text: COM(2024) 531 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2024) 531 final. 4

text: Regulation (EU) No 1024/2012

text: of the European Parliament and of the Council of 25 October 2012 on administrative cooperation through the Internal Market Information System and repealing

text: Commission Decision 2008/49/EC

text: ( ‘the IMI Regulation’), OJ L 316, 14.11.2012, p. 1–11. Article 1(1) of the Proposal. 6 Directive

text: of the European Parliament and of the Council of 15 May 2014 on the enforcement of Directive

text: concerning the posting of workers in the framework of the provision of services and amending

text: Regulation (EU) No 1024/2012

text: on administrative cooperation through the Internal Market Information System (‘the IMI Regulation’), OJ L 159, 28.5.2014, p. 11–31. See in particular

text: Article 9(1)

text: (a) of the posting of workers Directive. 7 Recital 1 of the Proposal; see also p. 4 of the Explanatory Memorandum of the Proposal. 8 Commission Staff Working document, p. 10-13. 9 Recital 21 refers to an opinion delivered on 5 September 2024. 4

text: Article 4(1)

text: (d) of the Proposal. 11

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1-88. 12 In this regard, we note a small typographical error in recital (19) of the Proposal. In the final sentence, the word “of” [the competent authorities] should be replaced by “by” [the competent authorities]. 13 Article 5 of the Proposal. 14 Article 5(2) of the Proposal. 5

text: Article 5(3) of the Proposal. 16 Article 5(4) of the Proposal; see also

text: Article 2(1)

text: (f) of the Proposal referring to this processing of personal data having regard to the functionalities to be provided by the public interface. 17 Article 4(2) of the Proposal. 6

identifier: EDPS yttrande 01/2025

title: EDPS Opinion 1/2025 on the Proposal for a Regulation on a public interface connected to the Internal Market Information System

text: 8 January 2025

text: Opinion 1/2025

text: on the Proposal for a Regulation on a public interface connected to the Internal Market Information System for the declaration of the posting of workers and amending

text: Regulation (EU) No 1024/2012

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on a public interface connected to the Internal Market Information System for the declaration of posting of workers and amending

text: Regulation (EU) No 1024/2012

text: . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 14 November 2024, the Commission consulted the EDPS on the Proposal for a Regulation of the European Parliament and of the Council on a public interface connected to the Internal Market Information System for the declaration of posting of workers and amending

text: Regulation (EU) No 1024/2012

text: (‘the Proposal’).

text: The objective of the Proposal is to establish a multilingual electronic public interface (‘the interface’) to be used for transmission of declarations of posting of workers. The interface would be connected to the Internal Market Information System (‘IMI’), established under

text: Regulation (EU) No 1024/2012

text: , and would facilitate the process of declaration of posting of workers in accordance with Directive

text: (‘the posting of workers Directive’).

text: The EDPS welcomes that the Proposal clarifies the roles of the Commission, the service providers and the national competent authorities in relation to the processing of personal data. The EDPS further welcomes that the Proposal specifies the information to be included in the standard form to be used for the declaration of the posting of workers, as well as the data retention period applicable to the information that would be submitted via the interface.

text: The EDPS recommends clearly specifying the terms ‘identity’ and ‘contact details’, referred to in

text: Article 5(3)

text: , point (a), (b) and (e) of the Proposal, in the standard form referred to in

text: Article 4(1)

text: and established via the implementing act referred to in Article 4(2) of the Proposal. The EDPS also recommends adding a reference to the service recipient in Article 5(3) of the Proposal, should any processing of personal data be envisaged.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 14 November 2024, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on a public interface connected to the Internal Market Information System for the declaration of posting of workers and amending

text: Regulation (EU) No 1024/2012

text: (‘the Proposal’).

text: 2. The objective of the Proposal is to establish a multilingual electronic public interface (‘the interface’) connected to the Internal Market Information System (‘IMI’), established under 4 5

text: Regulation (EU) No 1024/2012

text: , for the declaration of posting of workers . The interface would facilitate the process of declaration of posting of workers in accordance with Directive

text: (‘the posting of workers Directive’) and support administrative cooperation between national competent authorities .

text: 3. The Proposal is accompanied by a Commission Staff Working document describing in particular the envisaged public interface, the IT architecture, the standard form to be used by service providers in the context of the declaration of posted workers .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 14 November 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 21 of the Proposal. However, the EDPS notes that the issuance date of the Opinion is incorrectly stated and recommends its correction. The EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of the EUDPR.

text: 2. General remarks

text: 5. To allow controls at the workplace by the national competent authorities of the host Member State, certain information would need to be provided in the declaration of posting of workers via the public interface established by the Proposal. Sharing this information would entail the processing of certain well-defined and limited categories of personal data. For instance, the standard form, to be transmitted via the interface as specified in the Proposal, must contain, among others, information related to the posted worker as well as the contact person to liaise with the competent authorities .

text: 6. Against this background, the EDPS welcomes the reference to both the EUDPR and the 11 12 GDPR in the recitals of the Proposal . In addition, the EDPS welcomes the inclusion of a specific provision concerning the processing and retention of personal data .

text: 3. Roles and responsibilities

text: (a) ensuring the security and availability of the public interface;

text: (b) processing the identification and contact details of the person submitting the declaration of posting of workers .

text: (a) the identity and contact details of the service provider;

text: (b) the identity of a posted worker;

text: (c) an electronic notification address, such as a mail address, of a posted worker to inform the posted worker that a declaration has been submitted for that worker;

text: (d) the address of the workplace of the posted worker;

text: (e) the identity and contact details of the contact person of the service provider .

text: 9. The Proposal also provides that where a competent authority of a Member State receives posting declarations additionally through the public interface in its national back-end system, the competent national authority is to be considered as controller within the meaning of

text: Article 4(7)

text: GDPR in respect of the processing of personal data contained in these posting declarations .

text: 10. The EDPS welcomes the inclusion of these provisions in the Proposal, clarifying which entities act as a controller in relation to which processing of personal data.

