EU Regulation 2016/679: the age of consent and possible VAT consequences when accessing information society services

This contribution examines the new EU Regulation 2016/679 on the protection of personal data, which entered into force May 24 2016, in the light of its possible effects on the EU VAT system. The Regulation establishes an age threshold for consensus when accessing an information society service.

This rather broad category encompasses among others streaming services such as Spotify or Netflix, social media platforms such as Facebook or Instagram, auction platforms such as eBay, and online video games. Many of these platforms allow individual users to set up exchanges through microtransactions and support flourishing parallel micro-economies. The Regulation explicitly requires parental consent only for minors under the age of 16, unless different positive norms exist at the national level in the Member State, and sets a hard lower limit at 13.

The article discusses the scenarios opened by the Regulation in respect to minors and digital marketplaces, paying specific attention to consideration, the profile of taxable persons, and the VAT consequences thereof; to the interplay between the Regulation, VAT, and the EU Charter of Fundamental Rights; and to what, if any, parts of the EU framework that triggers VAT liability are in any way impacted by the new rules.

1 INTRODUCTION

This article examines the new EU Regulation 2016/679 (GDPR)1 on the protection of personal data in the light of its possible effects on the EU VAT system. The Regulation entered into force May 24 2016 and will be applicable starting May 25 2018.2

Among other measures, the Regulation establishes an age threshold for consent when accessing an information society service (ISS), requiring explicit parental consent only for minors under the age of sixteen,3 unless different positive norms exist at the national level in a Member State, and sets a hard lower limit of thirteen below which consent can never be legally given by the minors themselves.4

The formulation ISS represents a rather broad category that encompasses, among others, streaming services such as Spotify and Netflix, social media platforms such as Facebook and Instagram, auction platforms such as eBay, and online video games. Many of these platforms allow individual users to set up exchanges through transactions or microtransactions and support flourishing parallel economies or micro-economies.

This contribution discusses this specific measure enacted by the Regulation in the light of its VAT consequences, such as the foreseeable scenario of 13-year-olds creating efficient digital marketplaces through social media and thus becoming subjects liable to VAT. The participation of minors in platform-supported economies is far from being exceptional. Not only they trade and exchange digital assets on video gaming platforms such as League of Legends, but they actively create entirely new products, from new iPhone apps at age twelve,5 to extremely successful mobile games at age fifteen.6

This article pays specific attention to the profile of taxable persons, to consideration, and to the role of the EU Charter of Fundamental Rights in respect to the new scenarios that might open up at the intersection of these activities and the age of consent dispositions of the GDPR.

The first section of the paper provides a general framing; the second part specifically discusses the role of minors within the digital economy and the possible VAT and tax law consequences of the GDPR. At the end, a few conclusions are drawn.

2 THE DIGITAL SINGLE MARKET AND INFORMATION SOCIETY SERVICES

The creation of the European Digital Single Market is one of the Union’s main priorities,7 and the European Commission considers VAT and the protection of personal data one of the core elements of the European Digital Single Market to be addressed in the coming years.8 A better internet for minors9 is also one of the points on the agenda concerned with the Digital Single Market.10

It is thus essential to define what ISS are, since that is what the GDPR regulates, as well as how they relate to the Digital Single Market, and whether they are relevant for VAT.

ISS are defined broadly in all EU legal frameworks.11 Applicable law is the Directive on legal aspects of ISS,12 which focuses in particular on legal aspects of electronic commerce in the Internal Market. Recital Seventeenth establishes that the definition of ISS has already been provided in other EU Directives:

(t)he definition of information society services already exists in Community law in Directive 98/34/EC (...) and in Directive 98/84/EC (...). This definition covers any service normally provided for remuneration, at a distance, by means of electronic equipment for the processing (...) and storage of data, and at the individual request of a recipient of a service.

The VAT Directive13 also adopts a service approach to internet services, generically identifying them as “electronically supplied services”. Annex II of the VAT Directive contains a non-exhaustive list of electronically supplied services. This list includes, among others, services such as the supply of music, films and games.

