DAC7 — Директива (ЕС) 2021/514 об отчётности цифровых платформ

(1) Article 3 is amended as follows:

(a) in point (9), first subparagraph, point (a) is replaced by the following:

‘(a) for the purposes of Article 8(1) and Articles 8a to 8ac, the systematic communication of predefined information to another Member State, without prior request, at pre-established regular intervals. For the purposes of Article 8(1), reference to available information relates to information in the tax files of the Member State communicating the information, which is retrievable in accordance with the procedures for gathering and processing information in that Member State;’;

(b) in point (9), first subparagraph, point (c) is replaced by the following:

‘(c) for the purposes of provisions of this Directive other than Article 8(1) and (3a) and Articles 8a to 8ac, the systematic communication of predefined information provided in points (a) and (b) of the first subparagraph of this point.’;

(c) in point (9), the second subparagraph is replaced by the following:

‘In the context of Articles 8(3a), 8(7a), 21(2) and Annex IV, any capitalised term shall have the meaning that it has under the corresponding definitions set out in Annex I. In the context of Article 25(3) and (4), any capitalised term shall have the meaning that it has under the corresponding definitions set out in Annex I or V. In the context of Article 8aa and Annex III, any capitalised term shall have the meaning that it has under the corresponding definitions set out in Annex III. In the context of Article 8ac and Annex V, any capitalised term shall have the meaning that it has under the corresponding definitions set out in Annex V.’;

(d) the following points are added:

‘26. "joint audit" means an administrative enquiry jointly conducted by the competent authorities of two or more Member States, and linked to one or more persons of common or complementary interest to the competent authorities of those Member States;

27. "data breach" means a breach of security leading to destruction, loss, alteration or any incident of inappropriate or unauthorised access, disclosure or use of information, including but not limited to personal data transmitted, stored or otherwise processed, as the result of deliberate unlawful acts, negligence or accidents. A data breach may concern the confidentiality, availability and integrity of data.’;

(2) the following Article is inserted:

‘Article 5a

Foreseeable relevance

1. For the purposes of a request referred to in Article 5, the requested information is foreseeably relevant where, at the time the request is made, the requesting authority considers that, in accordance with its national law, there is a reasonable possibility that the requested information will be relevant to the tax affairs of one or several taxpayers, whether identified by name or otherwise, and be justified for the purposes of the investigation.

2. With the aim to demonstrate the foreseeable relevance of the requested information, the requesting authority shall provide at least the following information to the requested authority:

(a) the tax purpose for which the information is sought; and

(b) a specification of the information required for the administration or enforcement of its national law.

3. Where a request referred to in Article 5 relates to a group of taxpayers who cannot be identified individually the requesting authority shall provide at least the following information to the requested authority:

(a) a detailed description of the group;

(b) an explanation of the applicable law and of the facts based on which there is reason to believe that the taxpayers in the group have not complied with the applicable law;

(c) an explanation how the requested information would assist in determining compliance by the taxpayers in the group; and

(d) where relevant facts and circumstances related to the involvement of a third party that actively contributed to the potential non-compliance of the taxpayers in the group with the applicable law.’;

(3) in Article 6, paragraph 2 is replaced by the following:

‘2. The request referred to in Article 5 may contain a reasoned request for an administrative enquiry. If the requested authority takes the view that no administrative enquiry is necessary, it shall immediately inform the requesting authority of the reasons thereof.’;

(4) in Article 7, paragraph 1 is replaced by the following:

‘1. The requested authority shall provide the information referred to in Article 5 as quickly as possible, and no later than three months from the date of receipt of the request. However, where the requested authority is unable to respond to the request by the relevant time limit, it shall inform the requesting authority immediately and in any event within three months of the receipt of the request, of the reasons for its failure to do so, and the date by which it considers it might be able to respond. The time limit shall not be longer than six months from the date of receipt of the request.

However, where the requested authority is already in possession of that information, the information shall be transmitted within two months of that date.’;

(5) in Article 7, paragraph 5 is deleted;

(6) Article 8 is amended as follows:

(a) paragraphs 1 and 2 are replaced by the following:

‘1. The competent authority of each Member State shall, by automatic exchange, communicate to the competent authority of any other Member State all information that is available concerning residents of that other Member State, on the following specific categories of income and capital as they are to be understood under the national legislation of the Member State which communicates the information:

(a) income from employment;

(b) director’s fees;

(c) life insurance products not covered by other Union legal instruments on exchange of information and other similar measures;

(d) pensions;

(e) ownership of and income from immovable property;

(f) royalties.