text: 4. Standard form

text: 11. The EDPS notes that the Commission will establish the standard form, referred to in Article 4(1) of the Proposal, by way of implementing acts . The EDPS recalls that it should be consulted, among others, on implementing acts having an impact on the protection of personal data (as it would be the case for the implementing act referred to in Article 4(1) of the Proposal) pursuant to

text: Article 42(1)

text: EUDPR.

text: 12. The EDPS considers that the terms ‘identity’ and ‘contact details’, referred to in

text: Article 5(3)

text: , point (a), (b) and (e) of the Proposal, should be clearly defined in the standard form referred to in

text: Article 4(1)

text: 13. The EDPS highlights a potential inconsistency between

text: Article 4(1)

text: and Article 5 of the Proposal. In particular,

text: Article 4(1)

text: (e) specifies that the standard form must include information related to ‘the service recipient’. In contrast, Article 5 of the Proposal does not make explicit reference to the service recipient. Should any processing of personal data regarding the service recipient (e.g., a contact person) be envisaged, the EDPS recommends adding a reference to the service recipient in Article 5(3) of the Proposal.

text: 5. Retention period

text: 14. Article 5(5) of the Proposal provides that “[t]he public interface shall ensure the automatic deletion of the information related to a posting which has been submitted through that public interface 36 months after the end date of the posting period”. The EDPS welcomes the inclusion of a provision defining the maximum retention period for personal data related to a posting submitted through the public interface, as well as the justification of why this retention period would be necessary .

text: 15. The Proposal also stipulates that the public interface shall allow for the deletion of all personal data stored in there and in the service providers’ accounts when those data are no longer needed for the purposes for which they are collected and processed . In addition, the public interface shall allow for the sending of a reminder to the service provider to review and delete, when necessary, any personal data in accordance with Article 5(6) of the Proposal .

text: 6. Conclusions

text: 16. In light of the above, the EDPS makes the following recommendations: (1) to clearly specify the terms ‘identity’ and ‘contact details’, referred to in

text: Article 5(3)

text: Article 4(1)

text: and established via the implementing act referred to in Article 4(2) of the Proposal. Brussels, 8 January 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI


text: COM(2025) 685 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2025) 685 final. 4 Explanatory Memorandum, COM(2025) 685 final, p. 0.

text: Council Regulation (EU) 2017/1939 of 12 October 2017

text: implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’), OJ L 283, 31.10.2017, pp. 1–71, ELI: http://data.europa.eu/eli/reg/2017/1939/oj. 6 Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing

text: Regulation (EC) No 1073/1999

text: of the European Parliament and of the Council and

text: Council Regulation (Euratom) No 1074/1999

text: , OJ L 248, 18.9.2013, pp. 1–22, last amended by Regulation (EU, Euratom) 2020/2223 of the European Parliament and of the Council of 23 December 2020 amending Regulation (EU, Euratom) No 883/2013, as regards cooperation with the European Public Prosecutor’s Office and the effectiveness of the European Anti-Fraud Office investigations, OJ L 437, 28.12.2020, pp. 49–73. 7 Explanatory Memorandum, COM(2025) 685 final, p. 2. 8

text: Council Regulation (EU) No 904/2010 of 7 October 2010

text: on administrative cooperation and combating fraud in the field of value added tax (recast), OJ L 268, 12.10.2010, pp. 1–18, ELI: http://data.europa.eu/eli/reg/2010/904/oj, last amended by

text: Council Regulation (EU) 2025/517 of 11 March 2025

text: amending

text: Regulation (EU) No 904/2010

text: as regards the VAT administrative cooperation arrangements needed for the digital age, OJ L, 2025/517, 25.3.2025, ELI: http://data.europa.eu/eli/reg/2025/517/oj. 9 Explanatory Memorandum, COM(2025) 685 final, p. 2. 10 Ibid . 4

text: This type of fraud takes advantage of the VAT exemption on intra-Community supplies. The so-called Missing Traders acquire goods without accounting right away for the VAT. Any VAT charged on the subsequent domestic sales should be declared and paid to the Member State’s revenue authority. However, the Missing Traders charge VAT to buyers without remitting the value to the tax authorities. In more complex cases of MTIC fraud, known as carousel frauds, goods are acquired and sold through a series of companies before being sold again in another Member State. The first seller in the domestic chain is the missing trader. The last seller that sells these goods to another taxable person in another Member State, claims and receives the reimbursement of VAT payments that never occurred. 12 Currently, the EPPO and OLAF execute their respective tasks to combat fraud at EU level by cooperating bilaterally with tax authorities and through access to VAT information at national level, under different means and conditions. According to the Explanatory Memorandum, this approach does not align with the requirements of investigating cross-border VAT fraud that spans multiple jurisdictions, which demands a coordinated, multilateral strategy to address complex, interconnected schemes. The most recent EPPO investigations spanning more than half of the Member States demonstrate that the EU fight against VAT fraud can only benefit from an EU level access to VAT information. The more swiftly EPPO and OLAF gain a comprehensive EU-wide understanding of the fraud, the faster they can intervene. See COM(2025) 685 final, p. 2-3. 13 Article 1(4) of the Proposal, which would add

text: Article 36

text: (2a) to

text: Regulation (EU) No 904/2010

text: . 14 Article 1(4) of the Proposal, which would add

text: Article 36

text: (2c) to

text: Regulation (EU) No 904/2010

text: . 15 Article 1(4) of the Proposal, which would add

text: Article 36

text: (2b) and (2d) to

text: Regulation (EU) No 904/2010

text: . 16

text: Article 1(1)

text: and (2) of the Proposal, which would add to

text: Regulation (EU) No 904/2010

text: Article 21

text: (2c) for Member States’ systems,

text: Article 24

text: d for the Central Electronic System of Payment data (CESOP), and

text: Article 24

text: k for the VAT Information Exchange System (VIES), the three latter Articles being read in conjunction with the new

