Combatting VAT Fraud

Opinion1/2019

on two legislative proposals relating to combating VAT fraud

14 March 2019 1 | P a g e

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation (EU) 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under Article 57(1)(g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

He was appointed in December 2014 together with the Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

This Opinion is issued by the EDPS, within the period of eight weeks from the receipt of the

regard to impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data of the following proposals for legislative acts adopted by the Commission on 12 December 2018: Proposal for a Council Directive amending Directive 2006/112/EC as regards introducing certain requirements for payment service providers, COM(2018)812 final; Proposal for a Council Regulation amending Regulation (EU) No 904/2010 as regards measures to strengthen administrative cooperation in order to combat VAT fraud, COM(2018) 813 final.

2 | P a g e

Executive Summary

With this Opinion, issued pursuant to Article 42(1) of Regulation (EU) 2018/1725, the EDPS puts forward recommendations aiming at minimizing the impact of two Commission’s proposals on the fight against VAT fraud in the context of “e-commerce” on the fundamental right to privacy and to the protection of personal data, thus ensuring compliance with the applicable data protection legal framework.

In doing so, the EDPS stresses the need to strictly limit the processing operations envisaged by the proposals to the purpose of fighting tax fraud, and to limit the collection and use of personal data to what is necessary and proportionate for this purpose. In particular, we point out to that, in the context of these proposals, the data undergoing processing should not relate to the consumers (the payers) but only to the online businesses (payees). This would limit the risk of the information being used for other purposes, such as controlling purchase habits of the consumers. We appreciate the fact that the Commission followed this approach and we strongly recommend that this approach is maintained in the negotiations with the co-legislators leading to the final approval of the proposals.

Moreover, the EDPS wishes to stress that, pursuant to Article 42(1) of Regulation (EU) 2018/1725, it expects to be consulted on the implementing act that will in the future define the standard format for the transmission of information from the payment service providers to the national tax administration, before its adoption by the Commission.

Since the proposals would set up, in addition to the national databases, a central electronic database (CESOP) to be developed, maintained, hosted and managed by the Commission, the EDPS recalls his guidance on IT governance and management. The EDPS will follow up on the setting up of this information system as competent Supervisory Authority under Regulation (EU) 2018/1725.

Finally, this Opinion provides guidance on the conditions and limits for lawful and appropriate restrictions of data subject’s rights in compliance with the GDPR and Regulation (EU) 2018/1725.

3 | P a g e

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) , Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION AND BACKGROUND

1.1 Context of the Proposals

1. On 10 September 2018, the EDPS has been informally consulted by the European Commission on the following draft proposals: Draft Proposal for a Council Directive amending Directive 2006/112/EC as regards the introduction of certain requirements on payment service providers; Draft Proposal for a Council implementing Regulation amending Regulation (EU) No 282/2011 as regards certain value added tax obligations for certain taxable persons; Draft Proposal for a Council Regulation amending Regulation (EU) No 904/2010 as regards measures to strengthen administrative cooperation in order to combat VAT fraud in the field of “e-commerce”. The EDPS issued informal comments on 18 September 2018. In this regard, the EDPS confirms that he welcomes the possibility to exchange views with the Commission early in the policy-making process with a view to minimising the impacts of the proposals on the rights to privacy and to data protection .

2. On 12 December 2018, the European Commission published a Proposal for a Council Directive amending Directive 2006/112/EC as regards introducing certain requirements for payment service providers (hereinafter, “the proposed Council Directive”) and a Proposal for a Council Regulation amending Regulation (EU) No 904/2010 as regards measures to strengthen administrative cooperation in order to combat VAT fraud (hereinafter, “the proposed Council Regulation”) , hereinafter, collectively referred to as the “Proposals”.

4. The EDPS also points out to the fact that the proposed Regulation and Directive would, as highlighted further in this Opinion, establish data processing operations for which the Commission would be the controller pursuant to Regulation (EU) 2018/1725. We 5 | P a g e therefore recall that the EDPS is the competent supervisory authority as regards such processing. 1.2 Content of the Proposals

5. The EDPS notes that the Proposals, which are accompanied by an Impact Assessment , aim to address the problem of VAT fraud related to “e-commerce” by enhancing the cooperation between tax authorities and the payment service providers (hereinafter “PSPs”).

6. In particular, according to the proposed Council Directive, Member States should enact legislation that ensures that PSPs keep records of cross-border payment transactions in order to enable tax authorities to detect VAT fraud. The proposed Council Regulation complements the set of anti-fraud measures: (a) requiring Member States’ competent authorities to collect, exchange and analyse the information relating to payment transactions detailed in the Council Directive Proposal, and (b) setting up a central electronic information system (‘CESOP’) where Member States transmit the information stored at national level. The CESOP would then be accessible by Eurofisc liaison officials for the analysis of the information stored therein with the purpose of investigating tax fraud.

