EDPS Opinion the Proposal on the signing and conclusion of the provisional application of the Amending Protocol between the EU and Andorra on the automatic exchange of financial account information to improve international tax compliance

Opinion 22/2025

on the Proposal for a Council Decision on the signing and conclusion of the Amending Protocol to the Agreement between the European Union and the Principality of Andorra on the automatic exchange of financial account information to improve international tax compliance

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Andorra on the automatic exchange of financial account information to improve international tax compliance ; and to (ii) the Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Andorra on the automatic exchange of financial account information to improve international tax compliance .

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

Executive Summary

The EDPS is consulted on the Proposals for Council Decisions to sign and conclude, on behalf of the Union, the Amending Protocol to the Agreement between the European Union and the Principality of Andorra on the automatic exchange of financial account information to improve international tax compliance.

The Amending Protocol aims to ensure that the automatic exchange of financial account information between EU Member States and Andorra is aligned with the updated Common Reporting Standard developed by the Organisation for Economic Co-operation and Development. In addition, the Amending Protocol aims to align the text of the Agreement with the new data protection framework (i.e. the GDPR for EU Members States and Qualified Law 29/2021 on the protection of personal data for Andorra). Finally, the Amending Protocol would ensure that the existing agreement between the European Union and Andorra remains aligned with Union legislation in the same field.

Any transfer of information containing personal data from the European Union to Andorra constitutes an international transfer of personal data in the meaning of Chapter V of the GDPR. The international transfer of personal data from Member States to Andorra does not require specific authorisations nor safeguards under Chapter V of Regulation 2016/679, by virtue of Commission Decision 2010/625/EU. The EDPS recommends including a reference to the EU adequacy decision concerning Andorra in a recital of both the Signing and the Conclusion Proposals.

2

Contents

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 17 July, the European Commission issued: - a Proposal for a Council Decision on the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Andorra on the automatic exchange of financial account information to improve international tax compliance (‘the Signing Proposal’) ; - a Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Andorra on the automatic exchange of financial account information to improve international tax compliance (‘the Conclusion Proposal’) .

2. The objective of the Signing Proposal is to authorise the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Andorra (Andorra) on the exchange of financial account information to improve international tax compliance (‘the Agreement’).

3. The objective of the Conclusion Proposal is to approve the Amending Protocol .

4. The Agreement provides the legal basis for the reciprocal automatic exchange of financial account information between the EU Member States and Andorra, in accordance with the Common Reporting Standard (CRS) developed by the Organisation for Economic Cooperation and Development (OECD).

5. The Amending Protocol aims to (i) ensure that the automatic exchange of financial account information between EU Member States and Andorra is aligned with, and continues to take place in accordance with, the updated CRS from 1 January 2026; and to (ii) align the text of the Agreement with the new data protection framework (i.e. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General data protection regulation, GDPR) for EU Members States; and Qualified Law 29/2021 on the protection of personal data for Andorra ).

6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 17 July 2025, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in Recital 6 of the Signing Proposal and in Recital 8 of the Conclusion Proposal.

2. General remarks

7. The EDPS welcomes the objectives pursued by the Proposals, notably to improve administrative cooperation in the area of direct taxation, and to improve international tax compliance. The EDPS acknowledges that the negotiated Amending Protocol ensures that the existing agreement between the European Union and Andorra remains aligned with Union legislation in the same field, notably Council Directive 2014/107/EU amending Directive 2011/16/EU on administrative cooperation in the field of taxation (DAC 2) as amended by Council Directive (EU) 2023/2226 of 17 October 2023 amending Directive 2011/16/EU on administrative cooperation in the field of taxation (DAC8) . The EDPS has previously issued an opinion on DAC8 on 3 April 2023 .

8. The EDPS regrets not having been consulted on the Council Decision authorising the opening of negotiations for the amendment of the Agreement in line with Article 42(1) EUDPR.

9. Any transfer of information containing personal data from the European Union to Andorra constitutes an international transfer of personal data in the meaning of Chapter V of the GDPR.

10. On 19 October 2010, the Commission adopted a decision recognising that the Principality of Andorra ensures an adequate level of protection for personal data transferred within the scope of the Directive 95/46/EC of the European Parliament and of the Council (Data 11 12 Protection Directive) from the European Union to Andorra (‘the Adequacy Decision’) .

11. With the entry into application of the GDPR, the adequacy decisions adopted under the Data Protection Directive (including the one concerning Andorra) remained in force. Pursuant to Article 97 GDPR, the Commission shall periodically review adequacy decisions, every four years, in order to determine whether the countries and territories that received an adequacy finding continue to provide an adequate level of protection for personal data.

12. On 15 January 2024, the Commission confirmed that Andorra continues to provide an adequate level of protection for personal data transferred within the scope of the GDPR from the EU to Andorra . As a result, data transfers from the EU to Andorra can take place without additional requirements.

13. The EDPS welcomes that the preamble of the Agreement and the Explanatory Memoranda of both Signing and Conclusion Proposals refer to the Adequacy Decision. As the Adequacy Decision would cover the transfer of personal data regulated by the Agreement, the EDPS recommends including a reference to it in a recital of both the Signing and the Conclusion Proposals.

3. Conclusions

14. In light of the above, the EDPS recommends to include a reference to Commission Decision 2010/625/EU in a recital of both the Signing and the Conclusion Proposals. Brussels, 20 August 2025 (e-signed) p.o. Leonardo CERVERA NAVAS