Additional specifications on electronically supplied services are to be found in Council Implementing Regulation 282/201114 and in its subsequent amendments contained in Council Implementing Regulation 1042/2013.15 Again, EU VAT legislation stresses that these lists are not to be considered definitive or exhaustive.16

Generally speaking, ISS as defined in Directive 2000/31/EC thus fall within the scope of VAT, since ISS are by definition provided for remuneration and all services provided for remuneration fall within the scope of VAT.

The current version of the VAT Directive now formally uses the term “consideration”, with art. 2 prescribing that “the supply of services for consideration” will “be subject to VAT”.17 Nevertheless, at times the ECJ uses “remuneration” in VAT cases, for instance in the Tolsma case.18 The same holds true for EU law, with the ECJ using one term to explain the other:

Case C-422/01, Försäkringsaktiebolaget Skandia (publ) and Ola Ramstedt v Riksskatteverket, ECLI:EU:C:2003:380. Para. 23.

(a)rticle 50 EC provides that services are to be considered to be “services” within the meaning of the Treaty where they are normally provided for remuneration. It has already been held that, for the purposes of that provision, the essential characteristic of remuneration lies in the fact that it constitutes consideration for the service in question.19

In the field of VAT, consideration is also a term used to define the reciprocal character, or economic onerousness, of the supply as opposed to its gratuitousness. Moreover, the ECJ stated that only a “person providing services free of charge in all cases cannot be regarded as a taxable person” within the meaning of the Directive.20 Furthermore, for VAT to apply, a direct link needs to exist between the service provided and the consideration received.21 In the Société Thermale case, Advocate General Poiares Maduro maintains that the essence of a direct link lies in the “reciprocal synallagmatic link between the service and the payment”.22 EU law is again no different: an economic direct link between the provider of the service and the recipient must exist.23

Considering the non-prescriptive and non-exhaustive definition of an electronic supply of services included in the EU VAT legislation, we can therefore conclude that an ISS as covered by the GDPR, when performed in the context of an economic activity and hence provided against remuneration, falls within the scope of VAT when it brings into existence a direct link between said service and said remuneration, regardless of any other arguments.24

3 SOCIAL NETWORKING SERVICES AS INFORMATION SOCIETY SERVICES

The next necessary step is to understand whether a social network service (SNS) can be classified as an ISS as regulated by the GDPR. This seems to be the view of the European Data Protection Working Party, which very clearly states in Opinion 5/200925 concerning online social networking that SNS can be defined as ISS:

SNS can broadly be defined as online communication platforms which enable individuals to join or create networks of like-minded users. In the legal sense, social networks are information society services, as defined in Article 1 paragraph 2 of Directive 98/34/EC as amended by Directive 98/48/EC.

The Working Party goes on to list shared characteristics of SNS: users have to “provide personal data for the purpose of generating a description of themselves or ’profile’”; users are provided with tools that allow them to “post their own material (user-generated content such as a photograph or a diary entry, music or video clips or links to other sites); users are provided ways to interact with other users; much of the revenue is “generated through advertising which is served alongside the web pages set up and accessed by users”.

Likewise, in the Proposal for amending the Directive on audiovisual media services in view of changing market realities, the European Commission stated that video-sharing platforms, such as YouTube, constitute ISS26 “as defined by articles 56 and 5727 of the Treaty on the Functioning of the European Union”.28

4 RELEVANCE TO AND CONSEQUENCES FOR VAT

Economic exploitation of large amounts of personal data is one of the main commercial purposes of social media platforms:29 this is the reason why the OECD is looking into ways to evaluate the monetary value of the data in question.30 Civil doctrine maintains that SNS should not be considered to be free of charge only because there is no monetary payment when a subscription is initiated. The ratio rests on the fact that consent granted to use and process personal data is considered, in the contemporary economy, to be a type of payment in kind against the right to become a member of the SNS and use its services.31