text: Article 49

text: a to be added to

text: Regulation (EU) No 904/2010

text: as per Article 1(5) of the Proposal. 17

text: Article 1(1)

text: Regulation (EU) No 904/2010

text: Article 21

text: (2c) for Member States’ systems,

text: Article 24

text: d for CESOP, and

text: Article 24

text: k for VIES, the three latter Articles being read in conjunction with the new

text: Article 49

text: b to be added to

text: Regulation (EU) No 904/2010

text: as per Article 1(5) of the Proposal. 5

text: COM(2025) 685 final, p. 9. 19

text: implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’), OJ L 283, 31.10.2017, pp. 1–71. 20 COM(2025) 685 final, p. 3. 21 White Paper for the Anti-fraud Architecture Review, COM(2025) 546 final, p. 9-10. 6

text: Cf. Commission Implementing

text: Regulation (EU) 2025/512 of 13 March 2025

text: on technical arrangements for developing, maintaining and employing electronic systems for the exchange and storage of information under

text: Regulation (EU) No 952/2013

text: of the European Parliament and of the Council, OJ L, 2025/512, 20.3.2025, ELI: http://data.europa.eu/eli/reg_impl/2025/512/oj. 7

text: E.g. validity status of VAT numbers issued by Member States, basic trader information associated with the VAT number, i.e. name, address. Recapitulative Statements / EC Sales Lists, supplied by businesses and exchanged between Member States. Data includes: Supplier VAT ID, customer VAT ID (in another Member State), Type of transaction, i.e. intra-Community supplies of goods, taxable amount for each customer per period, i.e. aggregated information.

text: Article 17(1)

text: points (a)-(c) of

text: Regulation (EU) No 904/2010

text: . When goods up to €150 imported into the EU are sold via distance sales and declared under IOSS, customs collects the IOSS identification number declared by the intermediary or seller, the consignment value, description and TARIC codes of goods, Country of origin and customs declarant information, the Member State of final destination, the VAT amount that would have been due. When goods are imported in Member State A but then transported to Member State B under customs procedure 42, VAT is due in Member State B. Relevant data categories in the Surveillance System of customs are: importer/consignee identification numbers (EORI, VAT ID), Member State of dispatch after import, Member State of destination where VAT will be accounted for, value and nature of goods, customs duties paid, basis on which VAT exemption was granted, transport documentation indicators, VAT ID of the entity liable for acquisition VAT in the destination Member State. The purpose of the processing is to detect carousel fraud and ensure VAT is eventually reported in the correct Member State (since VAT is not charged at import). Customs procedure 63 relates to warehousing/common transit specifics.

text: Article 17(1)

text: points (e) and (f) of

text: Regulation (EU) No 904/2010

text: . CESOP collects data from payment service providers (PSPs) on cross-border payments that may indicate undeclared e-commerce activity. The data category “aggregated payment information” comprises the total number of cross-border payments received, the total value of cross-border payments, a breakdown by origin country of payments, payee identification summarised for risk analysis, matching results with VAT registrations, OSS/IOSS registrations, and customs data. Article 1(2) of the Proposal, which would add

text: Article 24

text: b(3) to

text: Regulation (EU) No 904/2010

text: . The EPPO and OLAF would be able to obtain information related to the VAT One-Stop-Shop and the SME special scheme (

text: Article 17(1)

text: points (d), (g), respectively, of

text: Regulation (EU) No 904/2010

text: ) through Eurofisc pursuant the amended

text: Article 36 of Regulation (EU) No 904/2010

text: . The alternative, i.e. providing EPPO and OLAF with a right to directly access those systems, would cause a need to adapt national authorities’ IT systems, as the relevant IT systems do not include central components at EU level. The Proposal avoids those impacts on national authorities by providing for access through Eurofisc.

text: The interface used by OLAF and the EPPO should technically ensure that only permitted search terms are used. In addition, the case number and purpose should be logged. Answers from the system that do not correspond with the nature of the query as a specific-interest query in a single case, should be identified by the interface and suppressed. 9

text: Cf.

text: Article 22

text: m of

text: Regulation (EC) No 767/2008

text: of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation), OJ L 218, 13.8.2008, pp. 60–81, as amended, ELI: http://data.europa.eu/eli/reg/2008/767/oj. 34 See

text: Article 59 of Council Regulation (EU) No 904/2010

text: . 10

identifier: EDPS yttrande 01/2026

amnesord:
Tax cooperation
Anti-fraud

publisher: Europeiska datatillsynsmannen

sprak: en

title: Opinion 1/2026 on the Proposal for a Regulation amending Regulation (EU) No 904/2010 as regards access of the EPPO and OLAF to VAT information

serie: yttranden

text: on the Proposal for a Regulation amending

text: Regulation (EU) No 904/2010

text: as regards access of the EPPO and OLAF to VAT information

type: rubrik

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Council Regulation amending

text: Regulation (EU) No 904/2010

text: as regards the access of the European Public Prosecutor’s Office (EPPO) and the European Anti-Fraud Office (OLAF) to value added tax information at Union level .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 14 November 2025, the European Commission issued the Proposal for a Council Regulation amending

text: Regulation (EU) No 904/2010

text: as regards the access of the European Public Prosecutor’s Office (EPPO) and the European Anti-Fraud Office (OLAF) to value added tax information at Union level (‘the Proposal’). The Proposal aims to address the urgent problem of combating intra- Community value added tax (VAT) fraud, including by providing for specific direct and centralised access to relevant VAT information for the EPPO and OLAF.

text: The Proposal concerns the boundaries between administrative VAT cooperation and criminal enforcement. The EDPS stresses that personal data processing for administrative purposes and for criminal law enforcement purposes are distinct from each other, and that this separation must also be carefully reflected by the Proposal.

