EDPS Opinion 54/2023 on the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of value added tax

13 December 2023

Opinion 54/2023

on the Proposals for a Council Decision on the conclusion and signing on behalf of the Union of the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of value added tax

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Council Decision on the conclusion on behalf of the Union of the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of value added tax , as well as to the Proposal for a Council Decision on the signing on behalf of the Union of the amendment of the Agreement between the European Union and the Kingdom of Norway . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 24 November 2023, the European Commission issued a Proposal for a Council Decision on the conclusion on behalf of the Union of the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of value added tax, as well as a Proposal for a Council Decision on the signing on behalf of the Union, of the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of value added tax (‘the Proposals’).

The aim of the Proposals is to foster the administrative cooperation in the field of value added tax between the competent tax authorities in the European Union and their homologue in Norway.

The EDPS welcomes that the Agreement would update the reference to the applicable data protection law by making reference to the provisions of the European Economic Area (EEA) agreement equivalent to Regulation (EU) 2016/679 (‘GDPR’). The EDPS recommends, however, to clearly distinguish between confidentiality rules pursuant to national law and confidentiality rules pursuant to data protection law to avoid any possible confusion.

The EDPS notes that the Agreement would allow states to restrict the scope of the obligations and rights provided for in the provisions of the EEA Agreement equivalent to Articles 12 to 15, 17, 21 and 22 of the GDPR. While the aim of the restrictions would be to safeguard an objective of general interest recognized by the Union, the EDPS recommends ensuring that the public interests referred to in the Agreement are indicated in an exhaustive manner. In addition, the EDPS recommends to clearly indicate in what circumstances and under which conditions a restriction of data subject rights may be adopted to ensure that the restriction remains limited to what is strictly necessary.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by Union institutions, bodies offices and agencies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 24 November 2023, the European Commission issued a Proposal for a Council Decision on the conclusion on behalf of the Union of the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of value added tax (‘the Agreement’), as well as a Proposal for a Council Decision on the signing on behalf of the Union, of the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of value added tax (‘the Proposals’). The text of the amendment of the Agreement is attached as Annex to the Proposal for a Council Decision on the conclusion on behalf of the Union of the amendment of the Agreement.

2. The objective of the Proposals is to improve cooperation and enhance the fight against tax fraud, bringing added value for both parties to the Agreement (the European Union and Norway). Since the conclusion of the Agreement, which entered into force in September 2018, several amendments were introduced to Council Regulation (EU) No 904/2010 , namely by the amending Council Regulation (EU) 2018/1541 . 3. The amendment of the Agreement provides for new administrative cooperation tools, similar to the ones introduced by Council Regulation (EU) 2018/1541. In addition, references to the repealed Directive 95/46/EC in the Agreement would be updated by the Proposals.

4. On 20 June 2022, the EDPS has issued the Opinion on the Recommendation for Council Decision to authorise the Commission to open negotiations for the amendment of the Agreement .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 24 November 2023, pursuant to Article 42(1) of EUDPR. The EDPS appreciates that fact that he has already been consulted informally at the early stages of the Proposals.

2. General comments

6. The EDPS recognises the importance of ensuring the implementation of the administrative cooperation between the European Union and Norway in the field of value added tax.

7. The EDPS welcomes the reference to the consultation of the EDPS pursuant to Article 42(1) of the EUDPR in recital 5 of the Proposal for Council Decision on the conclusion on behalf of the Union of the amendment of the Agreement and in recital 5 of the Proposal for Council Decision on the signing on behalf of the Union of the amendment of the Agreement.

8. The EDPS welcomes the updated reference to the applicable data protection law. Instead of making reference to Directive 95/46/EC, the fifth recital to the preamble of the Agreement would make reference to the provisions of the European Economic Area (EEA) agreement equivalent to Regulation (EU) 2016/679 (‘GDPR’) . In the same sentence, the recital would also make reference to rules on confidentiality pursuant to national law.

9. For the sake of clarity, the EDPS recommends having a separate sentence dedicated to compliance with GDPR to avoid any possible confusion with confidentiality rules pursuant to national law. The same recommendation applies to the amendment to Article 6(1) of the Agreement, referring to “confidential and protected” information, as well as with regard to Article 6(9), addressing in the same sentence breach of confidentiality and personal data breach.

3. Restriction of data subject rights

10. The EDPS notes that the Agreement would allow states to restrict the scope of the obligations and rights provided for in the provisions of the EEA Agreement equivalent to Articles 12 to 15, 17, 21 and 22 of the GDPR. Such restrictions should be limited to what is strictly necessary to safeguard the interests referred to in the provisions of the EEA Agreement equivalent to point (e) of Article 23(1) of Regulation (EU) 2016/679, in particular: (a) enable the competent authorities of the states to fulfil their tasks properly for the purposes of this Agreement; or (b) avoid obstructing official or legal enquiries, analyses, investigations or procedures for the purposes of this Agreement and to ensure that the prevention, investigation and detection of tax evasion and tax fraud is not jeopardised.

11. The EDPS notes that the aim of the restrictions would be to safeguard taxation as important objective of general interest recognized by the Union within the meaning of Art. 52(1) of the Charter . However, the EDPS recommends that the public interests referred to in the Agreement are indicated in an exhaustive manner, i.e. deleting the wording “in particular”.

12. In addition, the EDPS recommends to clearly indicate in what circumstances and under which conditions a restriction may be adopted to ensure that the restriction remains limited to what is strictly necessary. In particular, the EDPS recommends for the Agreement to clearly specify: the purposes of the processing; the categories of personal data concerned; the scope of the restrictions introduced; the safeguards to prevent abuse or unlawful access or transfer. Furthermore, the Agreement should specify the controller or categories of controllers; the storage periods; the applicable safeguards taking into account: the nature, scope and purposes of the processing or categories of processing; the risks to the rights and freedoms of data subjects. Moreover, the right of the data subject to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction, should also be referred to in the Agreement.

4. Transfers to third countries

13. Concerning the paragraph on transfers to third countries (Article 6(7)), the EDPS welcomes the addition of the wording “legally binding and enforceable” (before “assistance arrangements”), as recommended in the Opinion on the Recommendation for Council Decision to authorise the Commission to open negotiations for the amendment of the Agreement .

5. Access to personal data processed by the Commission

14. The amendment to Article 6(10) of the Agreement would allow persons duly accredited by the Security Accreditation Authority of the European Commission to have access to information obtained under the Agreement in so far as it is necessary for care, maintenance and development of the electronic systems hosted by the Commission and used by states to implement the Agreement. It further specifies that “[a]ny access to personal data shall be treated in accordance with Regulation (EU) 2018/1725”. As Regulation (EU) 2018/1725 applies to EU institutions and bodies (and not to states), the EDPS recommends replacing

6. Conclusions

15. In light of the above, the EDPS makes the following recommendations: (1) to distinguish between rules on confidentiality pursuant to national law and rules on confidentiality pursuant to data protection law in the amendments to the fifth recital to the preamble, Article 6(1) and Article 6(9) of the Agreement; (2) to indicate in Article 6(6.a) the general public interests referred to in the Agreement in an exhaustive manner by deleting the word “in particular”; (3) to indicate in what circumstances and under which conditions a restriction of data subject rights may be adopted, in particular by clearly specifying the purposes of the processing; the categories of personal data; the scope of the restrictions introduced; the safeguards to prevent abuse or unlawful access or transfer; the controller or categories of controllers; the storage periods and the applicable safeguards. The right of the data subject to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction, should also be referred to in the Agreement; Brussels, 13 December 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7