For taxable periods starting on or after 1 January 2024, Member States shall endeavour to include the Tax Identification Number (TIN) of residents issued by the Member State of residence in the communication of the information referred to in the first subparagraph.

Member States shall inform the Commission annually of at least two categories of income and capital listed in the first subparagraph with regard to which they communicate information concerning residents of another Member State.

2. Before 1 January 2024, Member States shall inform the Commission of at least four categories listed in the first subparagraph of paragraph 1 in respect of which the competent authority of each Member State shall, by automatic exchange, communicate to the competent authority of any other Member State information concerning residents of that other Member State. Such information shall concern taxable periods starting on or after 1 January 2025.’;

(b) in paragraph 3, the second subparagraph is deleted;

(7) Article 8a is amended as follows:

(a) in paragraph 5, point (a) is replaced by the following:

‘(a) in respect of information exchanged pursuant to paragraph 1 – without delay after the advance cross-border rulings or advance pricing arrangements have been issued, amended or renewed and at the latest three months following the end of the half of the calendar year during which the advance cross-border rulings or advance pricing arrangements were issued, amended or renewed;’;

(b) in paragraph 6, point (b) is replaced by the following:

‘(b) a summary of the advance cross-border ruling or advance pricing arrangement, including a description of the relevant business activities or transactions or series of transactions and any other information that could assist the competent authority in assessing a potential tax risk, without leading to the disclosure of a commercial, industrial or professional secret or of a commercial process, or of information whose disclosure would be contrary to public policy;’;

(8) the following Article is inserted:

‘Article 8ac

Scope and conditions of mandatory automatic exchange of information reported by Platform Operators

1. Each Member State shall take the necessary measures to require Reporting Platform Operators to carry out the due diligence procedures and fulfil reporting requirements laid down in Sections II and III of Annex V. Each Member State shall also ensure the effective implementation of, and compliance with, such measures in accordance with Section IV of Annex V.

2. Pursuant to the applicable due diligence procedures and reporting requirements contained in Sections II and III of Annex V, the competent authority of a Member State where the reporting in accordance with paragraph 1 took place shall, by means of automatic exchange, and within the time limit laid down in paragraph 3, communicate to the competent authority of the Member State in which the Reportable Seller is resident as determined pursuant to paragraph D of Section II of Annex V and, where the Reportable Seller provides immovable property rental services, in any case to the competent authority of the Member State in which the immovable property is located, the following information regarding each Reportable Seller:

(a) the name, registered office address, TIN and, where relevant, individual identification number allocated pursuant to the first subparagraph of paragraph 4, of the Reporting Platform Operator, as well as the business name(s) of the Platform(s) in respect of which the Reporting Platform Operator is reporting;

(b) the first and last name of the Reportable Seller who is an individual, and legal name of the Reportable Seller that is an Entity;

(c) the Primary Address;

(d) any TIN of the Reportable Seller, including each Member State of issuance, or, in the absence of a TIN, the place of birth of the Reportable Seller who is an individual;

(e) the business registration number of the Reportable Seller that is an Entity;

(f) the VAT identification number of the Reportable Seller, where available;

(g) the date of birth of the Reportable Seller who is an individual;

(h) the Financial Account Identifier to which the Consideration is paid or credited, insofar as it is available to the Reporting Platform Operator and the competent authority of the Member State where the Reportable Seller is resident in the meaning of paragraph D of Section II of Annex V has not notified the competent authorities of all other Member States that it does not intend to use the Financial Account Identifier for this purpose;

(i) where different from the name of the Reportable Seller, in addition to the Financial Account Identifier, the name of the holder of the financial account to which the Consideration is paid or credited, to the extent available to the Reporting Platform Operator, as well as any other financial identification information available to the Reporting Platform Operator with respect to that account holder;

(j) each Member State in which the Reportable Seller is resident determined pursuant to paragraph D of Section II of Annex V;

(k) the total Consideration paid or credited during each quarter of the Reportable Period and the number of Relevant Activities in respect of which it was paid or credited;

(l) any fees, commissions or taxes withheld or charged by the Reporting Platform during each quarter of the Reportable Period.