text: The EDPS welcomes the objectives of the Proposal and recognises that EPPO’s and OLAF’s direct access to VAT information is necessary to achieve the objective to effectively combat cross-border VAT fraud. In making this assessment, the EDPS has taken into consideration the specific characteristics of Missing Trader Intra-Community (MTIC) fraud, the targeted nature of the access and the specific categories of information concerned, which first and foremost relates to VAT numbers and business-to-business transactions.

text: The Proposal should clearly explain and underline the exceptional nature of providing direct (albeit limited) access to administrative databases for law enforcement purposes. The EDPS considers that further clarification is warranted to avoid that the Proposal would be misconstrued as a precedent for more general application.

text: The Proposal should also ensure the implementation of appropriate legal, technical and organisational safeguards tailored to the targeted nature of the measure. While the details of the technical and organisational measures can be further specified by a way of implementing act, as envisaged by the Proposal, certain parameters should already be defined at the level of the basic act. To this end, the EDPS recommends including in the Proposal a number of additional safeguards to help ensure compliance with the principles of purpose limitation, data minimisation and accountability.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 14 November 2025, the European Commission issued the Proposal for a Council Regulation amending

text: Regulation (EU) No 904/2010

text: 2. The objective of the Proposal is to address the urgent problem of combating intra- Community value added tax (VAT) fraud , by providing for specific direct and centralised access to relevant VAT information for the EPPO and OLAF without prejudice to the 5 6 7 existing rights of access stemming from the EPPO and OLAF Regulations .

text: 3. Under current

text: Regulation (EU) No 904/2010

text: , EPPO and OLAF do not have an explicit right to receive information on cross-border VAT fraud from the European network of national VAT antifraud officials, Eurofisc, and no centralised access for targeted searches to VAT relevant information through the EU IT systems . Instead, they must fulfil their mandate of combating fraud at EU level by cooperating bilaterally with tax authorities at national level .

text: 4. The Proposal would amend

text: Regulation (EU) No 904/2010

text: on administrative cooperation and combating fraud in the field of VAT, which sets out procedures allowing European Union (EU) Member States’ authorities to work together and share information on VAT and to combat VAT fraud.

text: 5. The Proposal targets especially Missing Trader Intra-Community (MTIC) fraud (or ‘carousel fraud’). This is a type of VAT fraud that exploits the EU’s rules for tax-free trade between Member States .

text: 6. The Proposal would strengthen the cooperation between Eurofisc, the EPPO and OLAF by providing a legal basis for the exchange of information and access to VAT data, enhancing the EU's ability to combat fraud against the financial interests of the Union . The Proposal aims to provide to the EPPO and OLAF a direct and streamlined communication with Eurofisc and a specific, direct and centralised access to relevant VAT information in relation with their respective mandates.

text: 7. The Proposal would establish a duty for Eurofisc working field coordinators to communicate spontaneously to the EPPO and OLAF any indication of suspected fraud based on the information exchanged between Member States on cross-border VAT fraud, in respect of which the EPPO could exercise its competence , or in accordance with OLAF’s mandate . In addition, they would be obliged to communicate to the EPPO or to OLAF any relevant information upon request .

text: 8. The Proposal would also require the competent authorities of the Member States to grant 16 17 the EPPO and OLAF centralised access for targeted searches to VAT relevant information through the EU IT systems for the purpose of investigating specific criminal offences as defined in Article 4 of the EPPO Regulation and for investigations in accordance with OLAF tasks.

text: 9. Access would be granted to European Prosecutors, European Delegated Prosecutors and selected staff of the EPPO and authorised staff of OLAF who hold a personal user identification allowing centralised access to the information. The access would be limited to targeted searches based on specific data categories, which would be defined in an implementing act, and for the purpose of investigating or prosecuting specific suspected criminal offences as referred to in Article 4 of the EPPO Regulation, for the purposes of opening and carrying out investigations in accordance with OLAF tasks as referred to in Article 1(1) of the OLAF Regulation, i.e. not for random searches .

text: 10. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 14 and 18 November 2025 pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 12 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 11. The Proposal raises important questions as to the role of the EPPO, whose investigative powers under the EPPO Regulation rely on the European Delegated Prosecutors’ (EDP’s) powers under national law. The Proposal would create an exception to this rule, by adding an investigative power at Union level that can be exercised by other staff of the EPPO than the EDP’s.

text: 12. The Explanatory Memorandum to the Proposal refers to the ongoing review of the EU antifraud architecture aimed at streamlining tasks, competences and coordination between the different EU actors in charge of prevention, investigation and repression of fraud affecting the EU’s financial interests . It is therefore the EDPS’ understanding that the Proposal is intended as an immediate measure to address an urgent problem, which is also mentioned in the White Paper for the Anti-fraud Architecture Review , and that the review of the anti-fraud architecture will be an opportunity to ensure further coherence and consistency.

text: 13. The Proposal also raises important questions regarding the boundaries between administrative VAT cooperation and criminal law enforcement. The EDPS stresses that personal data processing for administrative purposes and for criminal law enforcement purposes are distinct from each other. This separation must also be carefully reflected by the Proposal.

text: 14. The EDPS notes that the Proposal might also raise questions about sector-specific data protection legislation at national level, which may include the concept of tax secrecy (which limits direct access to VAT-related databases by entities other than tax authorities). While acknowledging that other national legal standards may exist, the current Opinion can only address the question of compatibility with the Union legal framework on data protection.

text: 15. Against this background, the EDPS welcomes the objectives of the Proposal and recognises that EPPO’s and OLAF’s direct access to VAT information is necessary to achieve the objective to effectively combat cross-border VAT fraud. In making this assessment, the EDPS has taken into consideration the specific characteristics of Missing Trader Intra- Community (MTIC) fraud, the targeted nature of the access and the specific categories of information concerned, which first and foremost relates to VAT numbers and business-tobusiness transactions.

text: 16. At the same time, the Proposal should clearly explain and underline the exceptional nature of providing direct (albeit limited) access to administrative databases for law enforcement purposes. The EDPS considers that such an explicit further clarification is warranted to avoid that the Proposal would be misconstrued as a precedent for more general application.

