EDPS Opinion 20/2026 on the Proposal for a Council Directive on administrative cooperation in the field of taxation (recast)

Opinion 20/2026

on the Proposal for a Council Directive on administrative cooperation in the field of taxation (recast)

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Council Directive on administrative cooperation in the field of taxation (recast) . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 24 June 2026, the European Commission issued Proposal for a Council Directive on administrative cooperation in the field of taxation (recast). The European Data Protection Supervisor supports the Commission's initiative to consolidate and improve the EU's framework for administrative cooperation in taxation (‘DAC recast’). The DAC recast presents an opportunity to strengthen data protection safeguards and provide greater legal certainty for both taxpayers and tax authorities. The usefulness of automatically exchanged tax information depends critically on its accuracy, completeness, correct attribution to taxpayers, and actual use for intended purposes. Better data protection safeguards can improve data quality, reduce unnecessary exchanges, and support effective use of information. Against this background, the EDPS recommends keeping the reference to the ‘foreseeable relevance’ of the exchange of information, as overarching interpretative principle of DAC. This principle contributes to ensuring that the exchange of personal data remains connected to a genuine tax-administration purpose and limited to what is necessary and proportionate. In the same vein, the EDPS recommends introducing further clarifications to ensure that the receiving Member State is identified in accordance with the relevant applicable criteria for the determination of the tax residence, in accordance with Union law and applicable international agreements. The EDPS welcomes the proposed strengthening of the feedback mechanism regarding information exchanged, as it is an important tool to improve data quality. The EDPS considers that the feedback mechanism should address both systemic issues and individual cases, including mismatches, duplicated data, or information not relevant to the framework's purposes. Access to financial and anti-money laundering databases and information, as provided by the Proposal, should remain limited to what is necessary and proportionate for defined DAC purposes, with appropriate safeguards, to be specified in the enacting terms of the Proposal. Similarly, access to pension-payment registers and databases should not result in unrestricted or general access and that access by tax authorities to types of personal data not needed for tax purposes is not allowed. The EDPS further recommends clarifying that the use of information exchanged under DAC for statistical purposes should, as a rule, rely on anonymised or effectively aggregated data. The Proposal represents an occasion to provide harmonization and clarifications on restrictions of data subjects’ rights. Instead of mandating the adoption of such restrictions to Member States in general terms, the EDPS recommends specifying those restrictions in the Proposal itself. To ensure storage limitation, the EDPS recommends specifying that the five-year retention period applies only insofar as continued retention remains necessary and proportionate for the purposes of the Directive, and to require periodic review of the continued necessity of data retention and the erasure or anonymisation of personal data where retention is no longer necessary.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 24 June 2026, the European Commission issued Proposal for a Council Directive on administrative cooperation in the field of taxation (recast) (‘the Proposal’).

2. The objective of the Proposal is to consolidate and codify Directive 2011/16/EU and its subsequent amendments into a single legal act, with a view to simplifying, clarifying and improving the functioning of the Union framework for administrative cooperation in direct taxation, without lowering the existing level of protection against tax fraud, evasion and avoidance .

3. The Proposal follows up on the Council conclusions of 11 March 2025 on a tax decluttering and simplification agenda, in which the Council invited the Commission to review the existing EU tax framework and, in particular, to explore ways of simplifying the rules laid down in the Directive on Administrative Cooperation (‘DAC’), reducing the associated administrative burden and eliminating overlaps and inconsistencies .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 24 June 2026, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 111 of the Proposal. In this regard, the EDPS also 4 positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

5. The EDPS welcomes the Commission’s objective of consolidating, simplifying and improving the DAC. The DAC lays down rules and procedures for administrative cooperation among competent authorities of the Member States of the Union in the field of taxation and it is a key legal instrument for the enforcement of Member States’ laws concerning the taxes falling under the scope of the DAC.

