EDPS Opinion 51/2023 on the Proposal for a Directive on transfer pricing

3 November 2023

Opinion 51/2023

on the Proposal for a Directive on transfer pricing

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal on a Council Directive on transfer pricing . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 12 September 2023, the European Commission issued the Proposal on a Council Directive on transfer pricing (‘the Proposal’). The Proposal aims at increasing tax certainty by introducing the ‘arm’s length principle’ into EU legislation and ensuring its coherent application across the Union, clarifying the role of the Organisation for Economic Co-operation and Development (OECD) Transfer Pricing Guidelines, and reducing double taxation as well as double non-taxation.

The EDPS welcomes the fact that the Proposal includes specific provisions on data protection that seek to specify the purposes of the personal data processing, identify the controllers involved in the processing, and determine how long personal data may be processed.

To enhance legal certainty and foreseeability, the EDPS recommends to further clarify the specific purposes of the processing of personal data in the context of the Proposal. In addition, the EDPS recommends clarifying the starting date of the proposed retention period and to ensure that the maximum retention period remains limited to what is strictly necessary.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 12 September 2023, the European Commission issued the Proposal on a Council Directive on transfer pricing (‘the Proposal’).

2. The objective of the Proposal is to harmonize transfer pricing rules within the Union and to ensure a common approach to transfer pricing problems. Transfer pricing is described as a mechanism for determining the pricing of transactions between related entities of a multinational group. The Commission indicates that, according to the current international standards, such transactions must be priced on the same basis as transactions between third parties under comparable circumstances. This is known as the ‘arm’s length principle’ .

3. More specifically, the draft Proposal aims at incorporating the arm’s length principle into Union law, clarifying the role and status of the Organisation for Economic Co-operation and Development (OECD) Transfer Pricing Guidelines and creating the possibility to establish common binding rules on specific subjects within the Union, within the framework of the OECD Transfer Pricing Guidelines .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 13 September 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 23 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

5. The EDPS understands that data that would be processed in the context of the Proposal would mainly be non-personal data, or personal data in the context of data processing related to legal persons. At the same time, the EDPS welcomes that recital 19 of the Proposal refers to the applicability of Regulation (EU) 2016/679 (‘the GDPR’), when personal data are processed within the framework of the Proposal.

6. The EDPS recalls that even information on economic operators that are legal persons might in some cases be considered as personal data. In these cases, the determining factor is whether the information ‘relates to’ an ‘identifiable’ natural person .

7. The EDPS positively notes the introduction of specific provisions on data protection in the enacting terms of the Proposal. Article 16 refers to the purposes of the personal data processing, and provides specifications on the determination of actors responsible for the processing of personal data and on data retention periods. At the same time, the EDPS considers that the content of some of these provisions should be developed further in order to ensure respect for the fundamental rights to privacy and to the protection of personal data enshrined in Article 7 and 8 of the Charter of Fundamental Rights of the European Union.

3. Purposes of the processing

8. According to Article 16(1) of the Proposal, ‘Member States may process personal data for the purposes of applying the Directive’. The EDPS considers that the mere reference to the purposes of ‘applying the Directive’ is not sufficient to clearly specify them, in accordance with Article 8 of the Charter of fundamental rights of the EU and Article 5(1)(b) of the GDPR.

9. It should be recalled that purpose limitation is among the key principles of the EU data protection framework, laid down in Article 5 of the GDPR. It is an essential safeguard to provide individuals with the confidence that their data will not be used against them in an unexpected manner. Purpose limitation requires, on the one hand, that personal data are collected for specified, explicit and legitimate purposes and, on the other hand, that personal data are not further processed in a manner that is incompatible with those purposes. Therefore, the EDPS recommends that the co-legislators clearly identify the purposes of the processing of personal data in the context of the Proposal.

10. Moreover, the EDPS also recalls that, in line with the data minimisation principle laid down in Article 5(1)(c) of the GDPR, the collection of personal data should be limited to what is necessary to fulfil the purposes for which they are processed.

4. Retention period

11. The EDPS welcomes the introduction, in Article 16(2) of the Proposal, of a maximum retention period of 10 years for the storage of personal data to achieve the purposes of the Directive. He also positively notes that Article 16(2) makes clear that the retention period may be shorter, having regard to the national laws on the statute of limitations applicable in each Member State.

12. As currently drafted, however, the starting point of the retention period may not be entirely clear. The EDPS recommends clarifying that the starting point for the maximum retention period of 10 years is the moment when personal data are processed for the purposes specified in the Proposal. In addition, the EDPS recommends the co-legislator to consider further whether a maximum retention period of 10 years is really needed and to limit the maximum period to what is strictly necessary.

5. Conclusions

13. In light of the above, the EDPS makes the following recommendations: (1) to further clarify the specific purposes of the processing of personal data to be carried out in application Chapter IV of the Proposal; (2) to clarify the starting date of the data retention period foreseen in the Proposal and to limit the maximum retention period to what is strictly necessary. Brussels, 3 November 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 6