EN Official Journal of the European Union C 66/1

Opinion of the European Data Protection Supervisor on the proposal for a Council Regulation on administrative cooperation and combating fraud in the field of value added tax (recast)

2010/C 66/01

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (1),

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (2), and in particular its Article 41,

HAS ADOPTED THE FOLLOWING OPINION:

I. INTRODUCTION

1. On 18 August 2009, the Commission adopted a proposal for a Council Regulation on administrative cooperation and combating fraud in the field of value added tax (VAT). (3) The proposal in fact constitutes an amendment of Council Regulation (EC) No 1798/2003 (4) on administrative cooperation in the field of value added tax, which has already been amended several times. However, for the sake of clarity and ease of comprehension, the Commission has chosen to use the recasting procedure, which means that Regulation (EC) No 1798/2003 will be repealed if the current proposal is adopted by the Council.

2. In the recasting procedure, the legislative discussion is in principle restricted to the substantive amendments proposed by the Commission and does not touch upon the ‘unchanged provisions’. (5) In this Opinion, however, the European Data Protection Supervisor (EDPS) will discuss the current Regulation and the proposed substantive amendments to it in their entirety. Such a full analysis is needed in order to properly assess the impact of the legislation on data protection. The EDPS will recommend adjustments which also relate to such unchanged provisions. The EDPS urges the legislator to take these recommendations into account despite the limited scope of the recasting procedure. In this respect the EDPS points at Article 8 of the Interinstitutional Agreement on the recasting procedure which provides for the possibility of amending unchanged provisions.

3. The legal basis of the proposal is Article 93 EC Treaty, which enables the Council to adopt measures regarding indirect taxation. The Council decides by unanimity on a proposal of the Commission and after the European Parliament and the European Economic and Social Committee have been consulted. The legal basis and the specific procedure will not change after the entry into force of the Lisbon Treaty.

4. The EDPS has not been consulted as required by Article 28(2) of Regulation (EC) No 45/2001. The current opinion is therefore based on Article 41(2) of the same Regulation. The EDPS recommends that a reference to this opinion is included in the preamble of the proposal.

5. The EDPS is aware of the importance of enhancing the effectiveness of measures against cross-border fraud and of achieving better collection of VAT in cross-border situations. Although the exchange of information, which is part of the administrative cooperation and the combating of VAT fraud, mainly involves information concerning legal persons, it is clear that data relating to natural persons are being processed as well. The EDPS acknowledges that in order to achieve these purposes it is necessary to process personal data. The EDPS underlines however that the processing of such data must be in conformity with the Community rules on data protection.

6. Situations which involve the trans-border exchange of personal data within the EU deserve special attention since they imply an increase in scale of the data processing which necessarily leads to legal uncertainty for the data subjects: actors from all other Member States can be involved, national laws of these other Member States might be applicable and might differ slightly from the laws data subjects are used to, or apply in a legal system which is unfamiliar to the data subject.

7. After having analysed the legal framework stemming from Regulation (EC) No 1798/2003 and the adjustments currently proposed, the EDPS concludes that, although several positive elements can be found, not all the requirements stemming from the Community rules on data protection are met.

8. Before explaining this point of view in greater detail in Part III (applicable data protection rules) and Part IV (detailed analysis of the proposal), the EDPS will in the next part first describe the context of the current proposal, the existing legal framework and the proposed adjustments.

II. EU COOPERATION IN THE FIELD OF VAT

II.1. Context

9. The current proposal results from a discussion at EU level which officially started in May 2006 by a Communication of the Commission on the fight against fiscal fraud in the internal market (6). Encouraged by the Council and the European Parliament, the Commission, in December 2008, published another Communication on a coordinated strategy to improve the fight against VAT fraud in the EU (7). The Communication announced several changes to the general VAT Directive 2006/112/EC (8) and also announced the current recast of Regulation (EC) No 1798/2003.

