The new version of § 11 of the German Tax Consultancy Act (StBerG) now provides clarity as to whether tax consultants are considered to be contracedt processors within the meaning of the GDPR or not.
What is ordered processing?
Art. 4 No. 8 GDPR defines the term “processor”. Accordingly, a processor is “a natural or legal person, authority, institution or other body which processes personal data on behalf of the controller”.
A contracted processing relationship is therefore always given if a company outsources data processing to an external third party. In this case, a corresponding agreement must be concluded between those parties, the so-called data processing agreement.
What does the new provision in the German Tax Consultancy Act govern?
On 18 December 2019, a new provision in § 11 StBerG came into force. Even before the amendment, para. 1 of the provision provided the legal basis for processing personal data in order to fulfil the tasks under the StBerG.
A new paragraph 2 has now been added, stating that “the processing of personal data by persons and companies referred to in Section 3 shall be carried out in accordance with the professional obligations applicable to them and without instructions”.
This provision makes it clear that a tax advisers are not bound by instructions within the scope of their professional activity. Within the meaning of Art. 4 No. 7 GDPR, the tax consultants are thus in principle responsible because the legislator now assumes that the tax consultants are carrying out an activity protected by professional secrecy and are not bound by instructions.
And what does this mean for the companies?
This new regulation is applied to all activities of the tax advisor. It no longer depends on the type of activity. In particular, the explanatory memorandum to the law mentions the preparation of wage and salary accountings, as this activity also “requires the independent examination and application of the statutory provisions”.
In the sense of the GDPR, the tax adviser is now considered to be the person responsible, so that an data processing agreement (DPA) has no longer to be concluded when preparing wage and salary accountings.
The purpose of this new regulation is to increase the general level of protection for all personal data processed by tax advisers, since they must now fully comply with their duties as a responsible party themselves.
ePrivacy will advice you on this topic