Where the Reportable Seller provides immovable property rental services, the following additional information shall be communicated:

(a) the address of each Property Listing, determined on the basis of the procedures set out in paragraph E of Section II of Annex V and respective land registration number or its equivalent under the national law of the Member State where it is located, where available;

(b) the total Consideration paid or credited during each quarter of the Reportable Period and number of Relevant Activities provided with respect to each Property Listing;

(c) where available, the number of days each Property Listing was rented during the Reportable Period and the type of each Property Listing.

3. The communication pursuant to paragraph 2 of this Article shall take place using the standard computerised format referred to in Article 20(4) within two months following the end of the Reportable Period to which the reporting requirements applicable to the Reporting Platform Operator relate. The first information shall be communicated for Reportable Periods as from 1 January 2023.

4. For the purpose of complying with the reporting requirements pursuant to paragraph 1 of this Article, each Member State shall lay down the necessary rules to require a Reporting Platform Operator within the meaning of point (b) of subparagraph A(4) of Section I of Annex V to register within the Union. The competent authority of the Member State of registration shall allocate an individual identification number to such Reporting Platform Operator.

Member States shall lay down rules pursuant to which a Reporting Platform Operator may choose to register with the competent authority of a single Member State in accordance with the rules laid down in paragraph F of Section IV of Annex V. Member States shall take the necessary measures to require that a Reporting Platform Operator within the meaning of point (b) of subparagraph A(4) of Section I of Annex V, whose registration has been revoked in accordance with subparagraph F(7) of Section IV of Annex V, can only be permitted to re-register on the condition that it provides to the authorities of a Member State concerned appropriate assurances as regards its commitment to comply with the reporting requirements within the Union, including any outstanding unfulfilled reporting requirements.

The Commission shall, by means of implementing acts, lay down the practical arrangements necessary for the registration and identification of Reporting Platform Operators. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 26(2).

5. Where a Platform Operator is deemed to be an Excluded Platform Operator, the competent authority of the Member State where the demonstration in accordance with subparagraph A(3) of Section I of Annex V was provided to, shall notify the competent authorities of all other Member States accordingly, including any subsequent changes.

6. The Commission shall, by 31 December 2022, establish a central register where information to be notified in accordance with paragraph 5 of this Article and communicated in accordance with subparagraph F(2) of Section IV of Annex V shall be recorded. That central register shall be available to the competent authorities of all Member States.

7. The Commission shall, by means of implementing acts, following a reasoned request by a Member State or on its own initiative, determine whether the information that is required to be automatically exchanged pursuant to an agreement between competent authorities of the Member State concerned and a non-Union jurisdiction is, within the meaning of subparagraph A(7) of Section I of Annex V, equivalent to that specified in paragraph B of Section III of Annex V. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 26(2).

A Member State requesting the measure referred to in the first subparagraph shall send a reasoned request to the Commission.

If the Commission considers that it does not have all the information necessary for the appraisal of the request, it shall contact the Member State concerned within two months of receipt of the request and specify what additional information is required. Once the Commission has all the information it considers necessary, it shall, within one month, notify the requesting Member State and it shall submit the relevant information to the Committee referred to in Article 26(2).

When acting on its own initiative, the Commission shall adopt an implementing act as referred to in the first subparagraph only after a Member State has concluded a competent authority agreement with a non-Union jurisdiction that requires the automatic exchange of information on sellers deriving income from activities facilitated by Platforms.

When determining whether information is equivalent within the meaning of the first subparagraph in relation to a Relevant Activity, the Commission shall take into due account the extent to which the regime on which such information is based corresponds to that set out in Annex V, in particular with regard to:

(i) the definitions of Reporting Platform Operator, Reportable Seller, Relevant Activity;

(ii) the procedures applicable for the purpose of identifying Reportable Sellers;

(iii) the reporting requirements; and

(iv) the rules and administrative procedures that non-Union jurisdictions are to have in place to ensure effective implementation of, and compliance with, the due diligence procedures and reporting requirements set out in that regime.

The same procedure shall apply for determining that the information is no longer equivalent.’;

(9) Article 8b is amended as follows:

(a) paragraph 1 is replaced by the following:

‘1. Member States shall provide the Commission on an annual basis with statistics on the volume of automatic exchanges under Articles 8(1), 8(3a), 8aa and 8ac and with information on the administrative and other relevant costs and benefits relating to exchanges that have taken place and any potential changes, for both tax administrations and third parties.’;

(b) paragraph 2 is deleted;

(10) Article 11 is amended as follows:

(a) paragraph 1 is replaced by the following:

‘1. With a view to exchanging the information referred to in Article 1(1), the competent authority of a Member State may request the competent authority of another Member State that officials authorised by the former and in accordance with the procedural arrangements laid down by the latter:

(a) be present in the offices where the administrative authorities of the requested Member State carry out their duties;

(b) be present during administrative enquiries carried out in the territory of the requested Member State;

(c) participate in the administrative enquiries carried out by the requested Member State through the use of electronic means of communication, where appropriate.