Economic exploitation of personal data by SNS is not anything new under current business models, but it is worth noting that personal data has also been a key element in past business practices, such as for example distance selling via mail and print catalogues. For example, the direct link between personal data provided by customers in exchange for “gifts” provided by companies is what the ECJ discusses in the Empire Stores case.32 Empire Stores was a mail order company selling goods via their catalog. Empire Stores used two different schemes to attract new customers: a self-introduction scheme and an introduce-a-friend scheme. Under the first scheme, anyone was entitled to choose goods from a given list as free of charge “gifts” upon supplying their personal data to Empire Stores. The ECJ ruled that the supply of gifts by Empire Stores constituted a supply of goods for consideration as per the VAT Directive, and therefore a taxable VAT transaction was part of the commercial schemes used by the company.33 Additionally, the provision of personal information by customers was the conditio sine qua non for the supply of free goods: therefore, a direct link existed between the two transactions34 and the personal data v. gifts transaction had a specific economic value.35 Commenting the case, the Advocate General observed that the consideration in kind received by Empire Stores via their self-introduction scheme was a concrete advantage consisting of two elements:

Case C-33/93, Opinion of Mr Advocate General Van Gerven, Empire Stores Ltd v Commissioners of Customs and Excise. ECLI:EU:C:1994:106. Para. 15.

the obtaining of personal (and partly confidential) information concerning the customer introducing herself and the – at least implicit – permission to use the information in order to investigate credit-worthiness.36

While nowadays print catalogues and mail orders might be out of fashion, the business models that rely on the exploitation of customers’ data hardly are. Information and communication technologies provide companies with the possibility to “gather, manipulate, and share massive quantities of (user) data”.37 Consideration in kind is hence still employed and exploited for profit purposes, and the natural computability of digital (including its transmissibility) have opened up the way to a flourishing trade of personal information of unprecedented size, so much that personal data has become “an important currency in the new millennium”.38 The vastly larger scale at which the model operates today only reinforces the Empire Stores case approach to personal information as consideration in kind relevant for VAT: we have just moved from the provision of personal data in exchange of free goods to personal data in exchange for free service (SNS).

That technology should be neutral in respect to taxation is a long-standing OECD principle, first established in 1988 and confirmed in 2011.39 Hence, it does not matter how this personal data is collected, stored, and used to generate profit, whether through mail orders and ledgers or the internet and databases.

Taxation should seek to be neutral and equitable between new forms of electronic commerce and between conventional and electronic forms of commerce. Business decisions should be motivated by economic rather than tax considerations.

Contemporary VAT doctrine has also argued that personal data could be deemed, for VAT purposes, to be consideration in kind for a supply of goods or services.40 As service providers usually reserve themselves the non-exclusive right to use subscribers’ data to sustain their businesses in a variety of ways, from advertising to profiling, the EU VAT system would in principle allow to classify participation to an SNS as falling within the scope of VAT,41 and specifically as a service provided against consideration in kind, following the Empire Stores case ruling. A direct link also clearly exists between personal data and access to the SNS service, since no access can be granted without some amount of personal information being disclosed that allows identification of that specific subscriber. In the wording of the ECJ in Empire Store, this is a conditio sine qua non in order to be granted access to the SNS.42 Additionally, barter contracts, which also fall within the scope of VAT, are an especially interesting type of transaction. In the Serebryannay case, the ECJ states that

Case C-283/12, Serebryannay vek EOOD v Direktor na Direktsia ’Obzhalvane i upravlenie na izpalnenieto’ - Varna pri Tsentralno upravlenie na Natsionalna agentsia za prihodite. ECLI:EU:C:2013:599. Para. 39.

