Data protection notice of the tax administration

General information on the implementation of the data protection provisions of Articles 12 to 14 of the General Data Protection Regulation in the tax administration

Almost all citizens and companies come into contact with the tax administration - in particular the tax offices - sooner or later because they have to submit tax returns and pay tax and can claim refunds or child benefit. This involves processing personal data.

The following information relates to the processing of personal data for tax purposes, insofar as the German Fiscal Code is directly or indirectly applicable. This does not include the processing of personal data by customs authorities (e.g. customs duties, import VAT and motor vehicle tax).

In the taxation procedure, data is personal if it can be attributed to a natural person, a corporate body (e.g. association, corporation), an association of persons or an estate. Anonymised or pseudonymised data is not personal data.

When tax authorities process personal data, this means that they collect, store, use, transmit, make available for retrieval or delete this data, for example.

In the following, we will inform you about what personal data we collect, from whom we collect it and what we do with this data. We also inform you about your rights in data protection matters and who you can contact in this regard.

1. Who are we?

"We" are the federal tax authorities (with the exception of the customs administration) and the federal states and are responsible for processing personal data for tax purposes.

2. Who are your contact persons?

You can address questions relating to data protection issues to the responsible tax authority, represented by the head of the authority.

As a rule, the tax offices are responsible for the processing of personal data, in the case of child benefit the family benefit offices. The other tax authorities (e.g. Ministry of Finance, Federal Central Tax Office, Regional Tax Office) are only responsible for processing personal data if they process this data to fulfil their statutory duties.

In addition, you can contact the data protection officer of the responsible tax authority. The Hessian tax administration has a central data protection officer for all tax offices. You can reach the data protection officer using the following contact details

Postal address:
Oberfinanzdirektion Frankfurt am Main
Zum Gottschalkhof 3
60594 Frankfurt am Main

Hotline: 069 58 303 2580
Fax number: 069 58 303 1090
E-mail: datenschutz@ofd.hessen.de

3. for what purpose do we process your personal data?

In order to fulfil our task of assessing and collecting taxes uniformly in accordance with the provisions of the German Fiscal Code and tax laws, we require personal data (Section 85 of the German Fiscal Code).

Your personal data is processed in the tax procedure for which it was collected (Section 29b of the Fiscal Code). Only in the cases expressly authorised by law may we also process the personal data collected to carry out a tax procedure for other tax or non-tax purposes (further processing in accordance with Section 29c (1) of the German Fiscal Code).

Example of processing:

The data collected by the tax authorities with the income tax return is processed in the income tax assessment.

Example of further processing:

In certain cases, individual tax bases are determined separately (e.g. income from an investment in a partnership). For this purpose, the information from the assessment declaration is processed in an independent procedure, the assessment procedure. The tax bases determined in this way and other necessary data are communicated to the tax authorities responsible for the taxation of the parties involved. These authorities process the notified data further by taking this data into account in the tax assessment procedure, e.g. for income tax.

The tax offices administer the following taxes in particular:

• Income tax (including wage tax and capital gains tax),
• corporation tax,
• solidarity surcharge,
• Church tax (exception: Free State of Bavaria),
• Trade tax (insofar as the federal states have not transferred administration to the municipalities),
• inheritance and gift tax,
• property tax
• Racing betting and lottery tax

The Federal Central Tax Office has the following tasks in particular in accordance with Section 5 of the Tax Administration Act:

• Allocation of the tax identification number (IdNr.),
• Creation of the electronic wage tax deduction features (ELStAM),
• Participation in external audits,
• reimbursement and exemption of German withholding taxes,
• Centralised collection and evaluation of foreign tax relationships,
• Reimbursement of input tax amounts to companies,
• allocation of the VAT identification number (VAT ID),
• Child benefit processing, for which the Federal Central Tax Office uses the family benefit offices.

4. What personal data do we process?

We process the following personal data in particular:

Personal identification and contact details, e.g.

• First name and surname, address, date and place of birth, tax number, identification number, e-mail address, telephone number.

Information required for the assessment and collection of taxes, e.g.

• Income (e.g. wages, business income, income from letting and leasing, capital gains, pensions),
• Expenses (e.g. income-related expenses, operating expenses, special expenses and extraordinary expenses),
• Taxes withheld by third parties (e.g. wage tax, capital gains tax, solidarity surcharge, church tax),
• marital status and children,
• wage tax class,
• occupation,
• bank details,
• Details of taxes paid or refunded,
• information on tax returns submitted and applications made as well as legal remedies.

We also only collect special categories of personal data, so-called"sensitive data", if this is necessary for the taxation procedure. For example, we require information on religious affiliation in order to be able to recognise church tax payments as special expenses, or information on illnesses/disabilities in order to deduct corresponding expenses as extraordinary burdens. We primarily collect your personal data from you yourself, e.g. through your tax returns, notifications and applications.

In addition, we collect your personal data from third parties insofar as they are legally obliged to notify us.

