text: COM(2026)308 final.

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2026)308 final. 4 COM(2026)308 final, p. 1. Council Conclusions on a tax decluttering and simplification agenda which contributes to the EU's competitiveness, 11 March 2025, FISC 44 ECOFIN 232. 6 COM(2026)308 final, p. 3.

text: COM(2026)308 final, p. 10. 8 Article 28 of the Proposal. 9 Article 36 of the Proposal. 10

text: Directive (EU) 2024/1640

text: of the European Parliament and of the Council of 31 May 2024 on the mechanisms to be put in place by Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Directive

text: (EU) 2019/1937

text: , and amending and repealing

text: Directive (EU) 2015/849

text: (Text with EEA relevance), OJ L, 2024/1640, 19.6.2024, ELI: http://data.europa.eu/eli/dir/2024/1640/oj. 11 Article 39 of the Proposal.

text: Article 30 of the Proposal. The external evaluation (Rambøll Management Consulting A/S, Evaluation of the Directive 2011/16 and its Amendments, Final Report – Volume 1 Main Text, issued 11 January 2024) defines quality by reference to whether the required elements are “correct, consistent, and reliable”; for DAC1 and DAC2 this expressly includes identifying elements needed to link records to the right taxpayer (cf. ibid., page 88). The Commission SWD (Commission Staff Working Document Evaluation Accompanying the document Report from the Commission to the European Parliament and the Council on the evaluation of

text: Council Directive 2011/16/EU

text: on administrative cooperation in the field of taxation, SWD(2025) 365 final), likewise identifies missing, incorrect and inconsistent information as affecting usability and stresses the importance of data-quality checks (page 26 and 46). The external evaluation further highlights that “the completeness, quality, and timeliness of the exchanges determine the usability of the information by the receiving tax authority” (page 88) and defines completeness in terms of both scope and granularity. The Commission's 2025 report (Report from the Commission to the European Parliament and the Council on the evaluation of

text: Council Directive 2011/16/EU

text: on administrative cooperation in the field of taxation, 19.11.2025, COM(2025) 695 final) highlights that “timeliness, completeness and quality” are the three main drivers of effectiveness because they influence Member States' ability to use the information received (page 3). The Commission Staff Working Document (SWD(2025) 365 final) refers to matching as “critical element of AEOI” (page 27) and explains that it consists in matching the received information to the taxpayer concerned in the national database, thereby identifying the taxpayer; importantly, it points out that this process “is necessary to ensure that the data can be used for tax compliance purposes” (page 27). The external evaluation (considers actual data processing and use of data for tax control as a separate component in assessing whether DAC has increased Member States' capacity to combat tax fraud, evasion and avoidance. Empirically, it finds increasing use: all tax authorities reported using DAC1 and DAC2 information in recent years; risk assessment is the most common use, followed by audits and other tax-control activities. The Commission Staff Working Document (SWD(2025) 365 final, pages 29 last paragraph to 30) also highlights that not all Member States systematically use information received under DAC, due to shortages of staff and IT resources.

text: COM(2026)308 final, pp. 9 and 10.

text: COM(2026)308 final, p. 11; recital 26; Article 8(4) of the Proposal. 19 CJEU, Judgment of 8 December 2022, Orde van Vlaamse Balies and Others,

text: , EU:C:2022:963, paragraphs 27 and 29–30. Paragraph 29 in particular states: “The obligation laid down by

text: Article 8

text: ab(5) of amended Directive 2011/16 for a lawyerintermediary where he or she is, on account of the legal professional privilege by which he or she is bound by national law, exempt from the reporting obligation laid down in

text: Article 8

text: ab(1) to notify without delay other intermediaries who are not his or her clients of their reporting obligations under

text: Article 8

text: ab(6) of that directive, necessarily entails the consequence that those other intermediaries become aware of the identity of the notifying lawyer-intermediary, of his or her assessment that the arrangement at issue is reportable and of his or her having been consulted in connection with the arrangement.”; while paragraph 30 specifies also states that “In those circumstances and in so far as those other intermediaries do not necessarily have knowledge of the identity of the lawyer-intermediary and of his or her having been consulted on the reportable cross-border arrangement, the obligation to notify, laid down in

text: Article 8

text: ab(5) of amended Directive 2011/16, entails an interference with the right to respect for communications between lawyers and their clients, guaranteed in Article 7 of the Charter.” 20 CJEU, Judgment of 29 July 2024, Belgian Association of Tax Lawyers and Others,

text: , EU:C:2024:639, paragraphs 118–120. Paragraph 118 states that “In the light of those considerations, and of the unique position which they accord to the profession of lawyer within society and for the purposes of the proper administration of justice, it must be held that the solution thus adopted in the judgment of 8 December 2022, Orde van Vlaamse Balies and Others (

text: , EU:C:2022:963) as regards lawyers can extend only to persons pursuing their professional activities under one of the professional titles referred to in

text: Article 1(2)

text: (a) of Directive 98/5.” 21 Directive

text: of the European Parliament and of the Council of 16 February 1998 to facilitate practice of the profession of lawyer on a permanent basis in a Member State other than that in which the qualification was obtained, OJ L 77, 14.3.1998, pp. 36– 43.

text: See COM(2026)308 final, p. 12: “Article 36 of the proposal envisaged a new tool to be developed by the Commission that would allow for a digital and automated verification of the correctness of TIN. The tool will confirm whether a reported TIN corresponds to the reported taxpayer on the basis of the identifying information provided or indicate that no match could be established.” 23

text: Article 25

text: GDPR. 24

text: Article 36(3)

text: , point (a), of the Proposal. 25 See recital 94 of the Proposal. 26 This can be done either in Recital 95 or in the enacting terms of the Proposal.

text: Regulation (EU) 2024/1624

text: of the European Parliament and of the Council of 31 May 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (Text with EEA relevance), OJ L, 2024/1624, 19.6.2024, ELI: http://data.europa.eu/eli/reg/2024/1624/oj.

text: These rules could include: designation of the authorised users, role-based access on a need-to-know basis, logging of queries, prohibition of bulk extraction of data from the registers, retention limits for information copied from registers into tax authority systems, whether access is intended only for case-by-case verifications of high-risk cases, if access is intended for verifications of the application of DAC by Financial Institutions, and if so, for which cases. 29 Mutatis mutandis having regard to the rules on access to databases, e.g. on bulk extraction, logs, etc., since this provision concerns access to information rather than to databases. 30 The objective set out in recital 98 sets out the objective of

text: Article 38

text: as ensuring that information held at national level by administrative authorities in a Member State, and needed for tax purposes in another Member State, is available to be exchanged.

text: See

text: Article 89 (1)

text: GDPR and

text: Article 13

text: EUDPR, which state that: “Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.” 33 33 Referring among others to compliance with

text: Regulation (EC) No 223/2009

text: , and in particular to the principle of statistical confidentiality provided by

text: Article 2(1)

text: , point (e) of

text: Regulation (EC) No 223/2009

text: . 34 See for further guidance EDPB Guidelines 10/2020 on restrictions under

text: Article 23

text: GDPR Version 2.1, Adopted on 13 October 2021.

