NZX darling Xero uses a US-based data centre to house its records, leaving its customers on shaky ground under current law. But help is at hand on that score – but a battle is brewing over privacy.
Legislation before parliament will allow Xero and MYOB to become approved IRD cloud providers – negating the current legal requirement for their customers to apply for individual exemptions to have financial records stored offshore.
"Xero plans to immediately apply on its customers’ behalf once this is available," says Xero CEO Rod Drury.
NZX darling Xero uses a US-based data centre to house its records, leaving its customers on shaky ground under present law.
“Section 22 of the Tax Administration Act (1994) requires taxpayers to keep their business records in New Zealand, unless they have our approval to store them outside New Zealand,” IRD group tax counsel Graeme Tubb told NBR ONLINE.
“The proliferation of cloud computing meant there was a risk taxpayers may have been storing their business records outside New Zealand without the necessary approval from Inland Revenue.”
This awkward issue is nothing new.
In December 2010 – as reported by NBR at the time – IRD issued an alert to businesses that read, in part, “It is the commissioner's view that only business records stored in data centres physically located in New Zealand [NBR’s italics] will comply with the record keeping obligations in the Inland Revenue Acts”.
That is a problem for Xero, whose customer files are stored with US-based data centre provider Rackspace.
And to a lesser degree, MYOB. Unlike the all-online Xero, most of MYBO’s accounting software is desktop based. Records for its cloud (internet-base) product are kept at a data centre in Australia. The company says its software offers the option to have a local backup.
The situation is being resolved amicably – bar a barb about privacy (keep reading).
“We recognised changes to legislation were required to keep in touch with developing technology,” Mr Tubb told NBR.
“Those changes are in a tax bill before parliament [the Taxation (Annual Rates, Returns Filing, and Remedial Matters) Bill] and we have been working with the software industry to develop guidelines on how the new legislation would work.
“Data storage providers will be asked to meet guidelines being developed in order that we can agree they will be an approved data storage provider.
"This is so taxpayers who store their data with an approved data storage provider will not have to make individual applications to Inland Revenue to store their business records outside New Zealand.”
A spokesman for Revenue Minister Peter Dunne was not immediate aware of when the bill would come up for its second reading (remember, this is a process that started in 2010).
Where do Xero customers stand in the meantime?
Mr Drury has told media his company has an “informal exemption” from the Section 22 requirement.
Asked if this was the case, an IRD spokeswoman said, “We do not have the ability to give approval for third parties to store records outside New Zealand on behalf of others.”
However, it appears Xero does has a de facto exemption pending the law change. NBR is unaware of any action being taken against any of its customers for storing financial records offshore without an individual exemption, and IRD was not immediately aware of any.
"The simple answer with respect to customers is that with the impending legislation our understanding is that there is no issue. Further, the use of Xero does not in itself necessitate applying for an exemption, as it depends on where source material is stored," Mr Drury told NBR.
Source material could be "invoices, receipts etc, either printed or electronic", a spokesman elaborated.
Meanwhile, consultation with IRD continues.
Xero says it's a constructive conversation.
MYOB's NZ general manager agrees. "IRD to have been very consultative and open in their approach to the issue," Mr Smith said.
Privacy barb
Mr Dury also reiterated his previous comment to NBR that "Xero is also pursuing that there should be a process that enables organisations to notify end customers of all requests to access their data before they are required to respond".
"We discussed this issue with the privacy commissioner to ensure that legislation is balanced."
Inland Revenue should not be allowed to go on what Mr Drury describes as "fishing expeditions" through his customers' financial records – or at least not until they get alerted first.
Officials noted this issue (see pages 3 to 5 of the report on submissions) but it is not covered in the current bill. The Taxation (Annual Rates, Returns Filing, and Remedial Matters) Bill is more process orientated. Any concession to Xero's privacy stance would necessitate changes to the separate Tax Administration Act.
It is Xero's view that the issue transcends any single piece of legislation.
"On any occasion that a government body requests access to our customers' data we believe our customers have the right to be notified," a Xero spokesman told NBR.
Xero shares [NZX:XRO] closed yesterday down 5.5% to $5.20, having retreated from their recent record high of $5.80.
