French report recommends privacy tax

In the meantime, however, the report says that France could impose a tax on firms that track Internet users in France. The tax would be levied on French and foreign firms alike, so as not to discriminate. The tax would be a small lump-sum amount for each Internet user that is subject to monitoring by the relevant firm. The tax would be structured so as to encourage the application of high data protection standards by the taxed firms. Firms that provide high data protection standards for users would pay the lowest rate of tax. The rate for these firms could be zero, says the report. Firms that apply a medium level of protection would pay the intermediary level of tax, and firms that apply low data protection safeguards would have to pay the highest rate of tax.

The report explains that firms would still be required to comply with the standards imposed by European data protection law, and that payment of the tax would not be a substitute for full privacy compliance. Internet firms would be required to file an annual declaration indicating the number of individual users whose data are monitored. Companies who want to benefit from one of the more favorable levels of tax would be expected to obtain a privacy certification from an independent certification firm. The report indicates that the annual declaration filed by Internet companies would be subject to audit, and that as the last resort, the government may look at incoming and outgoing data flows at peering points. The report acknowledges that this would be extremely difficult in practice and may require deep packet inspection, which raises other thorny issues.

The other factors that would be taken into account to determine whether a company qualifies for the lowest level of taxation would be whether the company treats the user as the real owner of his or her personal data. If a platform makes it easy for users to recover their data in a standard format, the company would earn points toward benefiting from the lowest rate. On the contrary, if Internet platforms give themselves a licence to exploit the user’s personal data for other purposes and make it difficult for the user to recover their data, this would be a sign that the user does not in fact control his or her personal data, and would put the company into a higher bracket.

The report acknowledges the untested character of its proposal, and recommends that the tax be phased in slowly, affecting only the largest firms initially. The report argues that the proposed tax is fairer than other recent French tax proposals because the tax is both technology and service neutral. It should not encourage or discourage particular business methods or technologies. The authors of the report compare the proposal to a carbon tax.

To encourage innovation, the report calls for a favorable tax environment for digital start-ups (modifications to the Research & Development tax credit and extension of the tax breaks available to so called Young Innovative Enterprises (“Jeune Entreprise Innovante”)). The report’s proposals will now be reviewed by the French Digital Council (Conseil National du Numérique). France plans to raise some of the report’s recommendations at the next G20 meeting in February.

We will continue to monitor developments relating to this issue.

Authored by Winston Maxwell and Xenia Legendre