text: 17. The Proposal should also ensure the implementation of appropriate legal, technical and organisational safeguards tailored to the targeted nature of the measure. While the details of the technical and organisational measures can be further specified by a way of an implementing act, as envisaged by the Proposal, certain parameters should already be defined at the level of the basic act. To this end, the EDPS recommends including in the Proposal a number of additional safeguards to help ensure compliance with the principles of purpose limitation, data minimisation and accountability, which are set out below.

text: 3. Data categories

text: 18. The EDPS notes that the data categories that would be affected by the direct access functionality are listed in Article 1(5) of the Proposal, which would add

text: Article 49

text: a and 49b to

text: Regulation (EU) No 904/2010

text: . The EDPS understands that, under observance of the timeline provided by the Proposal, the following systems and databases would be accessed by EPPO and OLAF: • the VAT Information Exchange System (VIES), • the Surveillance system (one of the electronic systems under the Union Customs Code), and • the Central Electronic System of Payment Information (CESOP).

text: 19. Furthermore, it is the EDPS’ understanding that the access to these systems would technically enable access to the following data categories: • information on VAT identification numbers and VAT intra-Community transactions ; • relevant information on VAT exempt importations related to the Import One-Stop- Shop (IOSS) and customs procedure 42 /63 importations ; and • aggregated payment information .

text: 20. The EDPS is concerned that, due to the legislative technique of cross-referencing, the Proposal does not clearly set out the relevant data categories in a manner that is clearly foreseeable and accessible to individuals. At the same time, the EDPS understands the challenges that stem from a tiered system of applicability and the envisaged change from a decentralised VIES to a centralised VIES in the future. To enhance clarity and foreseeability, the EDPS recommends providing a clear indication of the main data categories concerned, if only by way of a recital. The exact categories of data available in these systems, that OLAF and EPPO would need to access for the purpose of fighting cross border tax fraud, could then be further specified in an implementing act.

text: 4. Indications of suspected cross-border VAT fraud

text: 21. The EDPS notes that pursuant to Article 1(2) of the Proposal, amending

text: Article 24

text: d of

text: Regulation (EU) No 904/2010

text: , Eurofisc working field coordinators should communicate to EPPO or to OLAF ʻany indication of suspected cross-border VAT fraudʼ in respect of which EPPO or OLAF could exercise its competence. 8

text: 22. As neither EPPO nor OLAF are obliged to take up every case that falls under their mandate, a tiered approach to data transmission can help to comply with the principle of data minimisation. In some cases, it may be sufficient to provide indications without the sharing of (all) personal data, and to share further information once it has been established that the EPPO or OLAF intend to exercise their competence. This may help to avoid unnecessary sharing in the event that the EPPO or OLAF do not take up a case.

text: 23. Against this background, the EDPS welcomes that Eurofisc working field coordinators should in first instance communicate to EPPO or to OLAF ‘indications’ of suspected crossborder VAT fraud. To provide even more clarity, the EDPS recommends stating explicitly that Eurofisc working field coordinators should only actively communicate the information necessary to enable EPPO or OLAF to decide whether to exercise their competence.

text: 5. Technical and organisational safeguards

text: 24. The EDPS notes that Recital 11 of the Proposal refers to necessary adaptations to the existing and planned systems affected by the Proposal. It is the understanding of the EDPS that the Commission will include a separate gateway or interface for OLAF and EPPO access when determining the technical details in an implementing act. The EDPS welcomes such approach, as it seems suited to support purpose limitation and data minimisation.

text: 25. While the details of the technical and organisational measures would be further specified by way of an implementing act, as envisaged by the Proposal, due to the exceptional nature of such access, certain parameters should be spelled out at the level of the basic act, at least by way of defining objectives that would lower the risk of possible untargeted searches (‘fishing expeditions’) or abuse.

text: 26. For example, the EDPS recommends that access is limited to certain information necessary for the investigation of a specific crime with specific suspects through technical measures; this should not only be ensured by defining appropriate search terms, but also by technically restricting the response behaviour of the data base in case of too many hits .

text: 27. In addition, the EDPS recommends requiring at the level of the basic act that technical measures ensure that every access could be attributed to a concrete investigation (case file) and investigator (user). Further measures to ensure accountability could be provided by way of an implementing act. Comprehensive audit logging mechanisms should create a record of all access to the applications and databases, and these logs should be monitored to ensure the proper use of the system and the proper management of security incidents and personal data breaches. The overall solution should also ensure that incidents and personal data breaches are managed appropriately.

text: 28. Furthermore, the EDPS recommends specifying in the Proposal that measures should be in place to ensure that national authorities are made aware and can, where appropriate, challenge access that appears to go beyond what is necessary.

text: 29. Finally, the EDPS recommends requiring OLAF and the EPPO to put in place internal organisational measures to safeguard against unwarranted ‘fishing expeditions’ or other potential violations of tax secrecy. These safeguards could include internal authorisation processes, as have been established, for example, for Europol's access to the Visa Information System (VIS), the European Union's centralised biometric database (Eurodac), and the other EU large-scale information systems containing 'administrative' data .

text: 6. Ex-post evaluation and review

text: 30. The EDPS notes that under

text: Article 49(1)

text: , (3) and (4) of

text: Council Regulation (EU) No 904/2010

text: , a system to evaluate how well administrative cooperation is combating tax evasion and avoidance is already in place, including annual statistics by Member States about the information accesses by the EPPO and OLAF. It is the EDPS’ understanding that these clauses also apply to the amendments to be introduced by the Proposal.

text: 31. Accordingly, the Regulation’s application is supposed to be reviewed every five years . In this regard, the EDPS recommends that during the future reviews specific attention is paid to the practical application and the impact of the envisaged direct access to VAT data by the EPPO and OLAF.

