EDPS Opinion the Proposal on the signing and conclusion of the provisional application of the Amending Protocol between the EU and San Marino on the automatic exchange of financial account information to improve international tax compliance

Opinion 20/2025

on the Proposal for a Council Decision on the signing and conclusion of the Amending Protocol to the Agreement between the European Union and the Republic of San Marino on the automatic exchange of financial account information to improve international tax compliance

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Republic of San Marino on the automatic exchange of financial account information to improve international tax compliance ; and to (ii) the Proposal for a Council Decision on the on the conclusion, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Republic of San Marino on the automatic exchange of financial account information to improve international tax compliance .

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

Executive Summary

The EDPS is consulted on the Proposals for Council Decisions to sign and conclude, on behalf of the Union, the Amending Protocol to the Agreement between the European Union and the Republic of San Marino on the automatic exchange of financial account information to improve international tax compliance.

The Amending Protocol aims to ensure that the automatic exchange of financial account information between EU Member States and San Marino is aligned with the updated Common Reporting Standard developed by the Organisation for Economic Co-operation and Development. In addition, the Amending Protocol aims to align the text of the Agreement with the new data protection framework (i.e. the GDPR for EU Members States and and Law No. 171 of 21 December 2018 for San Marino). Finally, the Amending Protocol would ensure that the existing agreement between the European Union and San Marino remains aligned with Union legislation in the same field.

The EDPS welcomes the specific provisions on data protection, i.e. Article 6 and Annex III of the Agreement, which clarify the purposes of the processing, and provide for - inter alia - data accuracy and data minimisation, storage limitation, security and confidentiality of the data, as well as data subjects rights and restrictions on onward transfers and sharing of data. Taking these provisions into account, the EDPS considers that the Agreement, as updated by the Amending Protocol, provides for appropriate safeguards to enable the transfer of personal data.

The EDPS observes that the Agreement would require Member States and San Marino to restrict the scope of the right of access and of the right to information. In this respect, the EDPS recalls the conditions for such restrictions provided under Article 23 GDPR.

2

Contents

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 17 July, the European Commission issued: - a Proposal for a Council Decision on the signing on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Republic of San Marino on the automatic exchange of financial account information to improve international tax compliance (‘the Signing Proposal’) ; - a Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Republic of San Marino on the automatic exchange of financial account information to improve international tax compliance (‘the Conclusion Proposal’) .

2. The objective of the Signing Proposal is to authorise the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Republic of San Marino (San Marino) on the automatic exchange of financial account information to improve international tax compliance (‘the Agreement’).

3. The objective of the Conclusion Proposal is to approve the Amending Protocol .

4. The Agreement provides the legal basis for the reciprocal automatic exchange of financial account information between the EU Member States and San Marino, in accordance with the Common Reporting Standard (CRS) developed by the Organisation for Economic Cooperation and Development (OECD).

5. The Amending Protocol aims to (i) ensure that the automatic exchange of financial account information between EU Member States and San Marino is aligned with, and continues to take place in accordance with, the updated CRS from 1 January 2026; and to (ii) align the text of the Agreement with the new data protection framework (i.e. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General data protection regulation, GDPR) for EU Members States; and Law No. 171 of 21 December 2018 for San Marino) .

6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 17 July 2025, 2025, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in Recital 6 of the Signing Proposal and in Recital 6 of the Conclusion Proposal.

2. General Remarks

7. The EDPS welcomes the objectives pursued by the Proposals, notably to improve administrative cooperation in the area of direct taxation, and to improve international tax compliance. The EDPS acknowledges that the negotiated Amending Protocol ensures that the existing agreement between the European Union and San Marino remains aligned with the Union legislation in the same field, notably Council Directive 2014/107/EU amending Directive 2011/16/EU on administrative cooperation in the field of taxation (DAC 2) as amended by Council Directive (EU) 2023/2226 of 17 October 2023 amending Directive 2011/16/EU on administrative cooperation in the field of taxation (DAC8) . The EDPS has already issued an opinion on DAC8 on 3 April 2023 .

8. The EDPS regrets not having been consulted on the Council Decision authorising the opening of negotiations for the amendment of the Agreement in line with Article 42(1) EUDPR.

9. The EDPS notes that the amendments that would affect the provisions on data protection concern (i) updating references to the legislative data protection framework to align them with the new framework; (ii) replacing the term “information” with “personal data” (where appropriate); (iii) aligning the wording on automated decision-making and handling of sensitive data with the GDPR; and (iv) clarifying that the onward transfers (Article 6(5) of the Amending Protocol) are also subject to the safeguards provided under Annex III of the Agreement. In addition, the principle of data minimisation has been further clarified.

