Article 1
Regulation (EU) No 904/2010 is amended as follows: (1) in Article 2, the following points are added: ‘(s) “payment service provider” means any of the categories of payment service providers listed in points (a) to (d) of Article 1(1) of Directive (EU) 2015/2366 of the European Parliament and of the Council ( *1 ) or a natural or legal person benefiting from an exemption in accordance with Article 32 of that Directive; (t) “payment” means, subject to the exclusions provided for in Article 3 of Directive (EU) 2015/2366, a “payment transaction” as defined in point (5) of Article 4 of that Directive or a “money remittance” as defined in point (22) of Article 4 of that Directive; (u) “payer” means “payer” as defined in point (8) of Article 4 of Directive (EU) 2015/2366; (v) “payee” means “payee” as defined in point (9) of Article 4 of Directive (EU) 2015/2366. ( *1 ) Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC ( OJ L 337, 23.12.2015, p. 35 ).’;" (2) Chapter V is amended as follows: (a) the title of Chapter V is replaced by the following: ‘ COLLECTION, STORAGE AND EXCHANGE OF SPECIFIC INFORMATION ’; (b) the following heading is inserted before Article 17: ‘SECTION 1 Automated access to specific information stored in national electronic systems ’; (c) the following Section is inserted after Article 24: ‘SECTION 2 The central electronic system of payment information Article 24a The Commission shall develop, maintain, host and technically manage a central electronic system of payment information (“CESOP”) for the purpose of investigations into suspected VAT fraud or in order to detect VAT fraud. Article 24b 1. Each Member State shall collect the information on the payees and the payments referred to in Article 243b of Directive 2006/112/EC. Each Member State shall collect the information referred to in the first subparagraph from payment service providers: (a) no later than by the end of the month following the calendar quarter to which the information relates; (b) by means of an electronic standard form. 2. Each Member State may store the information collected in accordance with paragraph 1 in a national electronic system. 3. The central liaison office, or the liaison departments or competent officials designated by the competent authority of each Member State, shall transmit to CESOP the information collected in accordance with paragraph 1 no later than the tenth day of the second month following the calendar quarter to which the information relates. Article 24c 1. The CESOP shall have the following capabilities with regard to information transmitted in accordance with Article 24b(3): (a) to store the information; (b) to aggregate the information in respect of each individual payee; (c) to analyse the information stored, together with the relevant targeted information communicated or collected pursuant to this Regulation; (d) to make the information referred to in points (a), (b) and (c) of this paragraph accessible to Eurofisc liaison officials, as referred to in Article 36(1). 2. CESOP shall retain the information referred to in paragraph 1 for a maximum period of five years from the end of the year in which the information was transmitted to it. Article 24d The access to CESOP shall only be granted to Eurofisc liaison officials, as referred to in Article 36(1), who hold a personal user identification for CESOP and where that access is in connection with an investigation into suspected VAT fraud or is to detect VAT fraud. Article 24e The Commission shall adopt by means of implementing acts the following: (a) the technical measures for establishing and maintaining CESOP; (b) the tasks of the Commission for technically managing CESOP; (c) the technical details of the infrastructure and tools required to guarantee the connection and overall operability between the national electronic systems referred to in Article 24b and CESOP; (d) the electronic standard forms referred to in point (b) of the second subparagraph of Article 24b(1); (e) the technical and other details concerning the access to the information referred to in point (d) of Article 24c(1); (f) the practical arrangements to identify the Eurofisc liaison officials, as referred to in Article 36(1), who will have access to CESOP in accordance with Article 24d; (g) the procedures to be used by the Commission at all times which ensure that the appropriate technical and organisational security measures for the development and operation of CESOP are applied; (h) the roles and responsibilities of the Member States and the Commission as regards the functions of controller and processor under Regulation (EU) 2016/679 of the European Parliament and of the Council ( *2 ) and Regulation (EU) 2018/1725 of the European Parliament and of the Council ( *3 ) . Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 58(2). Article 24f 1. The costs of establishing, operating and maintaining CESOP shall be borne by the general budget of the Union. These costs shall include those of the secure connection between CESOP and the national electronic systems referred to in Article 24b(2), and those of the services necessary to carry out the capabilities which are listed in Article 24c(1). 2. Each Member State shall bear the costs of and shall be responsible for all necessary developments to its national electronic system referred to in Article 24b(2).’; ( *2 ) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ( OJ L 119, 4.5.2016, p. 1 )." ( *3 ) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC ( OJ L 295, 21.11.2018, p. 39 )." (3) Article 37 is replaced by the following: ‘Article 37 1. The Eurofisc chairperson shall submit an annual report on the activities of all of the working fields to the Committee referred to in Article 58(1). The annual report shall at least contain: (a) the total number of accesses to CESOP; (b) the operational results based on the information accessed and processed pursuant to Article 24d, as identified by Eurofisc liaison officials; (c) a quality assessment of the data processed in CESOP. 2. The Commission shall adopt by means of implementing acts the procedural arrangements in relation to Eurofisc. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 58(2).’; (4) in Article 55, the following paragraph is inserted: ‘1a. The information referred to in Section 2 of Chapter V shall only be used for the purposes referred to in paragraph 1 and where it has been verified by reference to other tax information available to the competent authorities of the Member States.’.