text: 7. Conclusions

text: 32. In light of the above, the EDPS makes the following recommendations: (1) to clearly explain and underline the exceptional nature of providing direct access to administrative databases for law enforcement purposes; (2) to further clarify the data categories affected by OLAF and EPPO access, at least by way of a recital; (3) to clarify that Eurofisc working field coordinators should only actively communicate the information necessary to enable EPPO or OLAF to decide whether to exercise their competence; (4) to require technical measures ensuring that access remains limited to information necessary for the investigation of a specific crime; (5) to require technical measures ensuring that every access can be attributed to a concrete investigation (case file) and investigator (user); (6) to require measures ensuring that national authorities are made aware and can, where appropriate, challenge access that appears to go beyond what is necessary; (7) to require OLAF and the EPPO to put in place internal organisational measures to safeguard against unwarranted ‘fishing expeditions’ or abuse; and (8) to pay specific attention to the practical application and the impact of the envisaged direct access to VAT data by EPPO and OLAF during the future reviews. Brussels, 7 January 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 11

type: vagledning

utgivare: edps


text: The EU has signed, or is negotiating, bilateral agreements with Switzerland, Andorra, Liechtenstein, Monaco and San Marino aiming to regulate and facilitate the exchange of financial, tax-relevant information, thus putting an end to banking secrecy in tax matters.

text: On a basis of the provisions of the agreement recently concluded with Switzerland (the "Agreement"), the EDPS has decided to call on the EU legislator to implement data protection safeguards in future similar bilateral agreements dealing with automatic exchange of tax information.

text: The context: The Organisation for Economic Cooperation and Development (OECD) was mandated by the G20 to develop a single global standard for automatic exchange of financial account information, in order to implement automatic exchange of information as a means to combat crossborder tax fraud and tax evasion by ensuring full tax transparency and cooperation between tax administrations worldwide. The OECD adopted such system in July 2014 (the "Global Standard").

text: In order to implement the Global Standard in the exchanges of data between the EU and the Swiss Confederation, the Agreement -signed by the parties on 27 May 2015 and replacing a previous agreement on the same subject- contains a number of provisions regulating the automatic exchange of tax information between the concerned tax authorities in Switzerland and in the Member States.

text: Such increased attention against tax evasion and the automatic exchange of financial information calls for appropriate safeguards for data protection rights.

text: The safeguards: The EDPS finds that, in spite of the provisions on data protection contained in Article 6 of the Agreement, basic data protection safeguards have not been fully implemented. He considers, in particular, that the following safeguards would have been appropriate:

text: (i) make the collection and exchange of tax-relevant information conditional on the effective risk of tax evasion; (ii) limit the purpose of data processing to the pursuit of a legitimate policy goal (i.e. countering tax evasion), preventing use for additional purposes without informing data subjects; (iii) provide for proper information of the data subjects as to the purpose and modalities of processing of their financial data, including the recipients of their data; (iv) set forth explicit security and data protection standards to be complied with by private and public authorities engaging in the collection and exchange of tax information; (v) provide for an explicit retention period applicable to the tax information exchanged and mandate for its deletion, once such information is no longer processed for the purpose of countering tax evasion.

text: Council Directive 2003/48/EC of 3 June 2003

text: on taxation of savings income in the form of interest payments, OJ L 157, 26.6.2003, p. 38–48.

text: Article 29

text: WP letter of 18.09.2014 on the OECD Common Reporting Standard, available at http://ec.europa.eu/justice/data-protection/article-29/documentation/otherdocument/files/2014/20140918_letter_on_oecd_common_reporting_standard.pdf.pdf . 3

text: Commission decision 2000/518/EC

text: of 26.7.2000, available at http://eur-lex.europa.eu/legalcontent/EN/TXT/?qid=1415700329280&uri=CELEX:32000D0518.

text: Court judgement of 8.4.2014, in joined cases

text: and

text: In this respect, further guidance should be sought in the

text: Article 29

text: Working Party opinion 3/2013 on purpose limitation (

text: WP 203

text: ), available at http://ec.europa.eu/justice/data-protection/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf .

identifier: EDPS yttrande 02/2015

amnesord:
International Agreements
Transfers of data
Information Security
Finance & Economy
Tax cooperation
Tax evasion

text: Opinion 2/2015

text: Opinion of the EDPS on the EU-Switzerland agreement on the automatic exchange of tax information

text: 8 July 2015

text: EXECUTIVE SUMMARY

text: 2 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: I. IMPLEMENTATION OF THE GLOBAL STANDARD FOR AUTOMATIC EXCHANGE OF FINANCIAL ACCOUNT INFORMATION

text: 1. The importance of automatic exchange of information as a means to combat cross-border tax fraud and tax evasion by ensuring full tax transparency and cooperation between tax administrations worldwide has been recognised at the international level. The Organisation for Economic Cooperation and Development (OECD) was mandated by the G20 to develop a single global standard for automatic exchange of financial account information. The Global Standard was released by the OECD Council in July 2014.

text: 2. In the EU, in order to preserve the level playing field of economic operators, agreements have been signed with Switzerland, Andorra, Liechtenstein, Monaco and San Marino providing for measures equivalent to those laid down in directive No.

text: (on 1 taxation of savings income in the form of interest payments) . The purpose of these agreements was to regulate and facilitate the exchange of financial information, relevant for taxation purposes, among the competent authorities of the countries involved in the agreements, thus putting an end to banking secrecy in tax matters.

text: 3. On 27 May 2015, the President of the Council signed, on behalf of the European Union, the Amending Protocol to the agreement between the European Community and the Swiss Confederation providing for measures equivalent to those laid down in Council Directive No

text: on taxation of savings income in the form of interest payments (hereafter "the Agreement"). The approval of the conclusion of the Agreement by the European Parliament is currently pending.

text: 4. In order to minimise costs and administrative burdens both for tax administrations and for economic operators, the Agreement aims at bringing the existing Savings Agreement with Switzerland in line with EU and international developments as regards automatic exchange of information. This will increase tax transparency in Europe and will be the legal basis for implementing the OCDE Global Standard on automatic exchange of information between Switzerland and the EU.