3. International transfers of personal data

10. Any transfer of information containing personal data from the European Union to San Marino under the Agreement constitutes an international transfer of personal data in the meaning of Chapter V of the GDPR. Recital (102) GDPR recalls that international agreements concluded between the Union and third countries may be a ground for transfer of personal data, insofar as they provide appropriate safeguards .

11. The EDPS positively notes that Article 6 and Annex III to the Agreement, as updated by the Amending Protocol, would provide for such safeguards.

12. The Agreement, as updated by the Amending Protocol, clearly sets out the categories of data transferred, the purposes of the processing, as well as the principle of storage limitation . It would also provide a clear indication of the relevant data controllers in the Agreement . In addition, the Agreement provides that the data processed must be adequate, relevant and limited to what is necessary in relation to the purposes set out in the Agreement and prohibits the exchange of sensitive data .

13. The EDPS observes that the provision of data subjects’ right, such as the right to transparency, right of access, rectification, and erasure of data are included . As regards the right of access, the EDPS understands that such right includes the right for data subjects to obtain confirmation as to whether or not personal data concerning them is being processed, and if that is the case, to obtain access to that data.

14. Furthermore, the EDPS positively notes the inclusion of data security and data integrity principles . With regards to the commitment taken by the parties to having in place appropriate technical and organisational measures to protect personal data against accidental or unlawful access, destruction, loss, alteration, or unauthorised disclosure, the EDPS understands that the level of security of such measures will take into consideration the risks, the state of the art and the related costs.

15. The EDPS takes note that paragraph 1, section 2, of Article 6 of the Amending Protocol would require Member States and San Marino to restrict the scope of the right of access and of the right to information (Article 13 and 14 GDPR) to the extent required in order to safeguard the interests referred to in Article 23(1)(e) of the GDPR. Article 23(1)(e) GDPR refers to an important objective of general public interest of the Union or of a Member State, which includes taxation. Whereas such a restriction is optional under Article 23 GDPR, the Amending Protocol would make it an obligation for the Member States and San Marino.

16. At the same time, the EDPS also notes that section 3 of Article 6(1) of the Amending Protocol guarantees certain information to be given to data subjects by the Reported Financial Institutions .

17. Regarding restrictions to the rights to access and to the right to information, the EDPS understands that it is for the EU Member States and San Marino to provide for the relevant restrictions. In this context, the EDPS recalls that to be lawful, restrictions shall be provided for in a legislative measure, concern a limited number of rights of data subjects and/or controller’s obligations. They shall respect the essence of the fundamental rights and freedoms at issue, be a necessary and proportionate measure in a democratic society and safeguard an important objective of public interest. Restrictions may only continue for as long as the reason for the restriction exists.

18. The EDPS recalls that, in line with the EDPB Guidelines 10/2020 on restrictions under Article 23 GDPR , the grounds for the restriction need to be clear, and includes a number of elements, such as the categories of personal data restricted, the scope of the restriction, the safeguards to prevent abuse or unlawful access or transfer as well as the risks to data subject’s rights and freedoms entailed by the restrictions. The EDPS encourages Member States and San Marino to take into account the EDPB Guidelines 10/2020 on restrictions under Article 23 GDPR as a reference when regulating the restrictions to data subjects’ rights.

19. The EDPS notes that the obligation to inform data subjects in the event of a data breach, as provided by paragraph 5 of Article 6 of the Amending Protocol, applies to any data breach likely to adversely affect data subjects. The EDPS understands that this obligation to notify encompasses cases where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, as it is the case under Article 34 GDPR.

20. The EDPS notes that Article 6(4) and (5) and Annex III, paragraph 7, to the Amending Protocol would regulate further processing as well as onward sharing and onward transfers of personal data. It welcomes the safeguards included for the further processing and with specific regard to the possibility of onward sharing, the EDPS welcomes the requirement for prior authorisation by the transferring competent authority, as well as the clarification that onward transfers are also subject to the safeguards provided for under Annex III notably paragraph 7 - which outlines the additional requirements under which onward transfers are allowed.

21. The EDPS welcomes the reference to the oversight of the competent data protection 19 20 supervisory authority and to the right to redress .

22. Finally, the EDPS welcomes the inclusion of provisions recognising that significant noncompliance with data protection rules may constitute grounds for suspending data exchanges, provided that no adequate resolution is reached by the parties . It also notes that, in the event of termination of the agreement, any personal data transferred from the EEA under the Agreement prior to its termination will continue to be processed in accordance with the provisions of the international agreement .

4. Conclusions

23. In light of the above, the EDPS considers that the Agreement, as updated by the Amending Protocol, provides for appropriate safeguards to enable the transfer of personal data. Brussels, 20 August 2025 (e-signed) p.o. Leonardo CERVERA NAVAS 8