EDPS Opinion 43/2023 on the position to be taken within the Trade Specialised Committee established by the Trade and Cooperation Agreement between the European Union and the United Kingdom

11 October 2023

Opinion 43/2023

on the Proposal for a Council Decision on the position to be taken on behalf of the European Union within the Trade Specialised Committee on Administrative Cooperation in VAT and Recovery of Taxes and Duties established by the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’. This Opinion relates to the Proposal for a Council Decision on the position to be taken on behalf of the European Union within the Trade Specialised Committee on Administrative Cooperation in VAT and Recovery of Taxes and Duties established by the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 4 September 2023, the European Commission issued a Proposal for a Council Decision on the position to be taken on behalf of the European Union within the Trade Specialised Committee on Administrative Cooperation in VAT and Recovery of Taxes and Duties established by the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part (‘the Proposal’).

The aims of the Proposal is to enable the administrative cooperation between the competent tax authorities in the European Union and their homologue in the United Kingdom. Since this cooperation, as further specified in the service level agreement that forms one of the annexes to the Proposal (Annex I), entails the processing of personal data, also by the Commission, the EDPS recommends referring to compliance with the GDPR and the EUDPR in a recital of the Proposal.

Moreover, the EDPS recommends to include in the Proposal a specific reference to the adequacy decision as the legal basis allowing for the transfer of personal data by competent authorities in the European Union to competent authorities in the United Kingdom. The EDPS also recommends to supplement the service level agreement (referred to in Annex I to the Proposal) with specific provisions, specifying all relevant data protection aspects.

2

Contents

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 4 September 2023, the European Commission issued a Proposal for a Council Decision on the position to be taken on behalf of the European Union within the Trade Specialised Committee on Administrative Cooperation in VAT and Recovery of Taxes and Duties established by the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part (‘the Proposal’).

2. The Proposal is accompanied by four Annexes, providing: • a draft Decision of the Trade Specialised Committee on Administrative Cooperation in VAT and Recovery of Taxes and Duties established by the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part (‘the Trade Specialised Committee’) on the procedure for the conclusion of a service level agreement (Annex I); • a draft Decision of the Trade Specialised Committee on the amount and modalities of the financial contribution to be made by the United Kingdom of Great Britain and Northern Ireland to the general budget of the Union in respect of the cost generated by its participation in the European Information Systems (Annex II); • a draft Decision of the Trade Specialised Committee laying down implementing rules for provisions relating to recovery assistance of the Protocol on administrative cooperation and combating fraud in the field of value added tax and on mutual assistance for recovery of claims (Annex III); • a draft Decision of the Trade Specialised Committee on standard forms for the communication of information and statistical data, the transmission of information via the Common Communication Network and the practical arrangements for the organisation of contacts between central liaison offices and liaison departments (Annex IV).

3. The objective of the Proposal is to establish the position to be taken on the European Union’s behalf in the Trade Specialised Committee on Administrative Cooperation in VAT and Recovery of Taxes and Duties for the adoption of the decision for the implementation of the Protocol on administrative cooperation and combating fraud in the field of value added tax and on mutual assistance for the recovery of claims relating to taxes and duties (‘the VAT Protocol’, ‘PVAT’), as laid down in Article 39(2) PVAT of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part (‘the Agreement’) .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 4 September 2023, pursuant to Article 42(1) of EUDPR. The EDPS remarks that the reference to this consultation in a recital of the Proposal is missing. Therefore, the EDPS recommends inserting such reference in a recital of the Proposal.

2. General remarks

5. The EDPS recognises the importance of ensuring the implementation of the cooperation between the European Union and the United Kingdom in VAT recovery of Taxes and Duties.

6. The EDPS highlights that this implementation, notably having regard to the standard forms for the communication of information and statistical data, the transmission of information via the Common Communication Network and the practical arrangements specified in Annex IV, may entail the processing of personal data falling under the scope of Regulation (EU) 2016/679 (‘the GDPR’) . This would be the case e.g. for ‘basic information’ referred to in Annex I to Annex IV (e.g., name, email address, telephone number) which may constitute information related to an identified or identifiable natural person, and thus personal data within the meaning of Article 4(1) of the GDPR. The EDPS also notes that according to the draft Decision of the Trade Specialised Committee on the procedure for the conclusion of a service level agreement the Commission would be required to provide operational services which entail the processing of personal data .

7. Therefore, the EDPS recommend inserting a recital in the Proposal specifying that ‘the processing of personal data in the context of this Council Decision shall comply with Regulation (EU) 2016/679 and with Regulation (EU) No 2018/1725’.

8. Furthermore, the EDPS notes that Chapter V of the GDPR sets out the conditions for transferring personal data from the European Union to a third country (like the United Kingdom). One of the possible lawful means to transfer personal data to a third country is the reliance on an adequacy decision issued by the Commission in relation to such third country pursuant to Article 45 GDPR.

9. On 28 June 2021, the Commission adopted a decision recognizing that the United Kingdom ensures an adequate level of protection for personal data transferred within the scope of the GDPR from the European Union to the United Kingdom (‘the UK adequacy decision’) . The EDPS notes that the Proposal would not as such provide for a legal basis for the transfers of personal data within the meaning of the GDPR in the context of exchanges of information between competent tax authorities in the European Union and the competent tax authority in the United Kingdom as per Article 46(2)(a) GDPR. The EDPS considers that such a legal basis would be provided by the UK adequacy decision . Moreover, the EDPS notes that, as specified at paragraph 279 of the UK adequacy decision, ‘during the period of application of this Decision, transfers from a controller or processor in the European Union to controllers or processors in the United Kingdom may take place without the need to obtain any further authorisation from supervisory authorities under the GDPR’ . Therefore, the EDPS recommends including in the Proposal a specific reference to the adequacy decision as the legal basis allowing for the transfer of personal data by competent authorities in the European Union to competent authorities in the United Kingdom.

10. Having specific reference to the proposed service level agreement (Annex I to the Proposal), to be laid down pursuant to Article 5 PVAT , the EDPS highlights that this service level agreement should be accompanied by specific provisions specifying all relevant data protection aspects: notably, data protection roles, exercise of data subject’s rights, information to data subjects, data retention period, technical and organizational measure to ensure security, communication of data breaches.

11. The EDPS notes that personal data processing in the context of the Proposal should remain adequate, relevant and limited to what is necessary in relation to the purposes of the processing, in line with the data protection principle of data minimisation . Nonetheless, the EDPS notes, with regard to the categories of personal data to be provided to competent authorities as specified in the Annex IV to the Proposal, that these categories of personal data correspond to information to be provided under the PVAT.

3. Conclusions

12. In light of the above, the EDPS makes the following recommendations: (1) to add a reference to the consultation of the EDPS pursuant to Article 42(1) EUDPR in a recital of the Proposal; (2) to insert a recital in the Proposal specifying that ‘the processing of personal data in the context of this Council Decision shall comply with Regulation (EU) 2016/679 and with Regulation (EU) No 2018/1725’; (3) to include including in the Proposal a specific reference to the adequacy decision as the legal basis allowing for the transfer of personal data by competent authorities in the European Union to competent authorities in the United Kingdom; (4) to accompany by specific provisions the service level agreement (referred to in Annex I to the Proposal), specifying all relevant data protection aspects. Brussels, 11 October 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7