EN Official Journal of the European Union C 289/6

Executive summary of the Opinion of the European Data Protection Supervisor on the EU-Switzerland agreements on the automatic exchange of tax information

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2015/C 289/06)

Summary

The EU has signed, or is negotiating, bilateral agreements with Switzerland, Andorra, Liechtenstein, Monaco and San Marino aiming to regulate and facilitate the exchange of financial, tax-relevant information, thus putting an end to banking secrecy in tax matters.

On a basis of the provisions of the agreement recently concluded with Switzerland (the ‘Agreement’), the EDPS has decided to call on the EU legislator to implement data protection safeguards in future similar bilateral agreements dealing with automatic exchange of tax information.

The context: The Organisation for Economic Cooperation and Development (OECD) was mandated by the G20 to develop a single global standard for automatic exchange of financial account information, in order to implement automatic exchange of information as a means to combat cross-border tax fraud and tax evasion by ensuring full tax transparency and cooperation between tax administrations worldwide. The OECD adopted such system in July 2014 (the ‘Global Standard’).

In order to implement the Global Standard in the exchanges of data between the EU and the Swiss Confederation, the Agreement -signed by the parties on 27 May 2015 and replacing a previous agreement on the same subject- contains a number of provisions regulating the automatic exchange of tax information between the concerned tax authorities in Switzerland and in the Member States.

Such increased attention against tax evasion and the automatic exchange of financial information calls for appropriate safeguards for data protection rights.

The safeguards: The EDPS finds that, in spite of the provisions on data protection contained in Article 6 of the Agreement, basic data protection safeguards have not been fully implemented. He considers, in particular, that the following safeguards would have been appropriate:

(i) make the collection and exchange of tax-relevant information conditional on the effective risk of tax evasion;

(ii) limit the purpose of data processing to the pursuit of a legitimate policy goal (i.e. countering tax evasion), preventing use for additional purposes without informing data subjects;

(iii) provide for proper information of the data subjects as to the purpose and modalities of processing of their financial data, including the recipients of their data;

(iv) set forth explicit security and data protection standards to be complied with by private and public authorities engaging in the collection and exchange of tax information;

(v) provide for an explicit retention period applicable to the tax information exchanged and mandate for its deletion, once such information is no longer processed for the purpose of countering tax evasion.

I. IMPLEMENTATION OF THE GLOBAL STANDARD FOR AUTOMATIC EXCHANGE OF FINANCIAL ACCOUNT INFORMATION

1. The importance of automatic exchange of information as a means to combat cross-border tax fraud and tax evasion by ensuring full tax transparency and cooperation between tax administrations worldwide has been recognised at the international level. The Organisation for Economic Cooperation and Development (OECD) was mandated by the G20 to develop a single global standard for automatic exchange of financial account information. The Global Standard was released by the OECD Council in July 2014.

2. In the EU, in order to preserve the level playing field of economic operators, agreements have been signed with Switzerland, Andorra, Liechtenstein, Monaco and San Marino providing for measures equivalent to those laid down in directive No. 2003/48/EC (on taxation of savings income in the form of interest payments) (1). The purpose of these agreements was to regulate and facilitate the exchange of financial information, relevant for taxation purposes, among the competent authorities of the countries involved in the agreements, thus putting an end to banking secrecy in tax matters.

3. On 27 May 2015, the President of the Council signed, on behalf of the European Union, the Amending Protocol to the agreement between the European Community and the Swiss Confederation providing for measures equivalent to those laid down in Council Directive No 2003/48/EC on taxation of savings income in the form of interest payments (hereafter ‘the Agreement’). The approval of the conclusion of the Agreement by the European Parliament is currently pending.

4. In order to minimise costs and administrative burdens both for tax administrations and for economic operators, the Agreement aims at bringing the existing Savings Agreement with Switzerland in line with EU and international developments as regards automatic exchange of information. This will increase tax transparency in Europe and will be the legal basis for implementing the OCDE Global Standard on automatic exchange of information between Switzerland and the EU.

5. Therefore, in order to implement the Global Standard in the exchanges of data between the EU and the Swiss Confederation, the Agreement contains a number of provisions regulating the automatic exchange of tax information between the concerned tax authorities in Switzerland and in the Member States.

6. The increased attention against tax evasion and the automatic exchange of financial information, however, calls for appropriate safeguards for data protection rights. This is a crucial aspect, considering that the OECD rules on automatic exchange converge on principles already adopted by the US legislation on the subject (the US FATCA) which, nonetheless, have a different approach to data protection issues (2).

7. With respect to the protection of personal data, it must be noted that the Agreement includes, in its Article 6, provisions on confidentiality and data protection. In addition, it must be borne in mind that the Commission has adopted an adequacy decision (3) finding that the data protection legal framework in force in Switzerland is consistent with the principles of Directive No 95/46/EC (the ‘Data Protection Directive’) thus allowing for unrestricted transfer of data pursuant to Articles 25 and 26 of the same Directive.

8. In this Opinion, we would like to formulate a number of considerations focusing on the data protection implications of the Agreement, with a view to provide guidance on essential safeguards that should be embedded in future bilateral agreements entered into by the EU for the purpose of facilitating the automatic exchange of financial account information.

III. CONCLUSION

29. In the light of the considerations above, we take note of the fact that the implementation of the Global Standard is considered as necessary to counter tax evasion and thus ensure a level playing field to market operators.

30. We consider, nonetheless, that, during the negotiation phase, a number of corrections should have been made to the Agreement in order to better address data protection issues. We now call on the EU legislator to introduce such data protection safeguards in future measures implementing the Agreement and in future bilateral agreements to be concluded with other countries in the same field. In particular, any similar agreement or future implementing measure should: — ensure proportionality of the data processing, by making the collection and exchange of tax information conditional on the effective risk of tax evasion and by implementing criteria to exempt low-risk accounts from reporting; — limit the purpose of data processing to the pursuit of a legitimate policy goal and prevent use for additional purposes without informing data subjects; — provide for proper information of the data subjects (pursuant to Article 10 of the Data Protection Directive) as to the purpose and modalities of processing of their financial data, including the recipients of their data; — set forth explicit security and data protection standards to be complied with by private and public authorities engaging in the collection and exchange of tax information (privacy-by-design). It should also provide for sanctions in case of breach of such provisions; — provide for an explicit retention period applicable to the tax information exchanged and mandate for its deletion, once such information is no longer processed for the purpose of countering tax evasion.

Done at Brussels, 8 July 2015. Wojciech Rafał WIEWIÓROWSKI European Data Protection Assistant Supervisor

(1) Council Directive 2003/48/EC of 3 June 2003 on taxation of savings income in the form of interest payments (OJ L 157, 26.6.2003, p. 38).

(2) Article 29 WP letter of 18.9.2014 on the OECD Common Reporting Standard, available at http://ec.europa.eu/justice/data-protection/article-29/documentation/other-document/files/2014/20140918_letter_on_oecd_common_reporting_standard.pdf.pdf

(3) Commission Decision 2000/518/EC of 26 July 2000, available at http://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1415700329280&uri=CELEX:32000D0518