text: Recital 113. 36 In this regard, see Judgment of the European Court of human Rights, Ferrieri and Bonassisa v. Italy, 8 January 2026, “105. The Court concludes that even if there could be said to be a general legal basis for the impugned measures in Italian law, that law does not meet the quality requirements imposed under the Convention. In particular, even taking into account the Contracting States’ broad margin of appreciation in respect of bank data, that is to say purely financial information (see paragraph 58 above), and the importance of the aim of similar measures in the field of taxation (see paragraph 73 above), the Court considers that the domestic legal framework afforded the domestic authorities unfettered discretion with regard to both the conditions in which the contested measures could be implemented and the scope of those measures. At the same time, that framework did not provide sufficient procedural safeguards, as the contested measures were not subjected to a judicial or independent review. Therefore, the domestic legal framework did not provide the applicants with the minimum degree of protection to which they were entitled under the Convention. The Court finds that in these circumstances, it cannot be said that the interferences in question were “in accordance with the law” as required by

text: Article 8

text: § 2 of the Convention. 106. There has accordingly been a violation of Article 8 of the Convention.” [emphasis added].

identifier: EDPS yttrande 20/2026

amnesord:
Finance
Tax cooperation

title: EDPS Opinion 20/2026 on the Proposal for a Council Directive on administrative cooperation in the field of taxation (recast)

text: Opinion 20/2026

text: on the Proposal for a Council Directive on administrative cooperation in the field of taxation (recast)

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Council Directive on administrative cooperation in the field of taxation (recast) . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 24 June 2026, the European Commission issued Proposal for a Council Directive on administrative cooperation in the field of taxation (recast). The European Data Protection Supervisor supports the Commission's initiative to consolidate and improve the EU's framework for administrative cooperation in taxation (‘DAC recast’). The DAC recast presents an opportunity to strengthen data protection safeguards and provide greater legal certainty for both taxpayers and tax authorities. The usefulness of automatically exchanged tax information depends critically on its accuracy, completeness, correct attribution to taxpayers, and actual use for intended purposes. Better data protection safeguards can improve data quality, reduce unnecessary exchanges, and support effective use of information. Against this background, the EDPS recommends keeping the reference to the ‘foreseeable relevance’ of the exchange of information, as overarching interpretative principle of DAC. This principle contributes to ensuring that the exchange of personal data remains connected to a genuine tax-administration purpose and limited to what is necessary and proportionate. In the same vein, the EDPS recommends introducing further clarifications to ensure that the receiving Member State is identified in accordance with the relevant applicable criteria for the determination of the tax residence, in accordance with Union law and applicable international agreements. The EDPS welcomes the proposed strengthening of the feedback mechanism regarding information exchanged, as it is an important tool to improve data quality. The EDPS considers that the feedback mechanism should address both systemic issues and individual cases, including mismatches, duplicated data, or information not relevant to the framework's purposes. Access to financial and anti-money laundering databases and information, as provided by the Proposal, should remain limited to what is necessary and proportionate for defined DAC purposes, with appropriate safeguards, to be specified in the enacting terms of the Proposal. Similarly, access to pension-payment registers and databases should not result in unrestricted or general access and that access by tax authorities to types of personal data not needed for tax purposes is not allowed. The EDPS further recommends clarifying that the use of information exchanged under DAC for statistical purposes should, as a rule, rely on anonymised or effectively aggregated data. The Proposal represents an occasion to provide harmonization and clarifications on restrictions of data subjects’ rights. Instead of mandating the adoption of such restrictions to Member States in general terms, the EDPS recommends specifying those restrictions in the Proposal itself. To ensure storage limitation, the EDPS recommends specifying that the five-year retention period applies only insofar as continued retention remains necessary and proportionate for the purposes of the Directive, and to require periodic review of the continued necessity of data retention and the erasure or anonymisation of personal data where retention is no longer necessary.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 24 June 2026, the European Commission issued Proposal for a Council Directive on administrative cooperation in the field of taxation (recast) (‘the Proposal’).

text: 2. The objective of the Proposal is to consolidate and codify Directive

text: and its subsequent amendments into a single legal act, with a view to simplifying, clarifying and improving the functioning of the Union framework for administrative cooperation in direct taxation, without lowering the existing level of protection against tax fraud, evasion and avoidance .

text: 3. The Proposal follows up on the Council conclusions of 11 March 2025 on a tax decluttering and simplification agenda, in which the Council invited the Commission to review the existing EU tax framework and, in particular, to explore ways of simplifying the rules laid down in the Directive on Administrative Cooperation (‘DAC’), reducing the associated administrative burden and eliminating overlaps and inconsistencies .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 24 June 2026, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 111 of the Proposal. In this regard, the EDPS also 4 positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 5. The EDPS welcomes the Commission’s objective of consolidating, simplifying and improving the DAC. The DAC lays down rules and procedures for administrative cooperation among competent authorities of the Member States of the Union in the field of taxation and it is a key legal instrument for the enforcement of Member States’ laws concerning the taxes falling under the scope of the DAC.

text: 6. The EDPS notes that the majority of the provisions of the DAC (as legislative text currently applicable, including all amendments as introduced by amending legislation since 2011) remain unchanged in substance . The main targeted amendments introduced by the Proposal more directly having an impact on data protection are: (ii) the update of the notion of legal professional privilege in Article 8 of the Proposal; (iii) changes related to feedback on information exchanged ; (iii) amendments related to the Taxpayer Identification Number (TIN) verification tool ; (iv) amendments related to access by tax authorities to information to be hold and registers established under Anti-Money Laundering (AML) legislation: the interconnected central beneficial ownership register; the bank account registers; to information on real-estate property, referred to, respectively, under Article

text: and

text: of Directive (EU) 2024/1640 ; as well as to mechanisms, procedures, documents and information referred to in Chapter III (customer due diligence) and

text: Article 77

text: (record retention) of

text: Regulation (EU) 2024/1624

text: ; (v) the introduction of provisions on access to national registers and databases on pension payments ; 5 (vi) amendments related to the use of information communicated between Member States for statistical purposes .

text: 7. The EDPS highlights that the usefulness of information processed depends on whether the information is accurate , complete , matched with the correct taxpayer and used . The EDPS therefore welcomes measures intended to improve the effective use of exchanged information, the matching of the information to the taxpayer concerned (via the proposed TIN verification tool) and the strengthening of feedback mechanisms between competent tax authorities. These amendments should aim at ensuring at the same time the effectiveness of the information exchange and compliance with EU data protection laws and principles.

text: 8. The DAC recast also offers the occasion to further specify data protection safeguards. This can improve data quality, reduce unnecessary administrative exchanges, facilitate matching, support the effective use of information received and enhance citizens’ trust and mutual trust of tax administrations exchanging information for administrative cooperation. The following recommendations are limited to those provisions of the Proposal that are relevant from a data protection perspective.