7. The EDPS acknowledges the objectives of the proposals and in particular the need to regulate on this subject matter establishing anti-fraud measures addressing e-commerce operations. The present Opinion seeks to provide a pragmatic advice on how to minimise the impact of the processing of personal data triggered by the proposals, ensuring compliance with the applicable data protection law.

2. COMMENTS AND RECOMMENDATIONS

2.1 General remarks on the applicable data protection law

8. The EDPS welcomes that both Recital 11 of the Council Directive and Recital 17 of the Council Regulation refer to “the right of protection of personal data laid down in article 8 of the Charter”. However, for the sake of clarity he recommends inserting in the recitals a reference to the applicable data protection legislation, i.e. the Regulation (EU) 2016/679 (hereinafter “the GDPR”) and the Regulation (EU) 2018/1725. The EDPS also notes that Recital 17 of the proposed Council Regulation, differently from the wording of Recital 11 of the proposed Council Directive (“fully respects” [the right of protection of personal data]), contains the wording “seeks to ensure full respect”). He recommends adjusting this wording aligning it to the one of the Council Directive. The EDPS also welcomes the reference, in both recitals, to the specification of the purpose of the processing operations envisaged by the proposals (under Recital 11 of the Council Directive: “The payment information retained and disclosed in accordance 6 | P a g e with this Directive should be processed only by the anti-fraud experts of tax authorities within the limits of what is necessary and proportionate to achieve the objective of fighting e-commerce VAT fraud.”; under Recital 17 of the Council Regulation: “The processing of payment information pursuant to this Regulation should only occur for the purpose of countering e-commerce VAT fraud.”). The EDPS considers that the specification of the purpose in the context of the proposals is particularly important in order to avoid any risk of ‘function-creep’ and, in particular, the use of information “for other purposes, such as controlling purchase habits of the consumers” . Hence, we recommend including the aforesaid purpose specification in the operative part of the legal act of both the Council Directive and the Council Regulation.

3. SPECIFIC REMARKS

3.1 On the obligation for Payment Service Providers (PSPs) to keep records of payment transactions and make them available to the tax authority of the Member State of establishment

9. Article 243b of the proposed Council Directive provides that Member States should ensure that PSPs keep records of payment transactions. This obligation for PSPs only applies in cases where funds are transferred from a payer located in a Member State to a payee in another Member State or third country (cross-border transaction) and the PSP executes more than 25 payment transactions to the same payee in the course of a calendar quarter. Article 243d defines the relevant categories of data that would have to be retained by a PSP. The EDPS notes that this data only refers to data regarding payees (in other words, information on the consumers paying for a purchase of goods or services payers - are not part of the exchange of information, except for the location of the payer established in accordance with Article 243c) and comprise inter alia the name and surname of the payee, his VAT identification number, his address and the time and date of the transaction. Pursuant to Article 243b(3)(b) of the proposed Council Directive, these records shall be made available to the Member State of establishment of the PSP in accordance with Article 24b of the Council Regulation.

10. Concerning the fact that, according to the proposals, data on payers will not be processed the EDPS agrees with the assessment by the Commission that “it would be disproportionate to systematically have recourse to (these) final consumers to investigate VAT fraud by the seller” . Furthermore, he notes that Article 24b(2)(b) of the proposed Council Regulation provides that an electronic standard format shall be used by each Member State tax authority to collect by PSPs into the national electronic system the information prescribed under the Council Directive. Such format will be adopted by the 7 | P a g e Given its data protection implications (from the data protection viewpoint, the standard format represents a useful safeguard against a potentially unnecessary and disproportionate collection of personal data), the EDPS points out that he expects to be consulted by the Commission prior to the adoption of such implementing act in accordance with Article 42(1) of Regulation (EU) 2018/1725. 3.2 On the national and central database (CESOP)

11. Article 24b of the proposed Council Regulation provides that each Member State shall collect and store the payment transactions of the PSPs in a national database and transfer them to a new central database - the “CESOP” - which, according to Article 24a, shall be developed, maintained, hosted and managed as a central electronic system by the Commission.

12. Article 24d of the proposed Council Regulation Proposal provides the possibility for Eurofisc liaison officials to access information contained in the CESOP when the following cumulative conditions are fulfilled: (i) in respect of individual payees for the purpose of VAT fraud investigation; and (ii) when the Eurofisc liaison official queries the information system via a “personal user identification”. Having regard to the access to the new database by Eurofisc, the EDPS welcomes the safeguard, laid down under the proposed Article 55(1a) of the Council Regulation, providing that the information can only be used if cross-checked with other information available to the tax authority (“where it has been verified by reference to other VAT information available to the competent authorities of the Member States”).

13. The EDPS points out that the Commission, as controller of the CESOP , has to comply with all relevant provisions of the Regulation (EU) 2018/1725 and, in particular, with the provisions on security of processing . In particular, due to the high volume of information to be stored in the CESOP and to the sensitivity of the information stored therein , we recommend the Commission to follow our “Guidelines on the protection of personal data in IT governance and IT management of EU institutions” when implementing/setting up the CESOP and working on its technical details .

