1

The claimant is an insolvency administrator. He is requesting tax information in relation to the insolvency debtor, an entrepreneurial company, in order to examine claims arising from the right to contest the debtor's transactions by virtue of insolvency (hereinafter insolvency avoidance claims, Insolvenzanfechtungsansprüche) from the competent tax office.

2

He made a request, citing the Freedom of Information Act of the Federal State of North Rhine-Westphalia (IFG NRW, Informationsfreiheitsgesetz des Landes Nordrhein-Westfalen), for information concerning the threat of enforcement measures and the granting of enforcement orders, payments received, the date of notification of the debtor's insolvency and sending of stored account extracts of all tax types managed there for the tax periods from March 2014 to June 2015. This request was rejected by the tax office.

3

The Administrative Court (Verwaltungsgericht) essentially upheld the action filed against this rejection. The appeal on points of fact and law of the defendant federal state was dismissed by the Higher Administrative Court (Oberverwaltungsgericht): The right to information, it held, was neither ruled out by area-specific provisions under tax procedure law nor precluded by grounds for exclusion. Although the requested information was objectively subject to the scope of protection of tax secrecy, it did not have to be kept confidential vis-à-vis the insolvency administrator, just as it did not have to be kept confidential vis-à-vis the party whose tax circumstances were concerned. The right of disposal in relation to tax data transferred to the insolvency administrator with the opening of the insolvency proceedings. This transfer also extended to business secrets and tax data, where this was necessary for proper administration of the insolvency estate and handling of the insolvency proceedings. The insolvency administrator was able to request information in relation to all circumstances concerning the proceedings from the insolvency debtor. The insolvency debtor's obligation to cooperate also encompassed the obligation to release the tax office from maintaining tax secrecy; his interests in confidentiality had to be of secondary importance in this respect.

4

The defendant continues to pursue his request for dismissal of the action by way of the appeal on points of law, which he was granted leave to bring by the Court of Appeal, due to the fundamental importance of the case.

5 The proceedings must be stayed and a preliminary ruling by the Court of Justice of the European Union (hereinafter Court of Justice) is to be obtained on the questions raised in the operative part of the decision (article 267 of the Treaty on the Functioning of the European Union (TFEU)).

6 1. The relevant provisions of EU law are articles 1 (1), 4 no. 1, articles 15 and 23 (1) (e), (i) and (j) of Regulation (EU) 2016/679.

7 2. The relevant provisions of national law were incorporated by Act of 17 July 2017 (Federal Law Gazette (BGBl., Bundesgesetzblatt) I p. 2541) into the Fiscal Code (AO, Abgabenordnung) during the proceedings relating to the appeal on points of law and entered into force with effect as from 25 May 2018. Those provisions read as follows:

8 Section 2a: Scope of the provisions on the processing of personal data
"(3) The provisions of this Code and of other tax legislation that pertain to the processing of personal data shall not apply to the extent that European Union law, in particular the applicable version of Regulation (EU) 2016/679 … applies directly or in accordance with subsection 5."
"(5) Unless otherwise required by law, the provisions of Regulation (EU) 2016/679, of this Code and of other tax legislation that pertain to the processing of natural persons' personal data shall apply accordingly to information relating to identified or identifiable
1. deceased natural persons or
2. corporations, associations of persons with or without legal capacity, and pools of assets."

9 Section 32e: Relation to other access and information rights
"Insofar as a data subject or third party has a right of access to information from a revenue authority pursuant to the Freedom of Information Act of 5 September 2005 (BGBl. I p. 2722), as amended, or pursuant to relevant federal states' legislation, articles 12 to 15 of Regulation (EU) 2016/679 in conjunction with sections 32a to 32d shall apply accordingly. More extensive rights to information on tax data are thus ruled out. Section 30 (4) no. 2 shall not apply in this case."

10 Section 32b: Obligation of the revenue authority to provide information where personal data have not been obtained from the data subject
"(1) In addition to the exceptions specified in article 14 (5) of Regulation (EU) 2016/679 and section 31c (2), the obligation of the revenue authority to provide information relating to the data subject in accordance with article 14 (1), (2) and (4) of Regulation (EU) 2016/679 shall not apply
1. insofar as the provision of information
a) would jeopardise the proper performance of the tasks, as described in article 23 (1)(d) to (h) of Regulation (EU) 2016/679, that lie within the competence of the revenue authorities or other public bodies or
b) ...
and therefore the interest of the data subject with respect to the provision of information is overridden. Section 32a (2) shall apply correspondingly."