The requested authority shall respond to a request in accordance with the first subparagraph within 60 days of the receipt of the request, to confirm its agreement or communicate its reasoned refusal to the requesting authority.

Where the requested information is contained in documentation to which the officials of the requested authority have access, the officials of the requesting authority shall be given copies thereof.’;

(b) in paragraph 2, the first subparagraph is replaced by the following:

‘Where officials of the requesting authority are present during administrative enquiries, or participate in the administrative enquiries through the use of electronic means of communication, they may interview individuals and examine records subject to the procedural arrangements laid down by the requested Member State.’;

(11) in Article 12, paragraph 3 is replaced by the following:

‘3. The competent authority of each Member State concerned shall decide whether it wishes to take part in simultaneous controls. It shall confirm its agreement or communicate its reasoned refusal to the authority that proposed a simultaneous control within 60 days of receiving the proposal.’;

(12) the following Section is inserted:

‘SECTION IIa

Joint audits

Article 12a

Joint audits

1. The competent authority of one or more Member States may request the competent authority of another Member State (or other Member States) to conduct a joint audit. The requested competent authorities shall respond to the request for a joint audit within 60 days of the receipt of the request. The requested competent authorities may reject a request for a joint audit by the competent authority of a Member State on justified grounds.

2. Joint audits shall be conducted in a pre-agreed and coordinated manner, including linguistic arrangements, by the competent authorities of the requesting and the requested Member States, and in accordance with the laws and procedural requirements of the Member State where the activities of a joint audit take place. In each Member State where the activities of a joint audit take place, the competent authority of that Member State shall appoint a representative with responsibility for supervising and coordinating the joint audit in that Member State.

The rights and obligations of the officials of Member States who participate in the joint audit, when they are present in activities performed in a different Member State, shall be determined in accordance with the laws of the Member State where the activities of the joint audit take place. While complying with the laws of the Member State where the activities of the joint audit take place, officials of another Member State shall not exercise any powers that would exceed the scope of the powers granted to them under the laws of their Member State.

3. Without prejudice to paragraph 2, a Member State where the activities of the joint audit take place shall take the necessary measures to:

(a) permit that officials of other Member States who participate in the activities of the joint audit interview individuals and examine records together with the officials of the Member State where the activities of the joint audit take place, subject to the procedural arrangements laid down by the Member State where those activities take place;

(b) ensure that evidence collected during the activities of the joint audit can be assessed, including on its admissibility, under the same legal conditions as in the case of an audit carried out in that Member State where only the officials of that Member State take part, including in the course of any process of complaint, review or appeal; and

(c) ensure that the person(s) subject to a joint audit or affected by it enjoy the same rights and have the same obligations as in the case of an audit where only the officers of that Member State take part, including in the course of any process of complaint, review or appeal.

4. Where competent authorities of two or more Member States conduct a joint audit, they shall endeavour to agree on the facts and circumstances relevant to the joint audit and endeavour to reach an agreement on the tax position of the audited person(s) based on the results of the joint audit. The findings of the joint audit shall be incorporated in a final report. Issues on which the competent authorities agree shall be reflected in the final report and be taken into account in the relevant instruments issued by the competent authorities of the participating Member States following that joint audit.

Subject to the first subparagraph, the actions by the competent authorities of a Member State or any of its officers following a joint audit and any further processes taking place in that Member State, such as a decision of tax authorities, process of appeal or settlement relating thereto, shall take place in accordance with the national law of that Member State.

