February 11, 2019

This article was first published in Tax Journal on 1st February 2019 and is republished here with permission. 

Data centres play a significant role in today’s digital economy by hosting and processing the reams of data stored in the cloud. The tax treatment  of digital data stored, processed and transferred by companies carrying out digital activities has become a modern day conundrum. As the physical manifestation of the cloud, the data centre and, in particular, the recent evolution of the micro data centre, stress tests the traditional concept of the permanent establishment (PE). For the last 20 years, the UK’s position has been that, contrary to the OECD’s advocated approach, data centres are not always recognised as PEs for UK tax purposes. Against the backdrop of the UK’s proposed introduction of the digital services tax and the wider challenges posed to international tax policy by the digital economy, we consider data centres and tax territoriality and query the extent to which data centres could provide a viable alternative to the consumer as a tax nexus.

How do you catch a digital cloud and pin it down? Ceri Stoner (Wiggin) and Clara Coudert (Kering) ask whether data centres could provide a viable alternative to the consumer as a tax nexus.

The transition from a bricks and mortar economy to a digital economy has profoundly disrupted the notion of permanent establishment (PE). Decades into the digital revolution, national and international debate on the introduction of a virtual PE is still grappling with the elusive nature of digital activities.

In part, the problem is one of perception. The internet is widely regarded as a purely virtual space in which users interact via online platforms and blockchains, and store data in the cloud. The problem is exacerbated by anticipated improvements in connected objects and artificial intelligence. Policymakers appear uncertain how to navigate through this uncharted digital space. As has been well documented, in the absence of any imminent international agreement at a European or OECD level on how to tax the digital economy, the UK has followed the EU’s lead and proposed what is viewed by many as a highly politicised fiscal solution: a digital tax on the revenue of certain highly digitalised businesses above a set threshold. The government’s attempt to provide a fair tax on digital business without impeding growth effectively places a value on the (intangible) content and data of (tangible) British consumers. Such a tax ‘risks being blunt and counterproductive’ if not properly designed, according to Carolyn Fairbairn, director-general of the Confederation of British Industry. Is this because, in its focus on the consumer or user, it is anchored to the wrong physical presence in this virtual world? Is there a more workable, palatable solution? And could the foundations for such an alternative international solution perhaps already have been laid?

The role of the data centre

It is a matter of fact that, in addition to its consumers or prosumers, our digital economy has another tangible manifestation: the data centre. Data centres are the physical infrastructures which constitute the backbone of the digital economy by hosting and processing the digital data upon which it relies. Such activities have long been formally recognised at a European level, being category 63.11 of the NACE classification (Nomenclature statistique des activités économiques dans la Communauté européenne), the European standard classification of productive economic activities.

The beating heart of these technological strongholds is the computer server on which a company’s website and other data is stored and accessed. Since their emergence in the 1990s, data centres housing many such servers have been known as ‘server farms’ and, with the prolific rise in and reliance on data, server functionality has become increasingly important. In addition to servers, data centres also have other key components, including buildings, management, security, cooling equipment (to avoid damaging servers that produce a lot of heat) and other computer equipment (e.g. hard disks, cables and optical fibre).

Despite their common functions and component parts, data centres can vary greatly in terms of data volume, equipment and staff. Mega data centres, for instance, can sprawl over thousands of square meters and require a full time, highly skilled labour force to maintain and protect the structure. Recently, such large capacity data centres are being increasingly supplemented by smaller ones, referred to as micro data centres. The micro data centre can be stripped back to its simplest form and its physical dimensions reduced by taking the shape of servers (or server racks) with embedded equipment (power distribution, electricity cables and monitoring appliances that prevent the server from physical threats or access events). Such decentralisation is designed to enable real-time data processing, relevant for today and the future; for example, to benefit the driver of tomorrow’s connected car. Micro data centres are, and will increasingly be, disseminated across smart cities, with the idea that the closer it is to the user, the quicker information flows. It is expected that these small devices will develop rapidly and become more prolific with the increase of connected objects.

The diversity of data centres already stress tests the existing concept of PE. The tax treatment of such data centres under the existing rules are explored in more detail below, but it is worth considering certain questions. Could data centres also provide a means to create or avoid a PE? And could the functions of data creation and data storage, which always occur in the jurisdiction of the data centre, present a conflict with, or perhaps a viable alternative to the current policy preference to tax digital activities in the jurisdiction of the consumer/end user?

Data centres and today’s concept of PE

The OECD’s position

In the late 1990s, the OECD’s Committee on Fiscal Affairs was mobilised to tackle the issue of the application of PE rules in the context of e-commerce. As a result, an update of the OECD commentary relating to article 5 (permanent establishment) of the Model Tax Convention on Income and on Capital clarifying the tax treatment of computer servers, and therefore data centres, was adopted on 22 December 2000, with new commentary added to the Convention on 28 January 2003.

The revised OECD commentary advocates the following principle. A computer server can constitute a PE provided that the following tests are met:

• Test 1: a fixed place of business exists in the relevant jurisdiction which is sufficiently controlled by the company in question.
• Test 2: business activities are performed through that fixed place.

Broadly, the rationale is set out below.