(b)arter contracts, under which the consideration is by definition in kind, and transactions for which the consideration is in money are, economically and commercially speaking, two identical situations.43

Similar observations also come from the EU Commission in the preparatory work “A European agenda for the collaborative economy”.44 The document touches upon several legal issues concerning the collaborative economy, taxation and VAT among them. The “collaborative economy”

COM(2016) 356 final, Ibidem. Para. 1, p. 3.

refers to business models where activities are facilitated by collaborative platforms that create an open marketplace for the temporary usage of goods or services often provided by private individuals.45

The European Data Protection Working Party considers SNS a collaboration platform:46 the above mentioned preparatory work states that supplies provided by collaborative platforms are in principle VAT-taxable transactions, albeit the practical application of VAT could prove to be difficult:

Supplies of goods and services provided by collaborative platforms and through the platforms by their users are in principle VAT taxable transactions. Problems may arise in respect of the qualification of participants as taxable persons, particularly regarding the assessment of economic activities carried on, or the existence of a direct link between the supplies and the remuneration in kind.

The EU Commission then not only maintains that these new supplies provided through or by means of collaborative platforms are in principle subject to VAT, but also that supplies that are provided through the platforms by their users are in principle VAT-taxable transactions,47 as the EU Commission outlines in their document on Online Platforms and the Digital Single Market Opportunities and Challenges for Europe.48 It must be stressed that SNS connect an unprecedented number of people in real-time: they not only provide a natural transactional platform, often across national borders, but some of them have established formally structured marketplaces. While eBay or Etsy are the examples that easily come to mind, it should be noted that Facebook has its own marketplace for its two billion users,49 and many online videogames have long been running flourishing parallel markets.50

When online platforms perform as marketplaces, not only is the provider of an SNS, such as Facebook, a provider of the service and hence a taxable person for VAT purposes, but also the recipients of these services, for example users registered on Facebook, may in turn become providers through their use of the SNS as a platform for the marketing and sale of products or services.51 In such situations, when the sale of products or services is involved, users also may become taxable persons for VAT purposes, as they normally would in a traditional marketplace. A street market or the Facebook market should be, from the perspective of VAT, just two markets. In this context SNS function only as the platform enabling the market to exist.52

The European Commission also maintains that a characteristic of these new supplies is that they are often provided by private individuals offering assets or services on an occasional peer-to-peer basis, among consumers / users themselves.53

This is in line with the OECD’s own BEPS report stating that the reliance on consumer-to-consumer transactions is a defining characteristic of the digital economy.54 Nevertheless, EU legislation does not provide guidance as for how to draw a distinction between what we could call peer or amateur providers and professional service providers.53 This is indeed a new scenario, and one which not only finds EU VAT legislators unprepared, but also possibly unaware. The GDPR brings an additional layer of complexity to the situation, at least as far as VAT law is concerned.

5 THE GDPR

The GDPR will repeal Directive 95/46/EC on the protection of individuals with regard to the processing of personal data.56 Besides recasting previous regulations concerning data processing, the GDPR will also introduce a general age restriction, preventing the processing of personal data belonging to minors below the age of sixteen in relation to the offer of ISS. Member States also retain a discretionary leeway to lower this threshold to thirteen.

While the provision covers the processing of personal data, because of the way online agreements for SNS are entered, it de facto also sets the requirements for legally becoming a subscribed user of an ISS. This is because to subscribe, a user must accept the Terms of Service of the SNS of choice. The vast majority of these Terms of Service are presented during the subscription process as “click-to-consent” or “click-to-agree” contracts, and constitute contracts of adhesion. A contract of adhesion is a standardized contract incorporating non-negotiated, pre-draft terms and clauses, which are usually complex, unclear, or very advantageous to the party proposing it.57 As a result, consumers frequently click through without reading such standard contracts,58 making their consent, already subject to non-negotiable conditions, also “non-informed, pressurised and illusory” and most certainly not easily considered to be “free and informed”.59

By clicking, tapping or else validating the “I agree” clause that is presented to them as a condition to access the platform, minors of fourteen not only consent to the processing of their personal data, but are also officially recognized via the provision of the GDPR as having entered into a contract with the service provider.

