Summary of the Opinion of the European Data Protection Supervisor on two legislative proposals relating to combating VAT fraud

(the full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2019/C 140/04)

Summary

With this Opinion, issued pursuant to Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (1), the EDPS puts forward recommendations aiming at minimising the impact of two Commission’s proposals on the fight against VAT fraud in the context of ‘e-commerce’ on the fundamental right to privacy and to the protection of personal data, thus ensuring compliance with the applicable data protection legal framework.

In doing so, the EDPS stresses the need to strictly limit the processing operations envisaged by the proposals to the purpose of fighting tax fraud, and to limit the collection and use of personal data to what is necessary and proportionate for this purpose. In particular, we point out to that, in the context of these proposals, the data undergoing processing should not relate to the consumers (the payers) but only to the online businesses (payees). This would limit the risk of the information being used for other purposes, such as controlling purchase habits of the consumers. We appreciate the fact that the Commission followed this approach and we strongly recommend that this approach is maintained in the negotiations with the co-legislators leading to the final approval of the proposals.

Moreover, the EDPS wishes to stress that, pursuant to Article 42(1) of Regulation (EU) 2018/1725, it expects to be consulted on the implementing act that will in the future define the standard format for the transmission of information from the payment service providers to the national tax administration, before its adoption by the Commission.

Since the proposals would set up, in addition to the national databases, a central electronic database (CESOP) to be developed, maintained, hosted and managed by the Commission, the EDPS recalls his guidance on IT governance and management. The EDPS will follow up on the setting up of this information system as competent Supervisory Authority under Regulation (EU) 2018/1725.

Finally, this Opinion provides guidance on the conditions and limits for lawful and appropriate restrictions of data subject’s rights in compliance with the GDPR and Regulation (EU) 2018/1725.

I. INTRODUCTION AND BACKGROUND

1.1. Context of the Proposals

1. On 10 September 2018, the EDPS has been informally consulted by the European Commission on the following draft proposals: Draft Proposal for a Council Directive amending Directive 2006/112/EC as regards the introduction of certain requirements on payment service providers; Draft Proposal for a Council implementing Regulation amending Regulation (EU) No 282/2011 as regards certain value added tax obligations for certain taxable persons; Draft Proposal for a Council Regulation amending Regulation (EU) No 904/2010 as regards measures to strengthen administrative cooperation in order to combat VAT fraud in the field of ‘e-commerce’. The EDPS issued informal comments on 18 September 2018. In this regard, the EDPS confirms that he welcomes the possibility to exchange views with the Commission early in the policy-making process with a view to minimising the impacts of the proposals on the rights to privacy and to data protection ( 2 )

2. On 12 December 2018, the European Commission published a Proposal for a Council Directive amending Directive 2006/112/EC as regards introducing certain requirements for payment service providers (hereinafter, ‘the proposed Council Directive’) ( 3 ) and a Proposal for a Council Regulation amending Regulation (EU) No 904/2010 as regards measures to strengthen administrative cooperation in order to combat VAT fraud (hereinafter, ‘the proposed Council Regulation’) ( 4 ) , hereinafter, collectively referred to as the ‘Proposals’.

3. On 14 January 2019, the Commission consulted the EDPS pursuant to Article 42(1) of Regulation (EU) 2018/1725.

4. The EDPS also points out to the fact that the proposed Regulation and Directive would, as highlighted further in this Opinion, establish data processing operations for which the Commission would be the controller pursuant to Regulation (EU) 2018/1725. We therefore recall that the EDPS is the competent supervisory authority as regards such processing.

1.2. Content of the Proposals

5. The EDPS notes that the Proposals, which are accompanied by an Impact Assessment ( 5 ) , aim to address the problem of VAT fraud related to ‘e-commerce’ by enhancing the cooperation between tax authorities and the payment service providers (hereinafter ‘PSPs’).