10. Regulation (EC) No 1798/2003 has so far been the reference Regulation for administrative cooperation on VAT issues. However, according to a recent study conducted by the Commission which was published on 18 August 2009, the same day as the current proposal, the intensity of the administrative cooperation between Member States to cope with intra-Community VAT evasion and fraud was considered to be unsatisfactory (9). The principal aim of the current proposal therefore is to adjust Regulation (EC) No 1798/2003 in such a way that the effectiveness of measures against cross-border fraud will be enhanced and that better collection of VAT in cross-border situations will be achieved.

II.2. The current system of cooperation: Regulation (EC) No 1798/2003

11. With Regulation (EC) No 1798/2003 the EU introduced a common system of administrative cooperation and exchange of information between competent authorities of the Member States to enable them to effect a correct assessment of VAT. The Regulation contains a list of competent authorities and obliges Member States to designate a single central liaison office which is responsible for contacts with other Member States in the field of administrative cooperation.

12. Information exchange between competent authorities takes place in three situations: exchange of information upon request, exchange of information without prior request (spontaneous exchange), and storage of data in an electronic database maintained by each Member State, a part of which can directly be accessed by the competent authorities of other Member States.

13. Regulation (EC) No 1798/2003 furthermore orders the Member States to ensure that persons involved in the intra-Community supply of goods and of services are allowed to obtain confirmation of the validity of the VAT identification number of any specified person. The system which enables these persons to do so is known as the VAT information exchange system (the VIES).

14. In general, the Regulation prescribes that communication of information should take place by electronic means. The Commission is thereby responsible for the development of a common communication network or common system interface (the CCN/CSI) as far as this is necessary to permit the exchange of information between Member States. The Member States are responsible for the development of their national systems as far as is necessary to permit information to be exchanged using the CNN/CSI. The Regulation contains further rules on relations with the Commission, simultaneous controls and the exchange of data which originates from third countries.

15. The kind of information which can be exchanged between the competent authorities upon request or spontaneously is not defined. Article 1 of Regulation (EC) No 1798/2003 only refers to ‘any information’ that may help them to effect a correct assessment of VAT. The electronic database contains the recapitulative statements of taxable persons identified for VAT purposes which are collected in accordance with the general VAT Directive. These statements contain VAT identification numbers of the different taxable persons involved and the total value of the supplies of goods carried out by the taxable person. The VIES only allows for the confirmation of the validity of a VAT identification number.

II.3. The envisaged improvements in general terms

16. With the current proposal the Commission envisages enhancing the effectiveness of the current cooperation by making competent authorities jointly responsible for the protection of VAT revenues in all Member States, by advancing the exchange of information between the competent authorities and by improving the quality and consistency of this information (10).

17. Improvement of the exchange of information between member states is achieved by defining the cases in which competent authorities may not refuse to reply to a request for information or for an administrative enquiry and by specifying the cases in which information must be exchanged spontaneously (11). The proposal furthermore introduces stricter deadlines and puts more emphasis on the use of electronic means.

18. The consistency of the information available in the electronic databases is enhanced by defining which kind of information the Member States are obliged to put in their national database. The proposal furthermore increases direct automated access to the electronic databases by competent authorities of other Member States. The information available to other taxable persons through the VIES is supplemented by the name and address of the person who is registered with a VAT identification number.

19. The proposal furthermore specifies the cases in which Member States may and must conduct multilateral controls. On top of that it creates a legal basis for the setting up of a common operational structure for multilateral cooperation (Eurofisc). This system should allow a fast exchange of targeted information between all Member States as well as the setting up of common risk and strategic analyses.

20. The proposal finally introduces a feedback requirement which enables Member States to assess the effectiveness of the information exchange.

21. A number of issues will be further elaborated in accordance with a Comitology procedure. These are for instance the standard forms used when competent authorities request information, the way in which the feedback requirement is arranged, the criteria that are used to decide whether changes are to be made to the data stored in the electronic database and to the setting up of Eurofisc.

