Tax law and freelancing as a side-job in Germany Is it legally possible for a European (non-German) PhD student/research assistant at a German university (who gets paid according to 75% of the TV-L 13 wage) perform side jobs for international clients (for example, through a platform like UpWork)? If yes, what are the rules regarding tax declarations, release of receipts, VAT, and so on?
Yes this is possible, no this is not simple. You are eligible to work as a Freelancer in Germany if you're from an EU/EEA member state. Your nationality is not relevant beyond that. When you start your freelancing, you must inform your employer/university. This is important for two reasons: you may not compete with your employer, and your effective tax rate depends on your predicted total income for the year, which they need in order to withhold the correct amount. (Don't worry, any discrepancies will be resolved with the tax declaration.) In Germany, self-employed work is either gewerblich or freiberuflich which has numerous consequences. This depends on the type of activity. Consulting and activities that require a completed 5-year diploma are generally freiberuflich. But e.g. software development has unclear status. This is ultimately the decision of the tax authority. You might have activities of both kind, but this complicates your accounting. When you start a gewerbliche activity you must register with the Gewerbeamt, and list your fields of activity. Make sure to register as a part-time freelancer, not full-time. In any case you must notify the tax authority through the Fragebogen zur steuerlichen Erfassung, which you should fill through the online Elster system. This will include your income projections and offers some important choices. If your income from freelancing is below a certain threshold, or if you are purely freiberuflich, your (now mandatory) tax declaration is simplified (EÜR). You will not have to do professional accounting. If your activities are gewerblich and your income is below a certain threshold, you do not have to pay business tax. Kleinunternehmer-Regelung: If your income is below a certain threshold, you can opt-out from collecting VAT within Germany. You can always give up Kleinunternehmer-status, but you can't easily return to it. Otherwise, you may request a VAT-ID (UstId). You will then have to regularly pay advance VAT, typically monthly. You can offset any VAT from business expenses that you paid. Tax rules are complex, and depend on the country where the service is rendered – generally, the location of your client. For your services in other countries, you may have to register in that country, or you may fall below their thresholds. The following cases can be discussed more specifically: You can only list VAT on your invoices if you have a VAT-ID. If you have a VAT-ID, you must collect VAT within Germany and for B2C sales within EU. For sales of digital items to consumers in other member states, you may have to use the MOSS system. For sales within the EU where both parties have a VAT-ID, the reverse-charge mechanism is used and the recipient is responsible for paying VAT. For sales in non-EU countries no VAT applies, but you have to follow the local rules. For sales in the US, the tax agreement between the US and Germany exempts professional services from US income tax as long as you perform the services remotely. You will have to send your client's accountants IRS form W8-BEN to document this. However, state-level taxes can still apply. For any income that you get, you should have issued an invoice. The exact details are documented elsewhere, but important aspects are: Your and your client's identity Your VAT number if you have one, your tax number otherwise (but not your personal tax-ID!) A sequential invoice number that will stay unique during your business, e.g. just count from 1 or restart yearly like 2019-1 A date VAT payment if you have a VAT ID, otherwise a notice why no VAT is due. In your tax declaration, you will list income from self-employed work separately from income from employed work, even though it is taxed together. You will have to prove your freelance income, generally through form EÜR. The tax authority may request your invoices and your bank statements and receipts for any expenses. It is therefore recommended but not necessary to open a separate account for your business activities. If you are freiberuflich then most banks welcome you, for gewerbliche activities only one or two banks offer free accounts. Besides tax issues, you must also consider health insurance and retirement plans. As long as your freelancing is only a side job (Nebenerwerb) this is fairly simple. You will have to inform your health insurance about your freelancing. They will need an income projection to calculate your premiums. If your total income fluctuates a lot, you should try to get your premiums calculated individually for each month. This generally doesn't matter if you have private health insurance as they use a flat rate. At this point it should be clear that freelancing is not necessarily trivial, mostly because VAT is a concern. You should therefore look for help: a tax advisor can help you navigate the German tax system, at least for your first tax declaration. dealing with tax issues might require professional help from an accountant, e.g. how to manage VAT and how to correctly apply a tax treaty. most universities have things like founder-workshops. While geared towards first-time full-time self-employed people or startups, there's still a lot of valuable information there.