11 Section 32c: Right of access by the data subject
"(1) The right of access by the data subject vis-à-vis a revenue authority in accordance with article 15 of Regulation (EU) 2016/679 does not exist insofar as
1. information is not to be provided to the data subject pursuant to section 32b (1) or (2),
2. the granting of access would adversely affect the legal entity of the revenue authority in the establishment, exercise or defence of civil law claims or in the defence of civil law claims established against it within the meaning of article 23 (1) (j) of Regulation (EU) 2016/679; obligations on the part of the revenue authority to provide information under civil law shall remain unaffected,
..."

12 The questions referred for a preliminary ruling are relevant for the decision. The success of the defendant's appeal on points of law depends on the answers to these questions. They require clarification by the Court of Justice because they have neither been clarified in its case-law nor are they obvious. With regard to the referral and the individual questions referred for a preliminary ruling, the following considerations are of relevance:

13 Regulation (EU) 2016/679 does not directly apply to the underlying facts of this case; the facts do not involve either personal (tax) data of a natural person within the meaning of articles 1 (1) and 4 no. 1 of Regulation (EU) 2016/679 or a right of access by the data subject under data protection law in accordance with article 15 of Regulation (EU) 2016/679. Data subject status under data protection law is a highly personal right that is not part of the insolvency estate and therefore is not covered by the transfer of the administrative power and right of disposal to the insolvency administrator in accordance with section 80 (1) of the Insolvency Statute (InsO, Insolvenzordnung). However, the Court of Justice has repeatedly held that, in order to ensure uniform interpretation of EU law, it also has jurisdiction to allow requests for preliminary rulings on questions concerning EU law provisions in situations where the facts of the cases being considered by the national courts were outside the scope of EU law but where those provisions of EU law had been rendered applicable by national law in a direct and unconditional way due to a reference made by that law to the content of those provisions (see CJEU, judgments of 16 March 2006 - C-3/04 [ECLI:EU:C:2006:176], Poseidon Chartering BV - para. 14 et seqq. and of 18 October 2012 - C-583/10 [ECLI:EU:C:2012:638], Nolan - para. 45 et seqq.).

14 Those conditions are satisfied in the present case. By means of the additions to the Fiscal Code, the legislature is pursuing - as is clear in particular from section 2a (3) and (5) AO - the objective, beyond the direct scope of application of Regulation (EU) 2016/679, of providing, in compliance with the general principle of the Fiscal Code, uniform procedural rules - which usually at the same time constitute rules relating to the processing of personal data - for all persons affected by tax law and tax procedure law, regardless of their legal form (see Bundestag printed paper (BT-Drs., Bundestagsdrucksache) 18/12611 p. 76). There are no apparent indications that this legislative objective is limited to taxes determined under EU law. Processing of data in a manner differentiated by taxable persons and tax types would moreover - as the representatives of the competent Federal Ministry of Finance leading the amendment to the Fiscal Code have explained in the oral hearing - be impossible to implement from a technical perspective.

15 At the same time, the national legislature intended to include rights of access to information existing in principle in accordance with the federal and federal state acts on freedom of information under this uniform tax procedure law and thus to supersede the acts on freedom of information in respect of tax data in an area-specific manner (BT-Drs. 12611 p. 89). Section 32e AO serves this purpose. An interpretation of this provision as a reference to a legal basis is unsuccessful. It would lead to the corresponding application as ordered therein of articles 12 to 15 of Regulation (EU) 2016/679, in conjunction with sections 32a to 32d AO, to rights to information by third parties always resulting in the exclusion of a claim and therefore coming to nothing due to the absence of data subject status. Such an understanding of the rule is not intended in light of the wording of section 32e first sentence AO. According to the explanations of the representatives of the Federal Ministry of Finance in the oral hearing, it is also not the intention of the provision set forth in section 32e second and third sentence AO to limit rights to information - where these have been established in the federal and federal state acts on freedom of information - in the sense of an upper limit to the extent that emerges from the Fiscal Code.

16 Against this background, a "split" interpretation of the new provisions in the Fiscal Code for situations that are subject to EU law, on the one hand, and situations that are not subject thereto, on the other, does not come into consideration.