III. APPLICABLE DATA PROTECTION RULES

22. In case personal data are being processed, Community legislation on data protection should be complied with. In the data protection legislation ‘personal data’ is broadly defined as ‘any information relating to an identified or identifiable natural person’ (12). As stated before, the exchange of information in the current context is mainly directed towards legal persons. It will, however, contain information relating to natural persons as well. The term ‘any information’ contained in Article 1(1) of the proposed Council Regulation seems to include even further information about natural persons working for or otherwise connected to the legal persons (see also point 31 below).

23. For data processing by the Member States, the national rules implementing Directive 95/46/EC are applicable. Reference to Directive 95/46/EC is made twice in the current Regulation (EC) No 1798/2003, namely in recital 17 and Article 41. The EDPS notes that these provisions only refer to Directive 95/46/EC in relation to the possibility to restrict certain rights which are guaranteed by the Directive. The recital and the Article reappear in the Commission proposal (as recital 35 and Article 57) but will undergo some changes, which will be discussed in greater detail in point 49 and further below. At this stage it is relevant to point at the fact that the Commission proposes to insert a general sentence into Article 41 (the new Article 57) stating that ‘[a]ll storage or exchange of information referred to in this Regulation is subject to the provisions implementing Directive 95/46/EC’. The EDPS welcomes this insertion and encourages the legislator to insert such a statement in the recital as well.

24. Although the Commission is not directly involved in the data exchange between the competent authorities, Article 51(2) shows that the Commission will receive ‘any available information relevant to the application of this Regulation’, ‘statistical data’, and ‘any other information’ that may help to effect a correct assessment of VAT as referred to in Article 1. (13) As mentioned earlier in point 14, the Commission is furthermore responsible for ‘whatever development of the CCN/CSI is necessary’ to permit the exchange of information between Member States (Article 55). As becomes clear from Article 57(2) this responsibility may under certain conditions involve access to the information which is exchanged through the system.

25. It follows from the foregoing that the Commission will be processing personal data as well. It is thereby bound by the data protection rules applicable to EU institutions and bodies which are laid down in Regulation (EC) No 45/2001 and subject to the supervision of the EDPS. For the sake of clarity and in order to prevent any doubt on the applicability of the Regulation, the EDPS urges the legislator to include a reference to the Regulation in the recitals as well as in a substantive provision.

26. If personal data are processed, Article 16 and 17 of Directive 95/46/EC and Article 21 and 22 of Regulation (EC) No 45/2001 require that the confidentiality and security of the data processing is ensured. It is not stated in so many words in the just cited Article 55 whether the Commission is responsible for the maintenance and security of the CCN/CSI (14). In order to avoid doubts about the responsibility for ensuring such confidentiality and security, the EDPS urges the legislator to define more clearly the responsibility of the Commission in this respect, to emphasise the obligations of the Member States and to put this all in the light of requirements stemming from Directive 95/46/EC and Regulation (EC) No 45/2001.

27. Bringing clarity to who will be responsible for compliance with data protection rules (in data protection terminology referred to as the ‘controller’ (15)), is also important with regard to the establishment of Eurofisc. Article 35 explains that Eurofisc will be composed of competent officials designated by the competent authorities of the Member States. The Commission will provide Eurofisc with technical, administrative and operational support. The proposed structure raises questions as to the applicable data protection law (Directive 95/46/EC or Regulation (EC) No 45/2001) and to the responsibility for compliance with these rules. Does the Commission intend to keep Member States responsible either alone or in combination with the Commission, or will Eurofisc as such, and perhaps in combination with the Commission, be the responsible authority? The EDPS calls upon the legislator to clarify these issues and to ensure that responsibilities will be clearly allocated.

IV. DETAILED ANALYSIS OF THE PROPOSAL

IV.1. Data and purpose specification and ensuring the necessity of data processing

28. The EDPS notes that the proposal does not sufficiently specify the kind of data that are exchanged and the purposes for which the data are exchanged. The proposal furthermore does not sufficiently ensure that personal data are only exchanged when necessary. This is all illustrated by Article 1(1) of the proposed Council Regulation.

29. Article 1(1) contains the overall purpose of the Regulation which is to ensure compliance with national VAT laws. This must be achieved through cooperation between Member States and the exchange of any information between the competent authorities of the Member States that may help to effect a correct assessment of VAT, monitor the correct application of VAT particularly on intra-Community transactions and combat fraud.

