Is this actually true?
Not really although there may be figments of truth woven in.
First, the GDPR does not prevent tax authorities from determining layers of corporate ownership or investigating tax fraud.
Second, your substantive tax liability depends upon the tax laws of the countries in question. If you owe taxes under a country's tax laws but the country can't find it, that makes you a tax criminal, and doesn't mean you don't owe the tax.
Third, the exact rules on what triggers tax liability in mixed country fact patterns are highly technical and not fully uniform. If you actually do business abroad within the meaning of a country's tax laws in a way that is not subject to its taxes, then it is legal. But this scheme probably doesn't meet that standard under most country's tax laws.
So you hire two local directors, as contractors, from country B. On
the contract signed, they oversee the day to day operations and work
for you as advisor since you're the only shareholder. So their
existence, the contract and the structure show that the company is
managed in country B, run in country B and has economic substance in
country B.
This way the offshore company isn't taxed in country A. This allows
you to get dividends from the company tax free (after paying corporate
taxes in country B) to your account in country A.
A few thoughts on this specific example.
If you truly are nothing but a passive source of funding for a company, then owning shares in this company is no different from owning shares in a public held company (e.g. BMW). The notion that dividends from the company are tax free in county A in that situation is very likely incorrect. Usually, dividends and other intangible income is taxable income in the country where they are received. Most likely, the dividends are income subject to taxation in country A.
There is a concept in tax law which U.S. tax lawyers call the "Economic Substance Rule" which is also true, but with different names (most of these countries don't have English language tax terminology anyway) which means that when someone is going through the motions of conducting a transaction in a tax favored form when in substance, something different is really going on, the tax authorities can choose to tax the substance rather than the form of the transaction. So, if the really valuable work is being done by the shareholder without visible compensation, rather than by the local directors and managers, you the shareholder might be taxed on "imputed income" representing the fair market value of the services rendered, or treated as the true manager of the company in country B. Similar issues can arise when valuable intellectual property is transferred to the company without being duly reflected in a fair market value purchase of equity interests, a sale at fair market value, or a licensing agreement for royalty payments.
Tax officials aren't limited to looking at paperwork. They can and do interview the human beings involved in interviews that those human beings are legally obligated to attend and cooperate with and to provide truthful information in with legal consequences for lying in those interviews.
Even if no official documentation or public statements would tip off tax officials, a significant share of tax evasion cases are driven by whistleblowing by disgruntled former employees, ex-spouses, jilted significant others, mistreated business partners, and revengeful angry children who feel that they have been mistreated by their parents. Nothing in the GDPR prevents whistleblowing to tax authorities.
Background
In E.U. countries, closely held company ownership must be declared and recorded in a notary public's "public records" or a corporate register (unlike, for example, the United States, where, this information was only contained in the internal records of the company in most cases, although a new law called the Corporate Transparency Act effective January 1, 2022, or later if initial regulations aren't adopted, changes this status quo).
E.U. directives expressly requires much more public disclosure by private companies than the U.S. more generally.
For example, a recent Dutch overhaul of its rules for disclosing beneficial ownership of companies is a model of contemporary modern European legislation on the subject. This affords access to this information as follows (UBO is the Universal Beneficial Ownership registry and FIO is the Fiscal Intelligence Agency, an anti-money laundering agency):
The public can only access the publicly accessible UBO-information
with a valid registration and in exchange for a fixed fee. The
identity of those persons that access the UBO-register will be
registered with the Dutch Chamber of Commerce and UBOs may inquire as
to how often their information has been consulted.
The Chamber of Commerce may register the Citizen Service Number
(Burgerservicenummer) of persons who access the register. The FIU and
other competent authorities will, upon request, have access to that
information.
The FIU and other competent authorities may perform a search in the
UBO-register based on the name of an individual, thus listing all
connections of that individual, while the public will only be able to
search the UBO-register for the UBO(s) of a specific entity (and not
for the name of an individual). Even though this limitation to search
options was presented as a measure to protect the privacy of UBOs, it
is generally expected that commercial platforms that register company
information will enable searches based on the name of individuals.
The FIU and competent authorities have access to both the publicly and
not publicly accessible UBO-information.
In the Netherlands, the following institutions are, amongst others,
qualified as competent authorities with unlimited access to the
UBO-information:
the Dutch Central Bank;
the Authority for the Financial Markets;
the Financial Supervision Office;
the Dutch Gaming Authority;
the Tax & Customs Authorities;
the National Police;
the Public Prosecutor’s Office;
the Dutch intelligence agencies; and
the Tax Intelligence Agency.
As this example illustrates, taxing authorities are given express statutory authority to gather information pertinent to tax collection.
The Dutch situation, prior to the recent reform, collected essentially similar information, but at a decentralized basis in the offices of the notary handling the incorporation of the entity in question, with similar parties having access to the information.
The E.U.'s General Data Protection Regulation generally, affirmatively extends to the provision of a good or service to an E.U. person subject to the regulation, something that would not include tax collection. See Article 3(2).
Also, mutual assistance treaty obligations between E.U. countries to share information, which would include many tax treaties between E.U. countries, and criminal investigations (which would include criminal tax fraud cases) are expressly exempted from its scope.