text: 3. Foreseeable relevance

text: 9. The EDPS welcomes that the Proposal takes into account the data protection principles of necessity and proportionality. The Explanatory memorandum indicates that “the set of data elements to be transmitted to tax administrations are defined in a way to capture only the 6 minimum data necessary to detect non-compliant underreporting or non-reporting, in line with the GDPR obligations, in particular the data minimisation principle” . Recital 112 of the Proposal further recalls that Member States should ensure a high level of protection of fundamental rights in national procedures giving effect to the DAC and any limitations of those rights (notably, the rights enshrined in Article 7 and 8 and 47 of the Charter) must comply with the principle of proportionality in accordance with Article 52(1) of the Charter.

text: 10. However, the EDPS notes the deletion of the words “that is foreseeably relevant to” after the words “exchanging information” in Article 1(1) of DAC. The EDPS also notes that the reference to foreseeable relevance is kept in recitals 63-65 and Article 18 and 50 of DAC and added to Article 17 of the Proposal, on exchange of information on request.

text: 11. The EDPS considers that the criterion of ‘foreseeable relevance’, as overarching interpretative rule for the implementation of administrative cooperation, contributes to ensuring that the exchange of personal data remains connected to a genuine taxadministration purpose and limited to what is necessary and proportionate. Therefore, the EDPS recommends retaining the criterion of foreseeable relevance in Article 1(1) of the Proposal.

text: 4. Tax residence

text: 12. The DAC framework, and specifically

text: Article 3

text: , does not establish a Union-wide definition of tax residence, which can create divergences in how Member States exchange tax information. One should avoid situations where tax data is sent based solely on factual indicators, such as the address of the taxpayer, without applying the legal rules governing tax residence. Otherwise, personal data is likely to be shared with Member States that have no tax interest in receiving it, leading to unnecessary exchange of information. Conversely, personal data could be withheld from Member States that should legally be regarded as the taxpayer's Member State of residence.

text: 13. The DAC has traditionally relied on competent tax authorities to correctly identify the receiving Member State, based on information collected directly by tax authorities or received by tax authorities from other entities. Where another Member State's competent authority has previously made a determination concerning the taxpayer's tax residence, that determination should also be taken into account as a relevant element when determining the Member State(s) to which the information should be exchanged. This would help promote legal certainty and avoid inconsistent exchange outcomes resulting from assessments based solely on factual indicators, thereby supporting a consistent implementation of the DAC.

text: 14. The EDPS recommends that the Proposal introduce clarifications to ensure that the receiving Member State is identified on the basis of a legal assessment applying the relevant 7 criteria for the determination of tax residence, in accordance with Union law and applicable international agreements.

text: 5. Legal professional privilege

text: 15. The EDPS notes that the Proposal amends provisions of DAC concerning legal professional privilege to take account of the case-law of the Court of Justice of the European Union 18 19 (‘CJEU’) . In particular, in Orde van Vlaamse Balies and Others , the CJEU held that the protection afforded by Article 7 of the Charter to communications between lawyers and their clients covers both the content of legal advice and the existence of the lawyer-client relationship and, consequently, precludes an obligation on a lawyer exempted from reporting on grounds of legal professional privilege to notify another intermediary who is not his or her client of their reporting obligations. The CJEU subsequently clarified, in Belgian Association of Tax Lawyers and Others , that this specific protection only applies to persons pursuing their professional activities under one of the professional titles referred to in

text: Article 1(2)

text: (a) of Directive

text: 16. The Proposal adds in

text: Article 8(4)

text: , first sentence, after “intermediaries” the wording “which are lawyers and other professional that are legally authorised to ensure legal representation” as specifications of entities entitled to the right to a waiver from filing information on a reportable cross-border arrangement. The Proposal also adds - in the second sentence of

text: Article 8(4)

text: – “on the basis of them pursuing their professional activities under one of the professional titles referred to in

text: Article 1(2)

text: , point (a) of Directive

text: 17. The Proposal also adds a new sentence – as third sentence of

text: Article 8(4)

text: – specifying that each Member State must take the necessary measures to require other intermediaries 8 which are legally authorised to ensure legal representation, but do not pursue their professional activities under one of the professional titles referred to in

text: Article 1(2)

text: , point (a), of Directive

text: , to notify, without delay, any other intermediary or, if there is no such intermediary, the relevant taxpayer of their reporting obligations under paragraph 6.

text: 18. The EDPS understands that the proposed amendments, which aim at codifying the caselaw of the CJEU by exempting lawyers and other professionals falling under

text: Article 1(2)

text: , point (a) of Directive

text: from the obligation to file information in breach of their legal privilege or to notify other intermediaries who are not their clients, while maintaining the obligation to inform the taxpayer of their reporting obligations.

text: 6. Feedback on information exchanged

text: 19. The EDPS welcomes the proposed strengthening of the feedback mechanism in

text: Article 28

text: , to be provided by the competent tax authority “at least” once a year and “with the technical support of the Commission as provided for in Article

text: and

text: 20. Feedback from receiving competent authorities is an important tool to improve data quality, as well as relevant and effective use of information exchanged under DAC, allowing tax administrations participating in the information exchange to identify information that is incorrect, duplicated, not matchable or not relevant.

text: 21. The EDPS recommends specifying in a recital of the Proposal that feedback should cover both systemic issues and, where appropriate, individual cases, including cases where information received could not be matched with a taxpayer, does not concern a resident taxpayer of the receiving Member State, is duplicated, or otherwise appears not to be necessary for the purposes of DAC.

text: 22. The EDPS further recommends that the Proposal specify the follow-up actions to be taken based on feedback received. Where a competent authority receives substantiated feedback indicating that information concerning a particular taxpayer is inaccurate, duplicated or not relevant, this authority should take appropriate steps to verify the information, correct it, or prevent repeated exchange of inaccurate or non-relevant information. The EDPS recommends adding to Article 28 of the Proposal an obligation requiring tax authorities to communicate to the tax authority of another Member State such inaccuracies or duplication, as well as the actions taken as follow up to the feedback received.

text: 23. The EDPS notes that the Commission is empowered under Article

text: and

text: to adopt implementing acts to establish, respectively, standard forms and linguistic arrangements for the automatic exchange of information, and practical arrangements for communication of information (also covering the communication of feedback). The EDPS recalls that, pursuant to

text: Article 42(1)

text: EUDPR, the Commission is required to consult the EDPS on these implementing acts. 9

text: 7. TIN verification tool

text: 24. The EDPS notes that

text: Article 36(1)

text: , as amended by the Proposal, introduces the Taxpayer Identification Number (TIN) verification tool, which would not be limited to verifying the syntactical correctness of a TIN but would be capable of verifying the validity of the TIN and its correspondence to the taxpayer .

text: 25. The EDPS welcomes the objective of improving data quality and reducing mismatches or non-matches by tax authorities pursued by the TIN verification tool.

text: 26. Article 36(2) of the Proposal specifies that confirmation of the validity of the TIN “may be requested only for the purposes of validation of the correctness of data”. The EDPS also welcomes this safeguard.