6. In particular, according to the proposed Council Directive, Member States should enact legislation that ensures that PSPs keep records of cross-border payment transactions in order to enable tax authorities to detect VAT fraud. The proposed Council Regulation complements the set of anti-fraud measures: (a) requiring Member States’ competent authorities to collect, exchange and analyse the information relating to payment transactions detailed in the Council Directive Proposal, and (b) setting up a central electronic information system (‘CESOP’) where Member States transmit the information stored at national level. The CESOP would then be accessible by Eurofisc liaison officials for the analysis of the information stored therein with the purpose of investigating tax fraud.

7. The EDPS acknowledges the objectives of the proposals and in particular the need to regulate on this subject matter establishing anti-fraud measures addressing e-commerce operations. The present Opinion seeks to provide a pragmatic advice on how to minimise the impact of the processing of personal data triggered by the proposals, ensuring compliance with the applicable data protection law.

IV. CONCLUSIONS

17. In light of the above, the EDPS makes the following recommendations: — Recital 11 of the proposed Council Directive and Recital 17 of the proposed Council Regulation on the applicable data protection law should be amended as indicated under Section 2.1 of this Opinion; — including the purpose specification, as laid down under Recital 11 of the Council Directive and Recital 17 of the Council Regulation, in the operative part of the legal act of both the Council Directive and the Council Regulation; — having regard to the central database ‘CESOP’, the Commission must ensure compliance with the provisions on security of processing under Regulation (EU) 2018/1725, in particular following the EDPS ‘Guidelines on the protection of personal data in IT governance and management of EU institutions’; — regarding possible restrictions of data subjects’ rights: i. amending the wording of Regulation (EU) No 904/2010, as amended by Council Regulation (EU) 2018/1541, in accordance with Article 23 of the GDPR, to either leave the possibility to enact restrictions to Member States (replacing the word ‘shall’ with ‘may restrict’); or, to the extent restrictions are necessary, provide for them directly in the Regulation (EU) No 904/2010; ii. inserting under Article 24e of the Council Regulation, among the elements to be further defined by the Commission in a future implementing act, the possible restrictions of data subjects’ rights in accordance with Article 25 of Regulation (EU) 2018/1725 and the guidance issued by the EDPS on this matter (‘Guidance on Article 25 of the new Regulation and internal rules’). — the Commission must, in accordance with Article 42(1) of Regulation (EU) 2018/1725, consult the EDPS on the implementing act on the electronic standard format for the transmission of information by the PSP to the competent tax authority of the Member State where the PSP is established before its adoption by the Commission.

Brussels, 14 March 2019. Wojciech Rafał WIEWIÓROWSKI European Data Protection Supervisor

(1) OJ L 295, 21.11.2018, p. 39.

(2) See Recital 60 of Regulation (EU) 2018/1725: ‘In order to ensure consistency of data protection rules throughout the Union, when preparing proposals or recommendations, the Commission should endeavour to consult the European Data Protection Supervisor. A consultation by the Commission should be obligatory following the adoption of legislative acts or during the preparation of delegated acts and implementing acts as defined in Article 289, 290 and 291 TFEU and following the adoption of recommendations and proposals relating to agreements with third countries and international organisations as provided for in Article 218 TFEU which have an impact on the right to protection of personal data. In such cases, the Commission should be obliged to consult the European Data Protection Supervisor, except where the Regulation (EU) 2016/679 provides for mandatory consultation of the European Data Protection Board, for example on adequacy decisions or delegated acts on standardised icons and requirements for certification mechanisms.’

(3) Proposal for a Council Directive amending Directive 2006/112/EC as regards introducing certain requirements for payment service providers, COM(2018) 812 final, proc. 2018/0412 (CNS).

(4) Proposal for a Council Regulation amending Regulation (EU) No 904/2010 as regards measures to strengthen administrative cooperation in order to combat VAT fraud, COM(2018) 813 final, proc. 2018/0413 (CNS).

(5) Commission staff working document Impact Assessment, Accompanying the document Proposals for a Council Directive, a Council Implementing Regulation and a Council Regulation on Mandatory transmission and exchange of VAT-related payment data.