; and where necessary the Data Protection Act of 4 October 2018 adopted by Liechtenstein to implement the GDPR where needed) .

6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 17 July 2025, 2025, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in Recital 6 of the Signing Proposal and of the Conclusion Proposal.

2. General Remarks

7. The EDPS welcomes the objectives pursued by the Proposals, notably to improve administrative cooperation in the area of direct taxation, and to improve international tax compliance. The EDPS acknowledges that the negotiated Amending Protocol ensures that the existing agreement between the European Union and Liechtenstein remains aligned with Union legislation in the same field, notably Council Directive 2014/107/EU2 amending Directive 2011/16/EU on administrative cooperation in the field of taxation (DAC 2) as amended by Council Directive (EU) 2023/2226 of 17 October 2023 amending Directive 2011/16/EU on administrative cooperation in the field of taxation (DAC8) . The EDPS has already issued an opinion on DAC8 on 3 April 2023 .

8. The EDPS regrets not having been consulted on the Council Decision authorising the opening of negotiations for the amendment of the Agreement in line with Article 42(1) EUDPR.

9. The EDPS recalls that, as a member of the European Economic Area, Liechtenstein applies the same data protection rules as the ones provided by the GDPR, due to the incorporation of the GDPR in the EEA Agreement, and it is not considered as a third country within the meaning of Chapter V of the GDPR . As a result, Chapter V of the GDPR does not apply to the exchange of personal data regulated by the Proposals and no additional safeguards or binding instrument is needed to ensure the protection of personal data transferred to Liechtenstein. The EDPS recommends to mention in a Recital the status of Liechtenstein of EEA EFTA country, having implemented the EEA acquis.

10. The EDPS observes that Article 6 of the Amending Protocol would require Member States and Liechtenstein to restrict the scope of the right of access (Article 15 GDPR) and the right to information (Articles 13 and 14 GDPR) to the extent required in order to safeguard the interests referred to in Article 23(1)(e) of the GDPR. Article 23(1)(e) GDPR refers to an important objective of general public interest of the Union or of a Member State, which includes taxation. Whereas such a restriction is optional under Article 23 GDPR, the Amending Protocol would make it an obligation for the Member States and Lichtenstein.

11. At the same time, the EDPS also notes that paragraph 2 of Article 6 of the Amending Protocol prohibits to extend such restriction to the information to be given to data subjects by the Reported Financial Institutions.

12. Regarding the restrictions to the rights to access and to the right to information, the EDPS understands that it is for the EU Member States and Liechtenstein to provide for the relevant restrictions. In this context, the EDPS recalls that to be lawful, restrictions shall be provided for in a legislative measure, concern a limited number of rights of data subjects and/or controller’s obligations. They shall respect the essence of the fundamental rights and freedoms at issue, be a necessary and proportionate measure in a democratic society and safeguard an important objective of public interest . Restrictions may only continue for as long as the reason for the restriction exists.

13. The EDPS also recalls that, in line with the EDPB Guidelines 10/2020 on restrictions under Article 23 GDPR , the grounds for the restriction need to be clear, and include a number of elements, such as the categories of personal data restricted, the scope of the restriction, the safeguards to prevent abuse or unlawful access or transfer as well as the risks to data subject’s rights and freedoms entailed by the restrictions. The EDPS encourages Member States and Liechtenstein to use the EDPB Guidelines 10/2020 on restrictions under Article 23 GDPR as a reference when regulating the restrictions to data subjects’ rights.

14. Finally, the EDPS notes that the obligation to inform data subjects in the event of a data breach, as provided by paragraph 5 of Article 6 of the Amending Protocol, applies to any data breach likely to adversely affect data subjects. The EDPS understands that this obligation to notify encompasses cases where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, as it is the case under Article 34 GDPR.

3. Conclusions

15. In light of the above, the EDPS recommends to further clarify the specific status of Liechtenstein as an EEA EFTA country having implemented the EEA acquis in a recital of both the Signing and the Conclusion Proposals. Brussels, 20 August 2025 (e-signed) p.o. Leonardo CERVERA NAVAS