EDPS Opinion 37/2023 on the Proposal for a Council Directive on Faster and Safer Relief of Excess Withholding Taxes

08 August 2023

Opinion 37/2023 on the Proposal for a Council Directive on Faster and Safer Relief of Excess Withholding Taxes

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’. This Opinion relates to the Proposal for a Council Directive on Faster and Safer Relief of Excess Withholding Taxes .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 19 June 2023, the European Commission issued a Proposal for a Council Directive on Faster and Safer Relief of Excess Withholding Taxes. The Proposal aims to introduce more efficient withholding tax (‘WHT’) procedures while, at the same time, providing Member States with the necessary tools to effectively fight tax fraud and abuse.

The EDPS notes that the Proposal would entail processing of personal data, notably personal data relating to taxpayers as natural persons entitled to receive dividend or interest income from securities subject to tax withheld at source in a Member State. Moreover, the Proposal would require Member States to provide for an automated process to issue Digital Tax Residence Certificate (‘eTRC’) for tax purposes more generally.

The EDPS welcomes that the Proposal seeks to address relevant data protection aspects, including purpose limitation, data minimisation and storage limitation. The EDPS recalls, however, that any use of the eTRC for a purpose other than applying the WHT procedures established by the Proposal would require its own (separate) legal basis under Union or Member State law. For this reason, the EDPS recommends to delete Article 4(2)(g) of the Proposal or to specify the purposes (other than the relief of WHT) for which the eTRC would be used, as well as the relevant categories of personal data.

The EDPS also welcomes that the Proposal circumscribes the extent to which data subject rights may be restricted. To ensure that the proposed restrictions do not extend longer than strictly necessary and is only applied in justified cases, the EDPS recommends including the wording “in so far as the exercise of such rights may jeopardise investigations” in Article 20(1) of the Proposal.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 19 June 2023, the European Commission issued the Proposal for a Council Directive on Faster and Safer Relief of Excess Withholding Taxes (‘the Proposal’).

2. According to its Explanatory Memorandum , the main objectives of the Proposal are to: • support the good functioning of the Capital Markets Union (‘CMU’) by facilitating cross-border investment and;

3. To achieve these objectives, the Proposal would introduce more efficient withholding tax (‘WHT’) procedures while, at the same time, provide Member States with the necessary tools to effectively fight tax fraud and abuse .

4. As explained in the Explanatory Memorandum , the Proposal builds on the Action Plan for fair and simple taxation supporting the recovery strategy and the Action Plan on a Capital Markets Union for people and businesses .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 19 June 2023, pursuant to Article 42(1) EUDPR. The EDPS positively notes that he was already previously informally consulted pursuant to Recital 60 EUDPR.

2. General remarks

6. The EDPS welcomes the objectives of the Proposal, namely supporting the good functioning of the CMU by facilitating cross-border investment and, at the same time, ensuring fair taxation by preventing tax fraud and abuse.

7. The EDPS notes that the Proposal would entail processing of personal data, notably personal data relating to taxpayers as natural persons entitled to receive dividend or interest income from securities subject to tax withheld at source in a Member State. Moreover, the Proposal would require Member States to provide for an automated process to issue Digital Tax Residence Certificate (‘eTRC’) for tax purposes more generally.

8. According to the Explanatory Memorandum, personal data would only be processed for the purposes of verifying that the correct WHT rate is applied to the taxpayer and mitigating the risk of tax fraud and abuse. Personal data would be transmitted only between entities which are involved in the WHT relief procedures under this Directive. The amount of personal data to be transmitted would be limited to what is necessary to detect underreporting, non-reporting or tax fraud or abuse. Finally, personal data would be retained only as long as necessary for this purpose .

9. The EDPS welcomes that the Proposal seeks to address relevant data protection aspects. The EDPS also welcomes that the Proposal contains a recital recalling that the General Data Protection Regulation (‘GDPR’) applies to any processing of personal data carried out under the Proposal. In the remainder of this Opinion, the EDPS shall provide specific comments and recommendations regarding the provisions of the Proposal that are particularly relevant from a data protection perspective.