6. The EDPS notes that the majority of the provisions of the DAC (as legislative text currently applicable, including all amendments as introduced by amending legislation since 2011) remain unchanged in substance . The main targeted amendments introduced by the Proposal more directly having an impact on data protection are: (ii) the update of the notion of legal professional privilege in Article 8 of the Proposal; (iii) changes related to feedback on information exchanged ; (iii) amendments related to the Taxpayer Identification Number (TIN) verification tool ; (iv) amendments related to access by tax authorities to information to be hold and registers established under Anti-Money Laundering (AML) legislation: the interconnected central beneficial ownership register; the bank account registers; to information on real-estate property, referred to, respectively, under Article 10, 16(1) and 18 of Directive (EU) 2024/1640 ; as well as to mechanisms, procedures, documents and information referred to in Chapter III (customer due diligence) and Article 77 (record retention) of Regulation (EU) 2024/1624; (v) the introduction of provisions on access to national registers and databases on pension payments ; 5 (vi) amendments related to the use of information communicated between Member States for statistical purposes .

7. The EDPS highlights that the usefulness of information processed depends on whether the information is accurate , complete , matched with the correct taxpayer and used . The EDPS therefore welcomes measures intended to improve the effective use of exchanged information, the matching of the information to the taxpayer concerned (via the proposed TIN verification tool) and the strengthening of feedback mechanisms between competent tax authorities. These amendments should aim at ensuring at the same time the effectiveness of the information exchange and compliance with EU data protection laws and principles.

8. The DAC recast also offers the occasion to further specify data protection safeguards. This can improve data quality, reduce unnecessary administrative exchanges, facilitate matching, support the effective use of information received and enhance citizens’ trust and mutual trust of tax administrations exchanging information for administrative cooperation. The following recommendations are limited to those provisions of the Proposal that are relevant from a data protection perspective.

3. Foreseeable relevance

9. The EDPS welcomes that the Proposal takes into account the data protection principles of necessity and proportionality. The Explanatory memorandum indicates that “the set of data elements to be transmitted to tax administrations are defined in a way to capture only the 6 minimum data necessary to detect non-compliant underreporting or non-reporting, in line with the GDPR obligations, in particular the data minimisation principle” . Recital 112 of the Proposal further recalls that Member States should ensure a high level of protection of fundamental rights in national procedures giving effect to the DAC and any limitations of those rights (notably, the rights enshrined in Article 7 and 8 and 47 of the Charter) must comply with the principle of proportionality in accordance with Article 52(1) of the Charter.

10. However, the EDPS notes the deletion of the words “that is foreseeably relevant to” after the words “exchanging information” in Article 1(1) of DAC. The EDPS also notes that the reference to foreseeable relevance is kept in recitals 63-65 and Article 18 and 50 of DAC and added to Article 17 of the Proposal, on exchange of information on request.

11. The EDPS considers that the criterion of ‘foreseeable relevance’, as overarching interpretative rule for the implementation of administrative cooperation, contributes to ensuring that the exchange of personal data remains connected to a genuine taxadministration purpose and limited to what is necessary and proportionate. Therefore, the EDPS recommends retaining the criterion of foreseeable relevance in Article 1(1) of the Proposal.

4. Tax residence

12. The DAC framework, and specifically Article 3, does not establish a Union-wide definition of tax residence, which can create divergences in how Member States exchange tax information. One should avoid situations where tax data is sent based solely on factual indicators, such as the address of the taxpayer, without applying the legal rules governing tax residence. Otherwise, personal data is likely to be shared with Member States that have no tax interest in receiving it, leading to unnecessary exchange of information. Conversely, personal data could be withheld from Member States that should legally be regarded as the taxpayer's Member State of residence.

13. The DAC has traditionally relied on competent tax authorities to correctly identify the receiving Member State, based on information collected directly by tax authorities or received by tax authorities from other entities. Where another Member State's competent authority has previously made a determination concerning the taxpayer's tax residence, that determination should also be taken into account as a relevant element when determining the Member State(s) to which the information should be exchanged. This would help promote legal certainty and avoid inconsistent exchange outcomes resulting from assessments based solely on factual indicators, thereby supporting a consistent implementation of the DAC.

