Wijzigingen Wtt 2018

Twee wetten die wijzigingen van de Wtt 2018 bevatten zijn op 21 februari jl. in het Staatsblad verschenen:

De eerste wet omvat onder meer het doorstroomvennootschappenverbod en de nieuwe hoog-risico-landen regels. De tweede wet bevat de volgende wijziging:

Aan artikel 54 van de Wet toezicht trustkantoren 2018 wordt een lid toegevoegd, luidende:

7. De curator is niet aansprakelijk voor schade veroorzaakt door een handelen of nalaten in de uitoefening van de taak op grond van dit artikel, tenzij deze schade in belangrijke mate het gevolg is van een opzettelijk onbehoorlijke taakuitoefening of een opzettelijk onbehoorlijke uitoefening van bevoegdheden of in belangrijke mate te wijten is aan grove schuld.

De besluiten inzake de inwerkingtreding zag ik nog niet, maar kunnen binnenkort worden verwacht.

 

Dit bericht verscheen eerder op de site van Compliance Platform Trustkantoren.

Geplaatst in Financieel recht, onder meer Wft, Wtt, Fraude, witwasbestrijding, Wwft, Trustkantoren | Tags: , , | Plaats een reactie

Profiling in the financial sector: “the automated establishment of a probability concerning the ability of a person to service a loan constitutes profiling under the GDPR”

In cases against SCHUFA, a German credit information provider, the advocate general at the Court of Justice of the EU (CJE), Mr Pikamäe, has presented his opinion on the case. He advised that the automated establishment of a probability concerning the ability of a person to service a loan constitutes profiling under the GDPR. Further he was of the opinion that the storage of data by a private credit information agency cannot be lawful once the personal data concerning insolvency have been erased from public registers.

From the press release, the case:

Case C-634/21 concerns proceedings between a citizen and Land Hessen, represented by the Data Protection and Freedom of Information Commissioner for Hesse (the ‘HBDI’), regarding the protection of personal data. As part of

its economic activity, which consists in providing its clients with information on the creditworthiness of third parties, SCHUFA Holding AG (‘SCHUFA’), a company governed by private law, provided a credit institution with a score for the

citizen in question, which served as the basis for the refusal to grant the credit for which the latter had applied. The citizen subsequently requested SCHUFA to erase the entry concerning her and to grant her access to the corresponding data. The latter, however, merely informed her of the relevant score and, in broad outline, of the principles underlying the calculation method for the score, without informing her of the specific data included in that calculation or of the relevance accorded to them in that context, arguing that the calculation method is a trade secret.

On the opinion:

In his Opinion, Advocate General Priit Pikamäe states, first of all, that the GDPR establishes a ‘right’ for the person concerned not to be subject to a decision based solely on automated processing, including profiling.

The Advocate General then finds that the conditions for that right are satisfied because:

1. the procedure at issue constitutes ‘profiling’,
2. the decision produces legal effects concerning the person concerned or similarly significantly affects him or her, and
3. the decision is based solely on automated processing.

The provision of the GDPR laying down that right is therefore applicable in circumstances like those in the main proceedings.

The Advocate General points out that, under another provision of the GDPR, the person concerned has the right to obtain from the controller not only confirmation as to whether or not personal data concerning him or her are being processed, but also other information, such as on the existence of automated decision-making, including profiling, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the person concerned. He considers that that the obligation to provide ‘meaningful information about the logic involved’ must be understood to include sufficiently detailed explanations of the method used to calculate the score and the reasons for a certain result. In general, the controller should provide the person concerned with general information, notably on the factors taken into account for the decision-making process and on their respective weight on an aggregate level, which is also useful for him or her to challenge any ‘decision’ within the meaning of the GDPR, recognising the ‘right’ not to be subject to a decision based solely on automated processing, including profiling.

The Advocate General takes the view that that provision is to be interpreted as meaning that the automated establishment of a probability value concerning the ability of the person concerned to service a loan in the future already constitutes a decision based solely on automated processing, including profiling, which produces legal effects concerning that person or similarly significantly affects him or her, where that value, determined by means of personal data relating to that person, is transmitted by the controller to a third-party controller and the latter, in accordance with consistent practice, draws strongly on that value for its decision on the establishment, implementation or termination of a contractual relationship with that same person.

