‘1.   Any information obtained by a state under this Agreement shall be treated as confidential and protected in the same manner as information obtained under its domestic law for the protection of personal data, in accordance with point 5e of Annex XI to the EEA Agreement.

2.   Such information may be disclosed to persons or authorities (including courts and administrative or supervisory bodies) of the states concerned with the application of VAT laws for the purpose of a correct assessment of VAT or the collection or administrative control of tax for the purpose of establishing the assessment of VAT as well as for the purpose of applying enforcement including recovery or precautionary measures with regard to VAT claims.’

‘6.   Information provided by a state to another state may be transmitted by the latter to another state, subject to prior consent by the competent authority from which the information originated. The state of origin of the information may oppose such a sharing of information within ten working days of the date on which it received the communication from the state wishing to share the information.’

‘6a.   All storage, processing or exchange of information referred to in this Agreement is subject to the national rules adopted pursuant to point 5e of Annex XI to the EEA Agreement as well as the specific requirements for the processing of personal data laid down in this Agreement. However, states may, for the purpose of the correct application of this Agreement, restrict the scope of the rights and obligations provided for in the provisions of the EEA Agreement equivalent to those of Articles 12 to 15, 17, 21 and 22 of Regulation (EU) 2016/679. Such restrictions shall be limited to what is strictly necessary to safeguard the interests referred to in the provisions of the EEA Agreement equivalent to Article 23(1)(e) of Regulation (EU) 2016/679, in particular to:

The processing and storage of information referred to in this Agreement shall only be carried out for the purposes referred to in Article 1 of this Agreement and the information shall not be further processed in a way that is incompatible with those purposes.

The processing of personal data on the basis of this Agreement for any other purposes, such as commercial purposes, shall be prohibited.’

‘7.   The states may transmit information obtained in accordance with this Agreement to third countries subject to the following conditions:

‘9.   Each state shall immediately notify the other states concerned regarding any breach of confidentiality, personal data breach or any remedial actions consequently taken or sanctions imposed.’

‘10.   Persons duly accredited by the Security Accreditation Authority of the European Commission may have access to this information only in so far as it is necessary for care, maintenance and development of the electronic systems that are hosted by the Commission and used by states to implement this Agreement. Any access to personal data shall be treated in accordance with Regulation (EU) 2018/1725.’

‘1.   By agreement between the requesting authority and the requested authority, and in accordance with the arrangements laid down by the latter, officials authorised by the requesting authority may, with a view to exchanging the information referred to in Article 2(1)(a), be present in the offices of the administrative authorities of the requested State, or any other place where those authorities carry out their duties. Where the requested information is contained in documentation to which the officials of the requested authority have access, the officials of the requesting authority shall be given copies thereof.

2.   By agreement between the requesting authority and the requested authority, and in accordance with the arrangements laid down by the latter, officials authorised by the requesting authority may, with a view to exchanging the information referred to in Article 2(1)(a), be present during the administrative enquiries carried out in the territory of the requested State. Such administrative enquiries shall be carried out exclusively by the officials of the requested authority. The officials of the requesting authority shall not exercise the powers of inspection conferred on officials of the requested authority. They may, however, have access to the same premises and documents as the latter, through the intermediation of the officials of the requested authority and for the sole purpose of carrying out the administrative enquiry.’

‘2a.   By agreement between the requesting authorities and the requested authority, and in accordance with the arrangements laid down by the latter, officials authorised by the requesting authorities may, with a view to collecting and exchanging the information referred to in Article 2(1)(a), take part in the administrative enquiries carried out in the territory of the requested state. Such administrative enquiries shall be carried out jointly by the officials of the requesting and requested authorities and shall be conducted under the direction and according to the legislation of the requested state.

The officials of the requesting authorities shall have access to the same premises and documents as the officials of the requested authority and, in so far as it is permitted under the legislation of the requested state for its officials, be able to interview taxable persons.

Where it is permitted under the legislation of the requested state the officials of the requesting state shall exercise the same inspection powers as those conferred on officials of the requested state. The inspection powers of the officials of the requesting authorities shall be exercised for the sole purpose of carrying out the administrative enquiry.

By agreement between the requesting authorities and the requested authority, and in accordance with the arrangements laid down by the latter, the participating authorities may draft a common enquiry report.’

‘3.   The officials of the requesting authority present in another State in accordance with paragraphs 1, 2 and 2a must at all times be able to produce written authority stating their identity and their official capacity.’

‘1.   In order to promote and facilitate multilateral cooperation in the fight against VAT fraud and to coordinate any follow-up actions, Norway shall be invited to participate in the network called Eurofisc, provided for in Chapter X of Council Regulation (EU) No 904/2010 (7), under the conditions laid down in Chapter 4 of this Agreement.’

‘1a.   Within the framework of Eurofisc, the states shall coordinate administrative enquiries of participating states related to VAT fraud identified by the Eurofisc liaison officials as referred to in Article 16(1) without the power to require the states to carry out administrative enquiries.’