User Consent and DAC8: What CASPs Must Communicate

While CASPs do not need user consent to process data for DAC8 compliance, they do have transparency obligations under GDPR. This article explains what CASPs must communicate to their users about DAC8 data processing.

Transparency Obligations

Under GDPR Articles 13 and 14, CASPs must inform users about the data processing activities related to DAC8. This information should be provided at the time of data collection — typically during onboarding or when requesting self-certifications and TINs.

Required Information

CASPs must communicate to users the identity of the data controller (the CASP), the purposes of processing (compliance with DAC8 tax reporting obligations), the legal basis for processing (legal obligation under Article 6(1)(c) GDPR), the categories of personal data collected (identification data, TINs, transaction data), the recipients of the data (the competent tax authority, which will share data with other EU Member States), the retention period for the data, and the user's rights (access, rectification, erasure subject to legal retention requirements, and complaint to a supervisory authority).

How to Communicate

The most effective approach is to include DAC8-specific information in the CASP's privacy notice, provide a separate notification at the point of self-certification collection, and include clear explanations in any communication requesting TINs or other tax-related data.

User Rights Under GDPR

Users retain their GDPR rights even with respect to DAC8 data processing. They can request access to the data held about them, request rectification of inaccurate data, and lodge complaints with the national data protection authority. However, the right to erasure (Article 17) is limited by the legal retention requirement — CASPs cannot delete data that they are legally required to retain for DAC8 purposes.

Conclusion

Transparency is a cornerstone of GDPR compliance. CASPs must proactively inform users about how their data will be processed for DAC8 purposes, ensuring that the information is clear, accessible, and provided at the appropriate time.