text: 5. Therefore, in order to implement the Global Standard in the exchanges of data between the EU and the Swiss Confederation, the Agreement contains a number of provisions regulating the automatic exchange of tax information between the concerned tax authorities in Switzerland and in the Member States.

text: 6. The increased attention against tax evasion and the automatic exchange of financial information, however, calls for appropriate safeguards for data protection rights. This is a 3 | P a g e crucial aspect, considering that the OECD rules on automatic exchange converge on principles already adopted by the US legislation on the subject (the US FATCA) which, nonetheless, have a different approach to data protection issues .

text: 7. With respect to the protection of personal data, it must be noted that the Agreement includes, in its

text: Article 6

text: , provisions on confidentiality and data protection. In addition, it must be borne in mind that the Commission has adopted an adequacy decision finding that the data protection legal framework in force in Switzerland is consistent with the principles of Directive No

text: (the "Data Protection Directive") thus allowing for unrestricted transfer of data pursuant to Articles 25 and 26 of the same Directive.

text: 8. In this Opinion, we would like to formulate a number of considerations focusing on the data protection implications of the Agreement, with a view to provide guidance on essential safeguards that should be embedded in future bilateral agreements entered into by the EU for the purpose of facilitating the automatic exchange of financial account information. II. DATA PROTECTION IMPLICATIONS OF THE PROVISIONS IMPLEMENTING THE AUTOMATIC EXCHANGE OF TAX INFORMATION. II.1 Proportionality of measures - Detection of Reportable Accounts and Due Diligence exercise

text: 9. The automatic exchange of information, to be carried out annually, concerns primarily Reportable Accounts, established either in Switzerland or in any EU Member State, to be identified through a Due Diligence exercise (also regulated by the Agreement). A reportable account is an account to which the Agreement links a significant risk of tax evasion, such to trigger reporting obligations. The reporting entails the transfer and processing of a significant amount of personal data to and by Switzerland and EU Member States (e.g. name, address and place of birth of the account holder, balance of the account, amount of interests, dividends and/or other income obtained from the account).

text: 10. Reportable Accounts, as mentioned, are identified not by virtue of specific circumstances linked to them or to the account holder, rather through a due diligence exercise carried out by financial institutions in both Switzerland and EU Member States. The due diligence consists mainly of an electronic record search of all electronically searchable data performed in relation to account holders whose residence information is missing- looking for evidence (e.g. mailing address, fix or mobile phone numbers, power of attorney granted) of the residence of such account holders in one of the jurisdictions where reporting and tax information exchange apply. If any of the evidence listed in the Agreement is discovered in the electronic search, or if there is a change in circumstances that results in one or more piece of evidence being associated with the account, then the reporting financial institution must treat the account holder as a resident for tax purposes of each jurisdiction for which a piece of evidence is identified. 4 | P a g e

text: 11. In the recitals, the Agreement indicates that certain financial institutions and accounts that present a low risk of being used to evade tax should be excluded from the scope. Nonetheless, it also takes the position that thresholds should not be generally included, as they could easily be circumvented by splitting accounts into different financial institutions. It is not clear then, reading the Agreement, how such low-risk institutions and accounts should be identified.

text: 12. Noting that the circumstances that identify a high risk of tax evasion -and trigger the reporting obligations- are not clear, that the due diligence exercise seems to rely heavily on electronic record search and that apparently there are no suitable criteria to exempt low risk accounts from reporting, we are concerned that the measures envisaged by the Agreement might exceed what is necessary and proportionate to achieve a legitimate policy goal (fight against tax evasion).

text: 13. The relationship between legitimate public policy goals and protection of personal data has been addressed by the European Court of Justice in its Digital Rights Ireland judgment. In fact, based on the Court judgment annulling Directive No

text: (Data Retention Directive applied to persons for whom there was no evidence capable of suggesting that their conduct might have a link, even an indirect or remote one with criminal activity), measures introducing massive and indiscriminate collection of data are deemed not to be proportionate, if they fail to narrow down the types of persons who can be targeted as individuals suspected of a crime.

text: 14. Therefore, we consider that the Agreement should have included provisions and criteria that explicitly link the reporting of personal data concerning financial accounts to possible tax evasion and that exempt low-risk accounts from reporting. In this respect, such criteria should be applicable ex ante to determine which accounts (and which information) would need to be reported. Only at that stage -once the relevance (or irrelevance) of the reporting for the purpose of countering tax evasion has been established- the electronic search might help determining the residence of the account holder. II.2 Purpose limitation in the processing of exchanged information Processing of tax information for additional purposes

text: 15. The Agreement includes provisions limiting the circulation and the use of the information exchanged through the automatic exchange system. To such effect,

text: Article 6(2)

text: (confidentiality and protection of personal data) provides that the information exchanged, including personal data, shall be disclosed on a "need-to-know" basis "only to persons and authorities (...) concerned with the assessment, collection or recovery of, the enforcement or prosecution in respect of, or the determination of appeals in relation to taxes of that jurisdiction, or the oversight of the above. Only the persons or authorities mentioned above may use the information and then only for purposes spelled out in the preceding sentence ".

text: 16. In addition,

text: Article 6(3)

text: provides that the information exchanged "may be used for other purposes when [this is possible] under the laws of the supplying jurisdiction (...) and the competent authority of that jurisdiction authorises such use". 5 | P a g e

text: 17. We welcome that the Agreement seeks to limit the circulation and use of the information exchanged, as purpose limitation is one of the fundamental principles of data protection enshrined in the Data Protection Directive. For the same reason, however, we are critical of the envisaged possibility to use the information for additional purposes, when this is possible under the laws of the supplying jurisdiction and there is the authorization of the competent authority of such jurisdiction. We consider that the problem is not so much that alternative uses are possible in the supplying jurisdiction as the fact that, in application of this provision, alternative uses become possible in the receiving jurisdiction, in a way which is potentially harmful to individual rights.