Other cases concerned the requests made to ensure the deletion of an entry relating to discharge from remaining debts from the records of SCHUFA. The agency has entered published information relating to early discharges from remaining debts in its own databases, but SCHUFA does not delete it until three years after entry. The questions referred by the national court concern, among other things, the question of the lawfulness of the storage of personal data from public registers by credit information agencies.

In the second place, the Advocate General states that, under the GDPR, the processing of personal data may be lawful, inter alia, when the three following cumulative conditions are satisfied:

– first, the pursuit of a legitimate interest by the data controller or by the third party or third parties to which the data are communicated,
– second, the need to process personal data for the purposes of the legitimate interest pursued, and
– third, the fundamental rights and freedoms of the person concerned by the data protection do not take precedence.

Mr Pikamäe observes that the considerable negative consequences that the storage of data will have on the person concerned after the period of six months in question seem to override the commercial interest of the private agency and its clients in storing the data after that period. In this context, he points out that the discharge from remaining debts granted is intended to allow the beneficiary to re-enter economic life. That objective would be frustrated if private credit information agencies were authorised to store personal data in their databases after the data have been erased from the public register

The Advocate General takes the view that the storage of data by a private credit information agency cannot be lawful, under the provision of the GDPR laying down the conditions set out above, once the personal data concerning insolvency have been erased from public registers. As regards the period of six months during which the personal data are also available in public registers, it is for the referring court to balance the abovementioned interests and impacts on the person concerned in order to determine whether the parallel storage of those data by private credit information agencies is lawful on that basis.

In the third place, the Advocate General points out that the GDPR provides a right for the person concerned to obtain the erasure of his or her personal data where he or she objects to the processing or where those data have been unlawfully processed. In the Advocate General’s view, in such situation, the person concerned therefore has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay. It is for the referring court to examine if, exceptionally, there are overriding legitimate grounds for the processing.

 

More information:

  • Press release on Advocate General’s Opinion in Case C-634/21 | SCHUFA Holding and Others (Scoring) and in Joint Cases C-26/22 and C-64/22 SCHUFA Holding and Others (Discharge from remaining debts).
  • The opinions: case C-634/21 ECLI:EU:C:2023:220 (scoring), NL version; cases C-26/22 and C-64/22 ECLI:EU:C:2023:222 (discharge from remaining debts), NL version.
Geplaatst in English - posts in English on this blog, Europa, Financieel recht, onder meer Wft, Wtt, Fraude, witwasbestrijding, Wwft, Grondrechten, ICT, privacy, e-commerce | Tags: , , , , , | Plaats een reactie

Financial institution breaches GDPR in direct marketing | Nordax Bank decision IMY

The Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, ‘IMY’) has dealt with a GDPR-complaint regarding the Nordax Bank.

Facts
This bank has instructed another company, Iper Direkt, to provide direct marketing services, including an address register, to the bank. Someone has complained with Nordax and asked for erasure of his/her personal data. Nordax is of the opinion that the complainant should go to Iper for that. Nordax was willing to institute a block on addressed direct marketing regarding complainant and has provided general information to the complainant that Nordax may process the complainant’s personal data in order to maintain a block on addressed direct marketing. The complainant did not provide the requested personal data (pre- and surname and full address) to Nordax. According to the decision at a later date complainant was  blocked against further direct marketing mailing regarding Nordax products.

Decision
In the decision IMY points out that Nordax is the controller, as Nordax determines the purposes and means of the processing of personal data. It can not refer to Iper for complying with GDPR-requests of data subjects.

IMY is of the opinion that Nordax unnecessarily asked the complainant to submit additional information in order to comply with the blocking request, even though the existing information in the request according to Nordax was sufficient to actually satisfy the request directly. For this reason Nordax has requested additional information that has not been necessary to confirm the identity of the data subject in violation of Article 12(6) GDPR. Further Nordax has breached GDPR by failing to inform complainant that it had blocked complainant against further addressed direct marketing.

The violations of the GDPR are grounds for IMY to issue a reprimand to Nordax and to issue some orders to the bank to correct its practices:

  • to comply with complainant’s request to exercise its right of access, “This is done by providing the complainant access to all personal data that Nordax process regarding the complainant by arranging a copy to the complainant of the personal data referred to in Article 15(3) and provide information pursuant to points (a) to (h) of Article 15(1) and 15.2.“;
  • to comply with complainant’s request for erasure;
  • to provide the complainant with information on the measures which been taken in response to the complainant’s request to exercise his right of objection to processing for direct marketing purposes.

