Balancing Data Protection and Public Interest: VAT Fraud as a Legitimate Exception Under the GDPR
From our point of view, the aim of Regulation (EU) 2016/679 on personal data protection does not seem as clear as it might initially appear. We were surprised by the approval of this new regulation, which did not appear strictly necessary. In fact, in Spain we already have an efficient legal framework in this matter, and the same can likely be said for most EU countries. On the contrary, what was truly needed was a common EU standard allowing public administrations to introduce exceptions to data protection in cases of public interest. A clear example of this is found in tax matters. The fight against VAT fraud is recognised as an important objective of general public interest for both the Union and its Member States.
To achieve the objectives of Regulation (EU) No 904/2010—namely, the cooperation and exchange of information for the correct assessment and monitoring of VAT, especially on intra-Community transactions—it is appropriate to allow specific and limited restrictions to certain rights and obligations laid down in Regulation (EU) 2016/679.
More specifically, full enforcement of the GDPR rights and obligations would seriously undermine the effectiveness of VAT fraud prevention. This would particularly allow data subjects to obstruct investigations and risk profiling, thereby jeopardising legal inquiries and administrative procedures under Regulation (EU) No 904/2010. It would also disable the administrative cooperation between competent authorities, a key mechanism for combating VAT fraud.
Consequently, restrictions should apply to the following rights:
- the right to transparent information
- the right to receive information when personal data are collected from the subject
- the right to receive information when data are obtained from other sources
- the right of access
- the right to erasure
- the right to object to processing
- the right concerning automated decision-making and profiling
These rights should only be restricted to the extent strictly necessary, in order not to compromise the objectives of Article 1 of Regulation (EU) No 904/2010. Such restrictions should apply only to certain categories of data, as referred to in Articles 1, 14, and 17 of that Regulation, and only insofar as necessary to ensure compliance with VAT legislation and with the relevant provisions of this Regulation.