Is this true? &quot;Thanks to GDPR laws, EU country A cannot check/investigate a corporate structure of a company incorporated in EU country B&quot; Not sure how to describe it better but I'll try my best. According to someone I talked to this is 100% legal and 100s of people do this. Here's the setup. You are a tax resident in EU country A. This country is normally high tax country but they have a temporary tax regime for foreigners (you) that doesn't tax foreign dividend income. You set up a company in EU country B. Here corporate taxes are super low for less than $1M turn over. If you do work for this company or manage it from country A, that makes this company subject to local high taxes. So you hire two local directors, as contractors, from country B. On the contract signed, they oversee the day to day operations and work for you as advisor since you're the only shareholder. So their existence, the contract and the structure show that the company is managed in country B, run in country B and has economic substance in country B. This way the offshore company isn't taxed in country A. This allows you to get dividends from the company tax free (after paying corporate taxes in country B) to your account in country A. Thanks to GDPR laws, tax office of Country A can't go around checking everything company B workers do in country B. They also cannot put a camera in your bedroom and watch you 24/7 in case you work for the company. They also cannot put a monitoring software on your computer in case you work for the company. There's nothing that stops you from working in tech or have a SaaS business through your company. As long as you have proper invoices. In case country A develops an interest in your business, you show them the corporate structure, contract with directors, invoices and relevant documents you got from the country B tax office. Everything is kosher. Is this actually true?
Is this actually true? Not really although there may be figments of truth woven in. First, the GDPR does not prevent tax authorities from determining layers of corporate ownership or investigating tax fraud. Second, your substantive tax liability depends upon the tax laws of the countries in question. If you owe taxes under a country's tax laws but the country can't find it, that makes you a tax criminal, and doesn't mean you don't owe the tax. Third, the exact rules on what triggers tax liability in mixed country fact patterns are highly technical and not fully uniform. If you actually do business abroad within the meaning of a country's tax laws in a way that is not subject to its taxes, then it is legal. But this scheme probably doesn't meet that standard under most country's tax laws. So you hire two local directors, as contractors, from country B. On the contract signed, they oversee the day to day operations and work for you as advisor since you're the only shareholder. So their existence, the contract and the structure show that the company is managed in country B, run in country B and has economic substance in country B. This way the offshore company isn't taxed in country A. This allows you to get dividends from the company tax free (after paying corporate taxes in country B) to your account in country A. A few thoughts on this specific example. If you truly are nothing but a passive source of funding for a company, then owning shares in this company is no different from owning shares in a public held company (e.g. BMW). The notion that dividends from the company are tax free in county A in that situation is very likely incorrect. Usually, dividends and other intangible income is taxable income in the country where they are received. Most likely, the dividends are income subject to taxation in country A. There is a concept in tax law which U.S. tax lawyers call the &quot;Economic Substance Rule&quot; which is also true, but with different names (most of these countries don't have English language tax terminology anyway) which means that when someone is going through the motions of conducting a transaction in a tax favored form when in substance, something different is really going on, the tax authorities can choose to tax the substance rather than the form of the transaction. So, if the really valuable work is being done by the shareholder without visible compensation, rather than by the local directors and managers, you the shareholder might be taxed on &quot;imputed income&quot; representing the fair market value of the services rendered, or treated as the true manager of the company in country B. Similar issues can arise when valuable intellectual property is transferred to the company without being duly reflected in a fair market value purchase of equity interests, a sale at fair market value, or a licensing agreement for royalty payments. Tax officials aren't limited to looking at paperwork. They can and do interview the human beings involved in interviews that those human beings are legally obligated to attend and cooperate with and to provide truthful information in with legal consequences for lying in those interviews. Even if no official documentation or public statements would tip off tax officials, a significant share of tax evasion cases are driven by whistleblowing by disgruntled former employees, ex-spouses, jilted significant others, mistreated business partners, and revengeful angry children who feel that they have been mistreated by their parents. Nothing in the GDPR prevents whistleblowing to tax authorities. Background In E.U. countries, closely held company ownership must be declared and recorded in a notary public's &quot;public records&quot; or a corporate register (unlike, for example, the United States, where, this information was only contained in the internal records of the company in most cases, although a new law called the Corporate Transparency Act effective January 1, 2022, or later if initial regulations aren't adopted, changes this status quo). E.U. directives expressly requires much more public disclosure by private companies