 

More information:

Geplaatst in English - posts in English on this blog, Financieel recht, onder meer Wft, Wtt, ICT, privacy, e-commerce | Tags: , , , , | Plaats een reactie

“MEPs to explore setting up a court to fight grand corruption” | European Parliament

In a press release by the European Parliament (EP) it is announced that MEPs on the Subcommittee on Human Rights (DROI) and invited experts on 20 March in a workshop will examine the idea of an International Anti-Corruption Court to tackle large-scale impunity.

I suppose this court will start with the corruption case in the EP itself.

The following guests are expected to address the Subcommittee:

  • Cedric Ryngaert, Professor of Public International Law of Utrecht University in the Netherlands;
  • Judge Mark Wolf, Chair of Integrity Initiatives International;
  • Juanita Olaya Garcia, Chair of the Working Group on Victims of Corruption at the UNCAC Coalition;
  • Juan Francisco Sandoval, former Head of the Special Prosecutor’s Office against Impunity in Guatemala.

See the full programme and meeting agenda.

 


Addition 20 March 2023
Ryngaert is the author of a briefing commissioned by the DROI Subcommittee, Towards an International Anti-Corruption Court? that covers familiar themes, like kleptocrats, asset recovery, evasion of constitutional safeguards by “investigative journalists and whistleblowers” that track crime, and the desires of pseudo-NGO Transparency International.

The briefing shows that there is international consensus on an international asset registry:

Going forward, the EU may now want to push for the adoption of a global financial registry, which logs financial instruments and their UBOs on a worldwide basis. Such a registry may eventually dismantle offshore havens which thrive on registering shell companies that hide their ultimate beneficiary owners (Alvaredo et al., 2018: 265; Zucman, 2014).

and that fundamental rights may be disrespected when it comes to fighting crime, since those disadvantaged by the proposed measures are not the criminals but decent citizens, as can be seen with the US FATCA law.

Geplaatst in English - posts in English on this blog, Europa, Financieel recht, onder meer Wft, Wtt, Fraude, witwasbestrijding, Wwft, Grondrechten, ICT, privacy, e-commerce, Overheidsregister van aandeelhouders, Ubo-register | Tags: , , , , , , | Plaats een reactie

Swedish privacy authority: ‘Data protection officers point to problems applying GDPR’ | GDPR

The Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, ‘IMY’) in January this year published a report ‘Data protection in practice. A study of data protection in organisations required to have a data protection officer‘.

IMY’s press release:

Data protection officers point to problems applying GDPR
Published: 31 January 2023

A survey by the Swedish Authority for Privacy Protection (IMY) notes that less than half of responding data protection officers assess that their own organisation works continually and systematically with data protection.

IMY has now published the report Data protection in practice, which is based on a survey of data protection officers in over 800 organisations. The report provides an indication of the conditions under which data protection is applied in organisations required to have data protection officers.

Less than 4 in 10 of data protection officers judge that their own organisation works continually and systematically with data protection. Only half feel that they are able to explain the importance of data protection issues to management.

“This is concerning. Systematic and continual data protection requires both knowledge of GDPR and commitment from the organisation’s management,” says Andrea Amft, an analyst at IMY.

The survey shows also that half of the officers are not included in a timely manner. Every fourth lacks allocated time for data protection and only every other feels that the allocated time they do have is sufficient.

“It is important that data protection officers are provided the necessary conditions and both sufficient and appropriate resources to allow them to fulfil their assignment within their organisations. This includes providing officers enough time for their tasks and access to necessary information,” says Amft.

From the summary:

Data protection in practice is largely carried out by the data protection officers found throughout the country. These data protection officers (DPO) need sufficient time to fulfil their assignment, something that, according to our survey, many still lack. It is also concerning that less than half of the DPO believe that their own organisation works continually and systematically with data protection. (…)

Effective data protection requires good organisation
Systematic and continual privacy and data protection require both knowledge of GDPR and interest among the organisation’s management in privacy and data protection. For this reason, it is concerning that less than half of DPO responded that their own organisation works continually and systematically with data protection.

Some important findings:

• Four of 10 feel that their own organisation works continually and systematic with data protection issues.
• Half can convince management and personal data controllers of the importance of personal data issues.
• Half feel that they are not included well in advance.
• Full-time DPO feel the assignment is more clear than those working part-time in the role.