30. Article 1(1) as such would not meet the requirements stemming from the Community rules on data protection since it is formulated too broadly and leaves too much room for discretion. This creates the risk of substantial non-compliance with applicable data protection rules in practice.

31. Firstly, the notion of ‘any information’ is very broad and entails the risk of disproportionate information exchange. As said, it seems to include even further information about natural persons working for or otherwise connected to the legal persons. In this respect, the EDPS wishes to point at the provisions which deal with special categories of data and which contain specific and stricter rules for processing of data relating to offences, criminal convictions, administrative sanctions or judgments in civil cases (16).

32. Secondly, the purposes for which information can be exchanged are very general, which is contrary to the requirement that the purpose must be specified and made explicit (17).

33. Thirdly, according to Article 1(1), information can be exchanged when it ‘may help’ the competent authority in another Member State. If personal data are involved, this would be in conflict with the requirement that data are only processed in so far as it is necessary to achieve the set purpose (18). Without precise knowledge of what kind of personal information is involved and without a further specification of the purposes, it is in any case impossible to assess the necessity of the exchange.

34. Some further specification of the purpose and of the kind of information which can or will be exchanged — at least in main lines or categories — is therefore needed in order for the exchange to be compliant with the data protection requirements. It should thereby also be assured that the necessity principle is complied with.

35. When looking at Regulation (EC) No 1798/2003 in its entirety and the proposed amendments to it, the EDPS notes that further specifications are not or at best only partly provided for. The EDPS will elaborate further on this point of view below. A distinction will thereby be made between the different processing operations that take place: information exchange upon request, spontaneously information exchange, availability of information through the electronic database for competent authorities, information available to other VAT registered persons (the VIES) and processing of data by Eurofisc.

Information upon request

36. As regards information upon request, no further specifications are made as to the kind of information exchanged or to the purposes for which the exchange takes place. Article 7 refers to the ‘information referred to in Article 1’ and states that this includes ‘any information relating to a specific case or cases’. A request for information can lead to the performance of an administrative enquiry. In Article 9 reference is furthermore made to the transfer of ‘any pertinent information’. It is not clarified what kind of information it may entail. The purposes for which the data may be processed are not further specified and the requirement of necessity is not mentioned.

37. The EDPS urges the legislator to specify the kind of personal information that can be exchanged, to circumscribe the purposes for which personal data can be exchanged and assess the necessity of the transfer, or at least assure that the necessity principle is respected.

Spontaneous exchange of information

38. For the spontaneous exchange of information it is defined in which cases the Member State shall forward information to another competent authority. With regard to the kind of information that shall be exchanged reference is again made to Article 1(1). Article 14(1) mentions the following cases: 1. where taxation is deemed to take place in the Member State of destination and the information provided by the Member State of origin is necessary for the effectiveness of the control system of the Member State of destination; 2. where a Member State has grounds to believe that a breach of VAT legislation has been committed or is likely to have been committed in the other Member State; 3. where there is a risk of tax loss in the other Member State. Although especially the second and third situation are still broad, these three cases could in principle be regarded as further specifications of the purposes for which data are exchanged. The first situation thereby even incorporates the necessity principle. However, spontaneous exchange of information is not restricted to these three situations. Article 15 states that any information referred to in Article 1 of which competent authorities are aware and which ‘may be useful’ to the competent authority of another Member States shall spontaneously be forwarded as well.

39. The proposed changes in fact broaden the provisions which are currently in place. Article 18 of Regulation (EC) No 1798/2003 states that the exact categories of information to be exchanged spontaneously have to be defined in accordance with the Comitology procedure. The Commission now proposes to delete this provision.

40. The EDPS again urges the legislator to specify the kind of personal information that can be exchanged, to circumscribe the purposes for which personal data can be exchanged and assess the necessity of the transfer, or at least assure that the necessity principle is respected.