than the U.S. more generally. For example, a recent Dutch overhaul of its rules for disclosing beneficial ownership of companies is a model of contemporary modern European legislation on the subject. This affords access to this information as follows (UBO is the Universal Beneficial Ownership registry and FIO is the Fiscal Intelligence Agency, an anti-money laundering agency): The public can only access the publicly accessible UBO-information with a valid registration and in exchange for a fixed fee. The identity of those persons that access the UBO-register will be registered with the Dutch Chamber of Commerce and UBOs may inquire as to how often their information has been consulted. The Chamber of Commerce may register the Citizen Service Number (Burgerservicenummer) of persons who access the register. The FIU and other competent authorities will, upon request, have access to that information. The FIU and other competent authorities may perform a search in the UBO-register based on the name of an individual, thus listing all connections of that individual, while the public will only be able to search the UBO-register for the UBO(s) of a specific entity (and not for the name of an individual). Even though this limitation to search options was presented as a measure to protect the privacy of UBOs, it is generally expected that commercial platforms that register company information will enable searches based on the name of individuals. The FIU and competent authorities have access to both the publicly and not publicly accessible UBO-information. In the Netherlands, the following institutions are, amongst others, qualified as competent authorities with unlimited access to the UBO-information: the Dutch Central Bank; the Authority for the Financial Markets; the Financial Supervision Office; the Dutch Gaming Authority; the Tax &amp; Customs Authorities; the National Police; the Public Prosecutor’s Office; the Dutch intelligence agencies; and the Tax Intelligence Agency. As this example illustrates, taxing authorities are given express statutory authority to gather information pertinent to tax collection. The Dutch situation, prior to the recent reform, collected essentially similar information, but at a decentralized basis in the offices of the notary handling the incorporation of the entity in question, with similar parties having access to the information. The E.U.'s General Data Protection Regulation generally, affirmatively extends to the provision of a good or service to an E.U. person subject to the regulation, something that would not include tax collection. See Article 3(2). Also, mutual assistance treaty obligations between E.U. countries to share information, which would include many tax treaties between E.U. countries, and criminal investigations (which would include criminal tax fraud cases) are expressly exempted from its scope.
I spent a few years working in and around the Energy industry - including a stint working at a supplier, I'm no longer there so unfortunately I no longer have access to the email chains I had discussing this with legal. The consensus at the time was that a "traditional" i.e. non-half-hourly (NHH), non-smart meter reading itself was not considered personal data - they are conceptually tied to a metering point (which may or may not be a physical meter), not to an individual and don't represent an individual's energy consumption (the granularity of the reading is insufficient to tell anything about the usage profile) But this information, while all around the implementation of GDPR it was a couple of years back and to be honest it was bugging me that I might be out-of-date on the current practices so I reached out to a former colleague who was the Data Protection Officer at the supplier I worked at to try and get a more up-to-date take. He's since moved on but was there until recently so has more experience with the topic since GDPR actually went into effect. I asked him whether a) estimated opening reads were considered "personal data" and b) what would happen with a request to change one under article 16 and he had this to say, I've translated industry-speak in square brackets: a) for NHH ["Non Half Hourly" - meters that are read ad-hoc, essentially all non-smart domestic meters will be this] an estimated reading wasn't personal data automatically until the billing flag was set in CRM and those would be the only ones we'd include on an SAR [Subject Access Request], any others are internal data not personal. HH ["Half Hourly" - meters for higher consumption users, typically larger business premises are billed on increments for each half hour so have readings for each] and remote [smart meter] readings are always personal for domestic and microb [micro-businesses are a certain class of non-domestic energy customer see condition 7A] b) erm no! we'd only change it if the value in CRM didn't match the value in the D10 [industry Data Flow used to transmit meter reads] for some reason. if they match it's an accurate representation of what we estimate the reading to be so it's just a vanilla billing dispute not a data protection issue so i'd have punted it to [name of person who was head of metering] From that it would sound as though the estimated read would count as personal data - so long as it's being used for billing purposes, but that doesn't mean they have to accept your read in it's stead. It all comes down to accuracy - GDPR requires that personal data be "accurate" but provides no definition as to what "accurate" means (which makes sense since you can't give a one-size-fits-all answer that isn't an encyclopedia) and while The Electricity Directive 2019 confirms the need for accuracy in billing again it doesn't tell us what that means. The implementation is left to member state regulators. In the UK this is OFGEM and all opening meter readings are validated through third parties (so you don't end up with the foxes guarding the hen house!) and are calculated using the following formula: Last validated reading