The biggest challenges: Create practical procedures and coordinate the data protection rules with the organisation
Data protection in practice seems to have entered a new phase compared with 2019. There seems to be a clear decrease in the initial difficulties in understanding and implementing GDPR – at least in the organisations included in the survey. Instead, DPO argue that a big challenge is now that the regulations are seen as an obstacle to the organisation and that GDPR makes the work of the organisation more difficult.

Some important findings:

• The two biggest challenges are achieving functioning procedures and processes and ensuring the data protection rules do not inhibit or obstruct the organisation.
• More and more data protection officers feel that the biggest problem is a lack of commitment and knowledge by management.
• Fewer and fewer DPO see the interpretation of the regulations as a major challenge.

 

More information:

Geplaatst in English - posts in English on this blog, Europa, Grondrechten, ICT, privacy, e-commerce | Tags: | Plaats een reactie

Verslag van een ‘duistere’ bestuurscultuur

Hans Siepel, voormalig topambtenaar, schreef in januari jl. een lezenswaardig artikel over de politieke cultuur in Nederland: Uit de memoires van een topambtenaar: verslag van een ‘duistere’ bestuurscultuur.

Zijn observaties sluiten aan bij mijn beeld dat de Nederlandse politieke cultuur gemedialiseerd is. De klassieke media spelen een eigen negatieve rol in het geheel. Het gevolg is onder meer dat er moeilijker goede mensen gevonden kunnen worden voor zowel de ministersploeg als het parlement, met verlaging van de wetgevingskwaliteit als consequentie.

 

 

Eerdere artikelen op dit blog over wetgevingskwaliteit:

Geplaatst in Grondrechten | Tags: , , | Plaats een reactie

Geschillenbeslechtende instantie Kifid druk bezig met verstevigen van haar positie | Wwft, Wft, grondrechten

Private geschillenbeslechtingsinstantie Klachteninstituut Financiële Dienstverlening (Kifid) (site) is druk bezig met het verstevigen van haar positie. Eerder heeft de instantie ook de BKR-geschillenbeslechting aan haar activiteiten toegevoegd.

Eind februari jl. publiceerde Kifid het bericht Onafhankelijke opinie over het beoordelingskader van Kifid. Daarin is vermeld dat op verzoek van Kifid een hoogleraar, O.O. Cherednychenko, hoogleraar Europees privaatrecht en rechtsvergelijking aan de Rijksuniversiteit Groningen, een wetenschappelijke opinie heeft geschreven over het beoordelingskader van Kifid. De opinie kan hier worden gedownload. Kifid meldt over deze opinie in gesprek te zullen gaan met de stakeholders waarmee zij regelmatig overlegt: vertegenwoordigers van consumentenorganisaties, financiële brancheorganisaties, toezichthouders en het ministerie van Financiën.

De rechtsbescherming in de financiële sector: verder zonder Kifid

Het verandert mijn mening over Kifid niet. Ik vind dat Kifid moet verdwijnen en dat voor een adequate rechtsbescherming van alle klanten van financiële instellingen (met name consumenten en mkb) een financiële ombudsman en een gespecialiseerde rechtsgang bij de onafhankelijke rechter nodig zijn. De onderwerpen die tegenwoordig bij Kifid spelen, zoals het Wwft-klantenonderzoek, zwarte lijsten en internationale financiële discriminatie zijn te moeilijk voor deze instantie.

Ik ben nog steeds diep geschokt over het oordeel vol onjuistheden dat de geschillencommissie van het Kifid heeft geveld in de zaak van de Accidental American. Niet alleen werd het standpunt van deze man onjuist in de uitspraak verkeerd weergegeven (kennelijk was de thematiek te moeilijk voor de commissie), ook werd hij op volledig onjuiste gronden voor valsheid in geschrifte veroordeeld (door de kort geding rechter van tafel geveegd, maar helaas was de rechtbank, lees het nieuwsbericht, nodig om tot een goed oordeel te komen).

Ook andere waarnemingen bevestigen mijn beeld dat Kifid niet geschikt is voor haar taken.

Consumentenorganisaties en burgerrechtenorganisaties doen er goed aan bij de overheid aan te dringen op verandering.