While the GDPR prescribes that the provisions related to the age threshold do not affect general contract law in Member States, including the regulations concerning validity, formation or effect of a contract in relation to a child,60 this EU-level protection is likely to be undermined, or at the very least severely weakened, by the general clauses usually contained in the Terms of Service of all non-EU SNS concerning the choice of applicable law, which is for many US law.61

The EU Commission reports how one of three internet users is a minor:62 given the statutory limits imposed by the GDPR and the possibility for Member States to lower them, the possibility of a fifteen-year-old accessing an ISS without any requirement of parental consent is far from being an impossibility. If that minor subsequently supplies services through the platform, those transactions are in principle taxable VAT transactions,63 and the minor could be considered, for the purposes of VAT, a taxable person.

6 MINORS AS PROVIDERS OF SERVICES

Art. 9 (1) of the VAT Directive defines the taxable person and links it to the concept of economic activity: “(t)axable person shall mean any person who, independently, carries out in any place any economic activity, whatever the purpose or results of that activity”. The concept of economic activity is framed widely, and is considered without any regards to its purpose or results.64 As the concept of taxable person does not have any derivative concept in national civil law,65 a contract lacking validity following national contract law regulations, for example because of an age limitation, still brings into existence a taxable person within the scope of VAT. Consequently, and in full accordance with European VAT, any person may be a taxable person and any person may become a taxable person when independently carrying out any economic activity in any place, regardless of the purpose or result of that activity.

The ECJ has established that subjective intentions are irrelevant for the classification of an activity as economic or not for VAT purposes.66 The broad definition of taxable person provided by the VAT Directive would also allow the inclusion of minors, since the Directive itself does not mention age or minority as a possible reason for exclusion or inclusion. The principle of competition would also suggest that taxable transactions carried out by minors would have to be subjected to the same VAT treatment they would receive if carried out by adults, since the principle of fiscal neutrality prevents to treat similar competing supplies differently for VAT purposes.67 Only transactions which are entirely illegal as such fall outside the scope of VAT,68 since the principle of fiscal neutrality prevents any general distinction between lawful and unlawful transactions.69 This not being the case here, we can conclude that a minor providing services through an ISS may, unintentionally or not, become an independent business operator and therefore a taxable person in accordance with EU VAT law.

A minor might then have to meet, in accordance with what Title XI of the VAT Directive prescribes for taxable persons,70 instrumental and formal obligations, such as, for example, to declare when activity commences, any changes or ceases, and the keeping of accounts sufficiently detailed for VAT to be applied and its application checked by the tax authorities. A VAT return would also need to be filed with the information needed to calculate the tax that has become chargeable and the deductions to be made including, in so far as is necessary for the establishment of the basis of assessment, the total value of the transactions relating to such taxes and deductions and the value of any exempt transactions.71 The VAT Directive also establishes that Member States may impose additional obligations if deemed necessary to ensure the correct collection of VAT and to prevent evasion.72

Furthermore, especially if we consider the higher limit set by the GDPR of sixteen years of age, secondary national considerations are also necessary, as domestic legislation often allows minors to exercise an economic activity. In Italy, for example, any minor over the age of sixteen, who has been through a process of emancipation and has been authorized by a court of law specializing in guardianship, may exercise an economic activity.73 What the GDPR may end up doing is drawing another line between the traditional economy, where legal protection for a minor running a business activity is in place and expected to be, and the digital economy, where the consequences of the actual interplay between the legal meaning of regulations and their practical effects often go unchecked because of the eminent complexity, leaving in this case minors, young people who have “not yet fully matured”,74 to face the potential risks and damage deriving from their lack of experience and unawareness.

7 CONCLUSIONS

The main issue raised here is whether the new age thresholds for consent officially introduced by the GDPR75 will have any consequences on the EU VAT system. The answer is clearly a positive one. The problem is two-fold: on the one hand, the GDPR does not consider the possible VAT ramifications on minors who are able to enter into a contract with an information service provider by agreeing to their Terms of Service without any need for parental consent; on the other, the current EU VAT debate on the digital economy has so far not considered that minors who participate in an SNS could potentially become taxable persons running an economic activity by providing services through that specific online platform.