5. The audited person(s) shall be informed of the outcome of the joint audit, including a copy of the final report within 60 days of the issuance of the final report.’;

(13) Article 16 is amended as follows:

(a) in paragraph 1, the first subparagraph is replaced by the following:

‘1. Information communicated between Member States in any form pursuant to this Directive shall be covered by the obligation of official secrecy and enjoy the protection extended to similar information under the national law of the Member State which received it. Such information may be used for the assessment, administration and enforcement of the national law of Member States concerning the taxes referred to in Article 2 as well as VAT and other indirect taxes.’;

(b) paragraph 2 is replaced by the following:

‘2. With the permission of the competent authority of the Member State communicating information pursuant to this Directive, and only in so far as this is allowed under the national law of the Member State of the competent authority receiving the information, information and documents received pursuant to this Directive may be used for other purposes than those referred to in paragraph 1. Such permission shall be granted if the information can be used for similar purposes in the Member State of the competent authority communicating the information.

The competent authority of each Member State may communicate to the competent authorities of all other Member States a list of purposes for which, in accordance with its national law, information and documents may be used, other than those referred to in paragraph 1. The competent authority that receives information and documents may use the received information and documents without the permission referred to in the first subparagraph of this paragraph for any of the purposes listed by the communicating Member State.’;

(14) Article 20 is amended as follows:

(a) in paragraph 2, the first subparagraph is replaced by the following:

‘2. The standard form referred to in paragraph 1 shall include at least the following information to be provided by the requesting authority:

(a) the identity of the person under examination or investigation and, in the case of group requests as referred to in Article 5a(3), detailed description of the group;

(b) the tax purpose for which the information is sought.’;

(b) paragraphs 3 and 4 are replaced by the following:

‘3. Spontaneous information and its acknowledgement pursuant to Articles 9 and 10 respectively, requests for administrative notifications pursuant to Article 13, feedback information pursuant to Article 14 and communications pursuant to Article 16(2) and (3) and Article 24(2) shall be sent using the standard forms adopted by the Commission in accordance with the procedure referred to in Article 26(2).

4. The automatic exchange of information pursuant to Articles 8 and 8ac shall be carried out using a standard computerised format aimed at facilitating such automatic exchange, adopted by the Commission in accordance with the procedure referred to in Article 26(2).’;

(15) in Article 21, the following paragraph is added:

‘7. The Commission shall develop and provide technical and logistical support for a secure central interface on administrative cooperation in the field of taxation where Member States communicate with the use of standard forms pursuant to Article 20(1) and (3). The competent authorities of all Member States shall have access to that interface. For the purpose of collecting statistics, the Commission shall have access to information about the exchanges recorded to the interface and which can be extracted automatically. The Commission shall have only access to anonymous and aggregated data. The access by the Commission shall be without prejudice to the obligation of Member States to provide statistics on exchanges of information in accordance with Article 23(4).

The Commission shall, by means of implementing acts, lay down the necessary practical arrangements. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 26(2).’;

(16) in Article 22, paragraph 1a is replaced by the following:

‘1a. For the purposes of the implementation and enforcement of the laws of Member States giving effect to this Directive and to ensure the functioning of the administrative cooperation it establishes, Member States shall provide by law for access by tax authorities to the mechanisms, procedures, documents and information referred to in Articles 13, 30, 31, 32a and 40 of Directive (EU) 2015/849 of the European Parliament and of the Council (*).

(*) Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (OJ L 141, 5.6.2015, p. 73).’;

(17) in Article 23a, paragraph 2 is replaced by the following:

‘2. Information communicated to the Commission by a Member State under Article 23, as well as any report or document produced by the Commission using such information, may be transmitted to other Member States. Such transmitted information shall be covered by the obligation of official secrecy and enjoy the protection extended to similar information under the national law of the Member State which received it.

Reports and documents produced by the Commission, referred to in the first subparagraph, may be used by Member States only for analytical purposes, and shall not be published or made available to any other person or body without the express agreement of the Commission.

Notwithstanding the first and second subparagraphs, the Commission may publish annually anonymised summaries of the statistical data that Member States communicate to it in accordance with Article 23(4).’;

(18) Article 25 is replaced by the following:

‘Article 25

Data protection

1. All exchange of information pursuant to this Directive shall be subject to Regulation (EU) 2016/679 of the European Parliament and of the Council (*). However, Member States shall, for the purposes of the correct application of this Directive, restrict the scope of the obligations and rights provided for in Article 13, Article 14(1) and Article 15, of Regulation (EU) 2016/679, to the extent required in order to safeguard the interests referred to in point (e) of Article 23(1) of that Regulation.

2. Regulation (EU) 2018/1725 of the European Parliament and of the Council (**) shall apply to any processing of personal data under this Directive by the Union institutions, bodies, offices and agencies. However, for the purposes of the correct application of this Directive, the scope of the obligations and rights provided for in Article 15, Article 16(1), and Articles 17 to 21, of Regulation (EU) 2018/1725, shall be restricted to the extent required in order to safeguard the interests referred to in point (c) of Article 25(1) of that Regulation.

