Automatic Exchange of Information for digital platform operators (DAC 7) - Luxembourg law voted

On 3 May 2023, the Luxembourg Parliament voted in favor of the bill of law N°8029, to implement DAC 7 into the Luxembourg legal system (the Law or the DAC 7 Law), with more than 5 months of delay.

The Law, taking effect as of 1 January 2023, introduces obligations on reporting platform operators (as defined by the Law) to collect information on their users being sellers and provide it to the Luxembourg tax authorities (LTA), on an annual basis.

For more information on the requirements applying to the reporting platform operators, as foreseen by the Law, please refer to our DAC 7 Flash News issued on 1 July 2022.

In the context of GDPR, the Law also amends existing provisions on the automatic exchange of information and administrative cooperation, including:

• DAC 2 also referred as to Common Reporting Standard (CRS) which provide for the exchange of financial account information as foreseen by the Law of 23 December 2016 (the CRS Law), and
• DAC 6, which provide for the exchange of cross-border tax arrangement information, as foreseen by the Law of 25 March 2020 (the DAC 6 Law) regarding data protection requirements applying to data controllers (e.g., Luxembourg reporting financial institutions for CRS purposes and Luxembourg intermediaries in the context of DAC 6).

So far, under CRS, Luxembourg Financial institutions had to inform:

• individuals of the collection and processing of their data, upon collection of the said data, (often done through the Terms and Conditions document, Offering Memorandum, etc.), and 

• reportable individuals that their personal data would be disclosed to the LTA and would be eventually continued to the tax authorities of their country of tax residence. Such information did not have to be repeated from a year to another as long as no material changes occurred in relation to the relevant individual. From a market practice perspective, such a requirement was often met by Luxembourg Financial Institution through a specific wording included in the FATCA/CRS self-certifications to be completed by their customers or investors.

With the implementation of DAC 7, the first requirement is maintained and the second one is reinforced. Indeed, the Law provides that under CRS, Luxembourg reporting financial institutions are required to transmit to each natural person concerned (i.e., reportable individuals) all the information to which he/she may have access from the controller within a period of time sufficient to enable him/her to exercise his/her data protection rights and, in any case, before the information is communicated to the LTA. 

Thus, Luxembourg reporting financial institutions will now have to notify their individual clients and controlling persons of passive non-financial entity clients subject to a reporting under CRS about the personal and financial information to be reported to the LTA, every year, prior to the reporting. Even though the delay between the (e)mail notification and the reporting is not defined, one could consider that a month would be sufficient in order for individuals to exercise their rectification rights. 

Under DAC 6, such notification is now required as well. It will however be different in its application as the notification:

• would have to be performed on an ongoing basis, following DAC  6 reporting, 

• would include more extensive information than for CRS, and

• will not be sent to the relevant individuals within the same time frame as for CRS, in order to comply with the requirement to perform a reporting under 30 days following the first step of implementation of the reportable cross-border arrangement.