14. The EDPS notes that neither of the Proposals refers to the possible restrictions of data subjects’ rights. The matter remains therefore regulated under the current text of Article 55(5) of Regulation (EU) No. 904/2010, as amended by Council Regulation (EU) 2018/1541 , which lays down as follows: “All storage, processing or exchange of information referred to in this Regulation is subject to Regulations (EU) 2016/679 and (EC) No 45/2001 of the European Parliament and of the Council. However, Member States shall for the purpose of the correct application of this Regulation, restrict the scope of the obligations and rights provided for in Articles 12 to 15, 17, 21 and 22 of Regulation (EU) 2016/679. Such restrictions shall be limited to what is strictly necessary in order to safeguard the interests referred to in point (e) of Article 8 | P a g e 23(1) of that Regulation, in particular to: (a) enable the competent authorities of the Member States to fulfil their tasks properly for the purposes of this Regulation; or (b) avoid obstructing official or legal enquiries, analyses, investigations or procedures for the purposes of this Regulation and to ensure that the prevention, investigation and detection of tax evasion and tax fraud is not jeopardised.” In this regard, the EDPS wishes to reiterate his observation made earlier in his formal comments (under Section 2.2) on the proposal for Council Regulation (EU) 2018/1541, namely that the word “shall” [restrict the scope] should be replaced with “may”. The proposed Council Regulation would thus be brought in line with Article 23(1) GDPR which provides that “[Union or] Member State law to which the controller is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22 [...].” In other words, to the extent that the EU legislator wishes to leave the assessment of necessity of specific restriction to national law, this should be properly reflected in the optional language of the provision (“Member States may restrict”). By contrast, where it is considered that certain restrictions are necessary and indispensable in the context of the Proposal, such restrictions should be imposed directly by the proposed Council Regulation. Such harmonization at EU level would be in line with Article 23 GDPR and would facilitate administrative cooperation among the national tax authorities. Moreover, specifying directly in the Proposal the conditions under which certain data subjects’ rights may be restricted, along with the necessary safeguards, would be in line with the case-law of the Court of Justice of the European Union . Concerning the applicability of Regulation (EU) 2018/1725, the EDPS observes that Article 55(5) of the proposed Council Regulation does not contain any reference to the possible restrictions of data subjects’ rights under Regulation (EU) 2018/1725 applicable to Union institutions and bodies (in this case, to the Commission, for all the data processing activities, notably concerning the CESOP, for which it will be the controller). The EDPS therefore recommends inserting under Article 24e of the proposed Council Regulation, among the elements to be further defined by the Commission in a future implementing act, the possible restrictions of data subjects’ rights (specifically, for instance, to safeguard “an important economic or financial interest of the Union or a Member State, including (...) taxation matters”, as laid down under Article 25(1)(c) of Regulation (EU) 2018/1725). The EDPS has recently adopted Guidelines on this issue which - although concerned mainly with internal rules of EU institutions and bodies can provide guidance to the Commission when regulating this matter. As pointed out with regard to the implementing act that will define the standard format for the transmission of data by the PSP to the competent tax authority, also in this case the Commission should consult the EDPS before the adoption of the act. 9 | P a g e

4. CONCLUSIONS

17. In light of the above, the EDPS makes the following recommendations:  Recital 11 of the proposed Council Directive and Recital 17 of the proposed Council Regulation on the applicable data protection law should be amended as indicated under Section 2.1 of this Opinion;  including the purpose specification, as laid down under Recital 11 of the Council Directive and Recital 17 of the Council Regulation, in the operative part of the legal act of both the Council Directive and the Council Regulation;  having regard to the central database ‘CESOP’, the Commission must ensure compliance with the provisions on security of processing under Regulation (EU) 2018/1725, in particular following the EDPS “Guidelines on the protection of personal data in IT governance and management of EU institutions”;  regarding possible restrictions of data subjects’ rights: i. amending the wording of Regulation (EU) No 904/2010, as amended by Council Regulation (EU) 2018/1541, in accordance with Article 23 of the GDPR, to either leave the possibility to enact restrictions to Member States (replacing the word “shall’ with “may restrict”); or, to the extent restrictions are necessary, provide for them directly in the Regulation (EU) No 904/2010; ii. inserting under Article 24e of the Council Regulation, among the elements to be further defined by the Commission in a future implementing act, the possible restrictions of data subjects’ rights in accordance with Article 25 of Regulation (EU) 2018/1725 and the guidance issued by the EDPS on this matter (“Guidance on Article 25 of the new Regulation and internal rules”).  the Commission must, in accordance with Article 42(1) of Regulation (EU) 2018/1725, consult the EDPS on the implementing act on the electronic standard format for the transmission of information by the PSP to the competent tax authority of the Member State where the PSP is established before its adoption by the Commission. Brussels, 14 March 2019 Wojciech Rafał WIEWIÓROWSKI 10 | P a g e

Notes

11 | P a g e

12 | P a g e