EDPS Opinion 49/2023 on the Directive on Business in Europe: Framework for Income Taxation (BEFIT)

3 November 2023

Opinion 49/2023

on the Directive on Business in Europe: Framework for Income Taxation (BEFIT)

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Council Directive on Business in Europe: Framework for Income Taxation (BEFIT) . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 12 September 2023, the European Commission issued the Proposal for a Council Directive on Business in Europe: Framework for Income Taxation (BEFIT) (‘the Proposal’). The objective of the Proposal is to reduce tax compliance costs for large businesses, primarily those who operate in more than one Member State, and to create a coherent approach to corporate taxation in the EU. A common set of rules for EU companies is introduced to calculate their taxable base while ensuring a more effective allocation of profits between EU countries.

The EDPS welcomes the fact that the Proposal includes specific provisions on data protection that specify the purposes of the personal data processing, identify the controllers involved in the processing, and determine how long personal data may be processed.

To enhance legal certainty and foreseeability, the EDPS recommends to further clarify the specific purposes of the processing of personal data in the context of Chapter IV of the Proposal. In addition, the EDPS recommends clarifying the starting date of the proposed data retention period and to ensure that the maximum retention period remains limited to what is strictly necessary.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 12 September 2023, the European Commission issued the Proposal for a Council Directive on Business in Europe: Framework for Income Taxation (BEFIT) (‘the Proposal’).

2. The objective of the Proposal is to develop a common corporate tax framework in support of the Single Market, by providing a degree of tax certainty and easier tax compliance for larger businesses that have taxable presence in multiple Member States . More specifically, the Proposal aims to reduce compliance costs for EU businesses, encourage cross-border expansion, and reduce distortions as well as the risk of double and over-taxation and tax disputes .

3. The Proposal builds on the internationally agreed achievements of the OECD/G20 Inclusive Framework on the Two Pillar Approach , in order to provide businesses in the Union ‘with simplicity and certainty in a comprehensive manner’ .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 13 September 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 26 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

5. The EDPS understands that data that would be processed in the context of the Proposal would mainly be non-personal data, or personal data in the context of data processing related to legal persons. At the same time, the EDPS welcomes that recital 22 of the Proposal refers to the applicability of Regulation (EU) 2016/679 (‘the GDPR’) when personal data are processed within the framework of the Proposal.

6. The EDPS recalls that even information on economic operators that are legal persons might in some cases be considered as personal data. In these cases, the determining factor is whether the information ‘relates to’ an ‘identifiable’ natural person .

7. The EDPS positively notes the introduction of specific provisions on data protection in the enacting terms of the Proposal. Article 76 provides specifications on the purposes for which personal data may be processed in the context of the Proposal, on the determination of actors responsible for the processing of personal data and on data retention periods. At the same time, the EDPS considers that the content of some of these provisions should be developed further in order to ensure respect for the fundamental rights to privacy and to the protection of personal data enshrined in Article 7 and 8 of the Charter of Fundamental Rights of the European Union.

3. Purposes of the processing

8. In accordance with Article 76 of the Proposal, Member States may process personal data ‘solely for the purpose of applying Chapter IV as well as for the purpose of examining and reaching consensus on the content of the BEFIT information return and processing and assessing individual tax returns under Chapter V’ .

9. The EDPS welcomes that the Proposal provides an indication of the purposes of the processing of personal data. In accordance with Article 5(1)b GDPR, the purposes for which personal data may be processed must be explicitly specified. In this regard, the EDPS considers that the general reference to Chapter IV of the Proposal is not sufficient to explicitly describe the purposes of the processing.

10. According to the explanatory memorandum, Chapter IV would provide a ‘risk assessment tool (‘traffic lights system’) with benchmarks, in order to facilitate transfer pricing compliance with associated enterprises outside the BEFIT group. The EDPS understands that personal data would be processed in the framework of exchanges between the competent authorities of Member States and the taxpayers when conducting the risk assessment. It is not fully clear, however, whether any personal data would need to be processed for the purpose of elaborating the risk assessment tool itself (e.g. when developing the relevant benchmarks). The EDPS therefore recommends to further clarify the specific purposes for which personal data may be processed in the context of Chapter IV of the Proposal and to indicate the relevant categories of personal data.

4. Retention period

11. The EDPS welcomes the introduction, in Article 76(2) of the Proposal, of a maximum retention period of 10 years for the storage of personal data to achieve the purposes of the Proposal. He also notes positively that Article 76(2) makes clear that the retention period may be shorter, having regard to the national laws on the statute of limitations applicable in each Member State.

12. As currently drafted, however, the starting point of the retention period may not be entirely clear. The EDPS recommends clarifying that the starting point for the maximum retention period of 10 years is the moment when personal data are processed for the purposes specified in the Proposal. In addition, the EDPS recommends the co-legislator to consider further whether a maximum retention period of 10 years is really needed and to limit the maximum period to what is strictly necessary.

5. Conclusions

13. In light of the above, the EDPS makes the following recommendations: (1) to further clarify the specific purposes of the processing of personal data to be carried out in application Chapter IV of the Proposal, (2) to clarify the starting date of the data retention period foreseen in the Proposal and to limit the maximum retention period to what is strictly necessary. Brussels, 3 November 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 6