text: 27. The EDPS also notes that, as specified in

text: Article 36(1)

text: , second sentence, the technical parameters of the tool would be set out by the Commission in implementing acts. The EDPS expects to be consulted on these implementing acts pursuant to

text: Article 42(1)

text: EUDPR. As regards the design of the TIN verification tool, the EDPS highlights that data protection by design and by default should be a guiding principle and that data minimisation should be ensured both regarding the information submitted in a query and the information returned by the TIN verification tool. The EDPS expects these aspects to be addressed in the forthcoming implementing acts.

text: 28. Article 36(3) of the Proposal provides that a reduced set of identification data (only the name and the verified TIN of the taxpayer concerned) may be transmitted by a reporting entity to the tax authority where the confirmation of the validity of the TIN is obtained by means of the TIN verification tool ; or the taxpayer was identified through one of the through a government verification service or equivalent EU services or the EUID attributed in accordance with Directive 2017/1132. The EDPS welcomes this provision which implements the data minimisation principle.

text: 29. The EDPS understands that the justification for the reduced set of identification data to be transmitted to the tax authority by the reporting entity is that, where the TIN has been reliably verified, the tax authority would not need to carry out additional matching for the purpose of identifying the taxpayer . In this regard, the EDPS recommends clarifying that the second derogation provided for in

text: Article 36(3)

text: (b) requires both the reliable identification of the taxpayer using the government verification services, equivalent EU services, or the EUID, and the verification that the TIN reported corresponds to that same taxpayer . 10

text: 8. Access by tax authorities to registers and procedures established and information to be held under AML legislation

text: 30. The EDPS notes that the Proposal introduces a new

text: Article 38

text: , providing for access by tax authorities for administrative cooperation purposes to: the interconnected central beneficial ownership register; the bank account registers; information on real-estate property, referred to, respectively, under Article

text: and

text: of Directive (EU) 2024/1640; as well as to mechanisms, procedures, documents and information referred to in Chapter III (customer due diligence) and

text: Article 77

text: (record retention) of

text: Regulation (EU) 2024/1624

text: Article 38(1)

text: provides tax authorities with immediate and direct access free of charge to information allowing the timely identification of beneficial owners of legal entities and of legal arrangements via interconnected central beneficial ownership registers referred to in

text: Article 10 of Directive (EU) 2024/1640

text: Article 38(2)

text: provides tax authorities with the power to access and search, directly and immediately, bank account information available through the bank account registers referred to in

text: Article 16(1) of Directive (EU) 2024/1640

text: Article 38(3)

text: provides for immediate and direct access free of charge to real-estate information via the Single Access Point (SAP) to be established in each Member State under

text: Directive (EU) 2024/1640

text: Article 38(4)

text: provides for immediate and direct access to information referred to in Chapter III (customer due diligence) and

text: Article 77

text: (record retention) of

text: Regulation (EU) 2024/1624

text: 35. The EDPS notes that the access modalities, the scope of the information to be accessed, and a number of technical safeguards are specified by

text: Directive (EU) 2024/1640

text: with regard to procedures for access to such registers for AML/CFT purposes. In particular,

text: Directive (EU) 2024/1640

text: establishes the interconnected central beneficial ownership registers, as well as the obligation for Member States to establish the Single Access Point (SAP) for realestate information, laying down provisions on data fields, interconnection, accuracy, authentication and technical specifications.

text: 36. With regard to the possibilities to access information, including personal data, provided under

text: Article 38(1)

text: (2) and (3) of the Proposal, as well as to access provided under

text: Article 38(4)

text: , the EDPS notes that the Proposal does not lay down the specific tax-related purposes for which the information obtained may be used, or the conditions under which tax authorities should exercise access to these registers. The EDPS therefore recommends that the Proposal should explicitly specify for which DAC obligations or forms of administrative 11 cooperation under DAC (including if automated, upon request, spontaneous) such access is allowed; what type of personal data would be needed according to the specific purpose of the administrative cooperation; and lay down rules governing access to these registers .

text: 37. With regard to access by tax authorities to the mechanisms, procedures, documents and information referred to in Chapter III (customer due diligence) and

text: Article 77

text: (record retention) of

text: Regulation (EU) 2024/1624

text: , the EDPS considers that such access – provided under Article 38(4) of the Proposal as “immediate and direct and in a digital format” – should also be better specified in the Proposal, making reference to the specific tax-related purposes and the conditions under which tax authorities may have such access, in line with set out above in this Section .

text: 9. Access to national registers and databases on pension payments

text: 38. Article 39 of the Proposal provides that Member States must ensure that tax authorities have direct and expeditious access to the information necessary for the relevant purposes which is held in existing national registers and databases concerning payments of pensions, in accordance with the conditions laid down by national law .

text: 39. Unlike Article 38 of the Proposal, this access right is not merely an integration into the DAC of access to the registers and procedures established under anti-money laundering legislation. It creates an EU-law obligation to give tax authorities access to national pension-payment registers and databases held by other public authorities.

text: 40. The EDPS acknowledges that timely access to pension-payment information may be necessary to ensure the effective automatic exchange of pension-income information under the Directive. Pensions are a category of income for which Member States must communicate information by automatic exchange, and the relevant data may be held by public authorities other than tax authorities, particularly in Member States where the payment or administration of pensions is not organised through the tax administration.

text: 41. However, the EDPS recommends clarifying that “direct and expeditious access” should not be understood as unrestricted or general access to pension databases. Where direct access is provided, it should be limited to secure, query-based access by authorised officials for a 12 specific purpose under the Directive, dependent on granting access by the pension authority in each case, and subject to access controls, logging, audit and supervision.

text: 42. The EDPS further recommends specifying in Article 39 of the Proposal the categories of personal data that may be accessed when accessing national registers and databases on pension payments. Access should be limited to: data strictly necessary for the administrative cooperation exchange on tax matters (e.g., access should not concern nontax-relevant information, such as medical data, disability assessments, social-assistance records, or family circumstances); verification and follow-up of pension-income information under DAC, such as the identity of the pension recipient, the paying authority, the amount and period of the pension payment and other tax-relevant information strictly required for the purposes of the DAC.

text: 43. Moreover, the EDPS considers that the reference to “conditions laid down by national law”, in Article 39 of the Proposal, should be better specified. Since Article 39 of the Proposal would create an EU-law obligation to provide access to personal data, the EDPS considers that the Directive should itself lay down minimum safeguards to operationalise the principles of purpose limitation, data minimisation, and data protection by design, including restrictions to authorized users, logging that requires specification of the purposes of the access, and retention limits for data accessed by the tax administration.

text: 10. Use of information for statistical purposes

text: 44. Article 30(1) of the Proposal allows the use of information communicated between Member States pursuant to the Directive for the assessment, administration and enforcement of the national law of Member States concerning the taxes referred to in

text: Article 2

text: , as well as VAT, other indirect taxes, customs duties and anti-money laundering and countering the financing of terrorism. It also allows use for other taxes and duties covered by Directive

text: , compulsory social security contributions, certain judicial and administrative proceedings, and, as newly proposed, statistical purposes, namely, to allow a regular evaluation by the Commission of the effectiveness of administrative cooperation under the DAC .