Examples:

• Employers transmit data on wages, taxes withheld and social security contributions paid in the wage tax statement, for example,
• Pension insurance providers transmit e.g. data on pension payments and withheld health and long-term care insurance contributions in the pension payment notification,
• Private health insurance companies transmit e.g. data on health and long-term care insurance contributions paid and, if applicable, reimbursed,
• Social authorities transmit data on wage replacement benefits,
• Credit institutions transmit data on investment income exempt from capital gains tax deduction,
• Municipalities transmit data on business registrations and registration data,
• Notaries transmit data on property sales, partnership agreements, inheritance contracts and gift agreements,
• Public authorities transmit data on payments and administrative acts,
• public broadcasting organisations transmit data on fees.

We also receive tax-relevant information from other tax authorities or through the intergovernmental exchange of information.

If we are unable to clarify a tax-relevant matter with your help, we may also collect personal data relating to you by making enquiries with third parties (e.g. requests for information from your employer). In enforcement proceedings, we may collect data from third-party debtors (e.g. credit institution or employer).

We may also process publicly accessible information (e.g. from newspapers, public registers or public announcements).

5. How do we process this data?

In the largely automated taxation procedure, your personal data is stored and then used as a basis for the assessment and collection of tax in mostly automated procedures. We use technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss or alteration and against unauthorised disclosure or access. Our security standards are always in line with the latest technological developments.

We only make legally binding decisions on the basis of "fully automated" processing of personal data if this is permitted by law (e.g. "fully automated" tax assessment in accordance with Section 155 (4) of the German Fiscal Code).

6. Under what circumstances may we pass on your data to third parties?

We may only pass on all personal data that has become known to us in a tax procedure to other persons or bodies (e.g. tax courts, health insurance funds, pension insurance providers or other authorities) if you have given your consent or if the disclosure is permitted by law .

Examples

• Notification of property tax and trade tax assessment amounts to the municipalities responsible for the assessment and collection of property tax or trade tax,
• Notifications to public corporations (e.g. chambers and guilds) for the determination of such levies that are linked to tax bases, tax assessment amounts or tax amounts,
• Notifications to the statutory social security system, the Federal Employment Agency and the Artists' Social Security Fund, insofar as knowledge of personal data is required for the determination of compulsory insurance or the assessment of contributions, including the artists' social security contribution,
• Notifications to social authorities to combat illegal employment and the misuse of benefits,
• notifications from the family benefits office to public sector pay offices to determine salary components linked to child benefit.

7. How long do we store your data?

We must store personal data for as long as it is required for the taxation procedure. This is based on the tax limitation periods (Sections 169 to 171 of the German Fiscal Code and Sections 228 to 232 of the German Fiscal Code).

We may also store personal data relating to you in order to process it for future tax proceedings (Section 88a of the German Fiscal Code).

8. What rights (right to information, right to object, etc.) do you have?

You have various rights under the General Data Protection Regulation. Details can be found in particular in Articles 15 to 18 and 21 of the General Data Protection Regulation.

• Right to information
  You can request information about your personal data processed by us. In your request for information, you should specify your request in order to make it easier for us to compile the necessary data. The request should therefore include details of the specific administrative procedure (e.g. tax type and year) and the section of the procedure (e.g. assessment, enforcement).
   
• Right to rectification
  If the information concerning you is not (or no longer) correct, you can request a correction. If your data is incomplete, you can request that it be completed.
   
• Right to cancellation
  You can request the erasure of your personal data. Your right to erasure depends, among other things, on whether the data concerning you is still required by us to fulfil our legal obligations (see "How long do we store your data?").
   
• Right to restriction of processing
  You have the right to request that the processing of your personal data be restricted. The restriction does not prevent processing if there is an important public interest in the processing (e.g. lawful and uniform taxation).
   
• Right to object
  You have the right to object, on grounds relating to your particular situation, at any time to processing of data concerning you. However, we cannot comply with this if there is an overriding public interest in the processing or if a legal provision obliges us to process the data (e.g. implementation of the taxation procedure).
   
• Right to lodge a complaint
  If you are of the opinion that we have not or not fully complied with your request, you can lodge a complaint with the competent data protection supervisory authority. The contact details of the federal and state data protection authorities can be found at www.datenschutz.de/projektpartner/.

General information on these rights
In some cases, we cannot or may not comply with your request (Sections 32c to 32f of the German Fiscal Code). If this is legally permissible, we will always inform you of the reason for the refusal.

However, we will always respond to you within one month of receiving your request. If we need longer than one month for a final clarification, you will receive an interim message.

9. where can you obtain further information?

You can find further information in the

• BMF letter on data protection in tax administration procedures dated 12 January 2018 (see Federal Tax Gazette 2018 Part I p. 183, and on the website of the Federal Ministry of Finance(www.bundesfinanzministerium.de under Topics - Taxes - Tax Administration & Tax Law - Tax Code - BMF letter / General) and
• the brochure "Taxes from A to Z" (see www.bundesfinanzministerium.de under the heading Topics - Service - Publications - Brochures)

can be found here.

Download this general information as a PDF document

You can download the above-mentioned information on the implementation of the data protection provisions of Articles 12 to 14 of the General Data Protection Regulation in the tax administration below.

Contact details of the data protection officers in the Hessian tax administration:

E-mail: datenschutz@ofd.hessen.de