for the meter point &lt;= supplied reading &lt;= (expected daily usage x number of days since last validated reading x 2.5) where "expected daily usage" is obtained from a database maintained by the regulator - it's calculated off meter type, property type, property use, previous validated reads etc. So if the customer provides a reading that falls outside the above the supplier can (and in practice invariably will) reject it as being inaccurate. Now this is why the when a meter reading is provided matters - reads you provide are always assumed to be the read on the day you give them. With opening reads there's some leeway, I can't remember the official rule on how much but usually they give you up to the next estimated read is generated but more on that later. Now if the reading you're trying to submit is a "now" reading and it's failed the validation criteria and you aren't happy with the rejection you can force the issue by demanding the supplier come read the meter. You don't say how long has passed since the opening read - more than the week from what you've said so presumably at least a month (guessing you've had at least your first bill). Now if they are saying the opening read was X (based on the estimated usage) and you're it should have been X + Y and the current reading is X + Y + Z you want to pay your actual usage Z not Y + Z. What you need to do is dispute the opening read, which you're entitled to do, arguably GDPR of Article 16 gives you this right, but on it's own it's a weak argument. There's established means by which an estimated read's "accuracy" is determined and assuming they followed that they're going to just tell you that as far as they are concerned it is accurate. Any challenge to that accuracy is going to have to be done within the legal/regulatory frameworks for assessing accuracy, that's what they're there for, if they won't accept your reading escalate that to the regulator - and as soon as you can. OFGEM for example allow disputing of opening reads for 12 months - it doesn't have to be resolved within that 12 months it just has to be lodged with them within that time. If you try and use the GDPR angle to pursue this IMHO it's going to muddy the waters and not help you get what you need - pursue this on billing accuracy.
The GDPR actually does require you to follow DNT in Article 21: In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications. I think this is quite explicit.
Whether GDPR applies does not depend on the country of residence. Instead, GDPR applies to a non-EU site or service if the data controller offers products or services to people in the EU (see Art 3(2) GDPR). This depends solely on the behaviour and intent of the data controller / the provider of the website – compare also the discussion of the “targeting criterion” in EDPB guidelines 3/2018 on the territorial scope of the GDPR. While your proposed measures might not be entirely ineffective (in that they document an intent to not serve people in the EU), they are both unnecessarily restrictive and overly lax. For example, they would unnecessarily prevent EU tourists in the US from registering but would nevertheless allow US tourists in the EU. For the targeting criterion, it matters whether the data subject is in the EU at the time of the offer, not at all what their residency is. Even if a person who is currently in the EU registers with your service, that doesn't necessarily mean that you are targeting people in the EU. Instead of implementing signup restrictions, a better strategy might be to clarify in the copy on your website that you are only targeting the domestic US market, not the European market with your services. I have discussed this in more detail in an answer to “How can you block GDPR users from US based sites?” If you have a site where GDPR doesn't apply, and you receive a GDPR data subject request, you shouldn't deny it on the basis that the user must have lied – instead you can deny it on the basis that GDPR just doesn't apply to you.
It depends on the state. In some states the Secretary of State holds the records for business entities and in others, such as Arizona, it's an organization known as the Arizona Corporation Commission. Regardless of the state's organization that keeps the information, one of the pieces of information you will find when you look at a company's records is the "registered agent", "resident agent" or "statutory agent." The agent, whether a person or a representative corporation, must be located within the state where business is conducted. That agent is who or what gets served with papers for a lawsuit. Here's a good explanation at legalzoom. A personal example that may help: I am an owner in a business that does business in Louisiana and Arizona. Our LLC is registered in Louisiana and is registered as a "foreign corporation" in Arizona. However, we are required to have a registered agent in each state. We pay a company to act as our registered agent in each state and the registered agent has a physical address in each state in which we are registered. If someone wants to sue my company then they can look up the name of my company in either state and will find my registered agent along with the registered agent's physical address. Service to the registered agent counts as service to my company. The agent will forward to me any service which is made to them. EDIT: if you don't known the name of the entity, i.e., the name on the door of the business does not represent the name of the company, then you need to find the "doing business as," or DBA record of the company. I don't know what state you're in but all the states in which I've done business maintain a "Doing Business As" system that can be searched. I guess it's possible that you're in a state that doesn't maintain DBA filings or require them. Typically, you can search either way - search by owner or search by the DBA name. Some states, such as Arizona, record DBA names at the county level. I've seen some states allow searching by address also.