text: 45. Under the GDPR and the EUDPR, further processing of personal data for statistical purposes is not considered to be incompatible with the original processing purposes, provided the conditions in Article 89(1) of the GDPR and Article 13 of the EUDPR are satisfied. In particular, these provisions stipulate that when personal data are (further) processed for statistical purposes, those data shall in principle be rendered anonymous (or 13 alternatively pseudonymous), provided that the statistical purpose is fulfilled in this manner .

text: 46. Against this background, the EDPS recommends specifying in recital 107 of the Proposal that the data provided under Article 30 of the Proposal should be aggregated to such a degree that individuals cannot be identified. For the sake of legal certainty, the EDPS recommends making specific reference to compliance with the safeguards relating to processing of personal data for statistical purposes under Article 89 of the GDPR and Article 13 of the EUDPR, in particular that the data should in principle be rendered anonymous.

text: 11. Restriction of data subjects’ rights

text: 47. Substantially unaltered by the Proposal,

text: Article 40(1)

text: and (2) require Member States to restrict data subjects’ rights pursuant to

text: Article 23(1)

text: (e) GDPR and

text: Article 25(1)

text: (c) and (g) EUDPR, without defining the extent to which such restrictions are necessary to safeguard the interests pursued.

text: 48. The EDPS considers that

text: Article 40(1)

text: and (2) should not provide for a blanket rule requiring Member States and the Commission to restrict data subjects’ rights. Any restriction of the rights provided for in Articles

text: and

text: GDPR or in Article

text: and

text: EUDPR should remain exceptional, be provided for by law, respect the essence of the rights concerned and be necessary and proportionate in a specific case or in clearly defined categories of cases, and lifted when the reasons justifying such restriction no longer apply .

text: 49. Moreover, the EDPS does not see a reason why the derogation to

text: Article 14

text: GDPR and 16 EUDPR would be limited to their first paragraph, while such limitation would apply to the entire

text: Articles 13

text: GDPR and 15 EUDPR. Therefore, the EDPS recommends replacing the reference to

text: Article 14(1)

text: GDPR with

text: Article 14

text: GDPR and the reference to

text: Article 16(1)

text: EUDPR with

text: Article 16

text: EUDPR.

text: 50. Furthermore, the EDPS recalls that according to

text: Article 23

text: GDPR and 25 EUDPR, any legal act or internal rule referred to in paragraph 1 of these provisions must contain specific provisions, where relevant, as to: the purposes of the processing or categories of processing; the categories of personal data; the scope of the restrictions introduced; the safeguards to prevent abuse or unlawful access or transfer; the specification of the controller or categories 14 of controllers; the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing; and the risks to the rights and freedoms of data subjects.

text: 51. In the same vein, the lack of a common provision in the Proposal restricting data subjects’ rights could lead to divergent restrictions across the various Member States and result in inconsistencies within the Union regarding the restriction of data subjects’ rights, depending on the Member State in which they are subject to tax obligations. Such divergent national approaches weaken the argument that broad restrictions are necessary in all cases. The EDPS therefore recommends specifying the derogation to the rights mentioned in

text: Article 40

text: directly in the Proposal itself. Alternatively, the EDPS recommends deleting the obligation for Member States to introduce restrictions to data subject rights (as the possibility of introducing such restrictions in any event exists under the GDPR).

text: 52. Additionally, the EDPS notes that the Proposal introduces a new recital , specifying that “[..] while the effectiveness of administrative cooperation requires that certain investigative steps may, where justified, be taken without prior notification to the taxpayer concerned, Member States should ensure, in accordance with their obligations, inter alia, under the European Convention on Human Rights, that persons whose rights are affected by investigative or disclosure measures connected with the implementation of this Directive have access, under national law, to effective review by a court or by an independent and impartial body competent to examine, within a reasonable time, the legality of the measure, including compliance with the applicable conditions relating to its justification, scope and any relevant privileges or protections” .

text: 53. However, the EDPS considers that, where fulfilment of the obligation and rights provided for in Articles

text: and

text: GDPR would not prejudice tax investigations or enforcement actions by tax authorities in the meaning of

text: Article 23(1)

text: (e) GDPR and

text: Article 25(1)

text: (c) and(g) EUDPR, data subjects should obtain information mentioned in Articles

text: and

text: GDPR and Articles

text: and

text: EUDPR, for instance about the categories of data exchanged, the Member States involved, the tax period concerned, the legal basis for the exchange of their personal data, access to their personal data and request correction or deletion, in accordance with the relevant provisions of the GDPR. The EDPS recommends amending recital 113 accordingly. 15

text: 12. Retention of automatically exchanged information

text: Article 40(5)

text: provides that information processed in accordance with the Directive must be retained for no longer than is necessary to achieve the purposes of the Directive, and in any case in accordance with each data controller’s domestic rules on statutes of limitation. The EDPS welcomes this clarification of the maximum retention period. This provision reflects the storage limitation principle set out in

text: Article 5(1)

text: (e) GDPR, according to which personal data must be kept in a form permitting identification of data subjects for no longer than is necessary for the purposes for which they are processed.

text: 55. However,

text: Article 40(6)

text: provides that Member States shall retain records of information received through automatic exchange pursuant to

text: Articles 4

text: to 9, 12, 15 and 16 “for no longer than necessary but in any event not less than five years from its date of receipt” to achieve the purposes of the Directive.

text: 56. The EDPS understands that tax authorities may require sufficient time to assess the relevance of information received through automatic exchange and to take appropriate action within applicable limitation periods. However, the wording of

text: Article 40(6)

text: does not clearly ensure that personal data will be deleted where retention is no longer necessary in a specific case.

text: Article 40(6)

text: seems therefore to derogate to

text: Article 40(5)

text: by introducing a mandatory minimum retention period of five years. A mandatory minimum retention period should not operate as an obligation to retain personal data where such retention would no longer be necessary and proportionate under the GDPR.

text: 57. The EDPS therefore recommends clarifying that the five-year period applies only insofar as continued retention remains necessary and proportionate for the purposes of the Directive and compatible with applicable data protection law. The EDPS also recommends that the Proposal specifies that periodic review of the continued necessity of data retention and the erasure or anonymisation of personal data where retention is no longer necessary must be ensured.