14. The EDPS recommends that the Proposal introduce clarifications to ensure that the receiving Member State is identified on the basis of a legal assessment applying the relevant 7 criteria for the determination of tax residence, in accordance with Union law and applicable international agreements.

5. Legal professional privilege

15. The EDPS notes that the Proposal amends provisions of DAC concerning legal professional privilege to take account of the case-law of the Court of Justice of the European Union 18 19 (‘CJEU’) . In particular, in Orde van Vlaamse Balies and Others , the CJEU held that the protection afforded by Article 7 of the Charter to communications between lawyers and their clients covers both the content of legal advice and the existence of the lawyer-client relationship and, consequently, precludes an obligation on a lawyer exempted from reporting on grounds of legal professional privilege to notify another intermediary who is not his or her client of their reporting obligations. The CJEU subsequently clarified, in Belgian Association of Tax Lawyers and Others , that this specific protection only applies to persons pursuing their professional activities under one of the professional titles referred to in Article 1(2)(a) of Directive 98/5/EC .

16. The Proposal adds in Article 8(4), first sentence, after “intermediaries” the wording “which are lawyers and other professional that are legally authorised to ensure legal representation” as specifications of entities entitled to the right to a waiver from filing information on a reportable cross-border arrangement. The Proposal also adds - in the second sentence of Article 8(4) – “on the basis of them pursuing their professional activities under one of the professional titles referred to in Article 1(2), point (a) of Directive 98/5/EC.”

17. The Proposal also adds a new sentence – as third sentence of Article 8(4) – specifying that each Member State must take the necessary measures to require other intermediaries 8 which are legally authorised to ensure legal representation, but do not pursue their professional activities under one of the professional titles referred to in Article 1(2), point (a), of Directive 98/5/EC, to notify, without delay, any other intermediary or, if there is no such intermediary, the relevant taxpayer of their reporting obligations under paragraph 6.

18. The EDPS understands that the proposed amendments, which aim at codifying the caselaw of the CJEU by exempting lawyers and other professionals falling under Article 1(2), point (a) of Directive 98/5/EC from the obligation to file information in breach of their legal privilege or to notify other intermediaries who are not their clients, while maintaining the obligation to inform the taxpayer of their reporting obligations.

6. Feedback on information exchanged

19. The EDPS welcomes the proposed strengthening of the feedback mechanism in Article 28, to be provided by the competent tax authority “at least” once a year and “with the technical support of the Commission as provided for in Article 43 and 44”.

20. Feedback from receiving competent authorities is an important tool to improve data quality, as well as relevant and effective use of information exchanged under DAC, allowing tax administrations participating in the information exchange to identify information that is incorrect, duplicated, not matchable or not relevant.

21. The EDPS recommends specifying in a recital of the Proposal that feedback should cover both systemic issues and, where appropriate, individual cases, including cases where information received could not be matched with a taxpayer, does not concern a resident taxpayer of the receiving Member State, is duplicated, or otherwise appears not to be necessary for the purposes of DAC.

22. The EDPS further recommends that the Proposal specify the follow-up actions to be taken based on feedback received. Where a competent authority receives substantiated feedback indicating that information concerning a particular taxpayer is inaccurate, duplicated or not relevant, this authority should take appropriate steps to verify the information, correct it, or prevent repeated exchange of inaccurate or non-relevant information. The EDPS recommends adding to Article 28 of the Proposal an obligation requiring tax authorities to communicate to the tax authority of another Member State such inaccuracies or duplication, as well as the actions taken as follow up to the feedback received.

23. The EDPS notes that the Commission is empowered under Article 43 and 44 to adopt implementing acts to establish, respectively, standard forms and linguistic arrangements for the automatic exchange of information, and practical arrangements for communication of information (also covering the communication of feedback). The EDPS recalls that, pursuant to Article 42(1) EUDPR, the Commission is required to consult the EDPS on these implementing acts. 9

7. TIN verification tool

24. The EDPS notes that Article 36(1), as amended by the Proposal, introduces the Taxpayer Identification Number (TIN) verification tool, which would not be limited to verifying the syntactical correctness of a TIN but would be capable of verifying the validity of the TIN and its correspondence to the taxpayer .

