C 199/6
EN
Official Journal of the European Union
7.6.2023
1.
INTRODUCTION
1.
On 8 December 2022, the European Commission issued a Proposal for a Council Directive (EU) amending Directive 2011/16/EU on administrative cooperation in the field of taxation (‘the Proposal’) (3).
2.
The objectives of the Proposal are (4): — to introduce provisions for the reporting, due diligence and exchange of information on certain crypto-assets and e-money; — to introduce the obligation for the competent authorities of the Member States to exchange information on tax rulings with a cross-border element concerning high net worth individuals; — to introduce provisions on penalties to be applied to infringements of the national provisions transposing Directive 2011/16/EU (‘the Directive’)
3.
The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 9 February 2023, pursuant to Article 42(1) of EUDPR.
The EDPS welcomes the reference to this consultation in recital 43 of the Proposal.
The EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.
4.
CONCLUSIONS
32.
In light of the above, the EDPS makes the following recommendations: (1) to indicate that the Proposal ensures full respect for the right of protection of personal data laid down in Article 8 of the Charter and to recall the applicability of GDPR and the EUDPR to the processing of personal data in the context of the Proposal; (2) to clarify that the reuse of personal data by the competent authority of each Member State may only be allowed if it is grounded in Union or Member State law which lays down a list of purposes for which the further processing may be lawfully authorised constituting a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1) GDPR and to provide in the Proposal itself an (exhaustive) list of purposes for which personal data might be further processed; (3) to amend the enacting terms of the Proposal to clarify which specific obligations of the Commission under the Directive warrant access to the information recorded in the central directory; (4) to delete the last two sentences of Article 8ad(10) as provided in Article 1(6) of the Proposal; (5) concerning Article 25(3) of the Directive as it would be amended by the Proposal, to clearly indicate in which cases the entities involved in the processing shall be considered as a controller (alone) and when they shall be considered as joint controllers; (6) to provide for a maximum period of storage duration and to specify that the records of information received through the exchange of information must be deleted after the maximum data retention period, or earlier, if they are no longer necessary.
Brussels, 3 April 2023.
Wojciech Rafał WIEWIÓROWSKI
(3) COM(2022) 707 final.
(4) COM(2022) 707 final, p. 1.