text: 13. Conclusions

text: 58. In light of the above, the EDPS makes the following recommendations: (2) to ensure, in the enacting terms or in a recital, that the receiving Member State is identified in accordance with the relevant applicable criteria for the determination of the tax residence, in accordance with Union law and applicable international agreements; (3) to specify in a recital that feedback under

text: Article 28

text: should cover both systemic issues and, where appropriate, individual cases, including cases where information received could not be matched with a taxpayer, does not concern a resident taxpayer of the receiving Member State, is duplicated or otherwise appears not to be necessary for the purposes of the Directive; and to 16 add to Article 28 of the Proposal an obligation requiring tax authorities to communicate to the tax authority of another Member State such inaccuracies or duplication, as well as the actions taken as follow up to the feedback received; (4) to ensure that the reported Tax Identification Numbers reported corresponds to that of the taxpayer in case where the taxpayer was identified through government verification services of Member States or equivalent EU services or the EUID attributed in accordance with Directive 2017/1132; (5) to ensure that access to registers and information provided under EU AML legislation under Article 38 of the Proposal is accompanied - in the enacting terms of the Proposal - by specifications on purpose limitation, and conditions under which tax authorities should exercise access to these registers and information; (6) to clarify that “direct and expeditious access” under

text: Article 39

text: should not be understood as unrestricted or general access to pension databases and, where direct access is provided, to limit it to secure, query-based access by authorised officials for a specific purpose under the Directive, dependent on granting access by the pension authority in each case, and subject to access controls, logging, audit and supervision; (7) to specify in

text: Article 39

text: the categories of pension-payment data that may be accessed under

text: Article 39

text: and to limit access to data strictly necessary for the exchange, verification and followup of pension-income information under the Directive; as well as to clarify the reference to “conditions laid down by national law” in Article 39 of the Proposal; (8) having regard to data to be used for statistical purposes under Article 30 of the Proposal, to specify in recital 107 of the Proposal that data should be aggregated to such a degree that individuals cannot be identified; (9) to further specify the restrictions to data subject’s rights in Article 40 of the Proposal; (10) to recall in recital 113 that, where fulfilment of the obligation and rights provided for in Articles

text: and

text: GDPR would not prejudice tax investigations or enforcement actions by tax authorities, data subjects should obtain information mentioned in Articles

text: and

text: GDPR and Articles

text: and

text: EUDPR; (11) to specify that the five-year retention period in

text: Article 40(6)

text: applies only insofar as continued retention remains necessary and proportionate for the purposes of the Directive, and to require periodic review of the continued necessity of data retention and the erasure or anonymisation of personal data where retention is no longer necessary. Brussels, 17 August 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 17 18


text: EUROPEISKA DATATILLSYNSMANNEN har,

text: ANTAGIT FÖLJANDE YTTRANDE.

text: ( ) EGT L 281, 23.11.1995, s. 31. ( ) EGT L 8, 12.1.2001, s. 1.

identifier: EDPS yttrande (2004)

amnesord:
Finance & Economy
Tax cooperation

publisher: Europeiska datatillsynsmannen

sprak: sv

title: Protection against fraud

serie: yttranden

text: C 301/4 SV Europeiska unionens officiella tidning 7.12.2004

type: stycke

text: EUROPEISKA DATATILLSYNSMANNEN

type: rubrik

text: EUROPEISKA DATATILLSYNSMANNENS YTTRANDE

text: om förslaget till Europaparlamentets och rådets förordning om ömsesidigt administrativt bistånd för att skydda gemenskapens ekonomiska intressen mot bedrägerier och all annan olaglig verksamhet (KOM(2004) 509 slutlig av den 20 juli 2004)

text: (2004/C 301/03)

text: med beaktande av Fördraget om upprättandet av Europeiska gemenskapen, särskilt artikel 286 i detta,

text: med beaktande av Europeiska unionens stadga om de grundläggande rättigheterna, särskilt artikel 8 i denna,

text: med beaktande av

text: Europaparlamentets och rådets direktiv 95/46/EG av den 24 oktober 1995

text: om skydd för enskilda personer med avseende på behandling av personuppgifter och om det fria flödet av sådana uppgifter ( ),

text: med beaktande av

text: Europaparlamentets och rådets förordning (EG) nr 45/2001 av den 18 december 2000

text: om skydd för enskilda då gemenskapsinstitutionerna och gemenskapsorganen behandlar personuppgifter och om den fria rörligheten för sådana uppgifter ( ), särskilt artikel 28.2 i denna,

text: 1. Förslaget förelades av Europeiska kommissionen den 28 september 2004 för yttrande av Europeiska datatillsynsmannen i enlighet med

text: artikel 28.2 i förordning (EG) nr 45/2001

text: . I denna föreskrivs att kommissionen, när den antar ett lagförslag som rör skyddet av enskilda personers fri- och rättigheter med avseende på behandling av personuppgifter, skall samråda med den europeiska datatillsynsmannen. Som framgår av detta fall gäller denna skyldighet inte endast förslag som huvudsakligen rör skydd av personuppgifter utan även förslag som bygger på, kompletterar eller ändrar den befintliga rättsliga ramen för uppgiftsskydd samt förslag som har en betydande inverkan på skyddet av enskilda personers fri- och rättigheter med avseende på behandling av personuppgifter, men där den befintliga rättsliga ramen inte beaktas.

text: 2. Förslaget grundas på artikel 280 i EG-fördraget. Det faller därför i sin helhet under verksamheten inom första pelaren, och när det gäller behandling av personuppgifter anges behovet av att garantera ett fullgott uppgiftsskydd enligt direktiv

text: och, i tillämpliga fall, förordning

text: (EG) nr 45/2001

text: (bland annat skäl 11 och artikel 18 i förslaget).

text: 3. Förslaget innehåller varken nya bestämmelser om uppgiftsskydd eller undantag från ovan nämnda lagstiftning om uppgiftsskydd. I artikel 18 i förslaget hänvisas tvärtom övergripande till den lagstiftningen och tillämpningsföreskrifter planeras på några områden, nämligen kommissionens tillgång till och användning av information från medlemsstaternas momsregister (

text: artikel 11.1

text: ), utbyte av finansiell information på eget initiativ mellan medlemsstaterna och kommissionen (

text: artikel 12.4

text: ) samt ömsesidigt bistånd och informationsutbyte (

text: artikel 21

text: ). Det noteras med tillfredsställelse att samråd skall ske med Europeiska datatillsynsmannen innan tillämpningsföreskrifterna antas. 7.12.2004 SV Europeiska unionens officiella tidning C 301/5

text: 4. I

text: artikel 18.1 andra stycket

text: föreskrivs särskild sekretess gentemot andra än personer eller myndigheter inom gemenskapens institutioner och organ eller i medlemsstaterna som i kraft av sin befattning eller myndighetsroll skall ha vetskap om sådana uppgifter. Det förutsätts att detta inte påverkar de registrerades rätt att få tillgång till personuppgifter som rör dem såvida inte något av de tillämpliga undantagen visar sig gälla, vilket i princip endast kan fastställas från fall till fall (

text: artikel 13 i direktiv 95/46/EG

text: och

text: artikel 20 i förordning (EG) nr 45/2001

text: 5. Förslaget kompletterar och förstärker förordning

text: (EG) nr 1073/1999

text: , rådets förordning (EG) nr 515/ 97 och

text: rådets förordning (EG) nr 1798/2003

text: och innehåller i flera avseenden bestämmelser som är parallella med bestämmelserna i dessa tidigare rättsakter. Följande kommentarer är relevanta: a)

text: Artikel 37.4 i förordning (EG) nr 515/97

text: om övervakning av skydd av personuppgifter bör i en tilläggsbestämmelse i utkastet ändras för att ta hänsyn till att Europeiska datatillsynsmannen nu har tillsatts. Därför bör även hela

text: artikel 37

text: ses över för att få till stånd ett lämpligare och effektivare system för övervakning och samarbete mellan tillsynsmyndigheter. Ett likartat system bör planeras eller ligga till grund för den föreslagna förordningen. b) Den kommitté som inrättats enligt

text: artikel 43 i förordning (EG) nr 515/97

text: och vars uppgifter nu utvidgas till att omfatta förslagets tillämpningsområde medför vissa problem som bör behandlas åtminstone med tanke på detta förslag, men kanske även för att ta tillfället i akt att ytterligare ändra förordning

text: (EG) nr 515/97

text: . Enligt den engelska versionen av den förordningen tycks ad hoc-sammansättningen bestå av de företrädare som avses i

text: artikel 43.1

text: samt företrädarna för uppgiftsskydd. Det bör klargöras att ad hoc-sammansättningen liksom i den franska versionen skall bestå av en ”sammansättning med företrädare som varje medlemsstat utser från sin eller sina tillsynsmyndigheter”. Europeiska datatillsynsmannen bör under alla omständigheter uttryckligen nämnas.

