What is the concern about data security with CbC Reporting?

The CbC report will be filed with the tax administrator in the tax jurisdiction of the MNE's ultimate parent. Thereafter, that tax jurisdiction is responsible for submitting the template to other tax jurisdictions in which the MNE operates. The primary method for automatically exchanging the template between tax administrators will be government-to-government mechanisms, such as bilateral tax treaties and tax information exchange agreements. There is a lurking vulnerability of information mismanagement between governments.

Confidentiality is a significant concern. Many tax practitioners believe that at least some tax jurisdictions will make the information reported publicly available. And with the number of governments that will be receiving this information on an annual basis, leaks to the press are inevitable. Add to that the increased scrutiny and involvement of bloggers, social activists, and nongovernment organizations, the risk is very real. A public release of the CbC information would effectively require a multinational company to respond in public as to how its public financial statements are reconciled to the template. If the template contains unintended errors or estimates that could be misinterpreted, unfair reputational risk to the company could result.