The Luxembourg law of 18 December 2015 on the automatic exchange of financial account information in the field of taxation (CRS Law), which regulates the automatic exchange of financial account information between tax authorities under the Common Reporting Standard (CRS), has been amended by the law of 16 May 2023 (the Amended CRS Law). The Amended CRS Law introduces a new requirement for reporting financial institutions from a data protection perspective.

Reporting financial institutions subject to CRS requirements are now formally required to inform individuals of the exact information that they will report to the Administration des Contributions Directes (ACD), in a timely manner and, in any case, before the information is communicated to the ACD, and to give clients the opportunity to exercise their rights as per the General Data Protection Regulation (GDPR), in particular the right to rectify any personal data which are not correct. The Amended CRS Law does not specify the appropriate means to communicate such personal data, i.e. reporting financial institutions should consider any appropriate means (e.g. letter, email, etc.).

In its opinion of 2 December 2022 on the bill implementing the changes on transparency of the data sharing, the Luxembourg data protection authority (the Commission Nationale pour la Protection des Données, CNPD) welcomed this amendment. The CNPD considers that the enhanced transparency requirement allows individuals to exercise their right of rectification provided for in article 16 of the GDPR, and ensures that accurate and up-to- date data will be communicated to the ACD in accordance with the principle of accuracy as set out in article 5.1(d) of the GDPR.

Individuals should review the information carefully and notify the reporting financial institutions of any errors or changes as soon as possible. This new obligation should not be interpreted as a way for individuals to oppose such processing, considering this is a legal requirement of reporting financial institutions.

This new obligation applies from 1 June 2023 and must be taken into account for the next CRS reporting due on 30 June 2023.

For further information on the topic, please reach out to your usual A&O contact, or any of the relevant contacts.