Social media is in this context only a platform. As such, it should be treated as neutral ground for all VAT purposes. What makes someone a taxable person or an activity relevant for VAT does not depend on the technology they might employ but only on the specific nature of the economic activity and its relevance for VAT. This is the base argument for looking at what the GDPR entails. The GDPR also adds complexity by establishing that minors in the 13–16 years of age demographic cohort may now legally access social media without parental consent. This is a VAT issue, since minors performing an economic activity on social media would then become taxable persons.

It is important to note that such enterprises cannot be dismissed as marginal: because of the outreach of any such platform, the Facebook marketplace easily reaching a potential two billion individual users, and given the scale, speed, and efficiency of operation, even peer operations such as selling in-game assets for videogames76 could generate significant profits.

In this respect, we can most certainly conclude that any VAT debate concerned with the digital economy should also include a discussion on the role of minors as taxable persons:77 should future VAT policies include a non-liability clause for VAT specifically targeting minors, as defined by the GDPR and national law, conducting economic activities on SNS? Should there be limits on annual turnover, type of activity, or similar criteria? The VAT Directive contains simplification measures that Member States may adopt after consulting the VAT Committee,78 and the possible adoption of a VAT simplification measure for minors running economic activities after entering into contract with an SNS might be part of the solution. Nevertheless, the primary issue remains that the removal of parental consent creates a misalignment between the goals of the GDPR and the obligations deriving from VAT, potentially burdening thirteen-year-olds with the duty of understanding how supplies provided via SNS might end up having VAT relevance and produce VAT consequences.

An additional reflection can be brought forth for another GDPR disposition concerning tax law. Recital Seventy-first considers the possible tax consequences of the interactions between the processing of personal data, if expressly authorized by Union or Member State law to counteract fraud and evasion, and the possible involvement of a minor, and then proceeds to dismiss the issue entirely since, in the words of the European legislator, “such measure should not concern a child”.

On one hand, the measure supports the hypothesis that the GDPR, tax and VAT law, and minority might have unexpected interactions: after all, the text of the Disposition itself introduces this possibility. On the other hand, the legislator seems to be unaware of the loophole created by the age of consent disposition contained in the GDPR.

This leads to consider this safeguard measure as potentially even more damaging, since the GDPR positively identifies minors as individuals exempt from the processing of personal data for fraud and tax evasion purposes. It is altogether entirely possible to imagine how minors could be economically exploited for VAT evasion or avoidance purposes when the age of consent clause contained in the GDPR enters into effect, either directly or indirectly, for example through impersonation or identity theft.

The creation of the European Digital Single Market is one of the top priorities for the EU. The European Commission considers VAT, the protection of personal data, and a better internet for everybody, including minors, necessary elements of the strategy. This does not seem to be unfortunately the case if we consider the GDPR and the changes it introduces to the age of consent.

Most pressingly, this also implies that these regulations concerning the age of consent need to be questioned in the light of the EU Charter of Fundamental Rights,79 whose art. 24 imposes a duty to protect children. In a recent document, the Council of the European Union states that the provisions contained in the EU Charter enshrine the principle of the child’s best interests as a primary consideration in all actions relating to them:80 it is worth remembering that, after the entry into force of the Lisbon Treaty, the EU Charter has become a binding instrument.81 That same principle of protection is also enshrined in the Treaty on European Union, art. 3(3).

According to the EU Charter, the child’s best interests must be a primary consideration in all actions relating to them,82 with children’s rights considered a cross-sectorial area of intervention where European competence needs to be ascertained on a case-by-case basis,83 even in respect to VAT. This cross-sectorial methodology is exactly what is missing in the matter discussed in this article, resulting in potential harm to minors as the perspective and constraints of VAT, and more in general of tax law, have not been considered at all. It is rather doubtful that the results produced by EU legislation in the specific area of the digital economy examined here reflect the child’s best interest: any forthcoming answer to the issues raised by the combined dispositions of the GDPR age threshold and the current EU VAT system should necessarily commence from here.

Cristina Trenta is an associate Professor and a senior lecturer of Tax Law, Örebro University, Sweden.