text: 18. In this respect, the EDPS notes that purpose elasticity restricts the individual rights to protection of personal data, as the purpose for data processing should be specified, explicit and legitimate and disclosed ex ante to the data subject. Further processing for additional purposes may only take place if such purposes are compatible with the original purpose (Article 6 of the Data Protection Directive). In his viewpoint, Article 6 (3) of the Agreement further limits the rights of the individual without providing any safeguards (e.g. prior information of the data subjects as to possible alternative uses of their information). II.3 Rights of the data subject

text: 19. Article 6(2) of the Agreement provides that "Information provided by a jurisdiction (being a Member State or Switzerland) to another jurisdiction (being, respectively, Switzerland or a Member State) may be transmitted by the latter to a third jurisdiction (being another Member State), subject to prior authorisation by the competent authority of the first-mentioned jurisdiction, from which the information originated. Information provided by one Member State to another Member State under its applicable law implementing

text: Council Directive 2011/16/EU

text: on administrative cooperation in the field of taxation may be transmitted to Switzerland subject to prior authorisation by the Competent Authority of the Member State from which the information originated".

text: 20. As this transfer of personal data takes place either between Member States (all bound by the Data Protection Directive) or toward Switzerland (which is the subject of a Commission adequacy decision), we do not have concerns as to the fact that the transfer complies with Articles 25 and 26 of the Data Protection Directive. We consider, however, that there is a specific need to ensure that data subjects are duly and timely informed on the circulation and use of their personal data, as required by Article 10 of the Data Protection Directive.

text: 21. Therefore, the Agreement should have specified that information on data transfers should be provided to the data subject with a reasonable delay before the actual exchange of the data takes place (so that the individual concerned gets time to defend himself if relevant). The information provided should at the minimum inform the data subjects of the fact that their personal data will be sent to a competent authority for the purpose of fighting tax evasion, include a list of the category of data sent and the contact of the controller in their country of residence and inform them of their right to object and their right of redress. 6 | P a g e II.4 Data security and retention period Data security measures

text: 22. The Agreement mandates (

text: Article 3(5)

text: ) that the authorities in charge of the automatic exchange of tax information will agree on one or more methods for data transmission including encryption standards. It also provides (

text: Article 6(4)

text: ) that each authority of a Member State or Switzerland will notify the other competent authority (i.e. that of Switzerland or the specific Member State) immediately regarding any breach of confidentiality, failure of safeguards and any sanctions and remedial actions consequently imposed.

text: 23. In consideration of the sensitive nature of tax information (they can reveal valuable aspects of the life and activities of citizens), we welcome that such safeguards have been provided for. We consider, however, that the Agreement should have explicitly set forth the security standards to be complied with by the authorities (both in Switzerland and in the EU) engaging in systemic data exchange. Also, an optimal system of safeguards would require that sanctions are applied as a consequence not only of security breaches, but also for the violation of data protection provisions, so as to make the latter rules cogent and thus more effective.

text: 24. Merging technology and data protection and designing a privacy-compliant system from the outset -rather than applying data protection rules ex post- is an example of privacy-bydesign approach. Such an effort is part of a philosophy that we support and that will be implemented also in the forthcoming General Data Protection Regulation. Retention period of exchanged tax information

text: 25. With respect to the application of the Global Standard in time, we note that the Agreement provides that relevant tax information is to be exchanged with respect to the first year starting at the entry into force of the amending protocol (the body of provisions implementing the Global Standard) and all subsequent years and will be exchanged within nine months after the end of the calendar year to which the information relates.

text: 26. On the one hand, the exchange of information on a certain number of accounts on an annual basis confirms our view that the information exchange is independent of the detection of any actual risk of tax evasion, thus questioning the proportionality of the measure itself (an issues we addressed in the paragraphs above). On the other hand, we note that nothing is said of what happens once tax information is collected and exchanged, namely there is no mention of any retention period.

text: 27. The indication of an explicit retention period for the personal data collected and exchanged would have ensured that data are retained for the time strictly necessary to pursue legitimate policy goals and, once this is achieved, they are deleted, restoring in full individual rights. Should this not be the case, the massive and continuous exchange of tax information concerning citizens would result in a large archive difficult to control and potentially harmful to the citizens.

text: 28. We therefore consider that the Agreement should have clearly indicated for how much time tax information should be retained, in order to counter tax evasion. It should have 7 | P a g e also explicitly provided for the deletion of such information once the retention period has expired. III. CONCLUSION

text: 29. In the light of the considerations above, we take note of the fact that the implementation of the Global Standard is considered as necessary to counter tax evasion and thus ensure a level playing field to market operators.

text: 30. We consider, nonetheless, that, during the negotiation phase, a number of corrections should have been made to the Agreement in order to better address data protection issues. We now call on the EU legislator to introduce such data protection safeguards in future measures implementing the Agreement and in future bilateral agreements to be concluded with other countries in the same field. In particular, any similar agreement or future implementing measure should:  ensure proportionality of the data processing, by making the collection and exchange of tax information conditional on the effective risk of tax evasion and by implementing criteria to exempt low-risk accounts from reporting;  limit the purpose of data processing to the pursuit of a legitimate policy goal and prevent use for additional purposes without informing data subjects;  provide for proper information of the data subjects (pursuant to Article 10 of the Data Protection Directive) as to the purpose and modalities of processing of their financial data, including the recipients of their data;  set forth explicit security and data protection standards to be complied with by private and public authorities engaging in the collection and exchange of tax information (privacy-by-design). It should also provide for sanctions in case of breach of such provisions;  provide for an explicit retention period applicable to the tax information exchanged and mandate for its deletion, once such information is no longer processed for the purpose of countering tax evasion. Bruxelles, 8 July 2015 (signed) Wojciech Rafał WIEWIÓROWSKI European Data Protection Assistant Supervisor 8 | P a g e