US expats living in the EU are subject to EU-wide laws as well as national laws in the country where they live. One recent EU law that came into force that affects US expat investors living in the EU is General Data Protection Regulation, more often known as GDPR.
The GDPR law was passed in 2016, but came into affect on May 25th this year. It relates to the collection and storage of Personal Data, otherwise known as Personally Identifiable Information (PII) in the US.
The rationale behind the law is to give EU residents more control over the way their personal data is collected and subsequently used, both online and offline.
Ownership of personal data
The fundamental principle of GDPR is that EU citizens own all data about themselves, rather than it being owned by the companies that collect it. The headlines around GDPR have focused on the so-called ‘right to be forgotten’, the idea that anyone can ask a company to reveal all the data it holds about them and ask them to delete it. This is one important aspect of the new law, but there are others. For example, the law stipulates that when a company collects data about an individual, which of course happens every time a company provides a service (or, in the case of online shopping, sells a product) to someone, or just when someone registers for something (such as a newsletter or a membership) the company must ensure that the data they collect is securely stored and is only used for the purpose that it was collected, unless they have explicit consent from the data subject to use it in any other way.
They can also only contact the data subject in ways that the data subject has consented to, so no more sending them email newsletters unless they’ve actively consented to receive them.
Companies must also nominate a Data Protection Officer to ensure that people’s data is secure, and answer any queries relating to it.
Lastly, there are now regional authorities throughout the EU to deal with personal data protection and storage complaints.
Territorial considerations
The scope of GDPR is wide reaching, in that it not only requires firms operating in the EU to adhere to the new rules, but also any firm in the world that markets or sells goods or services to EU citizens. Those firms that don’t comply face hefty fines, or being blocked from trading in the EU. This is where US expats living in the EU become further affected.
How do the GDPR regulations affect US expat investors in the EU?
American expat investors in the EU have two choices when they invest: either to invest through a local firm in the country where they live, or to use an American wealth management, asset management or other investment firm.
Those US expats who use European firms though become subject to extra and often costly US reporting requirements, such as having to file an annual FBAR (Foreign Bank Account Report), or file form 8938 with their federal income tax return, under FATCA, depending on the value of their foreign-based investments. Also, investments in non-US mutual funds create burdensome US tax reporting obligations as these are considered “Passive Foreign Investment Companies” under US tax law. As such it often seems preferable to invest through a US based, expat serving investment firm.
Many US wealth management, asset management, and financial and investment advisory firms aren’t willing to jump through the hoops to comply with EU regulations though, due to the associated administrative burden and compliance costs, particularly if the EU isn’t their primary market, meaning they’ll no longer be able to offer services to Americans based in the EU.
The solution for American expat investors living in the EU is to use a firm like IAM that, as a specialist provider of wealth management and financial advisory services to US expats, is happy to remain compliant with EU regulations including GDPR.
Sincerely,
Tom Zachystal, CFA, CFP©
President
Individual Asset Management (IAM) Contact Us