Cross-border data flow in the digital single market: study on data location restrictions (SMART 2015/0054) amount of time (AT, BG), without transportation (BE), at all reasonable times (IE) or immediately (SE) General confidentiality obligation - prohibition against third party access and/or disclosure
Ensuring security/confidentiality, and supporting accountability and supervision
Clarification from national regulators, supervisors and lawmakers that the requirement can be met if substantive access to the contents of financial data is made impossible. Offsite storage should not necessarily be considered as constituting third party access and disclosure.
Storage facilities must be within national borders (except when companies are active across borders), except with permission of the tax authority
Ensuring accountability verifiability
and
Modernisation of the requirement – moving to accessibility requirements rather than storage requirements.
Format and method of delivery shall be specified by the tax authority during verifications
Ensuring accountability verifiability
and
The requirement is not a barrier in practice if there is sufficient clarity on the requirements in relation to timeliness and method of delivery. EU level guidance on this point may be useful to avoid needless national divergences.
When new IT systems are introduced, the tax payer must ensure that the old systems remain operative for as long as required to ensure availability under applicable law
Ensuring accountability verifiability
and
Clarification that old systems need not remain operative if the updated system can provide access to all needed information.
As in the previous chapter, most of the aforementioned objectives aim to ensure the accountability and verifiability of the information. However, the barriers highlight that a variety of controls are required or are considered appropriate to achieve those objectives. Therefore, to continue to meet the common objectives through this variety of controls suggests that greater alignment of those controls at the EU-level is needed. In addition, there are also a few explicit geographical barriers that do not seem to be strictly required to achieve the goal of ensuring the availability and verifiability of the data. 2.3.6 Other data types and barriers Overview and subtypes of data As noted above, correspondents were also invited to report on barriers they observed for other types of data, which don’t fall cleanly within any single category, and will therefore be analysed collectively here. These reports referred more specifically to the following types of data:
53
