# C_2021096EN.01000901.xml

| 22.3.2021 | EN | Official Journal of the European Union | C 96/9 |
| --- | --- | --- | --- |

22.3.2021

EN

Official Journal of the European Union

C 96/9

---

Summary of the Opinion of the European Data Protection Supervisor on a proposal for an amendment of Council Directive 2011/16/EU relating to administrative cooperation in the field of taxation

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2021/C 96/09)

With this Opinion, issued pursuant to Article 42(1) of Regulation (EU) 2018/1725, the EDPS puts forward recommendations aiming at minimizing the impact of a Commission’s legislative proposal amending Directive 2011/16/EU on administrative cooperation in the field of taxation on the fundamental right to privacy and to the protection of personal data of individuals. These recommendations are intended to ensure compliance with the applicable data protection legal framework, while avoiding jeopardizing the efficacy and efficiency of the administrative action on the fight against tax evasion.

Whereas the EDPS acknowledges that tax compliance is an important objective of public interest, he insists that the right balance should be struck between the attainment of such goal and the right to privacy and personal data protection. In this regard, he calls for particular attention to the implementation of the principles of data protection by design and by default, data minimisation and data accuracy in the context of automatic exchanges of information between national tax authorities.

Concerning the management of the secure central interface on administrative cooperation in the field of taxation, the EDPS stresses the need for the Commission to ensure compliance with the provisions on security of processing under Regulation (EU) 2018/1725, in particular following the EDPS ‘Guidelines on the protection of personal data in IT governance and management of EU institutions’. Moreover, the EDPS considers that the role of the Commission with regard to the management of the secure central interface pursuant to Regulation (EU) 2018/1725, needs to be further ascertained in particular in the light of any further arrangement with Member States and the factual circumstances of the technical and logistical support provided within the system.

The EDPS also stresses that, pursuant to Article 42(1) of Regulation (EU) 2018/1725, it expects to be consulted before its adoption by the Commission, on the implementing acts that will define the administrative arrangements to provide technical and logistical support for the secure central interface where Member States communicate with the use of standard forms pursuant to Directive 2011/16/EU.

Finally, he recalls that in its capacity as competent supervisory authority under Regulation (EU) 2018/1725, the EDPS may follow up on possible updates concerning the secure central interface and, more broadly, the implications stemming from the Commission role within the processing operations in the context of the administrative cooperation on taxation.

1.   INTRODUCTION AND BACKGROUND

| 1. | On 2 September the EDPS was consulted by the European Commission on a Proposal for a Council Directive amending Directive 2011/16/EU on administrative cooperation in the field of taxation that was adopted on 15 July 2020 (hereafter, the ‘Proposal’). This consultation is made pursuant to Article 42 of Regulation (EU)2018/1725. |
| --- | --- |

1.

| 2. | Previously, on 29 April 2020 and on 5 May 2020 draft versions of the Proposal were submitted to the EDPS. The EDPS welcomes and encourages the possibility to be consulted by the Commission early in the policy-making process with a view to minimising the impact of the proposals on the fundamental rights to privacy and to the protection of personal data (1). |
| --- | --- |

2.

| 3. | The EDPS notes that the Proposal aims at improving the existing framework for the exchanges of information and administrative cooperation for the purpose of fighting tax evasion, having regard to direct taxation and the raising importance of digital platforms used by ‘sellers’. In addition to reinforcing existing rules, the Proposal highlights that ‘the expansion of administrative cooperation to new areas is required in the EU, in order to address the challenges posed by the digitalisation of the economy and help tax administrations better collect their taxes and keep pace with new developments’. (2) |
| --- | --- |

3.

| 4. | The EDPS acknowledges the objectives of the Proposal and, in particular, the need to address the cross-border dimension of the services offered through the use of digital platform operators. As recalled by recital 6 of the Proposal, ‘tax compliance is suboptimal and the value of unreported income is significant. Member States' tax administrations have insufficient information to correctly assess and control gross income earned in their country from commercial activities performed with the intermediation of digital platforms. This is particularly problematic where the income or taxable amount flows via platforms established in another jurisdiction.’ (3) |
| --- | --- |

4.

| 5. | The present Opinion focusses on the relevant aspects of the Proposal with regard to the protection of personal data of individuals and seeks to provide a pragmatic advice on how to minimise the impact of the processing of personal data required by the Proposal for taxation purposes, while maintaining the effectiveness of the envisaged measures. |
| --- | --- |

5.