Availability of data through the electronic database

41. With regard to the information available to competent authorities through the electronic database, the proposal is more specific as regards the kind of information contained in the database. Article 18 provides a list of information which shall be stored and processed in the electronic database. It concerns information collected pursuant to the general VAT Directive 2006/112/EC which is information gathered through the recapitulative statements and information collected by national authorities for the registration of non-established taxable persons supplying electronic services to other non-taxable persons. Other information in the database are the identity, activity or legal form of persons to whom a VAT identification number has been issued and the history of information exchanges upon request or spontaneously concerning these persons. The list and details of the data which are not collected pursuant to the VAT Directive shall be adopted in accordance with the Comitology procedure.

42. As from 1 January 2015, also information on persons supplying services will be put in the database, amongst which data on the turnover of these persons and information on compliance by these persons with their tax obligations, for example late submission of returns or existence of tax debts (see Article 18(3)).

43. Article 22 obliges the Member States to grant competent authorities from other Member States automated access to the information contained in the electronic database. The purposes for which the competent authorities will be able to consult the database are not further specified. This is a change to the current text of the Regulation in which it is laid down that competent authorities can have direct access to a limited part of the information and ‘solely in order to prevent a breach of VAT legislation’ and ‘wherever it considers it necessary for the control of intra-Community acquisitions of goods or intra-Community supplies of services’ (see the current Article 24).

44. By widening the possibility for competent authorities to access the database, the proposal increases the data protection risks. However, if the number of personal data fields stored in the electronic database is as limited as possible, this does not have to pose a problem from a data protection perspective. In that respect, the EDPS welcomes the specification of the data contained in the databases. The proposal, however, only states what information the Member States are obliged to store in the database and is silent on whether any other information can be put in the database as well and whether this information can also be accessed by other competent authorities. The EDPS therefore recommends the legislator to state explicitly that, in as far as personal data are concerned, no other data shall be put in the database, or to at least ensure that automated access is restricted to the categories of data mentioned. The EDPS furthermore urges the legislator to circumscribe the purposes for which the databases can be directly accessed and assure that the necessity principle is respected.

45. The part on data exchange through the electronic databases also contains rules which relate to the quality of the data. Article 20 states that Member States shall ensure that their databases are kept up to date and are complete and accurate. Article 23 provides for regular checks on the information in order to guarantee the quality and reliability of the information contained in the database. These requirements are fully in line with the data quality requirements of Article 6(1)(d) of Directive 95/46/EC and Article 4(1)(d) of Regulation (EC) No 45/2001. Article 20 furthermore announces that, through the use of the Comitology procedure, criteria shall be defined to determine which changes to the database are not pertinent, essential or useful and therefore need not to be made. The EDPS underlines that these criteria should be in line with data protection requirements (see also points 57-59 below).

46. Article 19 states that information in the electronic database shall be stored for at least five years from the end of the first calendar year in which access to the information was granted. There is no justification given for such a storage period. If personal data are involved, providing for a minimum period without any reference to the necessity principle is contrary to the requirement of the data protection legislation that data should not be stored longer than necessary. The EDPS therefore encourages to reassess this provision in light of the obligation stemming from Article 6(1)(e) of Directive 95/46/EC and Article 4(1)(e) of Regulation (EC) No 45/2001 and determine a maximum storage period in case personal data are concerned, with possible exceptions only in exceptional circumstances.

Information available through the VIES

47. Chapter IX of the proposal deals with information available to taxable persons. As explained in point 13 above, the VIES currently enables taxable persons to obtain confirmation of the validity of the VAT identification number under which a person has effected or received an intra-Community supply of goods or services. The Commission proposes to add a phrase stating that such confirmation is sought for the purpose of such transactions and furthermore to also provide the applicant with the name and address associated to the VAT identification number. The EDPS takes the view that these rules are in conformity with the data protection requirements.

