SPF Finances – Complaint Upheld (Belgium, 2023)

The data subject holds both Belgian and US nationality. Under US tax regulation, he was subject to the US tax system because of his nationality. To collect information and tax from Americans living abroad, the US signed agreements with other countries under the Foreign Account Tax Compliance Act (FATCA). In Belgium this implied that banks were obliged to inform the tax authorities if a US citizen had an account in Belgium. In May 2020, the bank where the data subject had an account informed him that it was legally obliged to inform the tax authorities that the data subject had an account, as well as his name, address, jurisdiction of residence, tax identification number, date of birth, account balance, account number and other information relating to his bank assets. On 22 December 2022, the data subject and the Association Accidental Americans of Belgium filed a complaint with the Belgian DPA. The DPA joined the cases. Under Article 17(1)(d) GDPR the data subject requested that the tax authority delete his data obtained on the basis of the FATCA agreement and under Article 18(1)(b) GDPR to limit the processing thereof. The complainants also requested to stop the exchange of information between the Belgian and US administrations on the basis of the FATCA agreement. They considered that this processing, based on the FATCA agreement, violated Articles 45, 46 and 49 GDPR, the principle of purpose limitation (Article 5(1)(b) GDPR), proportionality and data limitation (5(1)(c) GDPR), storage limitation (5(1)(e) GDPR), transparency (Articles 12 to 14 GDPR) and that an impact assessment should have been carried out (Article 35 GDPR). The Belgian administration argued that under Article 96 GDPR, the FATCA agreement (and therefore the transfer) was valid. This article states that international agreements existing before the GDPR remain in force provided that they comply with applicable legislation at the time they were concluded. Following the complaint, the DPA's inv