17 Question 1:
The answer to this question depends on whether a revenue authority is permitted at all to refuse access to tax data of the taxable person by reference to article 23 (1) (j) of Regulation (EU) 2016/679. This is obviously assumed by the national legislature according to the unambiguous wording of section 32c (1) no. 2 AO, which is, according to the explanatory memorandum (BT-Drs. 18/12611 p. 88), based on article 23 (1) (j) of Regulation (EU) 2016/679 and, moreover, expressly refers to that provision. By contrast, among the relevant experts, the view has in some cases been taken that the opening clauses in article 23 (1) (i) and (j) of Regulation (EU) 2016/679 were relevant only to subjects under private law; in this respect, letter j therefore had only a clarifying function with regard to letter i, which is broadly worded in relation to protection of the rights and freedoms of other private individuals (...). This view is supported by the fact that the protection of important public interests is the subject matter of the opening clauses in article 23 (1) (a) to (h) of Regulation (EU) 2016/679. Important financial interests of the state in budgetary and taxation matters may be protected for example on the basis of article 23 (1) (e) of Regulation (EU) 2016/679.

18 Question 2:
If revenue authorities are in principle able to invoke article 23 (1) (j) of Regulation (EU) 2016/679, it is necessary to clarify whether the wording "enforcement of civil law claims" also covers the defence against civil law claims. This is - as can again be clearly inferred from the wording and the justification relating to section 32c (1) no. 2 AO (BT-Drs. 18/12611 p. 88) - the case in the estimation of the national legislature. In this case, the express mention of article 23 (1) (j) of Regulation (EU) 2016/679 in section 32c (1) no. 2 AO, in accordance with the statements made by the representatives of the Federal Ministry of Finance in the oral hearing with regard to the desired conformity with EU law, serves to make it clear that this provision relates only to the defence against civil law claims.

19 Section 32c (1) no. 2 AO is intended to ensure that, in the context of uniform and lawful taxation and safeguarding of tax revenue, the revenue authorities in the case of civil law claims are not placed in a better, but also not worse, position than other debtors or creditors; the obligations to provide information are therefore to be guided solely by civil law (see BT-Drs. 18/12611 p. 88). The provision is aimed at correcting the "insolvency administrator-friendly" jurisprudence of the administrative courts in relation to requests for access to information under the federal and federal state acts on freedom of information (...). According to that jurisprudence, the administrative power and right of disposal of the insolvency administrator under section 80 (1) InsO also extend to information covered by tax secrecy, which is intended to be used for the examination of insolvency avoidance claims in accordance with section 129 et seqq. InsO against the revenue authority (see Federal Administrative Court (BVerwG, Bundesverwaltungsgericht), judgment of 26 April 2018 - 7 C 3.16 - (...) para. 24). As a consequence of this jurisprudence, insolvency administrators were able to demand access to tax data relating to the insolvency debtor from the revenue authorities; only as a result, they were generally able to examine insolvency avoidance claims against the revenue authority. With respect to other creditors of the insolvency debtor, the insolvency administrator is restricted to rights of access under civil law, which section 32c (1) no. 2 AO expressly leaves unaffected. However, the rights of access under civil law depend, in accordance with the established jurisprudence of the Federal Court of Justice (BGH, Bundesgerichtshof), on the fact that an insolvency avoidance claim is established on its merits and that the case only involves the further determination of the nature and extent of the claim. Until an obligation for restitution (Rückgewährschuldverhältnis) is established, the insolvency administrator is therefore limited to requesting all of the information required from the insolvency debtor (see BGH, judgments of 13 August 2009 - IX ZR 58/06 - (...) para. 7 with further references and of 14 February 2019 - IX ZR 149/16 - (...) para. 29). The insolvency administrator can thus request information from other creditors only at a much later stage of the procedure; section 32c (1) no. 2 AO is intended to prevent the revenue authorities being in a weaker position as a result of this in future.

20 The question of whether this legislative objective is covered by article 23 (1) (j) of Regulation (EU) 2016/679 requires clarification. The provision authorises the national legislature - subject to certain conditions - to enact restrictive rules in order to safeguard the enforcement of civil law claims. According to conventional understanding, the German term "Durchsetzung" refers to the sphere of the claimant (creditor) and is chiefly used as a synonym for the enforcement or execution of a claim which has already been established on the merits; the same would apply, for example, to the term "the enforcement" in the English version or "l'exécution" in the French version of Regulation (EU) 2016/679. The defence against civil law claims therefore cannot simply be subsumed under the term "enforcement". This is especially true since the EU legislature distinguishes between the terms "establishment", "exercise" and "defence" (of legal claims) in article 9 (2) (f), article 17 (3) (e), article 18 (1) (c) and (2), article 21 (1) second sentence, and article 49 (1) (e) of Regulation (EU) 2016/679. In this case, it is unclear whether the defence of legal claims also covers the defence against such claims (...).