Eurofisc

48. The Commission proposal creates a legal basis for the setting up of a common operational structure for multilateral cooperation (Eurofisc). The idea behind the structure is to allow for a fast exchange of targeted information between all Member States. The structure is intended to enable the performance of risk and strategic analyses on the basis of which multilateral exchange of information is promoted. In Article 36(2) it is stated that the arrangements for the exchange of information specific to the structure shall be determined in accordance with the Comitology procedure. In the chapter on which the structure should be established, no reference is made to any data protection requirements. The EDPS wishes to emphasise that — apart from the applicable law as discussed in part III above — the kind of personal information used should be specified, the purposes for which personal data will be investigated and exchanged must be circumscribed, and assurance should be given that the necessity principle is respected.

IV.2. Other elements with data protection relevance

Article 57: the purpose limitation principle

49. Chapter XV of the proposal deals with the conditions governing the exchange of information. The chapter contains provisions addressing the practicalities relating to the exchange of information. One article is of particular interest from a data protection point of view, namely Article 57. It states that persons dealing with information exchanged under the Regulation are bound by the obligation of official secrecy. Although in the fifth paragraph reference is made to Directive 95/46/EC (see below), the obligation of secrecy is not placed in light of data protection rules. The EDPS recommends the legislator to add a reference in the first paragraph to data protection legislation as well.

50. Paragraph 1 of Article 57 seems to introduce the use of data for other purposes than those previously referred to in the Regulation. Paragraph 3 explicitly allows for the use of information for ‘other purposes’ if, under the legislation of the Member State of the requested authority, the information can be used for similar purposes. In this respect, the EDPS points at the purpose limitation principle which is laid down in Article 6(1)(b) of Directive 95/46/EC and Article 4(1)(b) of Regulation (EC) No 45/2001. The EDPS underlines that if personal data are involved, these data can in principle not be used for other purposes than the one for which they were collected, unless strict conditions are satisfied under Article 13(1) of the Directive or Article 20(1) of the Regulation (see also points 51-53 below). The EDPS therefore requests the legislator to reassess this provision in the light of the purpose limitation principle as laid down in Article 6(1)(b) of Directive 95/46 and Article 4(1)(b) of Regulation (EC) No 45/2001.

Article 57(5): restriction of certain specific data protection rights and obligations

51. Recital 35 announces that for the purposes of the Regulation it is appropriate to consider limitations of certain rights and obligations laid down by Directive 95/46/EC. Reference is made to Article 13(1)(e) of the Directive which allows for such limitations. The proposal adds to this recital that these limitations are necessary and proportionate in view of the potential loss of revenue for Member States and the crucial importance of this information to effectively combating fraud.

52. The recital is elaborated in Article 57(5). After stating that all storage or exchange of information referred to in the Regulation is subject to the provisions implementing Directive 95/46/EC (see point 23 above), it continues by stating that ‘Member States shall, for the purpose of the correct application of this Regulation, restrict the scope of the obligations and rights provided for in Article 10, Article 11(1), Articles 12 and 21 of Directive 95/46/EC to the extent required in order to safeguard the interests referred to in Article 13(e) of that Directive’. The Articles referred to contain the obligation for the controller to inform the data subject (Article 10 and 11), the right of access to one's own information (Article 12) and the duty for the national data protection authority to keep a public register on data processing operations (Article 21).

53. The EDPS underlines that Article 13(e) of Directive 95/46/EC enables exemptions to certain provisions of the Directive and must be interpreted strictly. The EDPS acknowledges that in certain circumstances it could be considered as necessary for the purpose of tax fraud prevention and detection to temporarily set aside the duty to inform the data subject in advance and the right to obtain access to the information. However, Article 13 of Directive 95/46/EC requires that (i) such a restriction is laid down in a ‘legislative measure’ and that (ii) the restriction ‘constitutes a necessary measure to safeguard’ one of the interests listed. The current text of the proposed Article 57(5) does not reflect the first requirement since no reference is made to the required basis in law. The EDPS therefore urges the legislator to include this requirement in Article 57(5). The second requirement can be read into the phrase ‘to the extent required’. However, for the sake of consistency the EDPS recommends to replace this phrase by ‘if it constitutes a necessary measure’. The EDPS furthermore urges the legislator to reject the proposed additional sentence in recital 35 which states that the limitations are necessary and proportionate, since this sentence is too general and has no further legal value.