3.   CONCLUSIONS

| 20. | In the light of the above, the EDPS recommends the following:






  — | To follow an approach which respects data protection rights, particularly the principles of data protection by design and by default, data minimisation and data accuracy in the systems created and used for the exchange of information; |
| --- | --- | --- |

20.

—

To follow an approach which respects data protection rights, particularly the principles of data protection by design and by default, data minimisation and data accuracy in the systems created and used for the exchange of information;

| — | To amend Section III.B.2.c) of Annex V of the Proposal to better specifying the ‘identifying information’ to be reported and restricting it to financial identification information; |
| --- | --- |

—

To amend Section III.B.2.c) of Annex V of the Proposal to better specifying the ‘identifying information’ to be reported and restricting it to financial identification information;

| — | to ensure compliance of the secure central interface with the provisions on security of processing under Regulation (EU) 2018/1725, in particular following the EDPS ‘Guidelines on the protection of personal data in IT governance and management of EU institutions’; |
| --- | --- |

—

to ensure compliance of the secure central interface with the provisions on security of processing under Regulation (EU) 2018/1725, in particular following the EDPS ‘Guidelines on the protection of personal data in IT governance and management of EU institutions’;

| — | with regard to the secure central interface, to reconsider the reference to the role of the Commission as ‘processor’ in the Proposal (under the new Article 25(2) and (5) of Directive 2011/16/EU as inserted by Article 1(19) of the Proposal and in recital 25 of the Proposal). |
| --- | --- |

—

with regard to the secure central interface, to reconsider the reference to the role of the Commission as ‘processor’ in the Proposal (under the new Article 25(2) and (5) of Directive 2011/16/EU as inserted by Article 1(19) of the Proposal and in recital 25 of the Proposal).

Brussels, 28 October 2020.

Wojciech WIEWIÓROWSKI

---

(1)  See recital 60 of Regulation (EU) 2018/1725: ‘In order to ensure consistency of data protection rules throughout the Union, when preparing proposals or recommendations, the Commission should endeavour to consult the European Data Protection Supervisor. A consultation by the Commission should be obligatory following the adoption of legislative acts or during the preparation of delegated acts and implementing acts as defined in Article 289, 290 and 291 TFEU and following the adoption of recommendations and proposals relating to agreements with third countries and international organisations as provided for in Article 218 TFEU which have an impact on the right to protection of personal data. In such cases, the Commission should be obliged to consult the European Data Protection Supervisor, except where the Regulation (EU) 2016/679 provides for mandatory consultation of the European Data Protection Board, for example on adequacy decisions or delegated acts on standardised icons and requirements for certification mechanisms.’

1

(2)  See Explanatory Memorandum of the Proposal.

2

(3)  The EDPS would like to recall that tax evasion issues in relation to digital platforms, having regard to indirect taxation, have formed the object of the EDPS Opinion 1/2019 on two legislative proposals relating to combating VAT fraud, available at: https://edps.europa.eu/sites/edp/files/publication/19-03-15_edps_opinion_on_two_legislative_proposals_relating_to_combating_vat_fraud_en.pdf whereby the EDPS noted, among others, ‘In particular, we point out to that, in the context of these proposals, the data undergoing processing should not relate to the consumers (the payers) but only to the online businesses (payees). This would limit the risk of the information being used for other purposes, such as controlling purchase habits of the consumers. We appreciate the fact that the Commission followed this approach and we strongly recommend that this approach is maintained in the negotiations with the co-legislators leading to the final approval of the proposals.’

3

---