25. The EDPS welcomes the objective of improving data quality and reducing mismatches or non-matches by tax authorities pursued by the TIN verification tool.

26. Article 36(2) of the Proposal specifies that confirmation of the validity of the TIN “may be requested only for the purposes of validation of the correctness of data”. The EDPS also welcomes this safeguard.

27. The EDPS also notes that, as specified in Article 36(1), second sentence, the technical parameters of the tool would be set out by the Commission in implementing acts. The EDPS expects to be consulted on these implementing acts pursuant to Article 42(1) EUDPR. As regards the design of the TIN verification tool, the EDPS highlights that data protection by design and by default should be a guiding principle and that data minimisation should be ensured both regarding the information submitted in a query and the information returned by the TIN verification tool. The EDPS expects these aspects to be addressed in the forthcoming implementing acts.

28. Article 36(3) of the Proposal provides that a reduced set of identification data (only the name and the verified TIN of the taxpayer concerned) may be transmitted by a reporting entity to the tax authority where the confirmation of the validity of the TIN is obtained by means of the TIN verification tool ; or the taxpayer was identified through one of the through a government verification service or equivalent EU services or the EUID attributed in accordance with Directive 2017/1132. The EDPS welcomes this provision which implements the data minimisation principle.

29. The EDPS understands that the justification for the reduced set of identification data to be transmitted to the tax authority by the reporting entity is that, where the TIN has been reliably verified, the tax authority would not need to carry out additional matching for the purpose of identifying the taxpayer . In this regard, the EDPS recommends clarifying that the second derogation provided for in Article 36(3)(b) requires both the reliable identification of the taxpayer using the government verification services, equivalent EU services, or the EUID, and the verification that the TIN reported corresponds to that same taxpayer . 10

8. Access by tax authorities to registers and procedures established and information to be held under AML legislation

30. The EDPS notes that the Proposal introduces a new Article 38, providing for access by tax authorities for administrative cooperation purposes to: the interconnected central beneficial ownership register; the bank account registers; information on real-estate property, referred to, respectively, under Article 10, 16(1) and 18 of Directive (EU) 2024/1640; as well as to mechanisms, procedures, documents and information referred to in Chapter III (customer due diligence) and Article 77 (record retention) of Regulation (EU) 2024/1624 .

31. Article 38(1) provides tax authorities with immediate and direct access free of charge to information allowing the timely identification of beneficial owners of legal entities and of legal arrangements via interconnected central beneficial ownership registers referred to in Article 10 of Directive (EU) 2024/1640.

32. Article 38(2) provides tax authorities with the power to access and search, directly and immediately, bank account information available through the bank account registers referred to in Article 16(1) of Directive (EU) 2024/1640.

33. Article 38(3) provides for immediate and direct access free of charge to real-estate information via the Single Access Point (SAP) to be established in each Member State under Directive (EU) 2024/1640.

34. Article 38(4) provides for immediate and direct access to information referred to in Chapter III (customer due diligence) and Article 77 (record retention) of Regulation (EU) 2024/1624.

35. The EDPS notes that the access modalities, the scope of the information to be accessed, and a number of technical safeguards are specified by Directive (EU) 2024/1640 with regard to procedures for access to such registers for AML/CFT purposes. In particular, Directive (EU) 2024/1640 establishes the interconnected central beneficial ownership registers, as well as the obligation for Member States to establish the Single Access Point (SAP) for realestate information, laying down provisions on data fields, interconnection, accuracy, authentication and technical specifications.