Test 1: A fixed place of business: The server housed within the data centre is an item of tangible property likely to remain in the same place for a significant period and provide a means through which the company can carry out its business. Unlike a website devoid of physical substance, a computer server has a material reality in the same way as an office, a workshop or an oil well, and can therefore constitute a fixed place of business for the purposes of PE.

The OECD adds a condition to this analysis. In order to constitute a PE, the company’s data centre must be ‘at its own disposal’; i.e. the company must own (or lease) and operate it (OECD commentary on art 5 para 43.3).

Applying this in practice, if a company owns and operates its servers and the associated software through on-site staff acting on the company’s instructions, the data centre will be considered as being ‘at its own disposal’. However, according to OECD guidelines, even the absence of on-site staff does not disqualify the data centre as a PE, provided the two tests are otherwise met. The OECD commentary upholds this interpretation, despite the fact that it also provides that a PE is ‘mainly’ characterised by the presence of ‘persons who are in a paid-employment relationship with the enterprise (personnel)’ (OECD commentary, article 5 para 2).

As a result, a micro data centre, devoid of personnel (for instance, a mere rack of server set up close to a trading place in order to perform high-frequency trading) is capable of constituting a PE, provided that the data is not hosted by an internet service provider (ISP) (see below).

The OECD’s position has been upheld in certain national courts. In 2007, this interpretation was applied by Italian tax authorities to a French video game company which owned and operated servers in Italy in order to offer online games to its Italian customers. The fact that games were delivered from France, in the absence of personnel in Italy, did not prevent the structure from constituting a PE. On the facts, the server was considered to be at the disposal of the French company as off-site staff were operating it from France (Italian tax administration, Resolution 119 of 28 May 2007).

Test 2: Business activities are performed through that fixed place: Once a data centre is recognised as a fixed place of business, it must meet the second limb of the test; i.e. there must be the performance of an activity through the fixed place of business (Marco Rossi, Tax Notes International, 4 June 2007). Traditionally, the OECD excludes preparatory and auxiliary activities (for example, the use of facilities solely for the purpose of storage) from the list of activities that characterise a PE. However, the OECD commentary relating to article 5 provides that when the functions of the computer server ‘form in themselves an essential and significant part of the business activity of the enterprise as a whole, or where other core functions of the enterprise are carried on through the computer equipment’, then the activities performed are neither preparatory, nor auxiliary (OECD commentary on article 5 para 42.8).

Obviously, computer equipment forms an essential and significant part of the business of pure data centre operators (such as Digital Realty and OVH), since their core activity is to host data for third parties (companies and individuals). But what about companies, such as start-ups, banks and the fashion industry, performing in-house data storage? According to national case law, their data centres can also constitute PEs. In the Italian case referenced above, it was considered that the server of the video game company was an integral and essential part of the business. It was therefore constitutive of a PE as it was used ‘to conduct electronic commerce aimed at the sale of goods and services downloadable directly from the company’s website’; and ‘all the stages of the business, including the transfer of the product and the payment, [were] carried out electronically’.

The UK’s divergence from the OECD position

Whilst the OECD enjoins all signatory states to ‘conform to this Model Convention as interpreted by the Commentaries thereon’ (OECD Modern Tax Convention 2017, introductory para 3), signatory states do not always follow OECD commentary. Although some countries, such as India (Areva T&D India Ltd (2010) AAR/876) and Italy (see above), have abided by the OECD’s interpretation in the context of e-commerce, other countries have deviated from the OECD’s position.

For some countries, such as France, this is a question of degree. The French authorities have simply added an explicit condition for ‘the presence of on-site operating staff ’ to the characterisation of an activity that is neither preparatory nor auxiliary (Ministerial Response no. 56961). However, this requirement falls away if the operator ‘demonstrates that the functions typically linked to a sale (such as, for instance, the conclusion of contracts with clients, the processing of payment and the provision of online services) are fully performed automatically by the computer equipment where it has been set up. Consequently, the French micro data centre (devoid of personnel) of a non-resident company will constitute a PE if the server automatically performs functions linked to a sale.

The UK takes a more defiant line. Notably, in April 2000, following the publication of the OECD’s draft reports on e-commerce, HMRC published an acknowledgment of the OECD principles but asserted its refusal to treat a computer server (whether alone or associated to a website) as a PE (see HMRC’s International Tax Manual at INTM264700).

Consequently, from a UK perspective, even where a server is under the control of a company and forms an essential and significant part of the business activity, the equipment alone cannot constitute a PE in the country of performance of the activities in any circumstances.

A fixed place of business

What strategies can digital businesses deploy to manage whether they have a ‘fixed place of business’ by virtue of their data centre?

The OECD’s position

Outside the UK, certain steps can be taken by digital businesses to either create or avoid a PE in a particular jurisdiction, subject to any particular local rules.

First, companies seeking to ensure that a data centre forms a PE in the country of location can establish a subsidiary. Subject to confirmation from local counsel, the income generated through the equipment should be taxed in this country ‘through the use of a subsidiary even if no permanent establishment is considered to exist’ (OECD Committee on Fiscal Affairs, 22 December 2000).