You seem to have a solid understanding of the ePrivacy implications, but lack a fundamental insight: your organization does not have a right to achieve its mission or a right to disseminate unwanted marketing. But other people do have a right to not be subject to excessive marketing. Of course, reality is more complex, so it's probably not entirely impossible to do marketing. In your point 1, you note that some EU/EEA/UK countries distinguish ePrivacy protections between consumer and business subscribers. You can research the exact rules in the potential customer's country. This may allow you to email corporate/business accounts. I would strongly advise against messaging via Linkedin if there is a chance that the person is using that account for personal purposes like networking or hunting jobs, not just for conducting official company business. ePrivacy has markedly different rules for email marketing vs phone marketing. Whereas there are pretty strict rules for electronic messages and robocalls, manual cold calling can be OK from an ePrivacy perspective. However, many EU/EEA/UK countries have rules that go beyond ePrivacy, and may have a kind of do-not-call registry that you must respect. Of course manual calls take more effort than spamming emails, but recall the above point that you don't have a right to spam other people. Phone calls are probably the most appropriate approach when the company lists individuals' phone numbers on its website. This will at least give you a few seconds of attention with a real human, more than you can expect from an email that is likely to be caught by spam filters. Marketing via physical mail tends to have very lax rules. Note that every company/business that has a website will have to disclose its contact details including an address there, so this information is easy to acquire. However, chances are low that anyone would seriously engage with that marketing. You can consider alternatives to direct marketing, so that interested companies eventually come to you. Things like press releases, writing guest articles in industry publications, speaking at relevant conferences, working on search engine optimization, buying ads. On the GPDR aspects: GDPR and ePrivacy overlap, and it is necessary to comply with both sets of rules (GDPR likely applies here via Art 3(2)(a)). But where they potentially contradict each other, ePrivacy as the more specific law has precedence. For example, ePrivacy overrides the default GDPR legal basis rules when it comes to email marketing to existing customers (opt-out basis, no consent needed) or to using cookies (needs consent unless strictly necessary). Information that relates to corporations is not personal data, but information that relates to individual employees or to sole proprietors would typically be personal data. Since you are unlikely to obtain consent for using this data, you would need an alternative GDPR legal basis such as a &quot;legitimate interest&quot;. Relying on a legitimate interest requires that you conduct a balancing test, weighing your interests like marketing against the recipient's interests, rights, and freedoms. Core question in this context is whether the data subject can reasonably expect their personal data to be used like this, taking into account the nature of their relationship with you. Since there is no pre-existing relationship, claims of a legitimate interest are weak to start with. However, it may be possible to argue that when a company makes employee contact details available via its website (not LinkedIn!) then relevant marketing can be reasonably expected. I would rather not rely on such arguments, though.
Is it actually necessary for businesses (such as a Small Town News USA Inc) that do not reside in EU to care about GDPR? Only if they offer goods/services to or monitor behavior of people in the EU (Art. 3(2)). Note that: having a commerce-oriented website that is accessible to EU residents does not by itself constitute offering goods or services in the EU. Rather, a business must show intent to draw EU customers, for example, by using a local language or currency. If it is then how (and by whom) would compliance be audited and/or enforced? Supervisory Authorities will care of it.
Does an agreement in a chat count as a valid contract? In most jurisdictions (and for most transactions): yes. Usually the only thing that matters for a valid contract is that there is a mutual agreement &ndash; whether that is in writing, orally, via chat or via sign language does not matter. Of course, having things in writing makes it easier to prove in court if there is a problem, so it's still advisable. What steps could I take if they don't send the money? You can: remind them to pay if they still don't pay, you can sue them. Some juridictions have accelerated court proceedings for simple cases like this (e.g. Gerichtliches Mahnverfahren in Germany), otherwise you will have to sue in a regular court that deals with contract disputes. But I have no names and I am unsure what they can or have to do after they received the package. This is going to be the main problem. It's no good to enter into a contract if you do not know who the other party is :-). You definitely need to find out who exactly entered into an agreement with you. If the sale is to a private person, find out their name and address. If the sale is to a business (seems to be the case here), find the official name and legal type of the business, and make sure whoever you deal with is authorized to enter into contracts. Otherwise the contract will be hard to enforce in court if things go wrong.
Clearly in this case the writing does not reflect your actual agreement. If you were to bill for 1.5x your normal rate for hours over 40/week, relying on the writing, and it came to court, you might win, based on the general rule that matters explicitly covered in the written agreement are treated as final, and evidence of contradictory oral agreements are often not accepted to contradict the contract document. This is known as the parole evidence rule. But you don't plan to issue such a bill, so that won't come up. I don't see that you are at any legal risk. But you could send the client a letter saying that you signed the contract document so as not to hold the job up, but you think there is a mistake in it (pointing out exactly where and what the error is). This would help establish your ethics and good faith, so that if somehow there was a problem over this later (although that seems unlikely) you can't be accused of any improper actions. Keep a copy of any such letter. By the way, if you are an independent contractor, the governmental standard for overtime does not normally apply (in the US). If you are an employee of a consulting company, it may or may not, depending on your salary level and the kind of work you do. An independent contractor can contract for a higher rate for overtime hours, if the client is willing to agree. Many clients will not be willing.