Geplaatst in Bankrekening krijgen en behouden, Financieel recht, onder meer Wft, Wtt, Fraude, witwasbestrijding, Wwft, Grondrechten, Procesrecht, rechtspraak | Tags: , , , | Plaats een reactie

Does PET help respect fundamental rights? | UN, artificial intelligence

The latest holy grail in the digital world, which purports to respect fundamental rights, is known by the acronym ‘PET’. That stands for ‘Privacy-Enhancing Technologies‘.

The UN is working on and with PET. Read the introduction of a webinar in February:

In recent years, almost every government has been faced with very serious challenges, such as the global health pandemic, supply chain disruption, rising energy and food prices, and decreasing household budgets. To handle these crises in the right way, our leaders need the right data at the right time. National statistical offices are tasked to provide these trusted, relevant, timely and high-quality data. Some of the required data are collected by NSOs themselves, such as data from a population census or from household or business surveys. However, to act swiftly on emerging issues, additional secondary data sources are needed such as administrative data (for example, tax records, social security data, health records or customs administration records) or private sector data (for example, mobile phone records or transactional credit card information). All of those data are very sensitive in terms of private information on persons or businesses.

To gain access to the sensitive data while guaranteeing that privacy will be preserved, privacy-enhancing technologies (PETs) are receiving increased attention. Whereas legal arrangements on data sharing can lead to unwanted breaches, the promise of PETs is that privacy is guaranteed. If you cannot see the original data at any time, you cannot by accident reveal any original information.

UNBigData

See the website of the UN Committee of Experts on Big Data and Data Science for Official Statistics (UNBigData):

Events:

  • Webinar on Privacy-Enhancing Technologies for Official Statistics (54th Session of the United Nations Statistical Commission. Side Event), 9 February 2023, video.
  • UN PET Lab Open House, held 7 July 2022.

IAPP: UN launches PETs initiative for data anonymization, 27 January 2023.

Geplaatst in Bankrekening krijgen en behouden, English - posts in English on this blog, Financieel recht, onder meer Wft, Wtt, Fraude, witwasbestrijding, Wwft, Grondrechten, ICT, privacy, e-commerce | Tags: , , , , , , , , | Plaats een reactie

Registration of hosts providing short-term accommodation rental services and related obligations | EU

Europe is working on a proposal on a regulation on data collection and sharing relating to short-term accommodation rental services.

The regulation will apply to all types of short-term letting of short-term letting of furnished accommodation, provided for remuneration, whether on a professional or non-professional basis. The rules will not apply to hotels etcetera, “as data for these types of accommodation are usually available and well-documented“, neither to campsites and caravan parks.

Reason for the new duties
According to the newest draft proposal the data collection and sharing duties are necessary for public authorities to manage the consequences of short-term accommodation rental services:

While short-term accommodation rental services create many opportunities for guests, hosts and the entire tourism ecosystem, their rapid growth has also triggered concerns and challenges, in particular for local communities and public authorities. One of the main challenges is the lack of reliable information about short-term accommodation rental services, such as the identity of the host, the location where those services are being offered, and their duration, making it difficult for authorities to assess the actual impact of short-term accommodation rental services and develop and enforce appropriate and proportionate policy responses. (…)

Public authorities at national, regional and local level are increasingly taking measures to obtain information from hosts and online short-term rental platforms, by imposing registration schemes and other transparency requirements, including on online short-term rental platforms.

Though the registration and data collection is not intended to serve tax purposes, it will be useful for that too.

Some member state-authorities will collect information about hosts’ activities and obtain activity data from online platforms on a regular basis. The data will also be collected for the compilation of official statistics and other governmental uses. Europe shows itself to be a true data-driven government.

Of course enforcement is not forgotten. Penalties should be “effective, proportionate and dissuasive“, as the European mantra goes. The Commission should be empowered to adopt direct enforcement measures with regard to very large online platforms.

Information to be provided
According the proposal the following information should be provided by the hosts:

(11) Hosts should provide information regarding themselves, the units they offer for short-term accommodation rental services and other necessary information so that the competent authorities know the identity of the host and their contact details, as well as the location, the detailed address (e.g. flat number or land registry), the type (e.g. house, apartment, room, shared room, or relevant category provided in national law) and characteristics of the unit. Where relevant, hosts can also be required to indicate whether they have obtained an authorisation to provide the service as referred to in Article 9 of Directive 2006/123 from the relevant authorities, provided such authorisation requirement is line with Union law. (…) The description of the unit’s characteristics should include an indication of whether the unit is offered in whole or part and whether the host uses the unit for residential purposes as a primary or secondary residence or for other purposes. Hosts should also provide information on the maximum number of bed places that the unit is capable of accommodating.