First, when using profiling third party services (Analytics is "profiling" as defined by the GDPR), your main concern is not such a trivial thing as cookie compliance, but the security of processing I've analyzed Google's IP anonymization in some detail (as part of the DPIA I do for clients). My conclusion is that for most of the web-sites we manage, Google's IP anonymization is adequate to ensure security of processing as required by the DPIA process. However, on some sites that are likely to visited by users interested in what the GDPR calls "special categories of personal data" (Article 9), we either do not use Google Analytics, or we add additional layers of security in case the USA Government orders Google to disregard the stipulations in the DPA and hand over the data (yes, the US Government can legally do that - read the fine print in the Privacy Shield accord). As for Facebook Analytics, I think you've simply misunderstood their policy. Nowhere in that policy document does Facebook say that they "are not collecting Personal Identifiable Information". AFAIK, they collect tons of it, in all sorts of obnoxious and sneaky ways. What they actually say about PII in the context of Analytics is this: We do not share information that personally identifies you (personally identifiable information is information like name or email address that can by itself be used to contact you or identifies who you are) with advertising, measurement or analytics partners unless you give us permission. Let me remind you that one of their "analytics partners" was Cambridge Analytica, so if this promise not to share is true, it looks like a pretty new policy. OK, moving on to cookie compliance. To you (the controller), both Google and Facebook are processors. Given the history of the NSA and the methods it have used and AFAIK still use to get US-based companies to hand over the personal data about Europeans through orders issued by secret FISA courts, plus the fact that total nutcases currently are in charge in the USA, I am not going to rely on the privacy policy of any US-company for protection of personal data. So if I make use of Google Analytics (and I often do, they provide a great service), I always make sure that my users opt-in on that (hard cookie concent), even I make use of their IP anonymization feature (YMMV). As for Facebook, the fact that they promise not to share PII with third parties is irrelevant because they collect personal data. You will always need consent from your users to hand over their PII to Facebook in the first place. This is not optional. PS: If was a user, that consent would never been granted, no matter how great or valuable your site might be. If you have any sort of relationship with Facebook, I'll give you my personal data when you pry it from my cold, dead hands.
Countries, and supranational governments like the EU, have jurisdiction over companies that do business in their jurisdictions. Oracle is technically not a U.S. corporation; it's a closely related group of California and Delaware corporations. Very few companies incorporate under U.S. federal law (I believe some banking corporations are required to, but don't quote me on that). Almost all companies are incorporated under state law. However, if Oracle does business in Texas, it still has to obey Texas law. And if it does business in the EU, it still has to obey EU law. Some laws make distinctions in some corporate matters between domestic corporations (incorporated under that state's laws) and foreign corporations (incorporated under another state's laws). But if you do business in a state, including an EU member state, you still need to obey that state's general laws, including antitrust law. Short version: if you visit another country, you can't go around shooting people, then say, "your laws don't apply to me, I'm an American." Neither can a company, no matter where it's incorporated. As for stopping the merger...any country where the merging companies do business can stop the merged company from doing business there if the merger violates local law. If this is a major, commercially important region like the EU, then failure to get EU approval will stop the merger. If it's a minor territory, the company will sometimes enter into an agreement to divest itself of local assets or entities. For example, if merging Oracle and Sun would create an antitrust problem in the minicomputer repair market in Laos, the merged entities would sell off either Oracle's or Sun's Laotian minicomputer repair division.
On the first page of https://www.gov.uk/duty-free-goods/overview you find: "You can bring some goods from abroad without having to pay UK tax or ‘duty’ (customs charges), as long as they’re for your own use." And on the next page "... will use them yourself or give them away as a gift". This clearly doesn't cover anything that you bring into the UK to sell it. And a bit further on the site it says "You must tell customs (known as ‘declaring’) on arrival in the UK if you have goods: ... that you plan to sell". Since you are asking here, it is quite obvious that you intend to sell :-) You said "e.g. say this guys comes every month from Russia to France for unrelated business, each time he fills up his luggage with the maximum allowed amount of goods that comply with custom laws". If this guy sells the stuff to you, then the maximum allowed amount of goods to import without paying taxes is zero. Once he is willing to pay taxes, there is no limit. Obviously regularly importing things from Russia or France and selling in the UK at a profit means that he is running a business in the UK, which means he would have to register a business, pay corporation taxes etc. It's all a matter of degree; for small amounts nobody cares (up to some limit you don't need to register a business or pay taxes; I don't know the details).