text: 6. Enligt vad som gäller för övriga obligatoriska yttranden bör slutligen Europeiska datatillsynsmannens formella yttrande på grundval av

text: nämnas före skälen (”med beaktande av … yttrande”). Utfärdat i Bryssel den 22 oktober 2004. Europeiska datatillsynsmannen

type: vagledning

utgivare: edps


text: EUROPEISKA DATATILLSYNSMANNEN har,

text: ANTAGIT FÖLJANDE YTTRANDE:

text: Peter HUSTINX

identifier: EDPS yttrande (2005)

amnesord:
Police Cooperation
ECRIS

title: Criminal Records

text: 8.3.2005 SV Europeiska unionens officiella tidning C 58/3

text: EUROPEISKA DATATILLSYNSMANNEN

text: Europeiska datatillsynsmannens yttrande om förslaget till rådets beslut om utbyte av uppgifter ur kriminalregister (KOM(2004) 664 slutlig av den 13 oktober 2004)

text: (2005/C 58/03)

text: med beaktande av Fördraget om upprättandet av Europeiska gemenskapen, särskilt artikel 286 i detta,

text: med beaktande av Europeiska unionens stadga om de grundläggande rättigheterna, särskilt artikel 8 i denna,

text: med beaktande av

text: Europaparlamentets och rådets direktiv 95/46/EG av den 24 oktober 1995

text: om skydd för enskilda personer med avseende på behandling av personuppgifter och om det fria flödet av sådana uppgifter,

text: med beaktande av

text: Europaparlamentets och rådets förordning (EG) nr 45/2001 av den 18 december 2000

text: om skydd för enskilda då gemenskapsinstitutionerna och gemenskapsorganen behandlar personuppgifter och om den fria rörligheten för sådana uppgifter, särskilt artikel 41 i denna,

text: A. Inledande anmärkning

text: 1. Förslaget grundas på avdelning VI i Fördraget om Europeiska unionen (tredje pelaren). Europeiska datatillsynsmannen skall ge råd inte bara om förslag till lagstiftning inom ramen för Fördraget om upprättandet av Europeiska gemenskapen, utan också om förslag inom tredje pelaren. Europeiska datatillsynsmannen har som allmän uppgift att säkerställa respekten för de grundläggande fri- och rättigheterna med avseende på behandling av personuppgifter, en uppgift som är svår att utföra om ett så viktigt område som tredje pelaren utelämnas. Det ingår i detta uppdrag att betona konsekvensen i nivån på skyddet för enskilda i olika rättsliga sammanhang.

text: 2. Europeiska datatillsynsmannen har inte rådfrågats av kommissionen i enlighet med

text: artikel 28.2 i förordning (EG) nr 45/2001

text: . Datatillsynsmannen lämnar därför sitt yttrande på eget initiativ. B. Förslagets huvuddelar, betraktade ur ett dataskyddsperspektiv

text: 3. Förslaget har ett begränsat tidsperspektiv. Det förväntas täcka en allvarlig brist i bestämmelserna om utbyte av uppgifter, till dess ett nytt system för utbyte av uppgifter har inrättats. Det innehåller i stort två nya bestämmelser: — I

text: artikel 3

text: föreskrivs information på eget initiativ om fällande domar mot medborgare i andra medlemsstater (till dessa medlemsstater). —

text: Artikel 4

text: gäller framställningar om utbyte av uppgifter om fällande domar. Båda bestämmelserna härrör från den europeiska konventionen om inbördes rättshjälp i brottmål (Europarådet 1959) och den konvention om ömsesidig rättslig hjälp i brottmål mellan Europeiska unionens medlemsstater från 2000 som ännu inte trätt i kraft. Det nya huvudinslaget i texten är att utbyte av uppgifter bör ske omgående och på ett strukturerat sätt. Medlemsstaterna skall dessutom utse en centralmyndighet. C 58/4 SV Europeiska unionens officiella tidning 8.3.2005

text: 4. Förslaget motiveras av sin angelägenhetsgrad. I motiveringen nämns några enskilda tragiska fall, som ett exempel på illa fungerande, befintliga rättsregler. Framför allt innebär den befintliga lagen en skyldighet att informera andra medlemsstater om fällande domar för brott endast en gång om året. Detta förslag behandlas som starkt prioriterat inom rådet. Förslaget är avsett för en interimsperiod. Kommissionen är i färd med att bygga upp ett europeiskt kriminalregister, eller kanske en mindre omfattande variant: i motiveringen till det nuvarande förslaget nämns inrättandet av ett datoriserat system för utbyte av uppgifter mellan medlemsstaterna. En vitbok kommer att läggas fram av kommissionen under de närmaste månaderna. Rådets luxemburgska ordförandeskap nämner denna fråga som en prioritering.

text: 5. Förslaget har stor räckvidd. Det är inte begränsat till en viss brottstyp. Bilaga B innehåller en förteckning över allvarliga brott, men denna förteckning är inte begränsad och vissa kategorier i förteckningen är tämligen ospecificerade (såsom: ”vägtrafikbestämmelser”). I

text: artikel 1 b

text: sägs dessutom att inte endast domar utan också beslut av administrativa myndigheter ryms inom förslagets räckvidd. Detta innebär att förslaget går långt utöver räckvidden för förebyggande och bekämpning av brottslighet, såsom detta vanligtvis förstås. Denna stora räckvidd måste utvärderas mot bakgrund av väsentliga skillnader i medlemsstaternas lagstiftning i fråga om kriminalregister. Dessa skillnader föreligger beträffande vilka domar som måste föras in i kriminalregistren, tidsfristerna för bevarandet av domar i dessa register och vilka uppgifter från dessa kriminalregister som skall lämnas till tredje part, samt för vilka syften uppgifter kan lämnas. Förslaget föreskriver kort sagt utbyte av uppgifter och samordning av uppgifter i en heterogen rättsmiljö.

