(c)

the following Section is inserted after Article 24: ‘SECTION 2 The central electronic system of payment information Article 24a The Commission shall develop, maintain, host and technically manage a central electronic system of payment information (“CESOP”) for the purpose of investigations into suspected VAT fraud or in order to detect VAT fraud. Article 24b 1. Each Member State shall collect the information on the payees and the payments referred to in Article 243b of Directive 2006/112/EC. Each Member State shall collect the information referred to in the first subparagraph from payment service providers: (a) no later than by the end of the month following the calendar quarter to which the information relates; (b) by means of an electronic standard form. 2. Each Member State may store the information collected in accordance with paragraph 1 in a national electronic system. 3. The central liaison office, or the liaison departments or competent officials designated by the competent authority of each Member State, shall transmit to CESOP the information collected in accordance with paragraph 1 no later than the tenth day of the second month following the calendar quarter to which the information relates. Article 24c 1. The CESOP shall have the following capabilities with regard to information transmitted in accordance with Article 24b(3): (a) to store the information; (b) to aggregate the information in respect of each individual payee; (c) to analyse the information stored, together with the relevant targeted information communicated or collected pursuant to this Regulation; (d) to make the information referred to in points (a), (b) and (c) of this paragraph accessible to Eurofisc liaison officials, as referred to in Article 36(1). 2. CESOP shall retain the information referred to in paragraph 1 for a maximum period of five years from the end of the year in which the information was transmitted to it. Article 24d The access to CESOP shall only be granted to Eurofisc liaison officials, as referred to in Article 36(1), who hold a personal user identification for CESOP and where that access is in connection with an investigation into suspected VAT fraud or is to detect VAT fraud. Article 24e The Commission shall adopt by means of implementing acts the following: (a) the technical measures for establishing and maintaining CESOP; (b) the tasks of the Commission for technically managing CESOP; (c) the technical details of the infrastructure and tools required to guarantee the connection and overall operability between the national electronic systems referred to in Article 24b and CESOP; (d) the electronic standard forms referred to in point (b) of the second subparagraph of Article 24b(1); (e) the technical and other details concerning the access to the information referred to in point (d) of Article 24c(1); (f) the practical arrangements to identify the Eurofisc liaison officials, as referred to in Article 36(1), who will have access to CESOP in accordance with Article 24d; (g) the procedures to be used by the Commission at all times which ensure that the appropriate technical and organisational security measures for the development and operation of CESOP are applied; (h) the roles and responsibilities of the Member States and the Commission as regards the functions of controller and processor under Regulation (EU) 2016/679 of the European Parliament and of the Council (*2) and Regulation (EU) 2018/1725 of the European Parliament and of the Council (*3). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 58(2). Article 24f 1. The costs of establishing, operating and maintaining CESOP shall be borne by the general budget of the Union. These costs shall include those of the secure connection between CESOP and the national electronic systems referred to in Article 24b(2), and those of the services necessary to carry out the capabilities which are listed in Article 24c(1). 2. Each Member State shall bear the costs of and shall be responsible for all necessary developments to its national electronic system referred to in Article 24b(2).’; (*2) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1)." (*3) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39)."