Automatic Exchange of Information for digital platform operators (DAC 7) - Luxembourg law voted


In Brief

On 3 May 2023, the Luxembourg Parliament voted in favor of the bill of law N°8029 to implement DAC 7 into the Luxembourg legal system, thus introducing new requirements for reporting platform operators but also strengthening data protection requirements of data controllers in the context of the automatic exchange of information and administrative cooperation.

In detail

On 3 May 2023, the Luxembourg Parliament voted in favor of the bill of law N°8029, to implement DAC 7 into the Luxembourg legal system (the Law or the DAC 7 Law), with more than 5 months of delay.

The Law, taking effect as of 1 January 2023, introduces obligations on reporting platform operators (as defined by the Law) to collect information on their users being sellers and provide it to the Luxembourg tax authorities (LTA), on an annual basis.

For more information on the requirements applying to the reporting platform operators, as foreseen by the Law, please refer to our DAC 7 Flash News issued on 1 July 2022.

In the context of GDPR, the Law also amends existing provisions on the automatic exchange of information and administrative cooperation, including:

  • DAC 2 also referred as to Common Reporting Standard (CRS) which provide for the exchange of financial account information as foreseen by the Law of 23 December 2016 (the CRS Law), and
  • DAC 6, which provide for the exchange of cross-border tax arrangement information, as foreseen by the Law of 25 March 2020 (the DAC 6 Law) regarding data protection requirements applying to data controllers (e.g., Luxembourg reporting financial institutions for CRS purposes and Luxembourg intermediaries in the context of DAC 6).

So far, under CRS, Luxembourg Financial institutions had to inform:

  • individuals of the collection and processing of their data, upon collection of the said data, (often done through the Terms and Conditions document, Offering Memorandum, etc.), and 

  • reportable individuals that their personal data would be disclosed to the LTA and would be eventually continued to the tax authorities of their country of tax residence. Such information did not have to be repeated from a year to another as long as no material changes occurred in relation to the relevant individual. From a market practice perspective, such a requirement was often met by Luxembourg Financial Institution through a specific wording included in the FATCA/CRS self-certifications to be completed by their customers or investors.

With the implementation of DAC 7, the first requirement is maintained and the second one is reinforced. Indeed, the Law provides that under CRS, Luxembourg reporting financial institutions are required to transmit to each natural person concerned (i.e., reportable individuals) all the information to which he/she may have access from the controller within a period of time sufficient to enable him/her to exercise his/her data protection rights and, in any case, before the information is communicated to the LTA. 

Thus, Luxembourg reporting financial institutions will now have to notify their individual clients and controlling persons of passive non-financial entity clients subject to a reporting under CRS about the personal and financial information to be reported to the LTA, every year, prior to the reporting. Even though the delay between the (e)mail notification and the reporting is not defined, one could consider that a month would be sufficient in order for individuals to exercise their rectification rights. 

Under DAC 6, such notification is now required as well. It will however be different in its application as the notification:

  • would have to be performed on an ongoing basis, following DAC  6 reporting, 

  • would include more extensive information than for CRS, and

  • will not be sent to the relevant individuals within the same time frame as for CRS, in order to comply with the requirement to perform a reporting under 30 days following the first step of implementation of the reportable cross-border arrangement.

What’s next

For CRS purposes, as the Law has been voted upon lately, it would be in practice difficult to comply with the requirement to notify individuals sufficiently in advance before the reporting (whose deadline is 30 June of every year) for 2023. We can therefore expect some leniency, this year, from the Authorities in case of late notification.

However, this strengthened data protection obligation requires as from now Luxembourg Reporting Financial Institutions to:

  • Update their relevant policies and procedures,
  • Ensure that the extraction of concerned data is feasible, in due time (this should be the case as the information is used for CRS reporting purposes),
  • Determine the modus operandi to notify reportable individuals, e.g., determination of the scope, notification channel (by email, mail, mixed-use of both), language(s), task performed in-house or outsourced, under which timeframe, etc., and
  • Enhance the process to manage the requests of individuals wishing to modify part of their data prior to the reporting to the LTA, or simply wishing to obtain clarification on their data. Indeed, the financial data to be reported by Financial Institutions being often (and rightly) different from what taxpayers expect to report or have reported in their tax returns, one may expect some concerns from customers and investors that will have to be addressed.

For DAC 6 purposes, Luxembourg intermediaries must comply with this more stringent notification requirement as well by providing concerned individuals with all information that may concern them (which, depending on the individual’s role in the reportable arrangement, could include from a limited to the main content of the DAC 6 report to be sent to the LTA) with a high level of reactivity, the reporting period being only 30 days. The above mentioned “next steps”, would also have to be considered in light of DAC 6.  

Contact us

Pierre Kirsch

Tax Partner and Authorised Manager of the PSF, PwC Regulated Solutions S.à r.l.

Tel: +352 49 48 48 4031

Camille Perez

Tax Director and Authorised Manager of the PSF, PwC Regulated Solutions S.à r.l.

Tel: +352 62133 46 18

Frauke Anna Maria Ortmann

Tax Director, PwC Regulated Solutions S.à r.l.

Tel: +352 62133 37 62