EDPS Opinion on EPPO and OLAF VAT Data Access

The European Data Protection Supervisor (EDPS) published its Opinion regarding the European Commission's Proposal to integrate the European Public Prosecutor’s Office (EPPO) and the European Anti-Fraud Office (OLAF) into the existing administrative cooperation framework and to grant them a more direct role in VAT-related cooperation. The EDPS Opinion provides an overview of proposed measures and recommendations to ensure data privacy.

Key Considerations and Concerns Raised by the EDPS

In its Opinion, the EDPS noted that, under the current EPPO Regulation, the EPPO’s investigative powers are exercised indirectly through European Delegated Prosecutors (EDP) who act under national law. With the proposed changes, this model would be changed by introducing a new investigative power at the EU level that could be exercised by EPPO staff other than the EDPs, creating an exception to the existing framework, and raising questions about the balance between EU-level authority and national legal systems.

The EDPS further notes that this change is part of the broader ongoing review of the EU’s anti-fraud architecture, which aims to better align responsibilities, powers, and coordination among the various EU bodies involved in protecting the EU’s financial interests. 

On those grounds, the EDPS sees the proposed changes as a short-term response to an urgent problem already identified in the White Paper on the Anti-fraud Architecture Review. At the same time, the wider review process is expected to provide an opportunity to address these issues more comprehensively.

Generally, the EDPS supports the aims of the proposed changes and agrees that granting EPPO and OLAF direct access to VAT information is necessary to effectively tackle cross-border VAT fraud. However, it stresses that the European Commission's Proposal should clearly emphasise the exceptional character of granting direct, albeit limited, access to administrative databases for law enforcement purposes. 

Moreover, the EDPS emphasizes that the Proposal should ensure robust legal, technical, and organisational safeguards are in place, reflecting the targeted scope of access. Regarding safeguards, the EDPS suggested limited access to strictly necessary information for investigating a specific crime involving specific suspects, using technical measures that ensure every access can be attributed to a concrete investigation, that is, the case file and the investigator, labeled as the user.

Conclusion

Ultimately, the EDPS Opinion highlights the delicate balance between strengthening the EU’s capacity to combat sophisticated cross-border VAT fraud and preserving the fundamental principles of data protection and institutional competence. Although it acknowledges the practical necessity of granting EPPO and OLAF more direct access to VAT information as an urgent, targeted response, the EDPS makes clear that such access must remain strictly exceptional, narrowly defined, and safeguarded.

Source: European Data Protection Supervisor, VATabout - Direct Access for EPPO & OLAF to Fight EU VAT Fraud