(12) It should be possible for Member States to require hosts to submit additional information and documentation attesting compliance with requirements established by national law, such as health and safety and consumer protection requirements or other requirements, such as information as to whether the host has obtained the owner’s permission when this is relevant, without preventing the issue of a registration number. Member States can, in particular, in order to ensure equal access and inclusion, require hosts to provide information concerning the accessibility for persons with disabilities of the units offered for short-term accommodation rental services in relation to national or local accessibility requirements. (…)

The competent authorities in the member states may collect additional information:

(18) Competent authorities in Member States which have imposed a requirement on online s term rental platforms to transmit data about hosts’ activities and have registration systems in place should be able to obtain activity data from online platforms on a regular basis. The type of data that may be obtained should be fully harmonised and include information on the number of nights for which a registered unit has been rented, the number of guests the unit was rented for per night, their country of residence, the detailed address of the unit, the registration number and the URL of the listing of the unit. (…) Only online platforms that have effectively facilitated the conclusion of direct transactions between hosts and guests are covered by the obligation to provide the activity data, the registration number and the URL of the listing of the unit, as only those platforms are in a position to collect data, such as on the number of nights for which a unit is rented and the number of guests the unit was rented for per night. (…)

European digital infrastructure will play a role (the Single Digital Entry Point and the Once Only Technical System [*]).

Platforms
The proposal also regulates the position of platforms allowing consumers to conclude distance contracts with traders. Online short-term rental platforms should ensure that services are not offered where no registration number has been provided, in cases where a host declares that such a registration number applies.

Final remark
Europe interferes in detail with this type of activity, raising the question of why the rules – which are quite detailed – also apply to small-scale activities. I would find it more logical if only the large platforms and their hosts were regulated.

[*] In preamble (33) of the proposal the Once Only Technical System as established by Commission Implementing Regulation (EU) 2022/1463 is mentioned. This regulation is setting out technical and operational specifications of the technical system for the cross-border automated exchange of evidence and application of the ‘once-only’ principle in accordance with Regulation (EU) 2018/1724.

 

More information:

Council of the EU – Press release 2 March 2023

Council agrees position on data collection and sharing for short-term accommodation rentals

Ministers for competitiveness agreed today on a negotiating mandate (general approach) for the regulation on data collection and sharing for short-term accommodation rental services, as part of the ongoing efforts to promote a balanced tourism ecosystem within the EU.

This regulation will benefit players of the short-term accommodation rental segment alike: hosts will have an easy registration procedure, platforms will have a single set of rules for the information they have to provide, travellers will be better protected against fraud and authorities will be able to regulate based on accurate and reliable data.
Ebba Busch, Swedish Minister for Energy, Business and Industry and Deputy Prime Minister

Data from online platforms that operate in the short-term accommodation rental market are not currently standardised due to a diversity of rules and different methods established by member states. The Council supports the creation of a data collection and sharing framework at EU level while also including provisions to better take into account the registration systems that are already in place in the member states.

Easier and harmonised system for data collection
Under the new rules, member states that require data from platforms will have to set up a national “single digital entry point” for the transmission of data between online short-term rental platforms and the public authorities.

Every house, apartment or room offered for rent for a limited number of days per year will have a registration number, so that the competent authorities can know the identity of the “host”, i.e. the person that wants to rent the dwelling. The online platforms will have to make reasonable efforts to undertake regular random checks to verify that there are no incorrect declarations of hosts or invalid registration numbers. The treatment of all the information will have to be compliant with European data protection rules.

This will reduce red tape and costs for hosts and platforms while giving authorities the data they need to regulate the activity. This will also create a level playing field with other actors of the tourism sector (such as hotels, hostels or aparthotels) and help combat fraud.

Member states will have to provide the necessary information to allow public authorities, online platforms, hosts and citizens to understand the laws and requirements relating to the provision of short-term accommodation rental services within their territory. Those include registration procedures and requirements concerning access to, and provision of, these services.

Next steps
The general approach agreed today provides the Council presidency with a mandate for starting negotiations with the European Parliament once the latter has established its position.