36. With regard to the possibilities to access information, including personal data, provided under Article 38(1)(2) and (3) of the Proposal, as well as to access provided under Article 38(4), the EDPS notes that the Proposal does not lay down the specific tax-related purposes for which the information obtained may be used, or the conditions under which tax authorities should exercise access to these registers. The EDPS therefore recommends that the Proposal should explicitly specify for which DAC obligations or forms of administrative 11 cooperation under DAC (including if automated, upon request, spontaneous) such access is allowed; what type of personal data would be needed according to the specific purpose of the administrative cooperation; and lay down rules governing access to these registers .

37. With regard to access by tax authorities to the mechanisms, procedures, documents and information referred to in Chapter III (customer due diligence) and Article 77 (record retention) of Regulation (EU) 2024/1624, the EDPS considers that such access – provided under Article 38(4) of the Proposal as “immediate and direct and in a digital format” – should also be better specified in the Proposal, making reference to the specific tax-related purposes and the conditions under which tax authorities may have such access, in line with set out above in this Section .

9. Access to national registers and databases on pension payments

38. Article 39 of the Proposal provides that Member States must ensure that tax authorities have direct and expeditious access to the information necessary for the relevant purposes which is held in existing national registers and databases concerning payments of pensions, in accordance with the conditions laid down by national law .

39. Unlike Article 38 of the Proposal, this access right is not merely an integration into the DAC of access to the registers and procedures established under anti-money laundering legislation. It creates an EU-law obligation to give tax authorities access to national pension-payment registers and databases held by other public authorities.

40. The EDPS acknowledges that timely access to pension-payment information may be necessary to ensure the effective automatic exchange of pension-income information under the Directive. Pensions are a category of income for which Member States must communicate information by automatic exchange, and the relevant data may be held by public authorities other than tax authorities, particularly in Member States where the payment or administration of pensions is not organised through the tax administration.

41. However, the EDPS recommends clarifying that “direct and expeditious access” should not be understood as unrestricted or general access to pension databases. Where direct access is provided, it should be limited to secure, query-based access by authorised officials for a 12 specific purpose under the Directive, dependent on granting access by the pension authority in each case, and subject to access controls, logging, audit and supervision.

42. The EDPS further recommends specifying in Article 39 of the Proposal the categories of personal data that may be accessed when accessing national registers and databases on pension payments. Access should be limited to: data strictly necessary for the administrative cooperation exchange on tax matters (e.g., access should not concern nontax-relevant information, such as medical data, disability assessments, social-assistance records, or family circumstances); verification and follow-up of pension-income information under DAC, such as the identity of the pension recipient, the paying authority, the amount and period of the pension payment and other tax-relevant information strictly required for the purposes of the DAC.

43. Moreover, the EDPS considers that the reference to “conditions laid down by national law”, in Article 39 of the Proposal, should be better specified. Since Article 39 of the Proposal would create an EU-law obligation to provide access to personal data, the EDPS considers that the Directive should itself lay down minimum safeguards to operationalise the principles of purpose limitation, data minimisation, and data protection by design, including restrictions to authorized users, logging that requires specification of the purposes of the access, and retention limits for data accessed by the tax administration.

10. Use of information for statistical purposes

44. Article 30(1) of the Proposal allows the use of information communicated between Member States pursuant to the Directive for the assessment, administration and enforcement of the national law of Member States concerning the taxes referred to in Article 2, as well as VAT, other indirect taxes, customs duties and anti-money laundering and countering the financing of terrorism. It also allows use for other taxes and duties covered by Directive 2010/24/EU, compulsory social security contributions, certain judicial and administrative proceedings, and, as newly proposed, statistical purposes, namely, to allow a regular evaluation by the Commission of the effectiveness of administrative cooperation under the DAC .

45. Under the GDPR and the EUDPR, further processing of personal data for statistical purposes is not considered to be incompatible with the original processing purposes, provided the conditions in Article 89(1) of the GDPR and Article 13 of the EUDPR are satisfied. In particular, these provisions stipulate that when personal data are (further) processed for statistical purposes, those data shall in principle be rendered anonymous (or 13 alternatively pseudonymous), provided that the statistical purpose is fulfilled in this manner .