text: 6. Förslaget innehåller en artikel om uppgiftsskydd, som endast innehåller en bestämmelse om begränsning av syftena för utbyte av uppgifter, beträffande det utbyte av uppgifter om domar som begärs (såsom nämns i

text: artikel 4

text: ). Upplysningar kan begäras för straffrättsliga förfaranden, men också för andra syften (enligt lagen i den ansökande staten). Den anmodade staten kan i detta fall begränsa utbytet av uppgifter och kan be den ansökande staten upplysa om användningen av uppgifterna. Förslaget ger ingen annan garanti beträffande den korrekta behandlingen av den person som uppgifterna gäller. Artikeln om uppgiftsskydd gäller inte för information på eget initiativ om fällande domar (som nämns i

text: artikel 3

text: ), vilket har till följd att ingen begränsning finns av de syften för vilka dessa uppgifter kan användas. C. Konsekvensanalys

text: 7. Europeiska datatillsynsmannen har analyserat förslagets konsekvenser för skyddet av enskilda personers rättigheter och friheter med avseende på behandlingen av personuppgifter. Med hänsyn till förslagets art – det har ett begränsat tidsperspektiv och har viktiga men i sig begränsade följder för den befintliga nivån på uppgiftsskyddet – har denna analys formen av en snabbstudie.

text: 8. Beskrivning av förslagets konsekvenser — Konsekvenserna för den befintliga nivån på uppgiftsskyddet är begränsade eftersom utbyte av uppgifter ur kriminalregister redan föreskrivs i ett internationellt avtal som är bindande för medlemsstaterna. — Förslaget går emellertid utöver den befintliga rättsliga ramen eftersom det föreskrivs om omedelbart utbyte av uppgifter, i synnerhet genom införandet av en central myndighet i varje medlemsstat, med bred räckvidd (som omfattar både de brott som berörs och administrativa myndigheters beslut). — Det finns inga garantier om att skyddsåtgärder för uppgiftsskydd i nationell lagstiftning när det gäller utlämnande av uppgifter ur kriminalregister alltid är tillämpliga. 8.3.2005 SV Europeiska unionens officiella tidning C 58/5 — Detta är desto viktigare som de personuppgifter som det handlar om – angående den registrerade personens brottsliga förflutna – är känsliga. Dessa uppgifter är förtecknade i

text: artikel 8.5 i direktiv 95/46/EG

text: . En alltför omfattande användning av uppgifterna i ett kriminalregister skulle kunna äventyra möjligheterna till social återanpassning för den person som dömts för brott, vilket erkänns i skäl 10 i förslaget.

text: 9. Förenlighet med den befintliga rättsliga ramen för uppgiftsskydd — Förslaget är tillämpligt på ett område utanför tillämpningsområdet för direktiv 95/46. Konvention 108 och andra internationella avtal inom Europarådet är dock tillämpliga. Texten måste tolkas mot bakgrund av

text: artikel 8 i Europakonventionen

text: om skydd för de mänskliga rättigheterna och de grundläggande friheterna. Förslaget får inte leda till att en privatperson fråntas eller på orättmätigt sätt begränsas i utövandet av sin lagstadgade rätt till uppgiftsskydd. — Europeiska datatillsynsmannen anser att detta mål inte har uppnåtts. — Förslaget innehåller inte garantier om att tillgången till personuppgifter är begränsad till personer som uppträder i särskilda egenskaper och så långt nödvändigt för medborgarnas säkerhet. Det finns inga specificerade begränsningar om behandling och vidareutnyttjande av de personuppgifter som utväxlas. — Därtill kommer att skyddsåtgärderna för uppgiftsskydd (som anges i

text: artikel 5

text: ) inte är tillämpliga på information på eget initiativ om fällande domar. — Bilaga B till förslaget föranleder dessutom tvivel om huruvida den registrerade har rätt att informeras eftersom det är valfritt huruvida formuläret får överlämnas till den berörda personen och huruvida en förteckning över fällande domar får överlämnas till den berörda personen.

text: 10. Förslagets kvalitet — Förslaget är tydligt och enkelt utformat vilket i sig är en bedrift sett ur den aspekt som rör lagstiftningens kvalitet (se till exempel de gemensamma riktlinjerna om gemenskapslagstiftningens redaktionella kvalitet, EGT [1999] C 73, s. 1). — Rättsmiljön är emellertid heterogen. De väsentliga skillnaderna i nationell lagstiftning kräver ett ingripande genom den europeiska lagstiftningen som innebär antingen harmonisering eller åtminstone en exakt samordning, till exempel ett system för ömsesidigt erkännande med specificerade begränsningar som skyddar de registrerade personernas rättigheter.

text: 11. Nödvändigheten av och proportionaliteten när det gäller utbytet av uppgifter ur kriminalregister. Å ena sidan: — Utbytet av personuppgifter motiveras av att det är nödvändigt att ge medborgarna en hög nivå av säkerhet inom ett område med frihet, säkerhet och rättvisa. — Förslaget är avsett att avhjälpa en allvarlig brist i bestämmelserna om utbyte av uppgifter till dess att ett nytt sådant system har inrättats. Det medför en rättslig skyldighet för medlemsstaterna att omedelbart utbyta uppgifter ur kriminalregister. — Det allmänna intresset av att förebygga och bekämpa brott kan innebära att tillgång till uppgifter ur kriminalregister, under vissa omständigheter och på vissa villkor, ges till tredje parter utanför brottmålsförfaranden. Det kan gälla (framtida) arbetsgivare som har rätt att få tillgång till uppgifter om fällande domar som kan vara relevanta för en anställning eller administrativa myndigheter som samlar in uppgifter för deras räkning. Å andra sidan: — Såsom nämnts ovan har förslaget konsekvenser för uppgiftsskyddet, det innehåller inte alla garantier som är nödvändiga för ett adekvat uppgiftsskydd i överensstämmelse med den befintliga rättsliga ramen och det saknar exakthet, vilket är nödvändigt i en heterogen rättsmiljö. — Det trängande behovet av att inrätta ett kompletterande rättsinstrument rör endast fällande domar för vissa allvarliga brott (och inte alla brott som anges i bilaga B). I andra fall finns det inget som tyder på att den europeiska konventionen om inbördes rättshjälp i brottmål från 1959 inte är tillräckligt effektiv. — Förslaget innebär dessutom att utbytet av uppgifter ur kriminalregister påskyndas utan någon grundlig utvärdering av följderna för uppgiftsskyddet. Förslaget är därför inte proportionerligt. C 58/6 SV Europeiska unionens officiella tidning 8.3.2005 D. Slutsats

text: 12. Mot bakgrund av ovanstående rekommenderar Europeiska datatillsynsmannen att förslaget till rådets beslut om utbyte av uppgifter ur kriminalregister begränsas till kriminalregister för fällande domar för vissa allvarliga brott. Skyddet för den registrerade bör dessutom preciseras i förslaget, så att det överensstämmer med den befintliga rättsliga ramen när det gäller uppgiftsskydd. Som ett alternativ måste det åtminstone säkerställas att

text: artikel 5

text: även är tillämplig på information på eget initiativ om fällande domar och att de skyddsåtgärder för uppgiftsskydd som finns i nationell lagstiftning är tillämpliga.

text: 13. Det är nödvändigt att göra en grundlig utvärdering av följderna för uppgiftsskyddet i samband med utformandet av ett nytt system som kallas det europeiska kriminalregistret. Utfärdat i Bryssel den 13 januari 2005, Europeiska datatillsynsmannen