21 If the wording "enforcement of civil law claims" includes the defence of the revenue authority against such claims, this raises the further question of whether the claims (in this case the insolvency avoidance claims) must already have been established vis-à-vis the opposing party or whether it is sufficient for the information to be requested in order to examine such claims. The unfortunate wording of section 32c (1) no. 2 AO refers to the defence of the legal entity of the revenue authority "against civil law claims established against it …". If "to establish" is understood as a synonym for "to demand", "to assert", "to apply for", "to claim" or "to enforce", the wording "established" implies that the claimant (creditor) has already raised a claim vis-à-vis the opposing party (debtor), and that the merits of that claim have in any case therefore already been substantiated. By contrast, the mere possibility - which needs to be examined in more detail on the basis of the requested tax data - that insolvency avoidance claims exist vis-à-vis the revenue authority should not be sufficient. If, however, the right of access were to be excluded only after establishment of the insolvency avoidance claim, the rule would to a great extent be ineffective, as the insolvency administrator would have already acquired the necessary data. The Senate therefore understands section 32c (1) no. 2 AO in line with its unambiguous spirit and purpose, to the effect that the wording "established" also encompasses "yet to be established" or "possible" claims. It is debatable and must be clarified whether this understanding is also covered by article 23 (1) (j) of Regulation (EU) 2016/679.

22 Question 3:
Lastly, it must be clarified whether a national provision, under which the right of access pursuant to article 15 of Regulation (EU) 2016/679 is restricted to the defence of possible insolvency avoidance claims against the revenue authority, can be based on article 23 (1) (e) of Regulation (EU) 2016/679.

23 The national legislature envisaged the legislative objective of section 32c (1) no. 2 AO as being to place the revenue authority in neither a better nor worse position than other creditors and debtors in the case of civil law claims, also in the interest of uniform and lawful taxation and safeguarding of tax revenue; these two objectives constitute important objectives of general public interest in budgetary and taxation matters within the meaning of article 23 (1) (e) of Regulation (EU) 2016/679 (see BT-Drs. 18/12611 p. 88). In light of the wording of section 32c (1) no. 2 AO and the explanatory memorandum, the Senate proceeds on the assumption that the legislature primarily intended to make use of the opening clause in article 23 (1) (j) of Regulation (EU) 2016/679. From a systematic perspective, this is supported by the fact that it has referred to the opening clauses in article 23 (1) (d) to (h) of Regulation (EU) 2016/679 (only) in other provisions, for example in section 32b (1) no. 1 (a) AO, to which section 32c (1) no. 1 AO refers. Nonetheless, in any case it cannot be ruled out with certainty that section 32c (1) no. 2 AO can alternatively also be based on article 23 (1) (e) of Regulation (EU) 2016/679.

24 However, this assumption gives cause for concerns on the merits. The requested tax information is not of interest for the tax claims under substantive law, but rather mainly for the payment flows that are relevant under insolvency law as potentially contestable transactions within the meaning of section 129 (1) InsO. The insolvency administrator's claim directed against the revenue authority for restitution of payments contested under insolvency law is therefore not included among the claims arising from the tax relationship. Insolvency avoidance merely results in the ineffectiveness of the transaction disadvantaging the creditor, but not in the ineffectiveness of the underlying obligation. Instead, the legal ground of a contested payment - in this case the tax claims - remains unaffected by the insolvency avoidance. The opponent of the declaration of avoidance must return the performance made to it by the insolvency debtor, but retains its initially satisfied, now reopened claim (section 144 (1) InsO), which it can include in the insolvency table (see BVerwG, judgment of 26 April 2018 - 7 C 3.16 - (...) para. 12 with further references). Admittedly, the objective, pursued by section 32c (1) no. 2 AO, of equal treatment of revenue authorities and other creditors does concern financial interests of the State, because the revenue authority has to return any tax revenue collected and include its claims in the insolvency table. It is, however, at the very least debatable whether the interest in affording protection against this "reverse transaction" constitutes a laudable "important objective" within the meaning of article 23 (1) (e) of Regulation (EU) 2016/679, especially as there is no suggestion of a direct connection to ensuring uniform and lawful taxation and safeguarding tax revenue. The national legislature also - as shown by the provision of section 32a (2) AO referred to in section 32b (1) second sentence AO - primarily had other situations in mind in this regard.