EDPS Opinion 50/2023 on the Proposal for a Council Directive establishing a Head Office Tax system for SMEs

3 November 2023

Opinion 50/2023

on the Proposal for a Council Directive establishing a Head Office Tax system for SMEs

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to Proposal for a Council Directive establishing a Head Office Tax system for micro, small and medium sized enterprises, and amending Directive 2011/16/EU . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 12 September 2023, the European Commission issued a Proposal for a Council Directive establishing a Head Office Tax system for micro, small and medium sized enterprises, and amending Directive 2011/16/EU (‘the Proposal’).

The objective of the Proposal is to provide rules which open the possibility for standalone companies qualifying as micro, small and medium sized enterprises (SMEs) to use one single set of tax rules, namely the rules of the Member State of their Head Office, for computing the taxable result in respect of activities performed through a permanent establishment situated in another Member State.

The EDPS welcomes the fact that the Proposal includes specific provisions on data protection that specify the purposes of the personal data processing, identify the controllers involved in the processing, and determine how long personal data may be processed. To enhance legal certainty and foreseeability, the EDPS recommends clarifying the starting date of the proposed retention period and to ensure that the maximum retention period remains limited to what is strictly necessary.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 12 September 2023, the European Commission issued a Proposal for a Council Directive establishing a Head Office Tax system for micro, small and medium sized enterprises, and amending Directive 2011/16/EU (‘the Proposal’).

2. The objective of the Proposal is to provide rules which open the possibility for standalone companies qualifying as micro, small and medium sized enterprises (SMEs) to use one single set of tax rules, namely the rules of the Member State of their Head Office, for computing the taxable result in respect of activities performed through a permanent establishment situated in another Member State. The system relies on a mutual recognition among Member States of each other’s taxation rules, and is optional for all eligible SMEs, which can continue applying different sets of tax rules to their business operations .

3. The Proposal builds on a Communication from the European Commission that set out a possible solution to the compliance costs and other tax obstacles faced by SMEs and on the Commission’s SME Strategy for a sustainable and digital Europe . The Proposal is part of a broader SME Relief Package , which aims to provide short-term relief, boost long-term SME competitiveness and resilience, and foster a fair and SME-friendly business environment.

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 13 September 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 17 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

5. The EDPS understands that the data that would be processed in the context of the Proposal would mainly be non-personal data or personal data in the context of data processing related to legal persons. At the same time, the EDPS welcomes that recital 14 refers to the applicability of Regulation (EU) 2016/679 (‘the GDPR’) when personal data are processed in the context of the Proposal by competent authorities for the purpose of verifying the eligibility requirements or determining the tax liability of permanent establishments.

6. The EDPS recalls that even information on economic operators that are legal persons might in some cases be considered as personal data. In these cases, the determining factor is whether the information ‘relates to’ an ‘identifiable’ natural person .

7. The EDPS positively notes the introduction of specific provisions on ‘data protection’ in the enacting terms of the Proposal. Article 18 establishes the purposes for which competent authorities in EU Member States may process personal data, determines that such competent authorities shall act as controllers for the purposes of the GDPR, and defines personal data retention periods. At the same time, the EDPS considers that the content of these provisions should be developed further in order to ensure respect for the fundamental rights to privacy and to the protection of personal data enshrined in Article 7 and 8 of the Charter of Fundamental Rights of the European Union.

3. Purposes of the processing

8. Article 18(1) of the Proposal would allow competent authorities in EU member States to process personal data for the purpose of verifying the eligibility requirements or to determine the tax liability as referred to in Articles 4, 9 and 11 of the Proposal. The EDPS welcomes that the Proposal explicitly defines the purposes of the processing of personal data and also makes explicit reference to the specific provisions of the Proposal that would provide the legal basis for the processing.

4. Retention period

9. The EDPS welcomes the introduction, in Article 18(2) of the Proposal, of a maximum retention period of 10 years for the retention of personal data by competent authorities to achieve the purposes of the Directive, in particular, verification of eligibility requirements and determination of the tax liability of the taxpayers. He also positively notes that Article 18(2) makes clear that the retention period may be shorter, having regard to the national laws on the statute of limitations applicable in each Member State.

10. As currently drafted, however, the starting point of the retention period may not be entirely clear. The EDPS recommends clarifying that the starting point for the maximum retention period of 10 years is the moment when personal data are processed for the purposes specified in the Proposal. In addition, the EDPS recommends the co-legislator to consider further whether a maximum retention period of 10 years is really needed and to limit the maximum period to what is strictly necessary.

5. Conclusions

11. In light of the above, the EDPS makes the following recommendations: (1) to clarify the starting date of the data retention period foreseen in Article 18(2) of the Proposal and to limit the maximum retention period to what is strictly necessary. Brussels, 3 November 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 6