Die Deutsche Kreditwirtschaft

Coordinator: German Savings Banks Association Charlottenstraße 47 | 10117 Berlin | Germany Telephone: +49 30 20225-0 Telefax: +49 30 20225-250 www.die-deutsche-kreditwirtschaft.de The German Banking Industry Committee is the joint committee operated by the central associations of the German banking industry. These associations are the Bundesverband der Deutschen Volksbanken und Raiffeisenbanken (BVR), for the cooperative banks, the Bundesverband deutscher Banken (BdB), for the private commercial banks, the Bundesverband Öffentlicher Banken Deutschlands (VÖB), for the public-sector banks, the Deutscher Sparkassen- und Giroverband (DSGV), for the savings banks finance group, and the Verband deutscher Pfandbriefbanken (vdp), for the Pfandbrief banks. Collectively, they represent more than 1,700 banks.

Verband deutscher Pfandbriefbanken (vdp), for the Pfandbrief banks. Collectively, they represent more than 1,700 banks. Contact: Silvia Frömbgen Telephone: +49 30 20225- 5372 Telefax: +49 30 20225- 5345 E-Mail: [email protected] Berlin, February 7, 2024 Comments German Banking Industry Committee’s response to the Commission’s consultation on the GDPR Register of Interest Representatives Identification number in the register: 52646912360-95 Our ref Ref. DK: 211 Ref. DSGV:8418 Ref.

Interest Representatives Identification number in the register: 52646912360-95 Our ref Ref. DK: 211 Ref. DSGV:8418 Ref. Ares(2024)939474 - 07/02/2024 Page 2 of 3 Comments dated February 7, 2024 Report on the General Data Protection Regulation (GDPR) - Call for evidence by EU- Commission from 11 january 2024 (DG JUST, Units C3 and 01, Ares (2024)182158)1: German Banking Industry Committee’s response to the Commission’s consultation on the GDPR on Question 1 “General Comments”2 The GDPR provides a uniform legal framework that applies throughout the EU and guarantees a high level of data protection. The German Banking Industry Committee (DK) also believes that the GDPR has succeeded in principle. However, it is questionable whether the GDPR has the right answers due to the progress of technical developments (e.g.

However, it is questionable whether the GDPR has the right answers due to the progress of technical developments (e.g. cloud-based applications, AI-supported instruments) and how the requirements of the GDPR can be reconciled with these: This is because some of the technical developments, e.g. in connection with cloud technologies, are now unavoidable, also with regard to third countries. Banks in Germany have made considerable efforts to implement the GDPR appropriately. Based on the experience gained in the meantime, the following points in particular need to be improved: - The information requirements in Art. 13 and 14 GDPR are too detailed and excessive. They should be kept to a reasonable level in order to avoid flooding data subjects with information.

…and excessive. They should be kept to a reasonable level in order to avoid flooding data subjects with information. A two-stage approach would be better, namely an overview in the first stage and detailed information upon request in the second stage. - The very general and abstractly formulated accountability obligation in Art. 5 (2) GDPR, in combination with the excessive sanction regime, has led to an enormous bureaucratisation of internal data protection control and a huge increase in documentation obligations in companies. It certainly makes sense to properly document the implementation of the GDPR, but this should be limited to what is necessary. The level of data protection risks should also determine the scope of documentation obligations. Automatically linking any lack of documentation to the harsh sanctions regime is disproportionate.

Automatically linking any lack of documentation to the harsh sanctions regime is disproportionate. - The data subject's right of access under Art. 15 GDPR is a cornerstone of data protection law, as also demonstrated by the case law of the ECJ. However, practice shows that this right is also instrumentalised for purposes that have nothing to do with data protection (e.g. in termination disputes in the context of severance negotiations). It should therefore be made clear that the right of access may only be used by the data subject to pursue his or her data protection rights and not for any other purpose. The processing of requests for information should be facilitated to the extent that the data subject should, in principle, specify the areas to which the request for information relates. Data which are kept only to fulfil legal obligations to keep records, i.e.

…which the request for information relates. Data which are kept only to fulfil legal obligations to keep records, i.e. only for archiving purposes, should be excluded from the right of access. - Deletion of data (Art. 17 GDPR) may be technically difficult or even impossible. Consideration should therefore be given to qualifying or limiting the existing high erasure requirements, in particular by 1 https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/14054-Bericht-uber-die-Datenschutz- Grundverordnung_de 2 QUESTIONS TO GDPR MULTISTAKEHODLER EXPERT GROUP FOR COMMISSION 2024 REPORT ON THE APPLICATION OF THE GDPR 1. General comments, a. What is your overall assessment (benefits/challenges, increase in trust and awareness, etc.) of the application of the GDPR since May 2018? Are there priority issues to be addressed?

