Amended CRS Law
Related people
Headlines in this article
Related news and insights
Publications: 01 March 2024
Amount B or not to be? The OECD’s Pillar One Amount B report
News: 27 February 2024
Allen & Overy in Luxembourg launches AML / CTF e-learning module for Fund Professionals
Publications: 02 February 2024
Luxembourg podcast: Reverse hybrid mismatches: A-Tad too complex?
Publications: 08 January 2024
Director’s fees no longer subject to VAT: what you need to know
A new requirement to inform individuals of the exact personal data to be shared with the Administration des Contributions Directes.
The Luxembourg law of 18 December 2015 on the automatic exchange of financial account information in the field of taxation (CRS Law), which regulates the automatic exchange of financial account information between tax authorities under the Common Reporting Standard (CRS), has been amended by the law of 16 May 2023 (the Amended CRS Law). The Amended CRS Law introduces a new requirement for reporting financial institutions from a data protection perspective.
Reporting financial institutions subject to CRS requirements are now formally required to inform individuals of the exact information that they will report to the Administration des Contributions Directes (ACD), in a timely manner and, in any case, before the information is communicated to the ACD, and to give clients the opportunity to exercise their rights as per the General Data Protection Regulation (GDPR), in particular the right to rectify any personal data which are not correct. The Amended CRS Law does not specify the appropriate means to communicate such personal data, i.e. reporting financial institutions should consider any appropriate means (e.g. letter, email, etc.).
In its opinion of 2 December 2022 on the bill implementing the changes on transparency of the data sharing, the Luxembourg data protection authority (the Commission Nationale pour la Protection des Données, CNPD) welcomed this amendment. The CNPD considers that the enhanced transparency requirement allows individuals to exercise their right of rectification provided for in article 16 of the GDPR, and ensures that accurate and up-to- date data will be communicated to the ACD in accordance with the principle of accuracy as set out in article 5.1(d) of the GDPR.
Individuals should review the information carefully and notify the reporting financial institutions of any errors or changes as soon as possible. This new obligation should not be interpreted as a way for individuals to oppose such processing, considering this is a legal requirement of reporting financial institutions.
This new obligation applies from 1 June 2023 and must be taken into account for the next CRS reporting due on 30 June 2023.
For further information on the topic, please reach out to your usual A&O contact, or any of the relevant contacts.