46. Against this background, the EDPS recommends specifying in recital 107 of the Proposal that the data provided under Article 30 of the Proposal should be aggregated to such a degree that individuals cannot be identified. For the sake of legal certainty, the EDPS recommends making specific reference to compliance with the safeguards relating to processing of personal data for statistical purposes under Article 89 of the GDPR and Article 13 of the EUDPR, in particular that the data should in principle be rendered anonymous.

11. Restriction of data subjects’ rights

47. Substantially unaltered by the Proposal, Article 40(1) and (2) require Member States to restrict data subjects’ rights pursuant to Article 23(1)(e) GDPR and Article 25(1)(c) and (g) EUDPR, without defining the extent to which such restrictions are necessary to safeguard the interests pursued.

48. The EDPS considers that Article 40(1) and (2) should not provide for a blanket rule requiring Member States and the Commission to restrict data subjects’ rights. Any restriction of the rights provided for in Articles 13, 14(1) and 15 GDPR or in Article 15, 16(1) and 17-21 EUDPR should remain exceptional, be provided for by law, respect the essence of the rights concerned and be necessary and proportionate in a specific case or in clearly defined categories of cases, and lifted when the reasons justifying such restriction no longer apply .

49. Moreover, the EDPS does not see a reason why the derogation to Article 14 GDPR and 16 EUDPR would be limited to their first paragraph, while such limitation would apply to the entire Articles 13 GDPR and 15 EUDPR. Therefore, the EDPS recommends replacing the reference to Article 14(1) GDPR with Article 14 GDPR and the reference to Article 16(1) EUDPR with Article 16 EUDPR.

50. Furthermore, the EDPS recalls that according to Article 23 GDPR and 25 EUDPR, any legal act or internal rule referred to in paragraph 1 of these provisions must contain specific provisions, where relevant, as to: the purposes of the processing or categories of processing; the categories of personal data; the scope of the restrictions introduced; the safeguards to prevent abuse or unlawful access or transfer; the specification of the controller or categories 14 of controllers; the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing; and the risks to the rights and freedoms of data subjects.

51. In the same vein, the lack of a common provision in the Proposal restricting data subjects’ rights could lead to divergent restrictions across the various Member States and result in inconsistencies within the Union regarding the restriction of data subjects’ rights, depending on the Member State in which they are subject to tax obligations. Such divergent national approaches weaken the argument that broad restrictions are necessary in all cases. The EDPS therefore recommends specifying the derogation to the rights mentioned in Article 40 directly in the Proposal itself. Alternatively, the EDPS recommends deleting the obligation for Member States to introduce restrictions to data subject rights (as the possibility of introducing such restrictions in any event exists under the GDPR).

52. Additionally, the EDPS notes that the Proposal introduces a new recital , specifying that “[..] while the effectiveness of administrative cooperation requires that certain investigative steps may, where justified, be taken without prior notification to the taxpayer concerned, Member States should ensure, in accordance with their obligations, inter alia, under the European Convention on Human Rights, that persons whose rights are affected by investigative or disclosure measures connected with the implementation of this Directive have access, under national law, to effective review by a court or by an independent and impartial body competent to examine, within a reasonable time, the legality of the measure, including compliance with the applicable conditions relating to its justification, scope and any relevant privileges or protections” .

53. However, the EDPS considers that, where fulfilment of the obligation and rights provided for in Articles 13, 14(1) and 15 GDPR would not prejudice tax investigations or enforcement actions by tax authorities in the meaning of Article 23(1)(e) GDPR and Article 25(1)(c) and(g) EUDPR, data subjects should obtain information mentioned in Articles 13 and 14 GDPR and Articles 15 and 16 EUDPR, for instance about the categories of data exchanged, the Member States involved, the tax period concerned, the legal basis for the exchange of their personal data, access to their personal data and request correction or deletion, in accordance with the relevant provisions of the GDPR. The EDPS recommends amending recital 113 accordingly. 15

12. Retention of automatically exchanged information

54. Article 40(5) provides that information processed in accordance with the Directive must be retained for no longer than is necessary to achieve the purposes of the Directive, and in any case in accordance with each data controller’s domestic rules on statutes of limitation. The EDPS welcomes this clarification of the maximum retention period. This provision reflects the storage limitation principle set out in Article 5(1)(e) GDPR, according to which personal data must be kept in a form permitting identification of data subjects for no longer than is necessary for the purposes for which they are processed.