…in trust and awareness, etc.) of the application of the GDPR since May 2018? Are there priority issues to be addressed? Page 3 of 3 Comments dated February 7, 2024 placing more emphasis on technical feasibility when implementing erasure requests and by allowing for alternative safeguards in case of lack of technical feasibility (e.g. blocking of the data concerned). - The relationship between the GDPR and other legislation continues to cause problems in practice. Credit institutions are subject to many specific legal/regulatory requirements for data processing (e.g. MaRisk, BAIT). These specific legal requirements must be the guideline; a company would be completely overwhelmed if it had to check its compatibility with the GDPR. This is the sole responsibility of the legislator. - The implementation of data protection must be based on the principle of proportionality.

…the legislator. - The implementation of data protection must be based on the principle of proportionality. Therefore, the need for protective measures must be based on the risk of data processing. - We would like to see simpler procedures for reporting data breaches (Art. 33, 34 GDPR). The obligation to notify should only apply where there is likely to be a high risk to rights and freedom. s. The current timeframe for notification seems too short, especially for incidents before public holidays or on Fridays. Weekends and public holidays should be excluded from the calculation of the deadline in order to meet the legal requirements. - Article 25 (data protection by design) of the GDPR only refers to data controllers, but not to manufacturers. This forces data controllers to test products for privacy vulnerabilities before they are used, which is a significant burden.

…data controllers to test products for privacy vulnerabilities before they are used, which is a significant burden. The ongoing debate about the privacy-compliant use of Microsoft 365 products illustrates this problem. Manufacturers should be required to take data protection law into account in product development and to be guided by the state of the art in order to enable data controllers to fulfil their obligations. - The characteristic of "joint determination of the means and purposes" for categorisation as "joint responsibility" in Art. 26 GDPR is very generic. It is therefore proposed to define the categories of joint processing more clearly by going beyond the general characteristic of joint determination of the means and purposes.

…more clearly by going beyond the general characteristic of joint determination of the means and purposes. The effort involved in organising joint processing in the horizontal relationship between the processors and in the vertical relationship with the data subjects is in many cases not proportionate to the added value for the data subjects under data protection law. In practice, joint and several liability is often disproportionate, even taking into account the insight and influence on the other party's data processing. An appropriate limitation of joint liability in the external relationship is therefore recommended. Clarification is also required, particularly with regard to focussing on the controller that is closer to the subject matter when exercising supervisory powers.

…with regard to focussing on the controller that is closer to the subject matter when exercising supervisory powers. In order to make third country data transfers more secure and standardised, we propose that the EU Commission continuously review criteria for a Transfer Impact Assessment (TIA) regarding the use of the EU standard contractual clauses for individual third countries. These criteria should not only take into account specific data recipients, but also the general legal framework and data protection standards in these countries. The results of these assessments should be made public in order to support companies with individual assessments, promote transparency and save resources. ---

originalus šaltinis (PDF) ↗

Coordinator: National Association of German Cooperative Banks Schellingstraße 4 | 10785 Berlin | Germany Telephone: +49 30 2021-0 Telefax: +49 30 2021-1900 www.die-deutsche-kreditwirtschaft.de The German Banking Industry Committee is the joint committee operated by the central associations of the German banking industry. These associations are the Bundesverband der Deutschen Volksbanken und Raiffeisenbanken (BVR), for the cooperative banks, the Bundesverband deutscher Banken (BdB), for the private commercial banks, the Bundesverband Öffentlicher Banken Deutschlands (VÖB), for the public-sector banks, the Deutscher Sparkassen- und Giroverband (DSGV), for the savings banks finance group, and the Verband deutscher Pfandbriefbanken (vdp), for the Pfandbrief banks.

…for the savings banks finance group, and the Verband deutscher Pfandbriefbanken (vdp), for the Pfandbrief banks. Comments Proposal for a Council Directive amending Directive 2006/112/EC as regards VAT rules for the digital age (COM(2022) 701 final) Lobby Register No R001459 EU Transparency Register No 52646912360-95 Contact: Dirk Pick Telephone: +49 30 2021-24 11 Telefax: +49 30 2021-292400 E-mail: [email protected] Berlin, 23-04-03 Ref. Ares(2023)2391426 - 03/04/2023 Page 2 of 3 Comments Proposal for a Council Directive amending Directive 2006/112/EC as regards VAT rules for the digital age (COM(2022) 701 final) We would like to thank you for the opportunity to comment on the above-mentioned proposal for a directive and are pleased to take this opportunity. We would like to focus our comments on the introduction of digital reporting obligations to modernize VAT obligations.

