DPA case Opinion of 24 August 2021 - FATCA – Violation Found (Slovakia, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Slovak DPA raised concerns about a tax agreement with the U.S. that could affect personal data transfers. This matters because it highlights the need for proper legal bases when sharing personal information internationally. The ruling calls for stronger protections for personal data in international agreements.
What happened
The Slovak DPA found issues with the FATCA agreement regarding personal data processing and transfer to the U.S.
Who was affected
Individuals whose financial data could be shared with U.S. tax authorities are affected by this agreement.
What the authority found
The DPA noted that the agreement lacks adequate provisions for protecting personal data, violating GDPR requirements for international data transfers.
Why this matters
This opinion emphasizes the importance of ensuring that international agreements comply with GDPR standards. It signals that companies must be cautious when dealing with cross-border data transfers.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In 2021, the Slovak DPA was requested by the Ministry of Finance (the controller) to carry out an assessment on the GDPR compliance of the Agreement between the Slovak Republic and the United States of America (US) on the implementation of the Foreign Account Tax Compliance Act (FATCA). As a tax information exchange system, FATCA requires foreign financial institutions, such as banks, to report to the US tax authorities the data of persons located outside the US who are considered to be subject to taxation in the US, for example, due to dual nationality. The Opinion makes reference to the [https://edpb.europa.eu/system/files/2021-04/edpb_statement042021_international_agreements_including_transfers_en.pdf EDPB Statement No 04/2021]. First, the DPA identified provisions of the Agreement, which relate to personal data processing. In this regard, Annex 1 sets out the categories of personal data to be processed, including name, address, nationality and account balance, but there are no provisions on the protection of personal data. Second, the DPA looked closely at the data transfer system under the Agreement. It recalled that in order for a personal data transfer to a third country to be lawful, it needs to have a valid legal basis under Chapter V of the GDPR. It pointed out that there was a discrepancy between the intended objective of the legislator to legalise transfers to the US, as stated in the Agreement, and the conditions laid down in the GDPR. A mere declaration in the law is not sufficient to make the transfer comply with the GDPR. In this regard, the DPA noted that, specifically for transfers to the US, there is no adequacy decision within the meaning of Article 45 GDPR since the Court of Justice of the EU invalidated the Privacy Shield in its judgement C-311/18. Therefore, other transfer mechanisms should be used, for example, under Article 46 GDPR. These, however, also should offer an adequate level of data protection. In this regard, the Slovak DPA ref
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Opinion of 24 August 2021 - FATCA in SK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case Opinion of 24 August 2021 - FATCA - Slovakia (2021). Retrieved from cookiefines.eu
Last updated: