On 8 January 2026, the European Data Protection Supervisor (EDPS) published his opinion on the legislative proposal to amend Regulation 904/2010, which would grant the European Public Prosecutor’s Office (EPPO) and the European Anti-Fraud Office (OLAF) specific direct and centralised access to VAT information at EU level (→eucrim 3/2025, 204-205).

The EDPS welcomes the objectives of the proposal and recognises that EPPO’s and OLAF’s direct access to VAT information is necessary to achieve the objective to effectively combat intra-Community VAT fraud. He stresses, however, that the proposal is at the sensitive crossroads between administrative VAT cooperation and criminal law enforcement. Data protection follows different legal regimes and principles in these fields, which is why the separation must be carefully reflected in the legal framework.

The EDPS recommends that the proposal more clearly explains and underlines the exceptional nature of providing direct (albeit limited) access to administrative databases for law enforcement purposes. In addition, it should be clarified to avoid that the envisaged amendments would be misconstrued or later relied upon as precedent for more general application.

The EDPS also emphasises that appropriate legal, technical and organisational safeguards tailored to the targeted nature of the measure are needed. While some technical and organisational details may be specified through implementing acts (as envisaged by the proposal), core parameters must already be defined in the basic legislative act. Therefore, the EDPS recommends the inclusion of several additional safeguards in order to comply with the EU data protection law principles, such as purpose limitation, data minimisation and accountability.