We would like to focus our comments on the introduction of digital reporting obligations to modernize VAT obligations. We welcome and support this project in general. Nevertheless, we would like to point out that various reporting obligations have recently been introduced in tax law that exist side by side – Common Reporting Standard - CRS, Council Directive (EU) 2021/514 amending Directive 2011/16/EU on administrative cooperation in the field of taxation - DAC 7 and, last but not least, Central Electronic System of Payment Information - CESOP. In particular, the new requirements for payment service providers, according to which credit institutions will have to report certain payment transaction data to the central European database CESOP as of January 1st 2024, is currently resulting in an enormous amount of implementation work and considerable costs for financial institutions.

…is currently resulting in an enormous amount of implementation work and considerable costs for financial institutions. The same is to be expected regarding the implementation of electronic invoicing and new digital reporting requirements. It would be desirable and more effective if the systems - at least those that have the same goal of combating VAT fraud, such as CESOP and the planned Central VAT Information Exchange System - VIES - could be coordinated. This is because in the future, payment data will also be reported to the new Central VIES, although payment data for cross-border payments are already reported to CESOP, which would lead to unnecessary double reporting.

…payment data for cross-border payments are already reported to CESOP, which would lead to unnecessary double reporting. In detail, we would like to make the following comments on the proposed amendments to Directive 2006/112/EC: In our view it is positive, that the standard data set for electronic invoices is based on an already existing standard (Art. 218-proposal). We also support the proposal's underlying idea of harmonizing the data set for electronic invoices across the European Union (Art. 218-proposal, Art. 263 (1)-proposal). This also includes that we welcome the harmonization with regard to the introduction of a uniform electronic invoice for domestic transactions (Art. 271b-proposal). However, the option provided in the second subparagraph of Art.

…for domestic transactions (Art. 271b-proposal). However, the option provided in the second subparagraph of Art. 271b-proposal for Member States to also allow other data formats for the transmission of domestic electronic invoices contradicts the idea of harmonization. In general, options always lead to different implementation in the Member States, which not only leads to legal uncertainties - especially for example in the case of EU-wide group structures -, but also to an increased effort for companies, since different regulations have to be applied depending on the Member State.

…to an increased effort for companies, since different regulations have to be applied depending on the Member State. We continue to assume that VAT-exempt (financial) services will not be subject to the electronic reporting requirements as in the past and welcome the fact that the exemption from the obligation to issue invoices for transactions exempt from VAT under Article 135 (1) (a) to (g) will continue to apply (Article 220 (2) VAT Directive). However, in the discussion of the proposal with the banks we represent, a number of issues were also raised which, in our view, have not yet been regulated in the draft or have not yet been regulated in a practicable manner: • These include the two-day deadline for the creation of an electronic invoice and its transmission to the domestic tax authority (Art. 222(1)-proposal, Art. 263(1)-proposal), which we believe is too short.

…transmission to the domestic tax authority (Art. 222(1)-proposal, Art. 263(1)-proposal), which we believe is too short. This deadline is unlikely to be feasible, especially for smaller companies. Page 3 of 3 Comments Proposal for a Council Directive amending Directive 2006/112/EC as regards VAT rules for the digital age (COM(2022) 701 final) • In our view, it is also unclear how the recipient of an electronic invoice has to handle the data record of the electronic invoice received. According to paragraph 16 of the considerations to the draft directive, the recipient should also send the data to his domestic tax authority. In our opinion, this is not clearly expressed in Article 262 (1)-proposal and should therefore be formulated more explicit. What has not been specified in the draft so far are possible data verification obligations of the recipient of the electronic invoice.

…specified in the draft so far are possible data verification obligations of the recipient of the electronic invoice. In other words, the question of whether he has to audit and correct any recognizable errors in the data record. This would be the case, for example, if the invoice contains incorrect information about the scope of the delivery or service. • Furthermore, it is not regulated whether an IBAN must also be specified in case that no payment as a return service is stipulated, but the return service is provided in the form of a counter- performance, for example in the case of an exchange service (Art. 226 No. 17 and No. 18- proposal). • From a practical point of view, the omission of a monthly collective invoice is associated with a considerable additional effort in invoicing (omission of Art.

…of a monthly collective invoice is associated with a considerable additional effort in invoicing (omission of Art. 223 VAT Directive) and should be reconsidered, although this is a logical consequence of sales-related quasi real-time reporting. • Furthermore, in our view, it has not yet been clarified how to proceed in the case of an invoice sent by the recipient of the service (Art. 224 VAT Directive). • It was also expressed, that the scope of the data to be reported is too large and not necessary for the purposes of tax collection and combating tax evasion. It should therefore be re-examined whether the proposed data are all necessary for these purposes or whether the data set can be streamlined. • Member States will have a much larger amount of data at their disposal through the communication of invoice data compared to the current situation.

…larger amount of data at their disposal through the communication of invoice data compared to the current situation. Clear and uniform rules are needed regarding the purposes and the extent to which these may be used by the tax authorities. We would be pleased, if the aspects we have mentioned were included in the further discussion of the proposal and are at your disposal for any explanations or queries.

originalus šaltinis (PDF) ↗