What follows is a broad overview. I'm not an expert in this; I just have a bit of experience in this due to a tax situation my wife &amp; I experienced a few years ago. Please do not rely on this advice except as a starting point for more Googling. Your obligations (and your assistant's) will depend on whether the assistant is an employee or an independent contractor. In general, an independent contractor is someone you hire to "get a job done"; you have minimal control over the manner, time, place, tools, etc., that the assistant uses. An employee, on the other hand, is someone you hire to come to work at a particular time and do the job a particular way. (I'm glossing over some details here; see the IRS link above for more details.) If your assistant is an independent contractor, and you pay them over a certain threshold ($600 for 2020), you must provide them with Form 1099-MISC, and file a copy with the IRS as well. Your assistant will then be liable for income taxes on this amount, as well as self-employment tax (see below.) If your assistant is actually an employee, and you pay them over a certain threshold ($600 for 2020), you are required to provide them with a W-2 form, as well as filing a copy with the IRS. In addition, if you pay them more than a higher threshold ($2200 in a tax year or $1000 in any quarter for 2020), you are responsible for withholding taxes from their paychecks, as well as paying the employer's portion of Social Security, Medicare, and/or federal unemployment taxes. How to figure these taxes is complex, but generally the employee must provide you with a completed W-4, and then you must provide them (and the IRS) with a W-2 at the end of the tax year. See Publication 15: Employer's Tax Guide for all the gory details. The self-employment tax is designed to effectively cover the employer's portion of these taxes for self-employed workers. As you might imagine, employers are often tempted to misclassify employees as "independent contractors", since this means that this tax liability gets pushed from them onto their workers, as well as just making the employer's life easier. The Feds will not take kindly to such misclassification if it is discovered. Finally, for the state of Connecticut, consult the CT 1009-MISC filing guide (if your assistant is an independent contractor) or the Connecticut employer's tax guide (if they are an employee). The distinction is pretty much the same as at the federal level.
You're probably making an “international transfer” here, but that doesn't mean it is illegal. The GDPR has a very broad concept of “personal data” and of “processing”. Per Art 4(2), ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction Which I would summarize as: pretty much anything you do with the personal data counts as “processing”. So yes, your non-EU servers would be processing the personal data in HTTP requests, even when those servers aren't directly storing the personal data. Chapter V of the GDPR applies to Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country […] Per this definition, the question whether an international transfer occurred is inextricably linked with the question whether the data is being processed in the destination country. The generally accepted interpretation here is that mere transfer through a country does not constitute processing. For example, if your requests happen to take a network route through other countries, that wasn't an international transfer. But your HTTP server is definitely doing processing, even if it doesn't store the data persistently. If the HTTP server is in a non-EU country, then you have to consider how this transfer of data is protected. You're supposed to uphold the high GDPR data protection standards regardless of where the processing occurs. Some countries have been granted an EU adequacy decision, meaning that their data protection laws are sufficiently similar to EU laws and no extra bureaucracy is needed for that transfer. The transfer still needs to be noted in your privacy notice (compare Art 13(1)(f)). In other cases, you may be able to rely on “standard contractual clauses” (SCCs), which are pre-formulated contracts provided by the EU that translate relevant GDPR aspects into a private contract between the data exporter and data importer. However, you as a data controller must make sure that the data importer is legally able to enter into that contract. For example, the terms of these SCCs are incompatible with US national security laws, meaning that US companies might not be able to enter into the SCCs. There are a couple of other ways to authorize international transfers, but they are mostly relevant for multinational groups of companies, or in exceptional situations. In any case, other GPDR requirements like the need to have a suitable contract with your data processors remain unaffected. Also unaffected is the obligation to implement appropriate technical and organizational measures to ensure the compliance and security of your processing activities (e.g. see Art 24 and Art 32 of the GDPR). For example, this may imply the need to implement suitable encryption. In the wake of the Schrems II ruling that struck down the EU–US “Privacy Shield” adequacy decision, the EDPB published recommendations on extra compliance measures that could allow SCCs to remain valid for EU–US data transfers. But it's not easy to defend data processing activities when potential adversaries include literally the NSA, and measures such as end-to-end encryption (E2EE) are incompatible with cloud services that are more interesting than backup storage. Practically speaking, I would reconsider an architecture that would allow failover of EU data processing operations to non-EU locations, unless those target countries are covered by an adequacy decision. If you need a high availability setup for EU activities, it may be more appropriate to maintain multiple deployments within the EU.
First of all, the USA's legal system is not here to be referee to every single little "gotcha" mistake, and every little mistake doesn't mean a payday for someone. The employee at the tax preparer screwed up. They mixed up your folder with the other guy's folder. It was an honest mistake, which is another way of saying "nobody stands to gain from this." The best LEGAL action you can take is to either destroy the copy in your possession, or mail it back to the tax preparer, and call it a good day, done well. The law of torts exists to adjudicate sincere and structural divergences of interests, not to fix silly mistakes. As a point of law, what was the damage of this "event?" Some random person (you) saw a 1099 belonging to someone else. In good faith, you attempt to find and reinstate the rightful owner with their document. All good. As it is, you have zero "standing" in a case of inadvertent clerical error between two other parties.