04.06.23

Opinion of the European Data Protection Supervisor (EDPS) on VAT in the Digital Age (ViDA) proposal

The European Data Protection Supervisor (EDPS) issued its opinion on the EU VAT in the Digital Age (ViDA) proposal. EDPS is largely advocating and in agreement with the objectives pursued by these proposals and re-asserting that any processing of personal data must comply with the EU data protection Regulations, including the principle of purpose limitation and data minimization. 

With preoccupations around EU Regulations and principles on data protection, the EDPS made the following recommendations in its opinion: 

• To add a recital highlighting that the Proposal for a Council Directive amending Directive 2006/112/EC regarding VAT rules for the digital age ensures full respect for the fundamental rights to privacy and to the protection of personal data, as well as the applicability of the EU Regulations to the processing of personal data in the context of the proposal; 
• Specify that the information collected may only be processed for the purpose of fighting VAT fraud by the competent tax administration; and 
• To delete in recital 24 of the Proposal for a Council Regulation Amending Regulation 904/2010 regarding the VAT administrative cooperation arrangements needed for the digital age the words “seeks to”, to indicate clearly that this Regulation ensures the full respect for the right of protection of personal data. 

Finally, the EDPS also stressed that the setting up of a centralized information system may entail higher risks for data protection purposes due to the large volume of intra-Community transactions information which can lead to potential cyberattacks and data breaches. Thus, the EDPS considers it essential that an adequate level of security is guaranteed in the exchange of information between national tax authorities and the central VAT Information Exchange System (VIES). 

The opinion has raised the critical awareness of security concerns and protocols associated with the proposal. You can read the full opinion here on the EDPS website: 

https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONSIL:ST_7071_2023_INIT&qid=1678102312771&from=EN