Notification to individuals reported under DAC - A new mandatory requirement in the Luxembourg legal framework

In Detail

The DAC 7 Law, that took effect as of 1 January 2023, introduced obligations on reporting platform operators (as defined by the Law) to collect information on their users with  seller status, and provide it to the Luxembourg Tax Authorities (LTA), on an annual basis.

Moreover, the DAC 7 Law, also amended existing provisions on the automatic exchange of information and administrative cooperation from a specific GDPR perspective, including:

• DAC 2, also referred as to Common Reporting Standard (CRS) which provides for the exchange of financial account information as foreseen by the Law of 23 December 2016 (the CRS Law), and

• DAC 6, which provides for the exchange of cross-border tax arrangement information, as foreseen by the Law of 25 March 2020.

Concretely, the DAC 7 Law amended Article 5 of the CRS law (DAC 2) and requires Luxembourg Reporting Financial Institutions (FIs) to notify each reportable individual account holder and each reportable controlling person of Passive Non-Financial Entities (NFEs) regarding their personal information that will be included in the CRS report. More specifically, the Reporting FIs, as “Data Controller”, shall inform these individuals about the category of data that will be subject to the reporting and more importantly to which tax authorities the information will be exchanged with. 

This new obligation imposed on Reporting FIs after the implementation of DAC 7 Law aims to reinforce the rights of reportable persons recognised by GDPR in the context of the different versions of the DAC. 

Indeed, while the CRS Law already provided some GDPR related protection to reportable individuals and notably:

1. Right to information: Each reportable individual must be notified if their information is gathered and transmitted in accordance with the CRS law.

2. Right to access and right to rectification: Each reportable individual should have access to the information processed by the Data Controller (the Reporting FIs) within a reasonable timeframe to have enough time to correct any potential discrepancies in the information reported. For this reason, the notification must be completed before any information is shared with the Luxembourg Tax Authority (LTA).

Such guarantees were only given at the clients/investors on-boarding e, usually as part of the general terms of business and self-certifications collected from them and/or prior to the first reporting. Based on DAC 7 Law, such notification is now becoming an annual legal requirement.

The DAC 7 Law also made mandatory such notification under DAC 6 (MDR) reporting, even though this notification will be different in terms of timing and content. 

The DAC 7 Law being retroactively effective as of 1 January 2023, means the notification requirement should already be met from this year, and the market is reacting accordingly.

For CRS purposes, as the reporting deadline is 30 June of every year, and the DAC 7 Law has only been voted in May with a legal effect on 1 June 2023, it is currently recommended to notify CRS reportable persons still this year even though many actors were only able to send the notification after filing the reports.

For the coming years, Reporting FIs are required to inform individuals on a yearly basis, by using a notification sent sufficiently in advance of the reporting, to allow them to exercise their GDPR rights. The DAC 7 Law is silent regarding the exact timing of the notification. Considering general GDPR guidance provided by the Data Protection Commission on its website, it is understood by the market (and the relevant industry association) that a minimum 1-month period before the filing of the report should be given. 

On the other hand, for DAC 6 purposes, considering that the MDR report must be filed within 30 days, the 1-month notification period would not be feasible as for CRS and therefore it is recommended to send it as soon as possible but no later than a few days before the filing.

The notification must contain an indication of the jurisdiction(s) with which the data will be exchanged which corresponds to the jurisdiction(s) of tax residence of the concerned individuals. This is particularly important, since the tax residence(s) on file of the Reporting FIs might be improperly assessed, recorded, or simply no longer up to date. It is therefore critical that individuals are duly informed sufficiently well in advance of the actual date of reporting, by the Reporting FIs.

The notification must therefore contain at least the following information and indications:

1. The categories of data to be reported under CRS (such as, personal tax identification information, account balance at year-end, total gross amount paid or credited to the account holder by the Reporting FIs during the calendar year).

2. The purpose of the processing for which the personal data is intended as well as the legal basis for the processing (i.e. the reporting obligations under the CRS Law).

3. The recipient(s) of the data (i.e. the Luxembourg Tax Authorities and the tax authorities of the jurisdiction(s) the data will be exchanged with).

4. The right of the person to access and rectify the data and the related process to do so.

Except for the Tax residence and the Tax Identification Number, the market seems to agree on the fact that it would not be expected to disclose detailed information for each category listed above, such as the exact amounts to be reported, address, birth information. The Reporting FIs may remain generic and only transmit the detailed information if requested by the relevant individual.

At this stage, there is no specific indication of the notification format, but it is understood that the notification is an obligation of means and not of results. As such, there is no requirement to use registered mail. The Reporting FIs should use their regular communication channel (e.g. investor/client web portal, emails, mails, etc.).

Moreover, it is important to mention that notifications can be sent either by the Data Controller or by a party who is directly or indirectly contracted with, and acting on behalf of, the Data Controller (i.e. third party service provider in charge of the reporting, transfer agent, domiciliation agent).