Xero finally gains IRD approval to keep its customers' records in the cloud

UPDATE / Sept 12: IRD has today published a list of NZ companies that have been granted a blanket exemption to keep their customers' financial records offshore.

The public list confirms Xero and Cargowise are the only two companies to get the official stamp of approval so far.

[UPDATE: MYOB gained approval on October 18].

-------------

UPDATE / Sept 10: IRD has granted Xero a blanket exemption to keep its customers financial records in the cloud (or, more to the point, in a Rackspace datacentre in the US).

It's been a long slog.

IRD first flagged the illegality of storing customers electronic business records offshore in 2010 - although the agency added exemptions were possible on a case-by-case basis.

A law change late last year and a regulatory tweak in March (below) allowed third-party service providers to file for blanket exemptions covering all their customers.

MYOB and Xero immediately applied.

Xero spokesman Richard Wood pointed out today that the company's exemption has now been approved.

Finally, the company is street legal.

MYOB, which has a mix of online and offline accounting software, has also applied.

This moring a spokesman told NBR approval was in the pipeline.

An IRD spokesman told NBR that so far only two companies have been granted exemptions: Xero and freight logistics company Cargowise.

Others are pendiing. IRD will publish  a list on its website from Thursday, the spokesman said.

March 15, 2013: It will soon be legal to use a cloud service, like online accounting company Xero, that stores your data offshore.

This week, in an unheralded move, Inland Revenue posted a new Statement of Standard Practice on the “Retention of business records in electronic format and application to store records offshore.”

Among other things, it means companies like Xero can now apply for a blanket exemption on behalf of all of their customers.

Xero immediately filed its application.

“The law has caught up with the technology,” CEO Rod Drury told NBR Online this week.

This week’s IRD update was made possible by an amendment to the Tax Administration Act (1994) was amended on November 2 last year.

Previously, section 22 of the Act required “taxpayers to keep their business records in New Zealand, unless they have our approval to store them outside New Zealand,” IRD group tax counsel Graeme Tubb told NBR.

And case-by-case individual exemptions are tricky when, like Xero, you’ve got 135,000 customers.

Privacy fish hook remains
IRD first flagged the illegality of keeping business records offshore in 2010 with an alert that stated “It is the commissioner's view that only business records stored in data centres physically located in New Zealand will comply with the record keeping obligations in the Inland Revenue Acts”.

If the agency had got toey about the issue, it was potentially a major stumbling block for Xero (which stores customer record with US data centre operator Rackspace) and to a lesser extent rival MYOB (whose software is still mostly desktop-based or allows information to be saved locally; online files are stored in Australia.)

But in the final event, Inland Revenue worked through the problem, and did not hassle cloud customers in the interim. The process has been “very constructive” Mr Drury told NBR.

Well, almost.

There seems no reason to think Xero (and MYOB and others) won’t be granted the newly-available blanket exemption to keep data offshore. And we may see some who have been conservative about data sovereignty so far – such as banks and big government departments – take a second look at off-shoring files, or using cloud services run by multinational software companies that don’t happen to have a data centre in NZ.

But a tricky issue remains.

Can IRD go directly to a cloud provider (such as Rackspace used by Xero in the US) to request a taxpayer’s files?

As the tax amendment legislation winded its way through Parliament, Mr Dury told NBR he did not want IRD to be able to go on "fishing expeditions" through his customers' financial records – or at least not until Xero has the chance to alert the customer first, so they have the chance to apply for an injunction.

"We discussed this issue with the Privacy Commissioner to ensure that legislation is balanced,” the Xero boss said.

But while this privacy issue was noted in a report on submissions, it was not covered by the final legislation.

This week, Mr Drury told NBR it remained an issue for cloud computing providers across the board, and took in not just IRD, but any government agency that wants to access files online.

With the new legislation not directly addressing the issue, a test case would likely be needed, Mr Drury said.

chris@chriskeall.com

Follow @ChrisKeall