DAC8 in court: complaint against crypto reporting in Austria

Status: complaint filed with the Austrian Data Protection Authority (October 2026). On 2 November 2026 Bitcoin Austria launched the initiative dac8.org, backed by Coinfinity. Lawyer Dr Oliver Völkel (CERHA HEMPEL) filed the complaint as a customer of a crypto provider. The aim is for the Constitutional Court and the European Court of Justice to rule on whether DAC8 breaches fundamental rights. For your tax return nothing changes for now.

Austria implements the EU directive DAC8 through the Crypto Reporting Act (Krypto-Meldepflichtgesetz, BGBl. I 96/2025), in force since 1 January 2026. Who reports: exchanges, brokers and apps through which you buy, sell or hold crypto assets. What is reported: name, address, date of birth, tax residence and tax number, plus for each crypto asset the yearly totals of purchases, sales, exchanges and transfers, in euros and units.

Your own wallets: transfers to a wallet without a known provider are reported as a total, without wallet addresses. When: the provider reports 2026 to the tax office by 31 July 2027. If you live in another EU country, Austria passes the report on by 30 September 2027. How long: the provider keeps each yearly report for ten years. If you only hold your own keys and never use a provider, you are not reported.

The complaint starts from a concrete case: the data a provider prepares about one customer for DAC8. According to dac8.org it asks three questions. May the state demand this? Providers record the data of every customer without suspicion and keep each report for ten years. Does the tax office need it? Transfers to your own wallet are reported too, although they are not taxable in themselves. Could it be done with less?

According to the initiative, Germany and the Netherlands only compile data for customers who are actually reported, and Ireland keeps it for six years instead of ten. The route runs through the Data Protection Authority and the Federal Administrative Court to the Constitutional Court, which can review the law and refer the directive to the European Court of Justice, but does not have to. The initiative points to data retention: the ECJ declared that directive invalid in April 2014, and the Austrian Constitutional Court struck down the Austrian rules in June 2014.

The campaign was started by Bull Bitcoin. According to dac8.org, the company asked France's Conseil d'État in February 2026 to annul the French DAC8 decree. On 14 September 2026 the court refused to suspend it in summary proceedings. The annulment itself has not been decided yet. Bitcoin Austria argues mainly from safety: anyone who knows who holds how much crypto and where they live can target them.

The initiative cites known attacks on crypto holders in Europe and data leaks at providers, tax tools and authorities covering about 46 million people in total. These figures are the initiative's own; we have not checked them one by one. DAC8 still applies. A case through all courts takes years. Until a ruling…