3. Reporting Financial Institutions, intermediaries, Reporting Platform Operators and the competent authorities of Member States shall be considered to be data controllers when, acting alone or jointly, they determine the purposes and means of the processing of personal data within the meaning of Regulation (EU) 2016/679.

4. Notwithstanding paragraph 1, each Member State shall ensure each Reporting Financial Institution or intermediary or Reporting Platform Operator, as the case may be, which is under its jurisdiction:

(a) informs each individual concerned that information relating to that individual will be collected and transferred in accordance with this Directive; and

(b) provides to each individual concerned all information that the individual is entitled to from the data controller in sufficient time for that individual to exercise his/her data protection rights and, in any case, before the information is reported.

Notwithstanding point (b) of the first subparagraph, each Member State shall lay down rules obliging Reporting Platform Operators to inform Reportable Sellers of the reported Consideration.

5. Information processed in accordance with this Directive shall be retained for no longer than is necessary to achieve the purposes of this Directive, and in any case in accordance with each data controller’s domestic rules on statute of limitations.

6. A Member State where a data breach occurred, shall report the data breach and any subsequent remedial action to the Commission without delay. The Commission shall inform all Member States without delay of the data breach that has been reported to it or of which it is aware and any remedial action.

Each Member State may suspend the exchange of information to the Member State(s) where the data breach occurred by giving notice in writing to the Commission and the Member State(s) concerned. Such suspension shall have immediate effect.

The Member State(s) where the data breach occurred shall investigate, contain and remedy the data breach and shall, by giving notice in writing to the Commission, request the suspension of the CCN access for the purposes of this Directive, if the data breach cannot be contained immediately and appropriately. Upon such request, the Commission shall suspend the CCN access of such Member State(s) for the purposes of this Directive.

Upon reporting by the Member State where the data breach occurred of remedying the data breach, the Commission shall resume the CCN access of the Member State(s) concerned for the purposes of this Directive. In case one or more Member States request the Commission to jointly verify whether the remediation of the data breach was successful, the Commission shall resume the CCN access of such Member State(s) for the purposes of this Directive upon such verification.

Where a data breach occurs to the central directory or the CCN for the purposes of this Directive and where the exchanges of Member States through the CCN can potentially be affected, the Commission shall inform Member States of the data breach and any remedial actions taken without undue delay. Such remedial actions may include suspending access to the central directory or the CCN for the purposes of this Directive until the data breach is remedied.

7. Member States, assisted by the Commission, shall agree on the practical arrangements necessary for the implementation of this Article, including data breach management processes which are aligned with internationally recognised good practices and where appropriate a joint data controller agreement, a data processor – data controller agreement, or models thereof.

(*) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

(**) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).’;

(19) Article 25a is replaced by the following:

‘Article 25a

Penalties

Member States shall lay down the rules on penalties applicable to infringements of national provisions adopted pursuant to this Directive and concerning Articles 8aa, 8ab and 8ac, and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.’;

(20) Annex V, the text of which is set out in the Annex to this Directive, is added.

1. Member States shall adopt and publish, by 31 December 2022, the laws, regulations and administrative provisions necessary to comply with this Directive. They shall immediately inform the Commission thereof.

They shall apply those provisions from 1 January 2023.

When Member States adopt those provisions, they shall contain a reference to this Directive or shall be accompanied by such a reference on the occasion of their official publication. The methods of making such reference shall be laid down by Member States.

2. By way of derogation from paragraph 1 of this Article, Member States shall adopt and publish, by 31 December 2023, the laws, regulations and administrative provisions necessary to comply with point (1)(d) of Article 1 of this Directive as regards point (26) of Article 3 of Directive 2011/16/EU and with point (12) of Article 1 of this Directive as regards Section IIa of Directive 2011/16/EU. They shall immediately inform the Commission thereof.

They shall apply those provisions from 1 January 2024, at the latest.

When Member States adopt those provisions, they shall contain a reference to this Directive or shall be accompanied by such a reference on the occasion of their official publication. The methods of making such reference shall be laid down by Member States.

3. Member States shall communicate to the Commission the text of the main provisions of national law which they adopt in the field covered by this Directive.

This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Directive is addressed to the Member States.