PHAEDRA II - IMPROVING PRACTICAL AND HELPFUL CO-OPERATION BETWEEN DATA PROTECTION AUTHORITIES II

Transcription

1 DPA: Portugal. Comissão Nacional de Proteção de Dados (CNPD) TITLE: CNPD Opinion 22/2016 on draft legislation regarding tax issues DATE: August 2016 KEY WORDS: CNPD, bank secrecy, Directive 2014/107/EU, tax issues WEBSITE: ABSTRACT: Pursuant to the European Directive 2014/107/EU 1, the Law Decree 61/2013 of 10 May was approved to facilitate the exchange of banking information among member states in a bid to combat tax fraud. At the beginning of 2015, the government approved a draft which allowed the taxman access to pension funds, retirement and insurance plans, which had been applicable not only within their own country but also allowing foreign countries with which Portugal shares a Dual Taxation Agreement, to get all kind of information about Portuguese bank accounts. In this regard, the CNPD declared illegal the attempt by the new Portuguese Government to gain access to all data in bank accounts. It considered that its effective implementation would translate into disproportionate, excessive and unnecessary restriction of the citizens data rights by forcing banks to hand over bank balances and detailed reports. According to the CNPD s Opinion Allowing the Government to create the compulsory communication to the AT of all bank balances of people residing in Portugal would translate into disproportionate, unnecessary and excessive restriction of the fundamental rights of people s data and private lives. This is in clear violation of Article 18 of the Constitution. The Commission has concluded that This measure fails to demonstrate that it adequately protects against tax evasion and that the knowledge of bank account balances is not one that will necessarily prevent or fight tax evasion 2. ASSESSMENT After several failed efforts by the government to limit the bank secrecy in Portugal, the CNPD has clarified that citizens data rights may only be limited to protect other fundamental rights and interests protected by the Portuguese Constitution. 1 Council Directive 2014/107/EU of 9 December 2014 amending Directive 2011/16/EU as regards mandatory automatic exchange of information in the field of taxation. 2 The Portugal News: "Taxman dealt bank secrecy blow", March

2 This problem does not hinge, however, so much on the review for constitutionality, as on the absence of bank secrecy legislation that affects not only to Portugal but also in most of the EU countries. In this sense, EU countries do not have specific legislation dealing with it, unlike other third countries like the USA. Consequently, it must be differentiated between the following terms: bank secrecy, product of the contractual relationship between bank and customer, and data protection, which is imposed by act of law. These two terms constitute two independent concepts that do not oppose one another but co-exist provided that they do not overlap. While this absence of regulation might be taken to mean that bank secrecy stems from the duty of professional diligence and other fundamental rights such as, the right of privacy and data protection 3, there is no a general or common guidelines to be followed by Data Protection Agencies (DPAs) in this regard. For that purpose, the CNPD has analysed those general causes that allow collecting data (compelled to do so by law, it is in the bank s interests to disclose, the disclosure is made with express or implied consent of the customer) but also provides a restrictive interpretation of the a duty to the public to disclose. At a EU level, some DPAs have analysed other problems associated with bank services that arise from the application of national and European legislation. For example, the French Data Protection Authority (the CNIL) issued a public a warning decision in June 2012 ( against a financial services group operating as a IT service provider as some documents about some of the bank's customers and their transactions were made available to the personnel of the company. They were posted on shared folders and included private information such as; bank account details, credit card numbers, income and tax information, etc. According to the CNIL, this action contravened the bank secrecy but did not initiate any sanctions proceedings since the breach had been cured immediately. On the other hand, the Spanish Data Protection Agency (AEPD) issued conclusions on their ongoing assessments of online banking services. 3 In this regard, GDPR and the legislations of the Member States define personal data as "identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the (...) economic of that natural person" (art. 4 GDPR).