Background
The rental of apartments, houses, or rooms for short periods of time has become a common form of accommodation for tourists and travellers. Online platforms have boosted the use of these services, which currently amount to nearly one quarter of the total tourist accommodation in the EU. Some member states have implemented different systems of registration that differ in scope, requirements (to be submitted by the hosts or the online platforms), and the level of administration at which the registers are managed (national, regional, or local).
On 5 March 2020, the Commission signed a voluntary agreement with the biggest online platforms for short-time accommodation rental services on data sharing. This has allowed Eurostat to collect data on this activity, but the agreement was not relevant for enforcement.
On 13 July 2022, a coalition for touristic cities, known as the “European cities alliance on short-term holiday rentals”, called on the Commission to propose legislation on registration and data sharing to better control the activities of platforms and hosts at local level.
Finally, on 7 November 2022, the Commission published its proposed regulation on accommodation services. The proposal, for which the Council has today adopted its general approach, is limited to the creation of an easy-to-use registration system with common provisions for establishing registration procedures and is not intended to regulate access to the market.

Visit the meeting page

 

 

Information to be provided by hosts, article 5 of the proposal:

1. When registering pursuant to a registration procedure referred to in Article 4, a host shall submit the following information by way of declaration:

(a) for each unit:
(1) a detailed address of the unit;
(2) the type of unit;
(3) whether the unit is offered as a part or whole of the host’s primary or secondary residence, or for other purposes;
(4) the maximum number of available bed places that the unit accommodates;
(5) whether the unit is subject to, and if so, whether the host has obtained an authorisation to offer short-term rental accommodation services from the relevant authorities, where such authorisation requirement is line with Union law;

(b) where the hosts are natural persons:
(1) their name;
(2) a national identification number or other information allowing the identification of the person(s);
(3) their address(es);
(4) their contact telephone number;
(5) the electronic mail address that the competent authority can use for written communication;

(c) where the hosts are legal persons:
(1) their name;
(2) the national business registration number;
(3) the name of a legal representative;
(4) the registered address of the host that is a legal person;
(5) a contact telephone number of a representative of that legal person;
(6) an electronic mail address that the competent authority can use for written communication.

2. Member States may require that the information submitted pursuant to points 1 to 4 of subparagraph (a) and in subparagraphs (b) and (c) of paragraph 1 is accompanied by appropriate supporting documentation. With respect to the information referred to in point 5 of subparagraph (a) of paragraph 1, where the host declares that the unit is subject to authorisation, or where the other information referred to in paragraph 1 allows an automatic determination that an authorisation requirement applies, Member States may request a copy of, or reference to, the authorisation.

3. Where a Member State requires hosts to submit further information and documentation, including information and documentation about the compliance with national, regional or local rules referred to in Article 2.2(a), the submission of that information and documentation is without prejudice to the issuance of the registration number in accordance with Article 4(2), point (b). (…)

 

Duties of platforms, articles 7 and 9 of the proposal:

Article 7 Compliance by design

1. Online short-term rental platforms shall:

(a) design and organise their online interface in a way that requires hosts to self-declare whether the unit offered for short-term accommodation rental services is located in an area where a registration procedure has been established or applies;
(b) where the host declares that the unit offered for short-term accommodation rental services is located in an area where a registration procedure has been established or applies, design and organise their online interface in a way that enables hosts to let users identify the unit through a registration number, and to ensure that hosts have provided a registration number prior to allowing the offering of the short-term accommodation rental services with respect to that unit;
(c) make reasonable efforts to randomly check, including with reasonable regularity, declarations of the hosts concerning the existence or not of a registration procedure, taking into account the list made available pursuant to Article 13(1), point (a), and, where such a procedure exists, the validity of the registration number provided by the host, through the use of the functionalities offered by the Single Digital Entry Points referred to in Article 10(2), point (b), after allowing the offering of the short-term accommodation rental services by the host.

2. Online short-term rental platforms shall inform without undue delay the competent authorities and the hosts of the results of the random checks referred to in paragraph 1, point (c), concerning incorrect declarations of hosts or invalid registration numbers.