55. However, Article 40(6) provides that Member States shall retain records of information received through automatic exchange pursuant to Articles 4 to 9, 12, 15 and 16 “for no longer than necessary but in any event not less than five years from its date of receipt” to achieve the purposes of the Directive.

56. The EDPS understands that tax authorities may require sufficient time to assess the relevance of information received through automatic exchange and to take appropriate action within applicable limitation periods. However, the wording of Article 40(6) does not clearly ensure that personal data will be deleted where retention is no longer necessary in a specific case. Article 40(6) seems therefore to derogate to Article 40(5) by introducing a mandatory minimum retention period of five years. A mandatory minimum retention period should not operate as an obligation to retain personal data where such retention would no longer be necessary and proportionate under the GDPR.

57. The EDPS therefore recommends clarifying that the five-year period applies only insofar as continued retention remains necessary and proportionate for the purposes of the Directive and compatible with applicable data protection law. The EDPS also recommends that the Proposal specifies that periodic review of the continued necessity of data retention and the erasure or anonymisation of personal data where retention is no longer necessary must be ensured.

13. Conclusions

58. In light of the above, the EDPS makes the following recommendations: (2) to ensure, in the enacting terms or in a recital, that the receiving Member State is identified in accordance with the relevant applicable criteria for the determination of the tax residence, in accordance with Union law and applicable international agreements; (3) to specify in a recital that feedback under Article 28 should cover both systemic issues and, where appropriate, individual cases, including cases where information received could not be matched with a taxpayer, does not concern a resident taxpayer of the receiving Member State, is duplicated or otherwise appears not to be necessary for the purposes of the Directive; and to 16 add to Article 28 of the Proposal an obligation requiring tax authorities to communicate to the tax authority of another Member State such inaccuracies or duplication, as well as the actions taken as follow up to the feedback received; (4) to ensure that the reported Tax Identification Numbers reported corresponds to that of the taxpayer in case where the taxpayer was identified through government verification services of Member States or equivalent EU services or the EUID attributed in accordance with Directive 2017/1132; (5) to ensure that access to registers and information provided under EU AML legislation under Article 38 of the Proposal is accompanied - in the enacting terms of the Proposal - by specifications on purpose limitation, and conditions under which tax authorities should exercise access to these registers and information; (6) to clarify that “direct and expeditious access” under Article 39 should not be understood as unrestricted or general access to pension databases and, where direct access is provided, to limit it to secure, query-based access by authorised officials for a specific purpose under the Directive, dependent on granting access by the pension authority in each case, and subject to access controls, logging, audit and supervision; (7) to specify in Article 39 the categories of pension-payment data that may be accessed under Article 39 and to limit access to data strictly necessary for the exchange, verification and followup of pension-income information under the Directive; as well as to clarify the reference to “conditions laid down by national law” in Article 39 of the Proposal; (8) having regard to data to be used for statistical purposes under Article 30 of the Proposal, to specify in recital 107 of the Proposal that data should be aggregated to such a degree that individuals cannot be identified; (9) to further specify the restrictions to data subject’s rights in Article 40 of the Proposal; (10) to recall in recital 113 that, where fulfilment of the obligation and rights provided for in Articles 13, 14(1) and 15 GDPR would not prejudice tax investigations or enforcement actions by tax authorities, data subjects should obtain information mentioned in Articles 13 and 14 GDPR and Articles 15 and 16 EUDPR; (11) to specify that the five-year retention period in Article 40(6) applies only insofar as continued retention remains necessary and proportionate for the purposes of the Directive, and to require periodic review of the continued necessity of data retention and the erasure or anonymisation of personal data where retention is no longer necessary. Brussels, 17 August 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 17 18