3. Digital tax residence certificate

10. According to Article 4(1) of the Proposal, Member States must provide for an automated process to issue digital tax residence certificates (‘eTRC’) to a person deemed resident in their jurisdiction for tax purposes. While the Proposal would regulate the use of the eTRC in the context of WHT procedures, the Explanatory Memorandum indicates that the standardised eTRC can also be used for other purposes .

11. Article 4(2) lists the information that should be included in the eTRC . The EDPS notes that letter g) of Article 4(2) refers to “any additional information that may be relevant where the certificate is issued to serve purposes other than relief of withholding tax under this Directive (..)”.

12. In this regard, the EDPS recalls that according to Article 5(1)(b) GDPR, personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. Article 6(1) of the GDPR sets out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as lawful . In line with Article 6(4) of the GDPR, processing for a purpose other than that for which the personal data have been collected is possible if based on a Union law or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1) GDPR. Any use of the eTRC for a purpose other than applying the WHT procedures established by the Proposal would in principle require its own (separate) legal basis as provided by a Union or Member State law.

13. Against this background, the EDPS recommends deleting Article 4(2)(g) of the Proposal or to specify in the Proposal the purposes (other than the relief of the WHT) for which the eTRC would be used. Having specified these additional (tax) purposes, the Proposal should specify the relevant categories of personal data that would be required for each of these purposes, taking into account the principles of necessity and proportionality .

4. Restriction of data subject’s rights

14. Article 20(1) of the Proposal states that Member States shall restrict data subject’s rights under Articles 15 to 19 of the GDPR (right to access, right to rectification, right to erasure, right to restriction of processing and notification obligation) “only to the extent and only as long as it is strictly necessary for their competent authorities to mitigate the risk of tax fraud, evasion or avoidance in Member States, in particular by verifying that the correct withholding tax rate is applied for the registered owner, or by verifying that the registered owner obtains the relief if so entitled in a timely manner.”

15. The EDPS recalls that Article 23 GDPR allows under specific conditions a national or Union legislator to restrict, by way of a legislative measure, the scope of the obligations and rights provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard, inter alia, important objectives of general public interest of the Union or of a Member State, including taxation .

16. The EDPS welcomes Article 20(1) of the Proposal, which circumscribes the extent to which data subject rights may be restricted in the context of this Proposal. The EDPS recalls that data subject rights can be restricted, but not denied. As soon as the circumstances that justified the restriction no longer apply, the rights of the data subjects have to be reinstated. For example, it may be appropriate to limit the right of access in cases where such access would jeopardise an investigation . However, such restriction should be limited to the time necessary for the specific investigation and should be lifted as soon as the tax administration closes the investigation . To ensure that the proposed restriction does not extend longer than strictly necessary and is only applied in justified cases, the EDPS recommends including the wording “in so far as the exercise of such rights may jeopardise investigations” in Article 20(1).

5. Role of certified financial intermediaries and competent authorities of Member States

17. The EDPS welcomes Article 20(2) of the Proposal which provides that, when processing personal data, certified financial intermediaries and the competent authorities of Member States shall be considered as controllers, in the meaning of Article 4, paragraph 7, of the GDPR.

6. Data retention

18. In line with the storage limitation principle , personal data may only be kept in a form that permits identification of the individual for no longer than is necessary for the purposes for which it was processed. Therefore, the EDPS welcomes Article 9(5) and in Article 20(3) of the Proposal that establishes maximum storage period for processing of personal data.

7. Conclusions

19. In light of the above, the EDPS makes the following recommendations: (1) to delete Article 4(2)(g) of the Proposal or to specify the purposes (other than the relief of the WHT) for which the eTRC would be used, as well as the relevant categories of personal data; Brussels, 08 August 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI p.o. Leonardo CERVERA NAVAS Secretary-General