3. Online short-term rental platforms shall include, in a specific section of the online interface that is directly and easily accessible, a reference to the information to be made available by Member States pursuant to Article 17(1). (…)

Article 9 Obligation on online short-term rental platforms to transmit activity data and registration numbers

1. When a listing concerns a unit located in an area included in the list referred to in Article 13(1), point (b), providers of online short-term rental platforms shall collect and, on a monthly basis, transmit to the Single Digital Entry Point of the Member State where the unit is located, activity data per unit, together with the corresponding registration number as provided by the host, the detailed address of the unit and the URL of the listing. That transmission shall take place by machine-to-machine communication means. In case of a technical problem affecting the transmission of data by the online short-term rental platforms, the competent authority shall be able to request the online short-term rental platform to resubmit the data in its possession.

2. By way of derogation from paragraph 1, small or micro online short-term rental platforms that did not, in the previous quarter, reach a monthly average of 2 500 or more listings shall transmit the activity data per unit, together with the corresponding registration number, the detailed address of the unit and the URL of the listing, at the end of the quarter, by machineto-machine communication means or manually in accordance with national law, to the Single Digital Entry Point of the Member State where the unit is located.

 

 


Addition 28 November 2023
The Commission announced on 16 November 2023: Commission welcomes agreement on new short-term rentals rules to increase transparency in the sector:

Commission welcomes agreement on new short-term rentals rules to increase transparency in the sector
The Commission warmly welcomes the agreement found between the European Parliament and the Council on the short-term accommodation rentals proposal presented almost exactly a year ago. This new Regulation will increase transparency in the sector, with clear rules for hosts and platforms on data collection and sharing. It will provide key information to authorities that wish to address the impact of short-term rentals on local communities. Data sharing obligations for platforms will be adapted to the smallest players. After its entry into force, Member States will have a 24-month period to establish the mechanisms for data exchanges, which are already being prepared with the support of the Commission.

The short-term rentals Regulation will complement the Digital Services Act. A key deliverable for sustainable and smart tourism under the Tourism Transition Pathway, the new legislation will also provide aggregated data that will feed into a European data space for tourism.

Thierry Breton, Commissioner in charge of the Single Market, said: “Tourism is key for our EU economy.  Short-term rentals are an important part of the tourism ecosystem, but shouldn’t come at the expense of local communities. Today’s agreement will enable local authorities to manage short-term rentals in an effective and proportionate way. It will also build on the Digital Services Act and ensure that online rental platforms take their responsibility, share data and help fight illegal listings.”

Geplaatst in English - posts in English on this blog, Financieel recht, onder meer Wft, Wtt, ICT, privacy, e-commerce | Tags: , , , , | Plaats een reactie

Werkplan toezicht advocatuur 2023

Op 28 februari jl. heeft het College van toezicht advocatuur het werkplan 2023 bekend gemaakt. Veel van de inhoud is organisatorisch en geeft de huidige en te verwachten (politiek-)organisatorische ontwikkelingen weer.

Opvallend is dat het College geen aandacht besteedt aan de gevolgen die de toenemende compliance last voor advocaten / NOvA heeft voor de toegankelijkheid van de rechtsbijstand voor consumenten en midden- en kleinbedrijf.

Het is belangrijk, omdat het grootste deel van de advocatuur behoort tot het midden- en kleinbedrijf (zie bijvoorbeeld dit artikel dat spreekt over 57% eenpersoonskantoren en 29% van de kantoren bestaand uit 2 tot en met 4 advocaten, dat zal niet veranderd zijn).

Criminaliteitsbestrijding door de advocatuur
In hoofdstuk 3 wordt op de ontwikkelingen ingegaan en passeren de bekende criminaliteitsbestrijdingsthema’s zoals Wwft de revue. Over de sanctieregels tegen de Russische Federatie wordt opgemerkt:

Advocaten moeten zich – net als ieder ander houden aan de sancties. In dat kader is van belang dat zij hun bedrijfsvoering dusdanig op orde hebben zodat zij de sanctiemaatregelen kunnen naleven. Mede gezien de complexiteit van bepaalde sancties is dit een aandachtspunt voor advocatenkantoren naast naleving van andere integriteitswet- en regelgeving zoals de Wwft.

Ik blijf het overigens raadselachtig vinden welk rol advocaten hier zouden hebben nu ze – anders dan bijvoorbeeld banken – geen vermogen van gesanctioneerde personen onder zich hebben.

 

Meer informatie:

Geplaatst in Dienstverlening - juridisch financieel [advocaten, accountants, belastingadviseurs e.d.], Financieel recht, onder meer Wft, Wtt, Fraude, witwasbestrijding, Wwft | Tags: , , | Plaats een reactie