Alternatively, companies seeking to avoid taxation in the country of location of their data centre should consider outsourcing the running of the data centre through a hosting agreement. Such an agreement allows a company to delegate the operating, running and maintenance of a data centre to an ISP. As a result, the data centre ceases to be at the disposal of the company, since the company then has no physical presence in the country where the infrastructure is located. Only the digital data located inside the servers is at the disposal of the company, which consequently has a solely virtual presence.

However, the implementation of some hosting agreements – through which the ISP provides remote access to the company owning the data – has raised questions regarding the condition of ‘disposal’ of the server. For example, in 2016, a non-resident parent company that had delegated the running of a data centre to its Danish subsidiary was found not to have a Danish PE . In this case, only the subsidiary and its personnel owned, leased and operated the servers and any other computer equipment for the benefit of a unique client: the parent company using the storage space. The parent company was allowed to remotely carry out functions, such as surveying the efficiency of the equipment, setting up and managing applications and handling data.

The Danish authority found that the ability of the parent company to remotely access, observe and protect data and real time management of the infrastructure (e.g. by shutting down a server) did not represent sufficient control over the servers for the data centre to be considered ‘at its disposal’. The Danish authority based its decision on the fact that access to the data centre was limited to the subsidiary’s employees (or to the parent company’s employees subject to prior authorisation from the subsidiary); and that the parent company was neither instructing the personnel of the subsidiary, nor exercising control over their work (SKM (2016) 188.SR). In 2012, the same solution had been applied by Canada Revenue Agency in a very similar case (Canada Revenue Agency, Document No. 2012 – 0432141R3, 03/12/13). Both rulings complied with para 42.3 of the OECD commentary.

Furthermore, in the absence of a fixed place of business PE, the OECD asserts that hosting agreements do not establish the ISP (charged with running the data centre) as a dependent agent of the non-resident company. As a matter of fact, the OECD considers that the ISP cannot create an agency PE ‘because they will not have authority to conclude contracts in the name of these enterprises and will not regularly conclude such contracts’ or ‘because they will constitute independent agents acting in the ordinary course of their business, as evidenced by the fact that they host the web sites of many different enterprises’ (OECD commentary section 42.10).

The UK’s position

From a UK perspective, the point to remember is that a data centre operated in the UK under a hosting agreement (whether micro or macro, and whether with the absence or presence of personnel) will never establish the ISP as dependent agent.

The attribution of income to data centres

Once a data centre is considered to constitute a PE, the next question is how much business income should be attributed to the PE. According to the OECD transfer pricing guidelines, traditionally the remuneration of such a PE must comply with the arm’s length principle. For this purpose, a functional analysis of the server/data centre should be undertaken (OECD Tax policy study no. 10: E-commerce – transfer pricing and business profits taxation).

More recently, the attribution of business income arising in the context of e-commerce was considered by the European Commission. On 21 March 2018, the Commission published its proposal to recognise the concept of a significant digital presence in an attempt to better allocate taxing rights within the framework of digital economy (see bit.ly/2MvRWoM). If enacted, this proposal could significantly impact data centre operators. From the information available to date, it would appear that, as a result of the services provided to users through a digital platform, a company could in the future have a PE in a jurisdiction, even where there is an absence of control over a physical structure located in a country, by virtue, for instance, of a hosting agreement.

What strategies might be available to manage the attribution of profits?

In the event that the European Commission’s proposals are implemented, it is possible that the impact could be circumvented by the managed location of a company’s data centre.

For the attribution of profits in respect of a significant digital presence (SDP), the European Commission expresses the importance of criteria such as revenue and other user- based criteria. However, ‘in order to determine the functions of, and attribute the economic ownership of assets and risks to, the significant digital presence, the economically significant activities performed by such presence through a digital interface shall be taken into account’ (emphasis added). Afterwards, the Commission adds that economically significant activities include, inter alia, ‘the collection, storage, processing, analysis, deployment and sale of user-level data’ and ‘the collection, storage, processing and display of user-generated content’ (C(2018) 1650 final). These criteria seem to be oblivious of the fact that the digital interface is merely a virtual meeting point between the consumer and the provider of the digital services. Therefore, although a SDP exists in country A, activities such as data storage and processing will always be carried out by the country of the location of the data centre, i.e. potentially in country B. In such a case, although a SDP is characterised, almost no profit would be allocated to that SDP. As a matter of fact, the place of data processing impacts the functional analysis of the SDP and, ultimately, the profit allocation.

Therefore, location strategies regarding data centres may here minimise the risk of profit being allocated where the users (whose data is processed) are actually located. Pending new proposals, the carefully managed location of a data centre could help to direct profits away from the country of users.

The proposals by the UK government and the European Commission to implement a digital tax by reference to revenue, and based on a user-based criteria, currently appear to operate without regard to the physical location of the data centre (and other tax rules, including existing profit allocation rules). Such taxes do not appear to take account of or impact on the existing PE rules. Perhaps they should. Perhaps it is time that the UK bought its tax treatment of data centres in line with OECD guidance. Perhaps indeed a more holistic approach based on existing OECD rules could overall provide a more coherent, workable digital tax solution.