Cross-Border Data Transfers Under DAC8

DAC8's automatic exchange mechanism involves the transfer of personal data between EU Member States. This article examines the data protection framework governing these transfers.

Intra-EU Transfers

Transfers of personal data between EU Member States are not subject to the GDPR's restrictions on international data transfers (Chapter V). The EU's internal market provides a unified data protection framework, and DAC8 data exchanged between Member State tax authorities flows within this framework.

Non-EU Jurisdictions

When DAC8 data involves users who are tax residents of non-EU countries (for example, users who provided a non-EU TIN or who have tax obligations in CARF-adopting jurisdictions outside the EU), additional data transfer considerations may arise. The transmission of personal data to tax authorities outside the EU must comply with GDPR's international transfer rules, including adequacy decisions, standard contractual clauses, or other appropriate safeguards.

In practice, the international tax information exchange agreements that govern CARF data exchange between jurisdictions typically include data protection provisions that satisfy GDPR requirements. However, CASPs should verify this for each relevant jurisdiction.

CASP-to-Authority Transfers

The transfer of DAC8 reports from CASPs to their home Member State's tax authority is governed by the national transposition legislation, which provides the legal basis for the transfer. CASPs must ensure that they use secure transmission methods specified by the tax authority and that they do not transmit data to unauthorized recipients.

Conclusion

DAC8 data transfers within the EU are facilitated by the unified GDPR framework, but transfers involving non-EU jurisdictions require additional attention. CASPs should verify the data protection arrangements for all cross-border data flows associated with their DAC8 reporting.