Transparency

54. Articles 10 and 11 of Directive 95/46/EC contain the obligation for the controller to inform the data subject before the data are collected or, in case the data are not obtained from the data subject, at the time of undertaking the recording of the data. These provisions can be considered as elaborations of the general principle of transparency which is part of the fairness of processing as required in Article 6(1)(a) of Directive 95/46/EC. The EDPS has noted that the proposal contains no further provisions which deal with the transparency principle, for instance on how the system is communicated to the public at large or how data subjects will be informed about the data processing. The EDPS therefore urges the legislator to adopt a provision in which the transparency of the cooperation and the supporting systems is dealt with.

Article 52: exchange of information with third countries

55. Article 52 foresees the possibility of information exchange with third countries. It states that ‘information obtained under this Regulation may be communicated to [a] third country, with the consent of the competent authorities which supplied the information, in accordance with their domestic provisions applying to the communication of personal data to third countries’. The EDPS is pleased to see that the legislator is aware of the special rules that apply to the exchange of personal data to countries outside the EU. For the sake of clarity an explicit reference to Directive 95/46/EC could be included in the text, stating that such a transfer should be in conformity with the domestic rules implementing the provisions of Chapter IV of Directive 95/46/EC which deals with the transfer of personal data to third countries.

56. The proposal only refers to the competent authorities of the Member States. It is unclear whether any exchange of (personal) information to third countries is also envisaged at European level. This is closely related to the questions raised in Part III above on the law applicable to the conduct of Eurofisc. A transfer of personal data to a third country by Community institutions or bodies must be in conformity with Article 9 of Regulation (EC) No 45/2001. The EDPS requests the legislator to clarify this.

Comitology

57. As becomes clear from the analysis above, there are several issues with data protection relevance which will be further elaborated in rules adopted following the Comitology procedure as laid down in Article 60 of the proposal (see points 41, 45 and 48 above). Although the EDPS understands the practical need for using such a procedure, he wishes to underline that the main data protection references and guarantees should be laid down in the basic law.

58. The EDPS wishes to emphasise that if further rules are discussed through Comitology, this should be done with the data protection requirements stemming from Directive 95/46/EC and Regulation (EC) No 45/2001 in mind. The EDPS furthermore urges the Commission to involve the EDPS and request his advice if further rules with data protection relevance are indeed discussed. This would for instance be the case with the setting up of Eurofisc (see point 48 above).

59. In order to ensure the involvement of the EDPS when further rules are adopted on the basis of the Comitology procedure which have data protection relevance, the EDPS recommends the legislator to include in Article 60 a third paragraph stating the following ‘where implementing measures relate to the processing of personal data the European Data Protection Supervisor shall be consulted’.

V. CONCLUSION AND RECOMMENDATIONS

60. The EDPS is aware of the importance of enhancing the effectiveness of measures against cross-border fraud and of achieving better collection of VAT in cross-border situations. The EDPS furthermore acknowledges that in order to achieve these purposes it is inevitable that personal data are processed. The EDPS underlines however that the processing of such data must be in conformity with the Community rules on data protection.

61. After an analysis of the legal framework stemming from Regulation (EC) No 1798/2003 and the adjustments currently proposed, the EDPS has concluded that, although several positive elements can be found, not all the requirements stemming from the Community rules on data protection are met.