3 ECOMENDACIONES-BANCA-A-DISTANCIA.pdf. It outlined that those aspects require further improvement. More specifically, the bank secrecy was identified in action 2.6 in which the following gaps were identified: a) Some banking and financial contracts did not contain any provision to ensure confidentiality regarding the data that personnel may become aware of due to provision of the service. b) All the personal data and bank details were provided only through the simple submission of ID information. Last 9 September 2016, the Portuguese Ministry of finance, declared again that banks would only be required to report the balance of the accounts to the tax authorities when they exceed 50 thousand euros which may contradict CNPD s opinion. In the Portuguese case, thanks to the implementation of Article 22.2 of Law 67/98 of 26 October Data Protection Law which states that the CNPD must be consulted on any legal provisions relating to the processing of personal data, bilateral cooperation between the data protection authority and the government has been reinforced. Also, this Opinion s has been supported by several consumer watchdogs which reflects the need for greater protection for bank services users. However, existing constitutional and legal guarantees in this area need to be fully enforced not only in Portugal but also at a EU level and new approaches to the protection of data protection and other fundamental rights have to be considered such as the effective cooperation and coordination among European DPAs. Original text (Summary) English version (automated translation) Opinion No. 22/2016 Petition The Secretary of State for Fiscal Affairs referred the Comissão Nacional de Protecção de Dados (CNPD) for an opinion based on the Law-Decree authorized with complementary regulatory implementation of the Foreign Account Tax Compliance Act (FATCA), the transposition of Directive 2014/107/EU of 9 December 2014 amending Directive 2011/16/EU as regards mandatory automatic exchange of information in the field of taxation, the adoption of the common communication standard (CRS) and automatic access regime to financial information concerning residents, prepared by a Working Group coordinated by the technical level of the Center for Tax and Customs Studies.

4 The claim follows from the duties conferred by the CNPD n.0 2 of Article 22.0 of Law No. 67/98 of 26 October, as amended by Law No. 103/2015 of 24 August- Data Protection Law (LPDP) - issued in the use of established competence in a) of n.0 1 of Article 23.0 of the same law, restricting the aspects concerning to data. The CNPD has come to the following conclusions: 1. The authorization stated in Article of Law n A/2016 of March 30, on the obligation of financial data communication of residents in national territory (see Opinion 5 / 2016) is unconstitutional and the law-decree adopted in the draft is not sufficient to apply the restrictions and constraints to the right to personal data and privacy in accordance with paragraph b) of n.0 1 of Article of the CRP; 2. The legal obligation of communicate the bank balances of nationals and residents in Portugal reflects an unnecessary and excessive constraint of fundamental rights to the protection of personal data and privacy, in clear violation of No. 2 of Article 18.0 of the CRP because: a) It is not claimed or demonstrated the need for such communication; b) It is clear that financial information of personal data holders (almost all owners and beneficiaries of resident financial accounts in Portuguese territory) is defined without any minimum criteria (which are also non-proportional). It indicates illegal tax behaviours, or unless identify situations of risk of such behaviour; c) It has a significant and not justified impact on the privacy of residents in Portugal, undermining banking secrecy, also the concentration in the TA personal information on the private lives of the residents, which includes bank personal data to which you can access under Articles 63, 63-A and 63-B of General Tax Law, as well as information on trade transactions; 3. Notwithstanding these conclusions, the CNDP recommends that, to keep the prediction of such duty is introduced in Article 10.0 of the Draft, a standard to prevent access by third parties, whatever its legal status, personal data the balances or financial sing securities held by AT. 4. It is advisable to specify the n. 05 of Article 2.0 of the Draft states that if there is not a decision of the European Commission or the CNDP to recognize the adequacy of the level of protection of personal data of a third State, it is up to CNDP to assess whether any assurance mechanisms are effective enough to ensure adequate protection of personal data transmitted; 5. To fully comply with the n. 02 of Article 18.0 of CRP as well as paragraph e) of n.0 1 of Article 5.0 of LPDP, the standard of Article 37.0 of Annex 11 should be eliminated for not

5 being considered necessary to recognize the financial entities the ability to identify holders or beneficiaries in addition to the cases where there is a duty of communication to the AT; 6. It is noted the consecration of the rights to information and to access the personal data subject, in accordance with the system of protection of personal data should only be added in Article The that the Bill introduced by Decree-Law n.0 61/2013, that security measures must also comply with the provisions of Article 15.0 of the LPDP; 7. Also in Article 3.0, n.0 4 of Annex 11, which provides for the possibility of financial entities may use service providers for the purpose of fulfilling the obligations of communication and due diligence - prediction permitted by the Directive transposed and included in the FATCA Agreement - and should indicate the need to comply with the rules of personal data protection in the field of subcontracting.