In a landmark case last week the ECJ ruled that the “safe harbour” agreement that allowed the transfer of European citizens’ personal data to the US is no longer valid. The ramifications of this for the likes of Facebook, Google, Microsoft, Amazon and many other US based e-commerce businesses are potentially huge.
Europe has comprehensive legislation guaranteeing the privacy of EU citizens and preventing businesses from using their personal information in various potentially harmful ways. EU privacy law also forbids the movement of its citizens’ data outside of the EU, unless it is transferred to a location which is deemed to have “adequate” privacy protections in line with those of the EU.
The US does not have such comprehensive privacy legislation. The safe harbour agreement that was entered into between the EU and the US government in 2000 essentially promised to protect EU citizens’ data if transferred by American companies to the US. It allowed US companies to self-certify that they would protect EU citizens’ data when transferred and stored within US data centres.
Now that they can no longer rely on self-certification US businesses must decide whether to incorporate robust contract clauses that guarantee privacy protection in line with EU requirements into all their agreements in order to continue transferring the data outside the EU, or change their business model so that data on EU citizens stays in Europe.
Many US companies may now decide to build EU-based data centres to handle data relating to EU citizens. When making this decision though US businesses should not overlook the VAT implications.
VAT Implications for Safe Harbour
The cost of building a new data centre is likely to be very high. Significant VAT costs will be incurred whether the required kit and building materials are imported or purchased from local in-country suppliers. US businesses therefore need to consider how these VAT costs can be recovered.
Will they submit foreign VAT refund claims to the relevant EU tax authorities? Or, will it be more efficient to register for VAT in the EU country concerned and recover the VAT incurred via a VAT return?
Ongoing VAT compliance obligations would need to be considered in the case of the latter. Also does a data centre create a fixed establishment for VAT purposes and a requirement to register for VAT anyway?
The fixed establishment question is one on which there could be crucial developments over the coming months in light of the ongoing BEPs project.
When deciding how to address the fallout from this key case, any US business looking to retain data in the EU must take into account VAT considerations.