62. In the current Opinion the EDPS has advised the legislator the following: — As regards the issue of the applicable Community legislation on data protection, to clarify the respective responsibilities of the Member States, the Commission and Eurofisc for compliance with these rules. — As regards the data exchange between competent authorities upon request or spontaneously, to specify the kind of personal information that can be exchanged, to circumscribe the purposes for which personal data can be exchanged and assess the necessity of the transfer, or at least assure that the necessity principle is respected. — With regard to the data exchange through the direct accessibility of the electronic databases, to state explicitly that, in as far as personal data are concerned, no other data, then the data already defined, shall be put in the database, or to at least ensure that automated access is restricted to the categories of data mentioned. And furthermore to circumscribe the purposes for which the databases can be directly accessed, to assure that the necessity principle is respected, and to determine a maximum storage period for keeping personal data in the database, with possible exceptions in exceptional circumstances. — With regard to Article 57 (and recital 35), — to add a reference in the first paragraph to the Community legislation on data protection, — to reassess paragraph 1 and 3 in the light of the purpose limitation principle as laid down in Article 6(1)(b) of Directive 95/46 and Article 4(1)(b) of Regulation (EC) No 45/2001, — to include in paragraph 5 the requirement contained in Article 13 of Directive 95/46/EC that a restriction of the obligations and rights mentioned should be laid down in a legislative measure, — to replace in paragraph 5 the phrase ‘to the extent required’ by ‘if it constitutes a necessary measure’, — to reject the proposed additional sentence in recital 35. — With regard to the principle of transparency, to adopt a provision in which the transparency of the cooperation and the supporting systems is dealt with. — As regards the exchange of data with third countries, to include an explicit reference to Chapter IV of Directive 95/46/EC in Article 52 and to clarify whether any exchange of personal information to third countries is envisaged by the Commission and/or by Eurofisc. — With regard to the rules adopted on the basis of Comitology, to add a third paragraph to Article 60 stating the following: ‘where implementing measures relate to the processing of personal data the European Data Protection Supervisor shall be consulted’.

Done in Brussels, 30 October 2009. Peter HUSTINX European Data Protection Supervisor

(1) OJ L 281, 23.11.1995, p. 31.

(2) OJ L 8, 12.1.2001, p. 1.

(3) COM(2009) 427 final of 18 August 2009.

(4) OJ L 264, 15.10.2003, p. 1.

(5) See the Interinstitutional Agreement of 28 November 2001 on a more structured use of the recasting technique for legal acts (OJ C 77, 28.3.2002, p. 1).

(6) Communication COM(2006) 254 of 31 May 2006 concerning the need to develop a coordinated strategy to improve the fight against fiscal fraud.

(7) See Council Conclusions of 4 December 2007 and 7 October 2008, Resolution of 2 September 2008 of the European Parliament (2008/2033(INI)). See Communication COM(2008) 807 of 1 December 2008.

(8) OJ L 347, 11.12.2006, p. 1.

(9) Report COM(2009) 428 of 18 August 2009 on the application of Regulation (EC) No 1798/2003.

(10) The proposal incorporates the changes to Regulation (EC) No 1798/2003 which are envisaged by Council Regulation (EC) No 143/2008 and which will apply as from 1 January 2015 (OJ L 44, 20.2.2008, p. 1). These changes introduce rules relating to the place of supply of services, the special schemes and the refund procedure for VAT.

(11) See the Explanatory Memorandum to the proposal on p. 4.

(12) See Article 2(a) of Directive 95/46/EC and Article 2(a) of Regulation (EC) No 45/2001. See Opinion 4/2007 of 20 June 2007 of the Article 29 Working Party for an explanation of the concept of ‘personal data’ (available at http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2007/wp136_en.pdf).

(13) See also point 28 and further. In the remainder of this Opinion all references to recitals and Articles refer to those of the proposal, unless stated otherwise.

(14) See for relevant comments also the EDPS Opinion of 16 September 2008 on the proposal for a Council Decision on the establishment of the European Criminal Records Information System (ECRIS) (OJ C 42, 20.2.2009, p. 1), point 23 and further.

(15) See Article 2(d) of Directive 95/46/EC and Article 2(d) of Regulation (EC) No 45/2001. Both provisions envisage the possibility of single and joint control (‘… alone or jointly with others …’).

(16) See Article 8(5) of Directive 95/46/EC and Article 10(5) of Regulation (EC) No 45/2001.

(17) See Article 6(1)(b) of Directive 95/46/EC and Article 4(1)(b) of Regulation (EC) No 45/2001.

(18) See Article 7 of Directive 95/46/EC and Article 5 of Regulation (EC) No 45/2001.