What is the EDPS Opinion about EPPO and OLAF access to VAT data?

The EDPS Opinion reviews the European Commission’s proposal to give EPPO and OLAF more direct access to VAT information and assesses whether this can be done while respecting data protection principles.

Why does the EDPS see the proposed changes as exceptional?

The EDPS stresses that granting direct access to administrative VAT databases for law enforcement purposes should remain strictly exceptional because it departs from the current framework and raises concerns about institutional balance and privacy.

How would the proposal change EPPO’s investigative powers?

The proposal would allow certain investigative powers to be exercised at EU level by EPPO staff other than European Delegated Prosecutors, which is a shift from the current model based on national law.

What concerns does the EDPS raise about EU-level investigations?

The EDPS highlights concerns about how new EU-level powers could affect the balance between EU authority and national legal systems, especially when sensitive VAT data is involved.

What safeguards does the EDPS recommend for accessing VAT information?

The EDPS recommends limiting access to strictly necessary data for specific investigations, using technical measures to log and attribute every access to a case file and an identified investigator.

How does this proposal fit into the wider EU anti-fraud strategy?

According to the EDPS, the proposal is a short-term response to urgent issues identified in the review of the EU anti-fraud architecture, while a broader reform is expected to address these challenges more comprehensively.

EDPS Opinion on EPPO and OLAF VAT Data Access

The European Data Protection Supervisor (EDPS) published its Opinion regarding the European Commission's Proposal to integrate the European Public Prosecutor’s Office (EPPO) and the European Anti-Fraud Office (OLAF) into the existing administrative cooperation framework and to grant them a more direct role in VAT-related cooperation. The EDPS Opinion provides an overview of proposed measures and recommendations to ensure data privacy.

Key Considerations and Concerns Raised by the EDPS

In its Opinion, the EDPS noted that, under the current EPPO Regulation, the EPPO’s investigative powers are exercised indirectly through European Delegated Prosecutors (EDP) who act under national law. With the proposed changes, this model would be changed by introducing a new investigative power at the EU level that could be exercised by EPPO staff other than the EDPs, creating an exception to the existing framework, and raising questions about the balance between EU-level authority and national legal systems.

The EDPS further notes that this change is part of the broader ongoing review of the EU’s anti-fraud architecture, which aims to better align responsibilities, powers, and coordination among the various EU bodies involved in protecting the EU’s financial interests.

On those grounds, the EDPS sees the proposed changes as a short-term response to an urgent problem already identified in the White Paper on the Anti-fraud Architecture Review. At the same time, the wider review process is expected to provide an opportunity to address these issues more comprehensively.

Generally, the EDPS supports the aims of the proposed changes and agrees that granting EPPO and OLAF direct access to VAT information is necessary to effectively tackle cross-border VAT fraud. However, it stresses that the European Commission's Proposal should clearly emphasise the exceptional character of granting direct, albeit limited, access to administrative databases for law enforcement purposes.

Moreover, the EDPS emphasizes that the Proposal should ensure robust legal, technical, and organisational safeguards are in place, reflecting the targeted scope of access. Regarding safeguards, the EDPS suggested limited access to strictly necessary information for investigating a specific crime involving specific suspects, using technical measures that ensure every access can be attributed to a concrete investigation, that is, the case file and the investigator, labeled as the user.

Conclusion

Ultimately, the EDPS Opinion highlights the delicate balance between strengthening the EU’s capacity to combat sophisticated cross-border VAT fraud and preserving the fundamental principles of data protection and institutional competence. Although it acknowledges the practical necessity of granting EPPO and OLAF more direct access to VAT information as an urgent, targeted response, the EDPS makes clear that such access must remain strictly exceptional, narrowly defined, and safeguarded.

Source: European Data Protection Supervisor, VATabout - Direct Access for EPPO & OLAF to Fight EU VAT Fraud